Re: [squid-users] RDP, Certificates and Squid

In order to troubleshoot, we will need your entire ACL / http_access
portions copy/pasted, with sensitive portions edited, if need be.

>>> Damian Teasdale <damte_at_oppy.com> 2/23/2011 1:12 PM >>>
Here is our environment:

LAN users all go through the proxy for internet access, works fine. A
few users need access to RDP to an external partners Terminal Server.
The terminal server has a Certificate issued by GoDaddy.com. When the
users on the LAN attempt to connect to the external Terminal Server I
don't think that they can authenticate the certificate. I watch the
access.log and I see these lines written:

1297896161.739 70 192.168.x.xTCP_DENIED/407 1962 GET
http://certificates.godaddy.com/repository/gd_intermediate.crt -
NONE/- text/html
1297896161.742 0 192.168.x.x TCP_DENIED/407 2158 GET
http://certificates.godaddy.com/repository/gd_intermediate.crt -
NONE/- text/html
1297896161.745 2 192.168.x.x TCP_DENIED/407 1962 GET
http://certificates.godaddy.com/repository/gd_intermediate.crt -
NONE/- text/html
1297896162.086 319 192.168.x.x TCP_DENIED/407 2055 GET
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- NONE/- text/html
1297896162.089 0 192.168.x.x TCP_DENIED/407 2251 GET
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- NONE/- text/html
1297896162.091 2 192.168.x.x TCP_DENIED/407 2055 GET
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- NONE/- text/html

I have tried putting in some acl's for this but it doesn't seem to make
a difference, here are the acl's as I have them setup:

acl GoDaddy dstdomain .godaddy.com

http_access allow GoDaddy

There are a lot of other acl's that we have setup but did not include
them all, but could if needed. Any ideas about how to get this working?
As a work around I have put in a separate ACL to allow that LAN
computers IP address direct access and it works, but this is not ideal.

Thanks

Damian Teasdale
Senior Technical Analyst
The Oppenheimer Group
Tel: 604-461-6779
email: damte_at_oppy.com

The Oppenheimer Group ---- CONFIDENTIAL

This message is for the designated recipient only and may contain
privileged, proprietary, or otherwise private information. If you have
received it in error, please notify the sender immediately and delete
the original. Any other use of the email by you is prohibited.

Travel Impressions made the following annotations
-------------------------------------------------------------
"This message and any attachments are solely for the intended recipient
and may contain confidential or privileged information. If you are not
the intended recipient, any disclosure, copying, use, or distribution of
the information included in this message and any attachments is
prohibited. If you have received this communication in error, please
notify us by reply e-mail and immediately and permanently delete this
message and any attachments.
Thank you."
Received on Wed Feb 23 2011 - 18:19:05 MST