URL: https://linuxfr.org/forums/linux-general/posts/squid-certains-sites-tls-ne-traversent-pas Title: Squid : Certains sites TLS ne traversent pas Authors: Adminrezo Date: 2018年07月03日T13:36:50+02:00 License: CC By-SA Tags: squid, proxy, tls, https et ssl Score: 3 Bonjour, Je rencontre un problème avec mon serveur Squid pour afficher quelques sites en HTTPS. Je n'arrive pas à comprendre la logique car la plupart passent bien et d'autre me retournent une erreur type "Échec de la connexion sécurisée". Quelques exemples de sites qui ne traversent pas le proxy : https://bitly.com, https://www.velomacchi.com, https://www.raise3d.com/ J'imagine que leur configuration TLS est différente d'autres sites mais je ne sais pas en quoi. Je remarque des différences avec Wget et openssl connect. Est-ce que quelqu'un peut éclairer ma lanterne ? Merci d'avance root@cache:~# wget https://bitly.com --2018年07月03日 13:23:20-- https://bitly.com/ Résolution de bitly.com (bitly.com)... 67.199.248.15, 67.199.248.14 Connexion à bitly.com (bitly.com)|67.199.248.15|:443... connecté. GnuTLS: The TLS connection was non-properly terminated. Incapable d'établir une connexion SSL. root@cache:~# wget https://www.lemonde.fr --2018年07月03日 13:24:33-- https://www.lemonde.fr/ Résolution de www.lemonde.fr (www.lemonde.fr)... 93.184.220.239 Connexion à www.lemonde.fr (www.lemonde.fr)|93.184.220.239|:443... connecté. requête HTTP transmise, en attente de la réponse... 200 OK Taille : 382094 (373K) [text/html] Sauvegarde en : « index.html » index.html 100%[=======================>] 373,14K --.-KB/s in 0,01s 2018年07月03日 13:24:33 (37,2 MB/s) — « index.html » sauvegardé [382094/382094] root@cache:~# openssl s_client -connect bitly.com:443 CONNECTED(00000003) write:errno=0 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 176 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1530617494 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- root@cache:~# openssl s_client -connect www.lemonde.fr:443 CONNECTED(00000003) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA verify return:1 depth=0 C = US, ST = California, L = Los Angeles, O = "Verizon Digital Media Services, Inc.", OU = Technology, CN = www.atanar.net verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Los Angeles/O=Verizon Digital Media Services, Inc./OU=Technology/CN=www.atanar.net i:/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA 1 s:/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA 2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA --- Server certificate -----BEGIN CERTIFICATE----- MIIJhjCCCG6gAwIBAgIQAk5Lhyx585PuXtDh5H4U3zANBgkqhkiG9w0BAQsFADBN MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTgwNTA4MDAwMDAwWhcN MjAwODA5MTIwMDAwWjCBlTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju aWExFDASBgNVBAcTC0xvcyBBbmdlbGVzMS0wKwYDVQQKEyRWZXJpem9uIERpZ2l0 YWwgTWVkaWEgU2VydmljZXMsIEluYy4xEzARBgNVBAsTClRlY2hub2xvZ3kxFzAV BgNVBAMTDnd3dy5hdGFuYXIubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAoaZTuJc3tyHTYw5T+YFUK95otmnAjKEkOB+yITkQIfKB/4LdqLIoTyKt K4jwUkz8UeNr1SssxXrfK0bJHFmkoMh+yPvdHXt+Cax8+bHIXMJ5ilegtQ4a3/LT tiaDQTORRkHhGgp0NCAFcFFqYD+csz9GiXnqDy95K2RyfDrIDg3tO+W1lGq5qEBk z3yvdaXa+sZXuAWXAyUaNTp+0Ck5z50d/09O0ttQm0VZJm0DejywrXXE3sgQxZFg 11bzfOAe95w7Ui3oxp5gXWxXtmmzepjzBTRmXjABDT1ggtPPdajj/MQbpaBt84Gc a+8pazppVwXSJkcuyYyFavNpT+Ub6QIDAQABo4IGFzCCBhMwHwYDVR0jBBgwFoAU D4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0OBBYEFDs0L7cJdKbrchz19ACWWvLT sOdUMIICYQYDVR0RBIICWDCCAlSCDnd3dy5hdGFuYXIubmV0ggtzMS5sZW1kZS5m coILczIubGVtZGUuZnKCEmFib25uZXMubGVtb25kZS5mcoIOd3d3LmxlbW9uZGUu