Forum Linux.général Squid : Certains sites TLS ne traversent pas

Bonjour,

Je rencontre un problème avec mon serveur Squid pour afficher quelques sites en HTTPS.
Je n'arrive pas à comprendre la logique car la plupart passent bien et d'autre me retournent une erreur type "Échec de la connexion sécurisée".

Quelques exemples de sites qui ne traversent pas le proxy : https://bitly.com, https://www.velomacchi.com, https://www.raise3d.com/

J'imagine que leur configuration TLS est différente d'autres sites mais je ne sais pas en quoi.

Je remarque des différences avec Wget et openssl connect.

Est-ce que quelqu'un peut éclairer ma lanterne ?

Merci d'avance

root@cache:~# wget https://bitly.com
--2018-07-03 13:23:20--  https://bitly.com/
Résolution de bitly.com (bitly.com)… 67.199.248.15, 67.199.248.14
Connexion à bitly.com (bitly.com)|67.199.248.15|:443… connecté.
GnuTLS: The TLS connection was non-properly terminated.
Incapable d'établir une connexion SSL.


root@cache:~# wget https://www.lemonde.fr
--2018-07-03 13:24:33--  https://www.lemonde.fr/
Résolution de www.lemonde.fr (www.lemonde.fr)… 93.184.220.239
Connexion à www.lemonde.fr (www.lemonde.fr)|93.184.220.239|:443… connecté.
requête HTTP transmise, en attente de la réponse… 200 OK
Taille : 382094 (373K) [text/html]
Sauvegarde en : « index.html »

index.html            100%[=======================>] 373,14K  --.-KB/s    in 0,01s   

2018-07-03 13:24:33 (37,2 MB/s) — « index.html » sauvegardé [382094/382094]


root@cache:~# openssl s_client -connect bitly.com:443
CONNECTED(00000003)
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1530617494
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---


