amazonlinuxでSquidでSSLBumpする

FROM amazonlinux
RUN yum install -y \
        squid \
        openssl
RUN <<EOR1
        cd /etc/squid
        cat << EOF | openssl req -new -newkey rsa:2048 -days 60 -nodes -x509 -keyout bump.key -out bump.crt
JP
Kanagawa
Fujisawa
Ocharake Programmers Association
7th
self-signed CA
matobaa@ocharake.org
EOF
        openssl dhparam -outform PEM -out /etc/squid/bump_dhparam.pem 2048
        chown squid:squid /etc/squid/bump*
        chmod 400 /etc/squid/bump*

        mkdir -p /var/lib/squid
        rm -rf /var/lib/squid/ssl_db
        /usr/lib64/squid/security_file_certgen -c -s /var/lib/squid/ssl_db -M 20MB
        chown -R squid:squid /var/lib/squid

        sed -i '1 i acl intermediate_fetching transaction_initiator certificate-fetching' /etc/squid/squid.conf
        sed -i '2 i http_access allow intermediate_fetching' /etc/squid/squid.conf

        sed -i '$ a sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 20MB' /etc/squid/squid.conf
        sed -i '$ a sslproxy_cert_error allow all' /etc/squid/squid.conf
        sed -i '$ a ssl_bump stare all' /etc/squid/squid.conf
        sed -i '/^http_port/s%.*%http_port 3128 tcpkeepalive=60,30,3 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB tls-cert=/etc/squid/bump.crt tls-key=/etc/squid/bump.key cipher=HIGH:MEDIUM:!LOW:!RC4:!SEED:!IDEA:!3DES:!MD5:!EXP:!PSK:!DSS options=NO_TLSv1,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE tls-dh=prime256v1:/etc/squid/bump_dhparam.pem%' /etc/squid/squid.conf

EOR1

docker build -t squid . && docker run -it squid
bash-5.2# squid
bash-5.2# openssl s_client --proxy localhost:3128 --connect checkip.amazonaws.com:443 --showcerts <<< "Q"
bash-5.2# openssl s_client --proxy localhost:3128 --connect checkip.amazonaws.com:443 <<< "Q"
 | openssl x509 --text