configurationSquid作为HTTPS转发代理？

这是关于我的问题的一些背景：

• 我有一个在Heroku上运行的Web服务，使用dynamicIP地址。 Heroku上的静态IP不是一个选项。
• 我需要连接到防火墙后面的外部Web服务。 操作外部Web服务的人员只能将其防火墙打开到特定的静态IP。

我尝试的解决scheme是在具有静态IP的单独服务器上使用Squid将来自Heroku的请求转发到外部服务。 这样，外部服务总是看到代理服务器的静态IP，而不是Heroku服务的dynamicIP。

由于我的代理服务器不能依靠IP地址进行身份validation（这是开始的问题！），它必须依靠用户名和密码。 此外，用户名和密码不能以明文forms传输，因为如果攻击者拦截了明文，他们可以连接到我的代理假装是我，使用我的代理的静态IP做出站请求，从而逃避外部Web服务的防火墙。

因此，Squid代理只能通过HTTPS而不是HTTP接受连接。 （与外部Web服务的连接可能是HTTP或HTTPS。）

• yum和debian存储库的caching代理
• APIpipe理解决scheme
• 如果后端处于closures状态，nginx使用代理caching
• SSH通过SOCKS代理？ （客户端= OpenSSH OS X）
• 在Ubuntu升级之后，Nginx前端，Apache后端的mod_rpaf问题

我在CentOS 6.5.x上运行Squid 3.1.10，这里是我的squid.conf 。 仅出于故障排除的目的，我暂时启用了HTTP和HTTPS代理，但我只想使用HTTPS。

 # # Recommended minimum configuration: # acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Authorization auth_param digest program /usr/lib64/squid/digest_pw_auth -c /etc/squid/squid_passwd auth_param digest children 20 startup=0 idle=1 auth_param digest realm squid auth_param digest nonce_garbage_interval 5 minutes auth_param digest nonce_max_duration 30 minutes auth_param digest nonce_max_count 50 acl authenticated proxy_auth REQUIRED # # Recommended minimum Access Permission configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed #http_access allow localnet #http_access allow localhost http_access allow authenticated # And finally deny all other access to this proxy http_access deny all # Squid normally listens to port 3128 http_port 3128 https_port 3129 cert=/etc/squid/ssl/cert.pem key=/etc/squid/ssl/key.pem # We recommend you to use at least the following line. hierarchy_stoplist cgi-bin ? # Disable all caching cache deny all # Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /var/spool/squid 100 16 256 # Leave coredumps in the first cache dir coredump_dir /var/spool/squid # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 

使用这种设置，HTTP代理工作正常，但HTTPS代理不。

以下是来自本地框的HTTP代理请求：

 $ curl --proxy http://my-proxy-server.example:3128 \ --proxy-anyauth --proxy-user redacted:redacted -w '\n' \ http://urlecho.appspot.com/echo?body=OK OK 

好，那是我的预期。 这导致在/var/log/squid/access.log中有一行：

 1390250715.137 41 my.IP.address.redacted TCP_MISS/200 383 GET http://urlecho.appspot.com/echo? redacted DIRECT/74.125.142.141 text/html 

这是另一个请求，这次是HTTPS：

 $ curl --proxy https://my-proxy-server.example:3129 \ --proxy-anyauth --proxy-user redacted:redacted -w '\n' \ http://urlecho.appspot.com/echo?body=OK curl: (56) Recv failure: Connection reset by peer 

在这之后的access.log没有什么，但在cache.log ：

 2014/01/20 20:46:15| clientNegotiateSSL: Error negotiating SSL connection on FD 10: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request (1/-1) 

以上是更详细的说明：

 $ curl -v --proxy https://my-proxy-server.example:3129 \ --proxy-anyauth --proxy-user redacted:redacted -w '\n' \ http://urlecho.appspot.com/echo?body=OK * Adding handle: conn: 0x7f9a30804000 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x7f9a30804000) send_pipe: 1, recv_pipe: 0 * About to connect() to proxy my-proxy-server.example port 3129 (#0) * Trying proxy.server.IP.redacted... * Connected to my-proxy-server.example (proxy.server.IP.redacted) port 3129 (#0) > GET http://urlecho.appspot.com/echo?body=OK HTTP/1.1 > User-Agent: curl/7.30.0 > Host: urlecho.appspot.com > Accept: */* > Proxy-Connection: Keep-Alive > * Recv failure: Connection reset by peer * Closing connection 0 curl: (56) Recv failure: Connection reset by peer 

看起来像一个SSL错误。 但是，我将上面configuration中显示的子域通配符SSL证书重用为cert.pem和key.pem ，并已成功部署到其他Web服务器上。 而且，直接使用curl访问代理服务器，或者至lessbuild立一个通过SSL阶段的连接：

 $ curl https://my-proxy-server.example:3129 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> [--SNIP--] <div id="content"> <p>The following error was encountered while trying to retrieve the URL: <a href="/">/</a></p> <blockquote id="error"> <p><b>Invalid URL</b></p> </blockquote> <p>Some aspect of the requested URL is incorrect.</p> <p>Some possible problems are:</p> <ul> <li><p>Missing or incorrect access protocol (should be <q>http://</q> or similar)</p></li> <li><p>Missing hostname</p></li> <li><p>Illegal double-escape in the URL-Path</p></li> <li><p>Illegal character in hostname; underscores are not allowed.</p></li> </ul> [--SNIP--] 

任何想法我做错了什么？ 我试图甚至可能吗？ 提前致谢。