root@cache:~# openssl s_client -connect www.lemonde.fr:443
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
verify return:1
depth=0 C = US, ST = California, L = Los Angeles, O = "Verizon Digital Media Services, Inc.", OU = Technology, CN = www.atanar.net
verify return:1
---
Certificate chain
 0 s:/C=US/ST=California/L=Los Angeles/O=Verizon Digital Media Services, Inc./OU=Technology/CN=www.atanar.net
   i:/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA
 1 s:/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
 2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIJhjCCCG6gAwIBAgIQAk5Lhyx585PuXtDh5H4U3zANBgkqhkiG9w0BAQsFADBN
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTgwNTA4MDAwMDAwWhcN
MjAwODA5MTIwMDAwWjCBlTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
aWExFDASBgNVBAcTC0xvcyBBbmdlbGVzMS0wKwYDVQQKEyRWZXJpem9uIERpZ2l0
YWwgTWVkaWEgU2VydmljZXMsIEluYy4xEzARBgNVBAsTClRlY2hub2xvZ3kxFzAV
BgNVBAMTDnd3dy5hdGFuYXIubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAoaZTuJc3tyHTYw5T+YFUK95otmnAjKEkOB+yITkQIfKB/4LdqLIoTyKt
K4jwUkz8UeNr1SssxXrfK0bJHFmkoMh+yPvdHXt+Cax8+bHIXMJ5ilegtQ4a3/LT
tiaDQTORRkHhGgp0NCAFcFFqYD+csz9GiXnqDy95K2RyfDrIDg3tO+W1lGq5qEBk
z3yvdaXa+sZXuAWXAyUaNTp+0Ck5z50d/09O0ttQm0VZJm0DejywrXXE3sgQxZFg
11bzfOAe95w7Ui3oxp5gXWxXtmmzepjzBTRmXjABDT1ggtPPdajj/MQbpaBt84Gc
a+8pazppVwXSJkcuyYyFavNpT+Ub6QIDAQABo4IGFzCCBhMwHwYDVR0jBBgwFoAU
D4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0OBBYEFDs0L7cJdKbrchz19ACWWvLT
sOdUMIICYQYDVR0RBIICWDCCAlSCDnd3dy5hdGFuYXIubmV0ggtzMS5sZW1kZS5m
coILczIubGVtZGUuZnKCEmFib25uZXMubGVtb25kZS5mcoIOd3d3LmxlbW9uZGUu
ZnKCH2lkbS5zbWFydC1kaWdpdGFsLXNvbHV0aW9ucy5jb22CEHd3dy5zd2lzc2lu
Zm8uY2iCG29wbS1kbnguZGlzbmV5bGFuZHBhcmlzLmNvbYIVb2JqZWN0cy5haXJm
cmFuY2UuY29tgghhLmYxZy5mcoIIaS5mMWcuZnKCFHd3dy1hY3Auc3dpc3NpbmZv
LmNogghwLmYxZy5mcoITaW1hZ2UubWVkaWFib25nLmNvbYIUc3RhdGljLm1lZGlh
Ym9uZy5jb22CF3d3dy5zY2llbmNlc2V0YXZlbmlyLmZyghF3d3cuY2hhbGxlbmdl
cy5mcoIWd3d3LnBvdXJxdW9pZG9jdGV1ci5mcoIabXktcnVuLmRpc25leWxhbmRw
YXJpcy5jb22CGW15LXJ1bi5kaXNuZXlsYW5kcGFyaXMuZnKCHGJvb2stcnVuLmRp
c25leWxhbmRwYXJpcy5jb22CG2Jvb2stcnVuLmRpc25leWxhbmRwYXJpcy5mcoIM
aW1nLmxlbWRlLmZyghZ3d3cuc3RhZ2luZy5haXJidXMuY29tghxzdGF0aWMuYm9v
a2luZy53ZWVrZW5kZXNrLmZygg5hc3NldC5sZW1kZS5mcoIXYW5udWFscmVwb3J0
LmFpcmJ1cy5jb22CG2Nkbi5mci5zaG9wcGluZy5yYWt1dGVuLmNvbTAOBgNVHQ8B
Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGsGA1UdHwRk
MGIwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zc2NhLXNoYTItZzYu
Y3JsMC+gLaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc2
LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgGCCsGAQUFBwIBFhxodHRw
czovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAECAjB8BggrBgEFBQcBAQRw
MG4wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBGBggrBgEF
BQcwAoY6aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMlNl
Y3VyZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMIIB9AYKKwYBBAHWeQIEAgSC
AeQEggHgAd4AdQCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAWM+
2SaEAAAEAwBGMEQCIFyzDAbldNty+dVr0fmC5Qb4UPgNnDrobJaO8IzUAm6bAiBs
TKSkuV4wRo5VIWIWu6eYPy0a7kgmhs2S7VmIfbLjvwB2AG9Tdqwx8DEZ2JkApFEV
/3cVHBHZAsEAKQaNsgiaN9kTAAABYz7ZKCIAAAQDAEcwRQIhAPIa5xsQZ09fTO1T
GLFidBm2Ru+YUtajWR2M0+3dfbvGAiACd1F/v5t7ch/WNLFqbZKnSFG0kVRnzJwa
A/2MTxq/jQB1ALvZ37wfinG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABYz7Z
J4IAAAQDAEYwRAIgLsJJTHPeLGN7qnlr/og+BN3LGaGn8NznsWE8oSIk9tICIEuC
WG+AvIJFddp3XmdZ550TuclW0Mlj7xs/dfUdg8P/AHYAVYHUwhaQNgFK6gubVzxT
8MDkOHhwJQgXL6OqHQcT0wwAAAFjPtkpugAABAMARzBFAiBahXGGMpVV04a2cyzR
cl4Yr9Q/LDG49gU+w8+vJNsu/gIhAND6nP7MCionuv+aE33qfuXEuIJa8uD/AtnZ
ayvgL0i/MA0GCSqGSIb3DQEBCwUAA4IBAQBLfLrbD6yqybqhZOur9NkkHE0Ds7nk
tCDj/C/e0eOFh2dxoajHYmn3SG41bL0Ve5dYio5aQPGk0vR0uIztnZjCRC37/Ig/
7QeT3Luj2tMxQgL0hQ55N/eEYMy84rnLxxyv1A73Q3It1bgSsz163CyON9DLMy8m
3ZZaAi6cOSlsHM239+GU+6EJ6xGVq+TOa2cZkUMFN7T/zoxk1CvF6lDhYbysjdhu
68OHOkJc5RMvtkvV8qJS6ZM0qVmvsKTriobIJkU8cH8o9JoTEH8rMy9xSQokR01M
/Sjr0meD2NSutI85lzAaQq74mmFqqAliPKQ2bwW9f3UVNHCGbE8KunFY
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Los Angeles/O=Verizon Digital Media Services, Inc./OU=Technology/CN=www.atanar.net
issuer=/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5229 bytes and written 302 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 0E51A945BFF7BD5964A4092BF29390DFCF0C734F75B9FE1DA4A2920A66F03F3A
    Session-ID-ctx: 
    Master-Key: 5754E8D5C100C3FF354B19A1B5504FA762F9E16765FEB769CF7A517F80F645A164C0D2EB02A9A72F1B7FCAD00D7FBC98
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 8d c5 b5 6c 88 e7 47 58-bf e7 be 8f bb c6 6d d3   ...l..GX......m.
    0010 - a4 f3 bb 0e 87 62 c7 1f-ae 4d e6 7b 94 9d 77 2c   .....b...M.{..w,
    0020 - 7d f6 8c 21 62 3b bb 11-05 c3 ea 1c c4 2c fe 72   }..!b;.......,.r
    0030 - 55 a9 f4 b5 b9 b1 86 e2-a5 68 e4 08 3b 36 85 c2   U........h..;6..
    0040 - 27 5c 9f bf 97 31 ae fe-b1 cd f7 56 be a7 60 c3   '\...1.....V..`.
    0050 - a5 78 42 dc 8b f8 6b b7-30 94 d9 6d 4c 5a 19 e0   .xB...k.0..mLZ..
    0060 - aa 67 cb 47 fd ca 68 19-3c 27 31 3c 5a 84 69 5d   .g.G..h.<'1<Z.i]
    0070 - 07 4f 30 5a 2e ff 7d bc-36 d1 90 f8 28 06 09 58   .O0Z..}.6...(..X
    0080 - 26 a8 4d ff 87 36 ab 44-27 33 f8 2f b3 05 70 1d   &.M..6.D'3./..p.
    0090 - 45 3e c1 ab 85 c8 c4 55-89 5b 01 44 b7 39 02 b0   E>.....U.[.D.9..

    Start Time: 1530617635
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---