Squid 3.3.8 HTTPS (不透明)

Question

我想限制youtube的带宽，所以我想拦截https连接。我跟读了几个教程，但做不到。有人能帮我一把吗？

# Squid listen Port
http_port 192.168.1.215:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB key=/etc/squid/example.com.private cert=/etc/squid/example.com.cert
# SSL Bump Config
always_direct allow all
ssl_bump server-first all
sslproxy_cert_error deny all
sslproxy_flags DONT_VERIFY_PEER
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1

我将myCA.pem导入到web浏览器，然后我所使用的任何web都会得到“代理服务器拒绝连接”。如果不是的话，https很好。

我能做什么？

我是access.log

192.168.1.172 TCP_HIT/200 52543 GET http://www.silencio.com.ar/wp-content/uploads/2016/07/AHJ8239-540x386.jpg - HIER_NONE/- image/jpeg
192.168.1.172 TCP_HIT/200 49912 GET http://www.silencio.com.ar/wp-content/uploads/2016/07/strokes-2001-adentro-540x386.jpg - HIER_NONE/- image/jpeg
192.168.1.172 TCP_HIT/200 43804 GET http://www.silencio.com.ar/wp-content/uploads/2016/07/ArcticMonkeys012-540x386.jpg - HIER_NONE/- image/jpeg
192.168.1.172 TCP_DENIED/200 0 CONNECT www.google-analytics.com:443 - HIER_NONE/- -
192.168.1.172 TCP_MISS/301 807 GET http://www.youtube.com/ - HIER_DIRECT/64.233.186.91 text/html
192.168.1.172 NONE/200 0 CONNECT www.youtube.com:443 - HIER_DIRECT/64.233.186.91 -
192.168.1.172 NONE/200 0 CONNECT blocklist.addons.mozilla.org:443 - HIER_DIRECT/52.35.149.230 -

谢谢!

(我不会说英语)

Answer 1

拦截HTTPS的第一个建议是使用最新可用的squid版本。撰写本文时，对于有用的SSL来说，Squid-3.5.19+是必需的。使用旧版本只是自找麻烦。