Re: Squid & transparent proxy
Javier Gostling <[email protected]>
| Newsgroups | gmane.linux.redhat.release.enigma |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 2003-03-13 at 18:54, Cameron Simpson wrote: > I thought that was what CONNECT was for. It should work, since SSL is > end-to-end; it doesn't care what's in the middle - it's all certificate > based so proxying should work perfectly well. Proxy does. Transparent proxy does not. SSL negotiates a session key using the server's certificate, to prevent another server from impersonating it. If your browser establishes a session with the proxy (in transparent mode), it will complain that the certificate does not belong to the server (since it's trying to connect directly to the server). The CONNECT method (used for proxy SSL) creates a tunnel. Your browser connect to the proxy server, requests the tunnel CONNECTion to the destination server (some people prefer to call this the origin server), and your browser authenticates the server through the tunnel. If this is not clear enough, go to the squid web site (http://www.squid-cache.org/). IIRC, there is a question in the FAQ that touches this subject. Cheers, -- Javier Gostling Av. Kennedy 5757, of. 1502 Ingeniero de Sistemas Las Condes, Santiago, Chile Virtualia S.A. Fono: +56 (2) 202-6264 x 130 [email protected] Fax: +56 (2) 342-8763