Outlook 2010 to Office365 via Squid proxy

 狀況：

Outlook 2010 連到 Office 365 等很久 (狀態顯示：嘗試連線)，最後會連線成功。

原因：

Squid proxy 預設安裝只有 http proxy，對於其他 port 是建立 tunnel。

解法：

啟用Squid SSL bump，將 Office 365 的網域加入 ssl_exclude_domains.conf

步驟：

1. Create CA certificate and key for SSL bump

cd /etc/squid

mkdir ssl_cert

chown squid:squid ssl_cert

chmod 700 ssl_cert

cd ssl_cert

openssl req -new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509 -keyout myCA.pem  -out myCA.pem

2. Generate DH parameters in '/etc/squid' folder

openssl dhparam -outform PEM -out dhparam.pem 2048

3. extract certificate for importing in browsers

openssl x509 -in myCA.pem -outform DER -out myCA.der

4. Edit '/etc/squid/squid.conf' and use following before 'http_access deny all' rule

# Enable SSL bump

#acl step1 at_step SslBump1

#acl step2 at_step SslBump2

#acl step3 at_step SslBump3

acl ssl_exclude_domains ssl::server_name "/etc/squid/ssl_exclude_domains.conf"

acl ssl_exclude_ips     dst              "/etc/squid/ssl_exclude_ips.conf"

#ssl_bump splice localhost

#ssl_bump peek step1 all

ssl_bump splice ssl_exclude_domains

ssl_bump splice ssl_exclude_ips

#ssl_bump stare step2 all

#ssl_bump bump all

# And finally deny all other access to this proxy

http_access allow all

#http_access deny all

#http_port 3128

http_port  3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/etc/squid/ssl_cert/myCA.pem

5. Edit /etc/squid/ssl_exclude_domains.conf

.office365.com

.outlook.com

Reference:

Feature: SslBump Peek and Splice

在 Squid 服務中配置 SSL Bumping

Configure squid-3.3 in transparent mode on CentOS 7 with SSL bump

How to enable HTTPS decryption (SslBump) in Squid 3.5 for Windows?

PS. 我的環境如果勾 近端網址不使用Proxy伺服器，Outlook還是會等很久。