Re: [squid-users] Error negotiating SSL connection on FD ##: Closed by client

Thanks, Guy.

I’m almost tempted to just ssl_bump none for 23.0.0.0/12, but I’m sure that would lead to all sorts of annoyances for clients who are tracking users download usage etc.

I’d appreciate if you could share your list of IP addresses, might be useful for us.

Dan

On 7 Apr 2014, at 11:23 pm, Guy Helmer <ghelmer_at_palisadesystems.com> wrote:

> On Apr 6, 2014, at 11:58 PM, Dan Charlesworth <dan_at_getbusi.com> wrote:
>
>> This somewhat vague error comes up with relative frequency from iOS apps when browsing via our Squid 3.4.4 intercepting proxy which is performing server-first SSL Bumping.
>>
>> The requests in question don’t make it as far as the access log, but with debug_options 28,3 26,3, the dst IP can be identified and allowed through with ssl_bump none.
>>
>> The device trusts Squid's CA, but apparently that’s not enough for the Twitter iOS app and certain Akamai requests that App Store updates use.
>>
>> Can anyone suggest how one might debug this further? Or just an idea of why the client might be closing the SSL connection in certain cases?
>>
>> Thanks!
>>
>>
>
> I suspect that the Twitter app is using certificate pinning to prevent man-in-the-middle decryption: https://dev.twitter.com/docs/security/using-ssl
>
> IIRC, I have had some difficulty tracking down or obtaining intermediate certs that Akamai uses. I ended up whitelisting many Akamai IP addresses from SSL interception on my test network.
>
> Guy
Received on Mon Apr 07 2014 - 23:34:57 MDT