<div dir="ltr">Is absolutely for personal use. (actually preventing my kids for access to stuff not for them). Why https! Everything is over https today (social sites email even google search is default https). Or you can tell me if i'm in wrong direction.<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Apr 18, 2014 at 5:50 PM, Michael H. Warfield <span dir="ltr"><<a href="mailto:mhw@wittsend.com" target="_blank">mhw@wittsend.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Fri, 2014-04-18 at 15:19 -0400, Boris Borisov wrote:<br>
> I'm trying to build UTM based on debian+dansguardian+squid. So far so<br>
> good everything works. But what to do about https://. Most sites today<br>
> are trying to use secure https even google search. How dansguardian<br>
> can filter content going over https? Any ideas<br>
<br>
</div></div>For what purpose? And by that I mean, what is the user environment and<br>
organizational requirements, and not merely "to filter https". The<br>
answer to that question is very important.<br>
<br>
The goal would to have a proxy MITM the SSL connection.<br>
<br>
If it's for personal purposes, you can create your own certificate for a<br>
a proxy and just accept it internally. You have a limited client set so<br>
that's fairly trivial.<br>
<br>
A number of very large international corporations set up their own "wild<br>
card certs" (certs for *) and got them signed (no doubt for vast amounts<br>
of money) by certain CA's. When some of that was discovered, the<br>
proverbial feces hit the proverbial rapidly whirling blades and said<br>
CA's involved where hit with a noreaster of fecal flakes. All that<br>
said, there may still be some out there or you may have an institutional<br>
CA installed (large outfits often do) and then the proxy has the<br>
wildcard cert and key.<br>
<br>
If you're not an international head banger or covert governmental TLA,<br>
you probably need to go with an internal CA and have your users install<br>
it in your root store. That's actually not a big deal. I have a CA<br>
myself for things like IPSec, OpenVPN, and all my secure E-Mail stuff.<br>
Nobody should install it for anything other than dealing with me but, if<br>
you do, anything it signs would be accepted just like anything from<br>
Verisign. The deal is getting that CA installed in your root store.<br>
Then your users add it to their keystore and you create a wildcard cert<br>
for your proxy. Some orgs this would work. Some it would not.<br>
<br>
So it's context, purpose, and originzationally dependent. Can you do<br>
it? Yes, for some value of "can".<br>
<br>
Regards,<br>
Mike<br>
<span class="HOEnZb"><font color="#888888">--<br>
Michael H. Warfield (AI4NB) | <a href="tel:%28770%29%20978-7061" value="+17709787061">(770) 978-7061</a> | mhw@WittsEnd.com<br>
/\/\|=mhw=|\/\/ | <a href="tel:%28678%29%20463-0932" value="+16784630932">(678) 463-0932</a> | <a href="http://www.wittsend.com/mhw/" target="_blank">http://www.wittsend.com/mhw/</a><br>
NIC whois: MHW9 | An optimist believes we live in the best of all<br>
PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!<br>
<br>
</font></span><br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div><br></div>