HTTPS Inspection controls CONNECT handling and optional TLS man-in-the-middle (Deep Scan) for HTTP inside HTTPS. Requires a valid RCSC (root CA) loaded from activation; the policy engine returns no policy when the section is off or misconfigured. Enabled Master switch ( ssl_policy ). Off: no inspection policy applies. Inspection Policies Profile rows; first match wins. Sets Deep Scan, no-certificate, domain-mismatch, and max SSL error level for that CONNECT. Setup Stored server/ passphrase rows (see field help — not read by current runtime setup code). SSL Certs/Cache Download, upload, or refresh RCSC files and view SSL session/context cache. On CONNECT, deep_scan_check() loads the first matching InspectionBy default, general web traffic should be fully verified and fully inspected. The realistic exception is internal or development infrastructure whose certificates are self-signed, whose issuing chain is incomplete, or that is simply expired. Rather than relaxing verification globally, scope the relaxation to the specific traffic that needs it — ideally via a Request Type built for those internal hosts — rather than opening it up for everyone.
Deep Scan (MITM): The connection evaluator determines if deepscan is enabled for the connection. If true, SafeSquid performs full Man-in-the-Middle interception by generating a forged, trusted certificate for the client using the defined Root CA, enabling inspection of the encrypted payload.
Upstream Validation: SafeSquid builds an OpenSSL certificate store and verification parameters to validate the upstream origin server’s certificate against known CA authorities.
Strict Error Handling: Handlers validate domain mismatches (block_domain_mismatch), missing certificates (block_no_cert), and maximum allowable OpenSSL error levels (max_error_level). Failures drop the connection to prevent MITM attacks from malicious servers.
The console splits HTTPS Inspection into three tabs. There is no Setup tab — the Setup rows
described under SSL Certs/Cache below are configuration the current build never reads.
Enabled (enabled): Master switch for HTTPS Inspection. Off: The policy engine returns NULL and the inspection engine never enables Deep Scan. On: policies apply only when RCSC setup succeeds.
Every field here is per-connection tuning on an Inspection Policy row. The first matching
enabled row from the top wins for each CONNECT — this is first-match-wins, not
cumulative like Access Profiles: only the first matching entry governs a given CONNECT,
and entries below it are never consulted for that connection.
Enabled (enabled): When disabled, this row is skipped. First matching enabled row wins for each CONNECT.
Comment (comment): Operator note only; not used in SSL verification logs.
Profiles (profiles): Connection must match at least one listed profile (Access Profiles engine). Leave blank for all connections. Negated tags ( !profile ) skip the row when that profile is present. The engine stops at the first matching row from the top.
DeepScan (deepscan): When TRUE, the inspection engine returns TRUE and SafeSquid performs a client TLS handshake on CONNECT, decrypting HTTP for inspection. When FALSE, CONNECT is tunneled without decrypting; upstream SSL checks in this row are not applied to tunneled traffic. Use FALSE for non-HTTP TLS (Drive, Subversion, WinSCP, etc.).
Block Access to Sites that do not have an SSL Certificate (block_no_cert): When TRUE (default), upstream validation blocks if the upstream presents no certificate. When FALSE, connections without a server certificate are allowed to continue (logged at DEBUG).
Acceptable Errors in SSL Verification (block_err_level): Maximum OpenSSL verification error SafeSquid tolerates on the upstream certificate. Upstream validation blocks when error limits are exceeded. Level 0 is strictest — only a fully valid chain passes. Choosing a level tolerates that condition and everything listed above it in strictness; anything below it still blocks. Hostname and IP mismatch are also gated by Block domain mismatch separately.
Block domain mismatch in the web-site SSL certificate (block_domain_mismatch): When TRUE (default), hostname or IP mismatch errors from OpenSSL block the connection. When FALSE, X509_V_ERR_HOSTNAME_MISMATCH and X509_V_ERR_IP_ADDRESS_MISMATCH are explicitly allowed even if they exceed the acceptable error level.
On CONNECT, the inspection engine loads the first matching Inspection Policy row.
When Deep Scan is FALSE, CONNECT is forwarded as a tunnel without decrypting application data.
When Deep Scan is TRUE and RCSC is valid, SafeSquid completes a client-side TLS handshake and decrypts HTTP for filtering.
Before decrypting, the validation engine checks the upstream certificate (no cert, error level, domain mismatch rules).
Deep Scan only works when the tunneled protocol is HTTP; many non-HTTP TLS clients break when forced through inspection.
Certificate files live here. The Setup rows below were intended to carry the RCSC
passphrase and cache sizing per node, but the current build does not read them — they are
listed so an operator who finds them populated knows they have no effect.
Enabled (enabled): When disabled, this Setup row is skipped when the list is rebuilt on config reload. Note: rows are loaded into server_config_list but no runtime code in this tree reads that list (see ambiguities).
Comment (comment): Operator note only; not referenced by SSL setup code.
Proxy Host (proxy_server): Intended to match this SafeSquid instance (hostname from startup parameters) so the row applies on the correct node.
Encrypted Password (enc_pwd): Encrypted passphrase for the RCSC private key, stored per Setup row. Runtime RCSC load uses the global activation password, not this field, in the current build.
SSL Cache Store Size (ssl_cache_store_size): Intended cap for outbound SSL context/session cache entries ( CTXcacheOUT ). Stored on each server_config row but not applied by current cache code (cache sizing is internal to CTXcacheOUT ). Changing cache behaviour requires a restart when supported.
Code quirks — the Setup rows are not read at runtime
Setup rows are not used by current SSL setup code. Fields Proxy Host, Encrypted Password, and SSL Cache Store Size are loaded into the internal configuration loader decrypts and loads the root CA using the global activation password only — not Setup row passphrases. Cache sizing is internal to CTXcacheOUT; Setup SSL Cache Store Size is not applied. Treat Setup as operator reference until wired in code; use activation for the RCSC passphrase and SSL Certs/Cache for certificate files.
4 — Scoped relaxation for internal development servers
Inspection row, above the default: Profiles set to a label for known internal/development hosts, DeepScan TRUE, Acceptable Errors relaxed enough to tolerate a self-signed certificate or an incomplete local chain, Block domain mismatch left TRUE
Result: internal staging servers with a self-signed or incomplete-chain certificate pass Deep Scan without a certificate block, while Block domain mismatch staying on still catches a genuine hostname mismatch even on this relaxed entry — every connection outside that Profile still gets the strict default.
Turning on Deep Scan before clients trust the RCSC breaks HTTPS browsing for everyone behind it, not just for one site. Test with one machine that already trusts the certificate before enabling Deep Scan network-wide.
CONNECT to an HTTPS site; confirm filters (for example ClamAV) see decrypted content when DeepScan is TRUE.
Enable SSL log level for SSLcertSection:: and certificate validation lines.
Check Detailed logs for CONNECT handling and upstream certificate errors.
SSL Certs/Cache → Cache Refresh after RCSC or trusted-CA changes.
Confirm a destination with a genuinely broken certificate (expired, wrong hostname, self-signed) is blocked under the strict default entry, and only passes through when routed to an entry whose Acceptable Errors and Block domain mismatch settings were deliberately relaxed for it.
