0

I Recently installed squid as a web proxy, it works fine. But the problem is that connection to the proxy server is not encrypted, so it's visible to any mans in the middle by DPI (Deep Packet Inspection).

I've found --enable-ssl opetion in the squid configurations, but it seems to be useful for reverse proxy or https redirect, that I'm not sure if it would be applicable in securing my client connections to the server. If it is, please give some guidelines on the right configurations.

Another option seems to be, using STunnel for creating a secure tunnel between proxy sever and clients. but i think it may complicates configurations on the client side, as it needs stunnel to be installed and configured on each client system and may be inapplicable on some client host depends on the OS.

So I'm looking to find a way, for users to just enter IP/port and user/pass in their browsers or in their connection profile and get connected to a secure proxy server.

2 Answers 2

2

Here is my conf in squid3: https_port 3128 cert=/etc/letsencrypt/live/xxx.com/fullchain.pem key=/etc/letsencrypt/live/xxx.com/privkey.pem, and you could use Chrome ref, or Firefox ref to connect.

You have to enable --enable-ssl when configuring squid, just follow this : Install squid proxy with –enable-ssl for https_port.

1

There is stunnel for pretty much every platform and Windows: https://www.stunnel.org/downloads.html

Here are instructions how to do this: Centos + Squid + Stunnel

Unfortunately, as there is NO encryption on HTTP and you will not be able to encrypt that apart from encapsulating this traffic into some kind of tunnel... And stunnel seem to be the best for this!

2
  • Do you mean there is no encryption in http proxy at all?! I used to hear about https or SSL proxy tunnel. and even some applications such as Firefox, Proxifier and some others suggest https or SSL as an option for the type of proxy for connection. Also one windows equivalent of squid named ccproxy, offer https proxy. So what the SSL Tunnel/HTTPS Tunnel stands for?
    – 2i3r
    Feb 26, 2014 at 22:27
  • Updated in 2011: wiki.squid-cache.org/Features/… If you need to encrypt traffic between all browsers-proxy, you need tunnel unless something has changed in recent years.
    – Chris
    Feb 27, 2014 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.