Re: current status of bump-server-first + dynamic certs in 3.3??

On 04/23/2012 01:02 AM, Ahmed Talha Khan wrote:

> I want to use dynamic certificates (and/or mimic original ssl server
> certs) while running in a transparent mode. I know this is not
> possible in 3.2 because of the bump-client-first approach. Release
> roadmap for squid 3 says that bump-server-first is(will be) available
> in 3.3 which is under dev right now. Mimicking original ssl server
> cert is also available in 3.3.
>
> I want to know about the current status of these 2 features in 3.3.
> How far along are they in the testing and how much stable is it. Are
> the 2 features working correctly or to some extent? Can i start using
> them right now and get more confidence when the release matures. Any
> anticipated dates for stable 3.3?

Hello Ahmed,

    Bump-server-first[1] and certificate mimicking[2] features are
currently being tested by feature sponsors. The code appears to work
well overall, but there are still some corner cases or minor bugs that
we are working on. For example, two weeks ago we had to change how
IP-based URLs are handled. Last week, we discovered that we broke src
ACL for sslproxy_cert_error and are now fixing that code.

I tried to update features documentation on Squid wiki as we discover
new caveats or settle down upon a specific implementation path.

I expect to be able to submit the code for Squid Project review in 2-6
weeks, but this may be delayed if urgent projects or bugs intervene.

Thank you,

Alex.
[1] http://wiki.squid-cache.org/Features/BumpSslServerFirst
[2] http://wiki.squid-cache.org/Features/MimicSslServerCert
Received on Mon Apr 23 2012 - 17:57:27 MDT