I used the file proposed by you, 1.1.1.1 still does not work.
On account of the browser, what kind of certificate do I need to export? There are three of them on that site (1.1.1.1).
The file .1.1.1.crt is created in the directory Certs. I understand that there should be 1.1.1.1, and not *.1.1.1?
This appears to be a problem with the cert that ProxHTTPSProxyMII creates.
I didn't see it because I have disabled browser warnings for ssl.
I apologize for my poor memory. Sorry.
(Apr. 10, 2018 06:02 AM)JJoe Wrote: This appears to be a problem with the cert that ProxHTTPSProxyMII creates.
(Apr. 09, 2018 06:38 PM)vlad_s Wrote: I understand that there should be 1.1.1.1, and not *.1.1.1?
In the past, the common name could be an ip address.
I don't remember if a wildcard was allowed in a CN ip address.
I think most of MII's cert problems are cause by a missing SubjectAltNames field.
Added SubjectAltNames support for DNS and IP... No guarantees, warranties, etc., but it appears to work.
Common name will no longer use a leading '*'. This means less code but a larger cert folder.
Built with outdated WinXP compatable software. So, may work with WinXP.
In the past, free use was supported by pop over and under advertising.
Now, free downloads are throttled and limited to one every 2 hours.
Still good enough for this.
Is it possible for you to offer the py code for download?
I have done little adjustments for my usage with old v1.4 - but i am not able to do such a change.
(Apr. 18, 2018 06:29 PM)Thomas S. Wrote: Is it possible for you to offer the py code for download?
Try this one, minor mods and edits. It should work.
minor mods and edits. It should still work.
I have done a first short test, all seams to be good - but https://1.1.1.1 will not work.
"The security certificate of this website has been issued for a different address of the website"
If I look (with WinXP certificate manager) in the certificate "1.1.1.1.crt" it list NO CN, so IE8 rejects this.
It is a little bit useless because the site will not rendered OK in IE8, but for test it is good.
With the old version 1.4 is load without my extra confirmation.
In the next days I made more tests, may be all other site works.
(Apr. 19, 2018 08:13 PM)Thomas S. Wrote: If I look (with WinXP certificate manager) in the certificate "1.1.1.1.crt" it list NO CN, so IE8 rejects this.
Thanks, I didn't notice this was missing.
My browsers on Win7 and Win10 don't care.
I'll try to add the field.
'*' returns to cert's Subject field due to some hosts using more than the 64 characters that are allowed. Example: 18cfdfd73150f69310ab-4d842a0601d0ae955a714605e7fb6d6f.ssl.cf2.rackcdn.com.
http traffic would be than forwarded to privoxy. Where to send https to?
My question is do I need to edit privoxy config to listen on more than port 3128 or do I need to simply edit config.ini from ProxHTTPSProxyMII into this?
2018/05/09 07:50:44 kid1| assertion failed: PeerConnector.cc:116: "peer->use_ssl"
I think I understand but I haven't actually done it.
(May. 08, 2018 09:45 AM)ryszardzonk Wrote: http traffic would be than forwarded to privoxy. Where to send https to?
You send https to ProxHTTPSProxyMII front server at 3129. The front server adds a 'tagged' header to https requests and forwards to privoxy at 3128. Privoxy forwards 'tagged' requests to ProxHTTPSProxyMII rear server, 3130.
(May. 08, 2018 09:45 AM)ryszardzonk Wrote: My question is do I need to edit privoxy config to listen on more than port 3128 or do I need to simply edit config.ini from ProxHTTPSProxyMII into this?
You need to configure privoxy to recognize the 'tagged' requests and forward them to the rear server.
Yes sir. This is what I was missing is how privoxy would know to send traffic back to ProxHTTPSProxyMII. Simple code additions You pointed out in the howto (which btw I quite likely would never find by myself) made the traffic go like it should which is ProxHTTPSProxyMII -> privoxy -> ProxHTTPSProxyMII.
To make sure that message is not coming from my first proxy in chain I skipped squid and pointed browser to use ProxHTTPSProxyMII for https and privoxy for http.
To fix it I got the idea of copying ca-certificates from system to "Certs" directory, but than I saw all those certs to websites I tried to use written there so it seems firefox has problem with certificate ProxHTTPSProxyMII issues.
it seems firefox has problem with certificate ProxHTTPSProxyMII issues.
You will need to add ProxHTTPSProxy's "CA.crt" to each Client's (Firefox) store of trusted certificate authorities.
(May. 09, 2018 11:59 AM)JJoe Wrote: You will need to add ProxHTTPSProxy's "CA.crt" to each Client's (Firefox) store of trusted certificate authorities.