<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I'm many months late, but I happened to come across this thread while going through the archives. I have in fact been using Squid to work around https issues on an older system, in my case OS X 10.9. <div><br></div><div>Squid's documentation is difficult to decipher, so it took me a solid day to get everything set up! But, my working configuration file is as follows:</div><div><br></div><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px;"><div>http_port 3128 ssl-bump generate-host-certificates=on cert=/Library/Squid/Certificates/squid.pem key=/Library/Squid/Certificates/squid-key.pem</div><div><br></div><div>tls_outgoing_options cafile=/Library/Squid/Certificates/cacert.pem</div><div>sslcrtd_program /Library/Squid/security_file_certgen</div><div><br></div><div>acl excluded_domains ssl::server_name .<a href="http://pypi.org">pypi.org</a> .<a href="http://pythonhosted.org">pythonhosted.org</a></div><div>acl apple_domains ssl::server_name_regex ess\.apple\.com$ ^sw.*\.apple\.com$</div><div>acl local_addresses ssl::server_name_regex ^192\.[0-9]+\.[0-9]+\.[0-9]+$ ^10\.[0-9]+\.[0-9]+\.[0-9]+$ ^172\.(1[6-9]|2[0-9]|3[01])\.[0-9]+\.[0-9]+$</div><div>acl loopback_addresses ssl::server_name_regex ^127\.[0-9]+\.[0-9]+\.[0-9]+$ ^::1$</div><div>acl excluded any-of excluded_domains apple_domains local_addresses loopback_addresses</div><div>ssl_bump splice excluded</div><div>ssl_bump bump all</div><div><br></div><div>acl fetched_certificate transaction_initiator certificate-fetching</div><div>cache allow fetched_certificate </div><div>http_access allow fetched_certificate</div><div>sslproxy_cert_error deny all</div><div><br></div><div>http_access allow localhost</div><div>http_access deny to_localhost</div><div>http_access deny all</div></blockquote><div><div><br></div><div><div apple-content-edited="true"><div style="font-family: sans-serif; color: rgb(1, 1, 1);">This config file assumes there's a root cert in /Library/Squid/Certificates/squid.pem and a key in /Library/Squid/Certificates/squid-key.pem. The excluded domains can be adjusted if desired; `apple_domains` fixes issues with some built-in Apple services that appear to use certificate pinning (iMessage, App Store), and `local_addresses` fixed some issues with docker-machine. You can also exclude specific domains from the proxy within OS X's System Preferences.</div><div style="font-family: sans-serif; color: rgb(1, 1, 1);"><br></div><div style="font-family: sans-serif; color: rgb(1, 1, 1);">If your old system happens to be one of 10.6–10.9, and you're interested like to run Squid on the Mac itself as opposed to on an external router, I put together a little automagic installer here. The readme contains some additional instructions on adding a certificate to Keychain Access that may be useful even if you're going the different-device route. <a href="https://jonathanalland.com/downloads/wowfunhappy-https-proxy.dmg">https://jonathanalland.com/downloads/wowfunhappy-https-proxy.dmg</a></div><div style="font-family: sans-serif; color: rgb(1, 1, 1);"><br></div><div style="font-family: sans-serif; color: rgb(1, 1, 1);">I would recommend that basically anyone on an old system consider setting up something like this! It fixes a lot of stuff!</div></div></div></div>
<br></body></html>