<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link="#467886" vlink="#96607D" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal> Hello,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks to your answer Alex, <a href="https://ml-archives.squid-cache.org/squid-users/2025-May/027560.html">https://ml-archives.squid-cache.org/squid-users/2025-May/027560.html</a><o:p></o:p></p><p class=MsoNormal>our team is running a Squid with HTTPS transparent interception and requests rewrite to cache services since months.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>With recent OpenSSL v3 introduction in distributions like Debian 13, Python 3 requests or httpx modules (and probably soon more https client) now complains about missing AKID in squid mimic certificate with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We are investigating by adding logging to src/ssl/gadgets.cc and probably the ssl_bump sequence configured (step1/bump step2/stare step3/bump) prevents certificate generation to include these extensions.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Does this hypothesis sound plausible?<o:p></o:p></p><p class=MsoNormal>Is there a way to work-around this new issue thanks to configuration, or patching?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you in advance for your help<o:p></o:p></p><p class=MsoNormal>Best regards,<o:p></o:p></p><p class=MsoNormal>Yves<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none'> Yves MARTIN <br><b>Sent:</b> Tuesday, May 27, 2025 4:37 PM<br><b>To:</b> squid-users@lists.squid-cache.org<br><b>Subject:</b> How to do transparent rewrite with https requests?<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hello,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My team expects to transparently rewrite requests through squid, replacing original URL/hostname by another target URL/host.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Main objective is to redirect original HTTPS requests triggered by “docker pull alpine” to a local mirrored registry without obvious information in user client that the obtained image comes from mirror: original image location is preserved, no specific proxy or mirror configuration in docker client/daemon to set.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To do so, we have used squid-urlrewrite and it works well for HTTP request, even if rewrite targets HTTPS URL.<o:p></o:p></p><p class=MsoNormal>But when original request is HTTPS, connection still goes to original URL/hostname IP address <a href="https://github.com/rchunping/squid-urlrewrite/issues/3">https://github.com/rchunping/squid-urlrewrite/issues/3</a><o:p></o:p></p><p class=MsoNormal>According to debug logs, the original request hostname is resolved to IP early and kept in internal context after squid-urlrewrite is invoked.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Do you have recommendations how to implement such a rewrite? Any idea how to improve/fix current squid behavior?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you in advance for your help<o:p></o:p></p><p class=MsoNormal>Best regards,<o:p></o:p></p><p class=MsoNormal>Yves<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>