LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices



Reply
 
Search this Thread
Old 04-09-2008, 09:29 AM   #1
BerzinTehvs
Member
 
Registered: Mar 2005
Location: Latvia
Distribution: Slackware
Posts: 47

Rep: Reputation: 15
Squid cache_peer and ssl connections


Hi!

I am trying to configure two squid servers to communicate with each other over ssl:
from the config:

cache_peer ADRESS parent Port 3130 no-query proxy-only ssl sslflags="DONT_VERIFY_PEER NO_DEFAULT_CA DONT_VERIFY_DOMAIN"

and getting very informative error msg:

FATAL: Bungled squid.conf line 1383: cache_peer ADRESS parent Port
3130 no-query proxy-only ssl sslflags=DONT_VERIFY_PEER NO_DEFAULT_CA
DONT_VERIFY_DOMAIN

It doesn't helped a lot even if i pointed to the server's key and cert files, the msg was the same. -D option also did not helped.

So, the question is - how to configure parent and secondary server to get them using ssl for communication?

Squid documentation and google are very poor on that account.
 
Old 04-09-2008, 09:32 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968
well that is squid at a basic file parsing level saying that it doesn't understand the line. to me that suggests that squid isn't built with the right ssl support to do this, and you'll need to build it yourself with it enabled, or find an alternative version.
 
Old 04-09-2008, 03:50 PM   #3
BerzinTehvs
Member
 
Registered: Mar 2005
Location: Latvia
Distribution: Slackware
Posts: 47

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by acid_kewpie View Post
well that is squid at a basic file parsing level saying that it doesn't understand the line. to me that suggests that squid isn't built with the right ssl support to do this, and you'll need to build it yourself with it enabled, or find an alternative version.
yes, there were problems, I corrected them, but now i have such msg in secondary cache cache.log:
fwdNegotiateSSL: Error negotiating SSL connection on FD 18: error:00000000:lib(0):func(0):reason(0) (5/0/0)

corresponding conf line looks like:
cache_peer IP_addr parent PORT 3130 proxy-only ssl \
sslcert=/etc/ssl/host.cert \
sslkey=/etc/ssl/host.key \
sslflags=DONT_VERIFY_PEER

Other sslflags (NO_DEFAUL_CA, DONT_VERIFY_DOMAIN) caused bungled error.

there are no any error in parent cache server cache.log file.

May be something must be done at the parebt side also?

Last edited by BerzinTehvs; 04-09-2008 at 04:06 PM. Reason: aditional info
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
SSL Connections / second and SSL Accelerator Cards on Linux LinuxGeek Linux - Networking 0 06-10-2006 09:18 AM
squid cache_peer don't work jiawj Red Hat 0 11-18-2005 02:59 AM
SQUID cache_peer query wennie Linux - Software 0 02-06-2005 01:26 AM
SSL Connections sooner5150 Linux - Networking 0 11-03-2004 05:08 PM
Squid Cache_peer config crock2022 Linux - Networking 0 03-24-2004 06:44 AM


All times are GMT -5. The time now is 12:57 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration