Приветствую всех. Товарищи, помогите разобраться, плз. Есть необходимость осуществлять инспекцию https с целью фильтрации трафика. Настроил privoxy по вот этой статье (https://www.balpom.ru/whitelist/proxy/privoxy-https.html). Но при попытке посетить любой https ресурс получаю в юраузер
Secure Connection Failed
An error occurred during a connection to mail.ru. PR_END_OF_FILE_ERROR
Error code: PR_END_OF_FILE_ERROR
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
а в логи privoxy:
2026-02-14 11:17:51.541 7f8a2d6dc6c0 Connect: Accepted connection from 192.168.7.55 on socket 5
2026-02-14 11:17:51.542 7f8a2d6dc6c0 Header: scan: CONNECT mail.ru:443 HTTP/1.1
2026-02-14 11:17:51.543 7f8a2d6dc6c0 Header: scan: User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0
2026-02-14 11:17:51.543 7f8a2d6dc6c0 Header: scan: Proxy-Connection: keep-alive
2026-02-14 11:17:51.543 7f8a2d6dc6c0 Header: scan: Connection: keep-alive
2026-02-14 11:17:51.543 7f8a2d6dc6c0 Header: scan: Host: mail.ru:443
2026-02-14 11:17:51.543 7f8a2d6dc6c0 Header: crumble crunched: Proxy-Connection: keep-alive!
2026-02-14 11:17:51.543 7f8a2d6dc6c0 Header: Keeping the client header 'Connection: keep-alive' around. The server connection will be kept alive if possible.
2026-02-14 11:17:51.545 7f8a2d73dd40 Connect: Waiting for the next client connection. Currently active threads: 1
2026-02-14 11:17:51.558 7f8a2d6dc6c0 Error: A website key already exists but there's no matching certificate. Removing /var/lib/privoxy/certs/05b5616fa89869a19b089f3e29de07521f4c4e088bf5f8951a343ac5ba78f3a0.pem before creating a new key and certificate.
2026-02-14 11:17:51.739 7f8a2d6dc6c0 Error: Parsing issuer key /var/lib/privoxy/certs/05b5616fa89869a19b089f3e29de07521f4c4e088bf5f8951a343ac5ba78f3a0.pem failed: error:1C800064:Provider routines::bad decrypt
2026-02-14 11:17:51.739 7f8a2d6dc6c0 Error: Parsing issuer key /var/lib/privoxy/certs/05b5616fa89869a19b089f3e29de07521f4c4e088bf5f8951a343ac5ba78f3a0.pem failed: error:11800074:PKCS12 routines::pkcs12 cipherfinal error
2026-02-14 11:17:51.740 7f8a2d6dc6c0 Error: Parsing issuer key /var/lib/privoxy/certs/05b5616fa89869a19b089f3e29de07521f4c4e088bf5f8951a343ac5ba78f3a0.pem failed: error:1C800064:Provider routines::bad decrypt
2026-02-14 11:17:51.740 7f8a2d6dc6c0 Error: Parsing issuer key /var/lib/privoxy/certs/05b5616fa89869a19b089f3e29de07521f4c4e088bf5f8951a343ac5ba78f3a0.pem failed: error:11800074:PKCS12 routines::pkcs12 cipherfinal error
2026-02-14 11:17:51.740 7f8a2d6dc6c0 Error: generate_host_certificate() failed: -1
2026-02-14 11:17:51.740 7f8a2d6dc6c0 Error: Failed to open a secure connection with the client
2026-02-14 11:17:51.740 7f8a2d6dc6c0 Connect: Closing client socket 5. Keep-alive: 1. Socket alive: 1. Data available: 1. Configuration file change detected: 0. Requests received: 1.
2026-02-14 11:17:51.740 7f8a2d6dc6c0 Connect: Drained 1892 bytes before closing socket 5.
2026-02-14 11:17:51.746 7f8a2d73dd40 Connect: Waiting for the next client connection. Currently active threads: 1
Очевидно, что я делаю что-то не так, но не могу понять что.
конфиг privoxy:
user-manual /usr/share/doc/privoxy/user-manual
confdir /etc/privoxy
logdir /var/log/privoxy
actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on.
actionsfile default.action # Main actions file
actionsfile user.action # User customizations
filterfile default.filter
filterfile user.filter # User customizations
logfile logfile
debug 1 # Log the destination for each request. See also debug 1024.
debug 2 # show each connection status
debug 4 # show tagging-related messages
debug 8 # show header parsing
debug 128 # debug redirects
debug 256 # debug GIF de-animation
debug 512 # Common Log Format
debug 1024 # Log the destination for requests Privoxy didn't let through, and the reason why.
debug 4096 # Startup banner and warnings
debug 8192 # Non-fatal errors
debug 65536 # Log applying actions
listen-address 192.168.4.3:8118
toggle 1
enable-remote-toggle 0
enable-remote-http-toggle 0
enable-edit-actions 0
enforce-blocks 1
buffer-limit 16384
enable-proxy-authentication-forwarding 0
forwarded-connect-retries 0
accept-intercepted-requests 1
allow-cgi-request-crunching 0
split-large-forms 0
keep-alive-timeout 5
tolerate-pipelining 1
connection-sharing 1
socket-timeout 300
ca-directory /etc/privoxy/CA
ca-cert-file ca.crt
ca-key-file ca.pem
ca-password KoiU%Ngosmhw#J7KnsE2QXmJ
certificate-directory /var/lib/privoxy/certs
cipher-list TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-ECDSA-WITH-AES-256-CCM:TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8:TLS-ECDHE-ECDSA-WITH-AES-128-CCM:TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8:TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-CAMELLIA-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CCM:TLS-DHE-RSA-WITH-AES-256-CCM-8:TLS-DHE-RSA-WITH-AES-128-CCM:TLS-DHE-RSA-WITH-AES-128-CCM-8:TLS-DHE-RSA-WITH-CAMELLIA-128-GCM-SHA256:TLS-ECDH-RSA-WITH-AES-128-GCM-SHA256:TLS-ECDH-RSA-WITH-CAMELLIA-128-GCM-SHA256:TLS-ECDH-RSA-WITH-CAMELLIA-256-GCM-SHA384:TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256
trusted-cas-file /etc/ssl/certs/ca-certificates.crt
upd:
- пробовал выключать/включать intercept, не помогает;
- без https-inspect работает.
Решено:
- Перегенерировал сертификат с очень простым паролем. По всей видимости специальные символы ломают логику парсера конфига.
- После перегенерации серта, получил ошибку несовпадения протоколов шифрования. Не стал с этим заморачитьваться, закомментировал в конфиге cipher-list, что, по всей видимости, включило все доступные алгоритмы, и всё заработало.
Благодарю всех причастных.
