# Squid HTTPS Reverse Proxy **URL:** \ **Category:** Server\ **Created:** [February 20, 2017, 3:51pm UTC](https://community.letsencrypt.org/t/squid-https-reverse-proxy/28288 "2017-02-20T15:51:19Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![chiasa.men](https://avatars.discourse-cdn.com/v4/letter/c/c2a13f/32.png) [@chiasa.men](https://community.letsencrypt.org/u/chiasa.men)\ **Post date:** [February 20, 2017, 3:51pm UTC](https://community.letsencrypt.org/t/squid-https-reverse-proxy/28288/1 "2017-02-20T15:51:19Z")
there are different machines running different websites in an internal network. squid shall work as CDN proxy which shall make use of letsencrypt certificates in order to encrypt the client-proxy-connection. 1 would it be possible to disguise the proxy so that the client doesnt know about the proxying? i.e. the client only talks to the proxy and doesnt know about the actual delivering server? 2 [http://wiki.squid-cache.org/ConfigExamples/Reverse/SslWithWildcardCertifiate](http://wiki.squid-cache.org/ConfigExamples/Reverse/SslWithWildcardCertifiate) makes use of a wildcard certificate. I guess in that case it’s probably the same as a multidomain certificate? 2.1 is it possible to sign self-created certificates with the LE cert like an intermediate CA? ---
**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\ **Post date:** [February 20, 2017, 6:38pm UTC](https://community.letsencrypt.org/t/squid-https-reverse-proxy/28288/2 "2017-02-20T18:38:28Z")
> [@chiasa.men](#): > > 1 would it be possible to disguise the proxy so that the client doesnt know about the proxying? i.e. the client only talks to the proxy and doesnt know about the actual delivering server? Yes. If squid is configured as a HTTP(S) reverse proxy, it doesn't have to disclose the backend server. You should probably still lock down the backend servers so that only the reverse proxy has access to it - not doing that is what often allows attackers to determine the IP address of sites using CDNs like CloudFlare, which try to hide the real IP address as well. > [@chiasa.men](#): > > 2 [http://wiki.squid-cache.org/ConfigExamples/Reverse/SslWithWildcardCertifiate](http://wiki.squid-cache.org/ConfigExamples/Reverse/SslWithWildcardCertifiate) makes use of a wildcard certificate. I guess in that case it's probably the same as a multidomain certificate? It doesn't look like anything in that guide really requires wildcards, so a Multi-SAN (Multi-Domain) certificate should work just as well.[quote="chiasa.men, post:1, topic:28288"] 2.1 is it possible to sign self-created certificates with the LE cert like an intermediate CA? [/quote] Unfortunately, that's not possible. You'd have to essentially run and be audited as a CA (πŸ’°πŸ’°πŸ’°) before you could get an intermediate certificate from a publicly-trusted CA. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 22, 2017, 6:39pm UTC](https://community.letsencrypt.org/t/squid-https-reverse-proxy/28288/3 "2017-03-22T18:39:10Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.