Patches for dynamic SSL certificate generation

Michal Rybarik <[email protected]> Tue, 16 Sep 2025 15:49:09 +0200
Newsgroups gmane.comp.web.squid.devel
Message-ID <[email protected]> 
This is a multi-part message in MIME format.
--===============7218813428280449270==
Content-Type: multipart/alternative;
 boundary="------------4SZ5kNzFBnhPQMde5srV17k7"
Content-Language: sk

This is a multi-part message in MIME format.
--------------4SZ5kNzFBnhPQMde5srV17k7
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Dear Squid developers,

thank you for all your effort and work on Squid.

I’ve created several patches to improve dynamic SSL certificate 
generation for modern browser compatibility. The patches are for Squid 
4, but most should also apply to Squid 5 and 6. Would you be interested 
in reviewing and possibly merging them (with adjustments if needed)?

Main improvements:

- Correct generation of certificates mimicked from self-signed certs 
(use |CA:FALSE| instead of |CA:TRUE|).
- Add SAN when missing (derived from CN), as modern browsers require SAN.
- Proper generation of certificates for IP addresses.
- Improved setCommonName functionality, so valid certificates for DNS/IP 
are generated in intercept/tproxy modes too.

Thank you again, and I wish you all the best.

-- 
Regards,
Michal Rybarik

--------------4SZ5kNzFBnhPQMde5srV17k7
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p data-start="55" data-end="79">Dear Squid developers,</p>
    <p data-start="81" data-end="131">thank you for all your effort and
      work on Squid.</p>
    <p data-start="133" data-end="410">I’ve created several patches to
      improve dynamic SSL certificate generation for modern browser
      compatibility. The patches are for Squid 4, but most should also
      apply to Squid 5 and 6. Would you be interested in reviewing and
      possibly merging them (with adjustments if needed)?</p>
    <p data-start="412" data-end="432">Main improvements:</p>
    <p data-start="412" data-end="432">- Correct generation of
      certificates mimicked from self-signed certs (use <code
        data-start="505" data-end="515">CA:FALSE</code> instead of <code
        data-start="527" data-end="536">CA:TRUE</code>).<br>
      - Add SAN when missing (derived from CN), as modern browsers
      require SAN.<br>
      - Proper generation of certificates for IP addresses.<br>
      - Improved setCommonName functionality, so valid certificates for
      DNS/IP are generated in intercept/tproxy modes too.<br>
    </p>
    <p data-start="796" data-end="843">Thank you again, and I wish you
      all the best.</p>
    <pre class="moz-signature" cols="72">-- 
Regards,
Michal Rybarik</pre>
  </body>
</html>

--------------4SZ5kNzFBnhPQMde5srV17k7--

--===============7218813428280449270==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-dev mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-dev

--===============7218813428280449270==--