-   Linux - Networking (
-   -   Squid reverse proxy problem (HTTPS to HTTP) (

RussP 09-30-2008 10:10 AM

Squid reverse proxy problem (HTTPS to HTTP)
I'm trying to set up a squid reverse proxy for an Outlook Web Access webmail server. I want the connection to squid to be encrypted with SSL, but the connection to the web server to be simple HTTP, ie:

client_browser <---HTTPS---> squid <---HTTP---> outlook_web_access

Below is the config that I currently have on squid:


https_port cert=/etc/shv-ssl/CertAuth/testcert.cert key=/etc/shv-ssl/CertAuth/testkey.pem
cache_peer parent 80 0 no-query originserver login=PASS front-end-https=on name=OWA

acl all src
acl manager proto cache_object
acl localhost src
acl to_localhost dst
acl SSL_ports port 443

# Deny requests to unknown ports
http_access deny !SSL_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports


cache_access_log /var/log/squid/reverse-access.log
cache_log /var/log/squid/reverse-cache.log
cache_store_log /var/log/squid/reverse-store.log

I was getting errors telling me that the access was denied due to ACL rules, but now I'm getting:


The following error was encountered:

    * Invalid Request

Some aspect of the HTTP Request is invalid. Possible problems:

    * Missing or unknown request method
    * Missing URL
    * Missing HTTP Identifier (HTTP/1.0)
    * Request is too large
    * Content-Length missing for POST or PUT requests
    * Illegal character in hostname; underscores are not allowed

The squid access log has the following entry:

1222780606.494    46 TCP_DENIED/400 1586 GET error:invalid-request - NONE/- text/html
Can anyone give me any idea of where I'm going wrong?

hsugawar 10-02-2008 02:20 PM

Doesn't seem possible
I tried the same with Apache and was unsuccessful.

I have a network camera that speaks only http, and I wanted to monitor my house from outside over https through a firewall running Apache. After several attempts, I concluded http and https are so different that a proxy server cannot easily convert.

So, I wrote a small CGI script that mimics the expected proxy(?) conversion. It works almost fine, but it is somewhat server (network camera) specific and it can't handle some IE browser-specific protocols.


All times are GMT -5. The time now is 02:48 PM.