Secure web proxy using squid

Question

I Recently installed squid as a web proxy, it works fine. But the problem is that connection to the proxy server is not encrypted, so it's visible to any mans in the middle by DPI (Deep Packet Inspection).

I've found --enable-ssl opetion in the squid configurations, but it seems to be useful for reverse proxy or https redirect, that I'm not sure if it would be applicable in securing my client connections to the server. If it is, please give some guidelines on the right configurations.

Another option seems to be, using STunnel for creating a secure tunnel between proxy sever and clients. but i think it may complicates configurations on the client side, as it needs stunnel to be installed and configured on each client system and may be inapplicable on some client host depends on the OS.

So I'm looking to find a way, for users to just enter IP/port and user/pass in their browsers or in their connection profile and get connected to a secure proxy server.

Answer 1

Here is my conf in squid3: https_port 3128 cert=/etc/letsencrypt/live/xxx.com/fullchain.pem key=/etc/letsencrypt/live/xxx.com/privkey.pem, and you could use Chrome ref, or Firefox ref to connect.

You have to enable --enable-ssl when configuring squid, just follow this : Install squid proxy with –enable-ssl for https_port.

Answer 2

There is stunnel for pretty much every platform and Windows: https://www.stunnel.org/downloads.html

Here are instructions how to do this: Centos + Squid + Stunnel

Unfortunately, as there is NO encryption on HTTP and you will not be able to encrypt that apart from encapsulating this traffic into some kind of tunnel... And stunnel seem to be the best for this!