ZnKCH2lkbS5zbWFydC1kaWdpdGFsLXNvbHV0aW9ucy5jb22CEHd3dy5zd2lzc2lu Zm8uY2iCG29wbS1kbnguZGlzbmV5bGFuZHBhcmlzLmNvbYIVb2JqZWN0cy5haXJm cmFuY2UuY29tgghhLmYxZy5mcoIIaS5mMWcuZnKCFHd3dy1hY3Auc3dpc3NpbmZv LmNogghwLmYxZy5mcoITaW1hZ2UubWVkaWFib25nLmNvbYIUc3RhdGljLm1lZGlh Ym9uZy5jb22CF3d3dy5zY2llbmNlc2V0YXZlbmlyLmZyghF3d3cuY2hhbGxlbmdl cy5mcoIWd3d3LnBvdXJxdW9pZG9jdGV1ci5mcoIabXktcnVuLmRpc25leWxhbmRw YXJpcy5jb22CGW15LXJ1bi5kaXNuZXlsYW5kcGFyaXMuZnKCHGJvb2stcnVuLmRp c25leWxhbmRwYXJpcy5jb22CG2Jvb2stcnVuLmRpc25leWxhbmRwYXJpcy5mcoIM aW1nLmxlbWRlLmZyghZ3d3cuc3RhZ2luZy5haXJidXMuY29tghxzdGF0aWMuYm9v a2luZy53ZWVrZW5kZXNrLmZygg5hc3NldC5sZW1kZS5mcoIXYW5udWFscmVwb3J0 LmFpcmJ1cy5jb22CG2Nkbi5mci5zaG9wcGluZy5yYWt1dGVuLmNvbTAOBgNVHQ8B Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGsGA1UdHwRk MGIwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zc2NhLXNoYTItZzYu Y3JsMC+gLaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc2 LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgGCCsGAQUFBwIBFhxodHRw czovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAECAjB8BggrBgEFBQcBAQRw MG4wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBGBggrBgEF BQcwAoY6aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMlNl Y3VyZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMIIB9AYKKwYBBAHWeQIEAgSC AeQEggHgAd4AdQCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAWM+ 2SaEAAAEAwBGMEQCIFyzDAbldNty+dVr0fmC5Qb4UPgNnDrobJaO8IzUAm6bAiBs TKSkuV4wRo5VIWIWu6eYPy0a7kgmhs2S7VmIfbLjvwB2AG9Tdqwx8DEZ2JkApFEV /3cVHBHZAsEAKQaNsgiaN9kTAAABYz7ZKCIAAAQDAEcwRQIhAPIa5xsQZ09fTO1T GLFidBm2Ru+YUtajWR2M0+3dfbvGAiACd1F/v5t7ch/WNLFqbZKnSFG0kVRnzJwa A/2MTxq/jQB1ALvZ37wfinG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABYz7Z J4IAAAQDAEYwRAIgLsJJTHPeLGN7qnlr/og+BN3LGaGn8NznsWE8oSIk9tICIEuC WG+AvIJFddp3XmdZ550TuclW0Mlj7xs/dfUdg8P/AHYAVYHUwhaQNgFK6gubVzxT 8MDkOHhwJQgXL6OqHQcT0wwAAAFjPtkpugAABAMARzBFAiBahXGGMpVV04a2cyzR cl4Yr9Q/LDG49gU+w8+vJNsu/gIhAND6nP7MCionuv+aE33qfuXEuIJa8uD/AtnZ ayvgL0i/MA0GCSqGSIb3DQEBCwUAA4IBAQBLfLrbD6yqybqhZOur9NkkHE0Ds7nk tCDj/C/e0eOFh2dxoajHYmn3SG41bL0Ve5dYio5aQPGk0vR0uIztnZjCRC37/Ig/ 7QeT3Luj2tMxQgL0hQ55N/eEYMy84rnLxxyv1A73Q3It1bgSsz163CyON9DLMy8m 3ZZaAi6cOSlsHM239+GU+6EJ6xGVq+TOa2cZkUMFN7T/zoxk1CvF6lDhYbysjdhu 68OHOkJc5RMvtkvV8qJS6ZM0qVmvsKTriobIJkU8cH8o9JoTEH8rMy9xSQokR01M /Sjr0meD2NSutI85lzAaQq74mmFqqAliPKQ2bwW9f3UVNHCGbE8KunFY -----END CERTIFICATE----- subject=/C=US/ST=California/L=Los Angeles/O=Verizon Digital Media Services, Inc./OU=Technology/CN=www.atanar.net issuer=/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 5229 bytes and written 302 bytes Verification: OK --- New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES128-GCM-SHA256 Session-ID: 0E51A945BFF7BD5964A4092BF29390DFCF0C734F75B9FE1DA4A2920A66F03F3A Session-ID-ctx: Master-Key: 5754E8D5C100C3FF354B19A1B5504FA762F9E16765FEB769CF7A517F80F645A164C0D2EB02A9A72F1B7FCAD00D7FBC98 PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 7200 (seconds) TLS session ticket: 0000 - 8d c5 b5 6c 88 e7 47 58-bf e7 be 8f bb c6 6d d3 ...l..GX......m. 0010 - a4 f3 bb 0e 87 62 c7 1f-ae 4d e6 7b 94 9d 77 2c .....b...M.{..w, 0020 - 7d f6 8c 21 62 3b bb 11-05 c3 ea 1c c4 2c fe 72 }..!b;.......,.r 0030 - 55 a9 f4 b5 b9 b1 86 e2-a5 68 e4 08 3b 36 85 c2 U........h..;6.. 0040 - 27 5c 9f bf 97 31 ae fe-b1 cd f7 56 be a7 60 c3 '\...1.....V..`. 0050 - a5 78 42 dc 8b f8 6b b7-30 94 d9 6d 4c 5a 19 e0 .xB...k.0..mLZ.. 0060 - aa 67 cb 47 fd ca 68 19-3c 27 31 3c 5a 84 69 5d .g.G..h.<'1.....U.[.D.9.. Start Time: 1530617635 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: yes ---

AltStyle によって変換されたページ (->オリジナル) /