Re: [squid-users] using squid as reverse proxy to connect to exchange 2010 owa

On 08/07/11 01:25, Sidnei Moreira wrote:
> hi,
> i have searched the archive for a case like mine and could not find
> any help, so i would like to post my actual issue.
>
> i have an exchange 2010 server, configured to respond with a
> self-signed certificate to internal computers on our lan.
> i have a public certificate from a trusted CA, which does not include
> my internal domain, and for a couple of reasons i can't add this local
> internal domain to that public certificate.
>
> so whenever an internal outlook client tries to connect internally,
> exchange keeps saying that the certificates are not the same.
> on the external side, i can't connect to the OWA site without popping
> up the 'site is not trusted' message on the browser.
>
> i read about squid reverse proxy feature, which receive connections
> from the outside world using a public trusted certif. and pass it on
> to exchange server.
> i guess this could solve my problem, as i would not need to add the
> public certificate to the exchange server, but only to the squid
> server.

It solves your problem in a similar way that turning certificate
validation OFF will also do. With a great reduction in security.

I think you want to make exchange accept your self-signing CA used to
sign the internal domains. Such that it trusts clients contacting it
with internal certificates.

>
> from the wiki page i copied the following configuration into my
> squid.conf file, and adapted it. I am using squid version 3.0.STABLE1

Please don't. 3.0.STABEL1 has an enormously long list of bugs and
security vulnerabilities. If you must use 3.0 at all please be sure it
is the final release of that series.

Also be aware that recent releases of MS software are starting to
require HTTP/1.1 features more.

>
> ########################## START OF REVERSE PROXY CONFIG
> SOURCE: http://wiki.squid-cache.org/ConfigExamples/Reverse/ExchangeRpc
> ##########
> extension_methods RPC_IN_DATA RPC_OUT_DATA
> https_port<my-squid-server-internal-ip>:443
> cert=/var/crt/my-public-domain-trusted-certificate.p7s
> defaultsite=my-public-domain.com
> cache_peer<my-exchange-server-internal-ip> parent 443 0 no-query
> originserver login=PASS ssl
> sslcert=/var/crt/my-self-signed-exchange-certificate.pfx
> name=exchangeServer
>
> acl EXCH dstdomain .rpc_domain_name
> cache_peer_access exchangeServer allow EXCH
> cache_peer_access exchangeServer deny all
> never_direct allow EXCH
> http_access allow EXCH
> http_access deny all
> miss_access allow EXCH
> miss_access deny all
> ########################## END OF REVERSE PROXY CONFIG
>
> but, i am getting this error when restarting squid:
>
> 2011/07/07 08:39:18| parseConfigFile: 'squid.conf' line 90
> unrecognized: 'https_port<my-squid-server-internal-ip>:443
> cert=/var/crt/my-public-domain-trusted-certificate.p7s
> defaultsite=my-public-domain.com'
> 2011/07/07 08:39:18| parse_peer: token='ssl'
> FATAL: Bungled squid.conf line 91: cache_peer
> <my-exchange-server-internal-ip> parent 443 0 no-query originserver
> login=PASS ssl sslcert=/var/crt/my-self-signed-exchange-certificate.pfx
> name=exchangeServer
> Squid Cache (Version 3.0.STABLE1): Terminated abnormally.

3.0.STABLE1 is too old to support the 'ssl' parameter.

Squid also does not support the proprietary PFX format. Convert it to
the PEM format instead.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.14
   Beta testers wanted for 3.2.0.9