[SOLVED]Proxy blocking https ports.

[matias.aiskovich]

Hi, i have a problem with the Zentyal proxy:
We need to use some pages that have  invalid ssl certificates and seems that zentyal is blocking them,i have been searching about this problem with squid and i found that there are some lines of squid.conf that will block the pages that dont have a valid certificate so i thinked that maybe zentyal have this configuration set by default but when i looked in the squid.conf.mas pattern file this wasn´t applied. I also tried with creating exceptions in the proxy filter section to this pages but didnt work, i know that will be better to not allow to enter to pages without valid ssl but we really need to use this pages, is there any way to solve it?
Thank you very much

[Sam Graf]

My recollection was that the proxy doesn't interfere with access to sites having invalid certificates. Regrettably, I'm away from the office so can't take a look.

What version of Zentyal are you running? Are you using a categorized domain list?

[Escorpiom]

Already replied it in the Spanish section, please - one at a time.
Advised to look at the way proxy has been set up and to look at the firewall rules.
This has to be something new in Squid 3 because I've never had that issue.

Cheers.

[matias.aiskovich]

Excuse me, i wasnt right about this problem, i believed what the users told me. First, i cheked again and Zentyal isn`t blocking https, the users thought that i blocked them the site when they saw the normal advertise that you have when you are trying to enter to a non valid https, then there is something that is really being blocked by Zentyal and is a page that use the port 8443 and a invalid ssl(i thought about ssl but is clear that the problem is the port), so i think i have to allow this port on the firewall to this issue?
Thank you very much
Excuse me for my mistake

pd: Escorpiom i will delete the spanish thread

[Sam Graf]

I understand then that you are not using a transparent proxy?

[matias.aiskovich]

No, i am using the non transparent proxy.
Thank you

[Escorpiom]

If you need port 8443, from what I read on Speedguide it is used by any of these services:

Code: [Select]

PCsync HTTPS, PCSync SSL, Common alternative https port, SW Soft Plesk Control Panel, Apache Tomcat SSL, iCal service (SSL) SG
 8443 tcp SW Soft Plesk Control Panel (unofficial) Wikipedia
 8443 tcp,udp pcsync-https PCsync HTTPS IANA
 8443 tcp pcsync-ssl PCSync SSL SANS
 8443 tcp https-alt Common alternative https port
If you are not using the transparent proxy, then you would have to allow this port in Squid's config file, it will be somewhere in this line:

Code: [Select]

acl SSL_ports port 443 563 # https, snews
change to

Code: [Select]

acl SSL_ports port 443 563 8443 # https, snews
You have to hack into the .mas file that is here in Zentyal 2.2.7:

Code: [Select]

/usr/share/zentyal/stubs/squid
You can perhaps add por 8444 also. After the change, restart proxy service and you are good to go.

Cheers.

[matias.aiskovich]

It worked
Thank you very much for your help

[Escorpiom]

Ofcourse it worked. My n00b tips are useful sometimes 
Let's mark it as "solved" then?

Cheers.

[RodixPy]

Hi I have the same problems but this solution not work for me.

P.D: sorry for my bad english

[Escorpiom]

Please make a new post and explain in detail.

Cheers.