Important: I have this question on stackoverflow but somebody told me this is more relevant place for this question. Thanks

I have configured squid(3.4.2) as ssl bumped proxy. I am setting proxy in firefox(29) to use squid for https/http. Now it works for most sites, but some sites which support old SSL proto(sslv3) break, and I see squid not employing any workarounds for those like browsers do.

Sites which should work: https://usc-excel.officeapps.live.com/ , https://www.mahaconnect.in

As a workaround I have set sslproxy_version=3 , which enforces SSLv3 and above sites work.

My question: is there a better way to do this which does not involve enforcing SSLv3 for servers supporting TLS1 or better.

Now I know openssl doesn't automatically handle that. But I imagined squid would.

My squid conf snipper:

http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/certs/SquidCA.pem

always_direct allow all ssl_bump server-first all sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /usr/local/squid/var/lib/ssl_db -M 4MB

client_persistent_connections on server_persistent_connections on

sslproxy_version 3

sslproxy_options ALL

cache_dir aufs /usr/local/squid/var/cache/squid 100 16 256

coredump_dir /usr/local/squid/var/cache/squid

strip_query_terms off

httpd_suppress_version_string on

via off

forwarded_for transparent

vary_ignore_expire on

refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320

UPDATE: I have tried compiling squid 3.4.5 with openssl 1.0.1h . No improvements