您并没有提供足够的信息来确定您遇到问题的原因。
例如:
您的Squid https代理是如何配置的?代理是否在splice或bump模式下运行?
您绝对确定您的代理正在工作吗?
您尝试通过http或https连接到其他站点了吗?
是否设置了其他代理身份验证选项?有限制可以使用代理的IP地址吗?您配置了什么身份验证选项?启用身份验证后是否可以正常工作?
就我个人而言,我出于自己的原因需要做同样的事情。我首先在“全部拼接”模式下配置了代理,这里显示了仅头文件的结果:
$ curl -x 10.10.1.1:3128 -I https://www.google.com/
HTTP/1.1 200 Connection established
HTTP/2 200
content-type: text/html
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Mon, 04 Apr 2022 12:14:56 GMT
server: gws
x-xss-protection: 0
x-frame-options: SAMEORIGIN
expires: Mon, 04 Apr 2022 12:14:56 GMT
cache-control: private
[snip]
接下来,我将代理配置为“白名单拦截,否则放行”模式并再次尝试:
HTTP/1.1 200 Connection established
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
这是预料之中的。
使用 -k 选项可以让它工作(忽略证书错误):
HTTP/1.1 200 Connection established
HTTP/1.1 200 OK
Content-Type: text/html
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Date: Mon, 04 Apr 2022 12:34:21 GMT
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Expires: Mon, 04 Apr 2022 12:34:21 GMT
Cache-Control: private
[snip]
或者使用在https代理设置中定义的证书:
$ curl -x 10.10.1.1:3128 --cacert ~/test/my-MITM.crt -I https://www.google.com/
HTTP/1.1 200 Connection established
HTTP/1.1 200 OK
Content-Type: text/html
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Date: Mon, 04 Apr 2022 12:35:06 GMT
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Expires: Mon, 04 Apr 2022 12:35:06 GMT
Cache-Control: private
[snip]
接下来,我启用了身份验证(仍处于bump模式,忽略证书错误),正如预期的那样,它不喜欢这样做。
$ curl -x 10.10.1.1:3128 -k -I https://www.google.com/
HTTP/1.1 407 Proxy Authentication Required
Server: squid/4.15
Mime-Version: 1.0
Date: Mon, 04 Apr 2022 12:40:46 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3532
X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Proxy-Authenticate: Basic realm="Please enter your credentials to access the proxy"
X-Cache: MISS from pfsense
X-Cache-Lookup: NONE from pfsense:3128
Via: 1.1 pfsense (squid/4.15)
Connection: keep-alive
curl: (56) Received HTTP code 407 from proxy after CONNECT
那么让我们尝试进行身份验证:
$ curl -x hello:world@10.10.1.1:3128 -k -I https://www.google.com/
HTTP/1.1 200 Connection established
HTTP/1.1 200 OK
Content-Type: text/html
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Date: Mon, 04 Apr 2022 12:43:09 GMT
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Expires: Mon, 04 Apr 2022 12:43:09 GMT
Cache-Control: private
[snip]
没问题。
由于你的错误与我见过的任何内容都不匹配,所以我想再尝试一个练习。与其不将协议作为代理服务器定义的一部分而不指定它,我将其添加进去:
$ curl -x https://hello:world@10.10.1.1:3128 -k -I https://www.google.com/
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
啊,有趣。让我们来了解一些细节:
$ curl -x https://hello:world@10.10.1.1:3128 -k -I https://www.google.com/ -v
* Trying 10.10.1.1...
* TCP_NODELAY set
* Connected to 10.10.1.1 (10.10.1.1) port 3128 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
* Closing connection 0
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
这看起来更接近你的错误。
最后的测试,指定代理服务器时使用 http 而不是 https。
$ curl -x http://hello:world@10.10.1.1:3128 -k -I https://www.google.com/
HTTP/1.1 200 Connection established
HTTP/1.1 200 OK
Content-Type: text/html
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Date: Mon, 04 Apr 2022 12:51:27 GMT
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Expires: Mon, 04 Apr 2022 12:51:27 GMT
Cache-Control: private
[snip]
就是这样,对我来说已经足够好了。
我猜测,如果您在代理字符串中指定协议,它将尝试使用该协议与代理服务器通信。因此,使用http://或像我最初所做的那样不指定它都可以正常工作,但是一旦我说了https:... ☠️☠️☠️
我希望这对任何对此小细节感兴趣的人有所帮助。