This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTPS broken in transparent mode

Hi Guys,

Im having a weird problem lately. I have an Software Astaro v7.511 running with Proxy + https scan enabled. I had this configuration running for quite a while actually, but lately its causing certificate errors on some sites (not all). Basicly its always the same error: The Browser says the domain doesnt match with the certificate. Wenn login to youtube.de or ebay.de it tells me that the certificate is only valid for *.youtube.com or *.ebay.com respectively.

In the Logs I am seeing:

2011:07:30-10:19:38 proxy httpproxy[4093]: [0xa3425480] ssl_log_errors (ssl.c:41) C: 4093:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt.c:1057:SSL alert number 42
2011:07:30-10:19:38 proxy httpproxy[4093]: [0xa3425480] ssl_log_errors (ssl.c:41) C: 4093:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:842:

If I run the proxy in standard mode, everything works. It also works if I disable the proxy and user an Packetfilter rule.

I have found other posts with that ssl handshake error, but their problem was never quite the same.

I have already tried clearing the cache and rebooting without any changes.

Got any ideas?

Thanks in advance

This thread was automatically locked due to age.

Parents

0 Scott_Klassen over 14 years ago

Sometimes this will happen when using the transparent proxy. Usually it is due to a misconfiguration in the remote sites certificate or with complex certificate chains. On a case by case basis, the easiest way to deal with these is either to create exceptions for the individual sites or add them to the transparent proxy skiplist.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 GreatByte over 14 years ago in reply to Scott_Klassen

Actually, in case of ebay the chain isnt complex. The only thing above their domain ist my astaro certificate...

And I prefer to be more restrictive in applying exclusions. It may get it to work, but it basicly removes the security that comes with it. Like you say its a case by case decicion, and in case of ebay ignoring certificate errors is not an option. [;)]

But as a workaround I have no Problem running the proxy in Standart mode. I preferred transparent so I wont have to enable / disable the proxy in the browser when I take my notebook somewhere.

I still think ist a bug though. I cant believe that a company like ebay has their servers misconfigured.

The funny thing is, when I surf to ebay.de using Standard mode - the certificate ist for ebay.de. Why would the server send a different certificate when using transparent mode? Does the server even know what Mode my Proxy is running?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 GreatByte over 14 years ago in reply to Scott_Klassen

Actually, in case of ebay the chain isnt complex. The only thing above their domain ist my astaro certificate...

And I prefer to be more restrictive in applying exclusions. It may get it to work, but it basicly removes the security that comes with it. Like you say its a case by case decicion, and in case of ebay ignoring certificate errors is not an option. [;)]

But as a workaround I have no Problem running the proxy in Standart mode. I preferred transparent so I wont have to enable / disable the proxy in the browser when I take my notebook somewhere.

I still think ist a bug though. I cant believe that a company like ebay has their servers misconfigured.

The funny thing is, when I surf to ebay.de using Standard mode - the certificate ist for ebay.de. Why would the server send a different certificate when using transparent mode? Does the server even know what Mode my Proxy is running?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data