squid: Enable dynamic SSL certificate generation 15507/head
authorWong Hoi Sing Edison <hswong3i@pantarei-design.com>
Sun, 25 Apr 2021 02:38:14 +0000 (10:38 +0800)
committerWong Hoi Sing Edison <hswong3i@pantarei-design.com>
Sun, 25 Apr 2021 03:03:54 +0000 (11:03 +0800)
commitdbda77686d5dccb3d3999ed2e7dec18aab11fff8
tree92d7f34161b9e176fab068be6f2c1b01762a8fb9
parent9c6fc23e01a2227770659d0060dbabb491fdff67
squid: Enable dynamic SSL certificate generation

Maintainer: @neheb / @BKPepe / @zhanhb
Compile tested: ipq806x, generic, netgear_r7800, master
Run tested: ipq806x, generic, netgear_r7800, openwrt-19.07

Description:

Squid now only support HTTPS proxy in TCP tunnel mode (e.g. `ssl_bump splice all`):

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    ssl_bump splice all

In order to operate in SSL Bump mode, we need to compile with `--enable-ssl-crtd` for following configuration:

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    sslcrtd_program /usr/lib/squid/security_file_certgen -s /car/cache/squid/ssl_db -M 4MB
    ssl_bump stare all
    ssl_bump bump all

This PR switch the `SQUID_enable-ssl-crtd` into `default y`, therefore default enable SSL Bump mode.

Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
net/squid/Config.in