Squid4+HTTPS - How to disable security warning messages on clients?

Question

Squid

Good
squid v.4 is built with https support. When navigating through sites using a proxy registered through wpad.dat, windows with security warnings appear. The situation arises when the certificate is issued to another domain/subdomain. Actually, how to exclude them using squid?

Security Warning

Squid -v

Squid Cache: Version 4.0.24
Service Name: squid

This binary uses OpenSSL 1.0.2k-fips 26 Jan 2017. For legal restrictions on distribution see https://www.openssl.org/source/license.html

configure options: '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--verbose' '--exec_prefix=/usr' '--enable-async-io=8' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-follow-x-forwarded-for' '--enable-auth' '--disable-maintainer-mode' '--enable-auth-basic=DB,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,getpwnam,fake' '--enable-auth-ntlm=SMB_LM,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos,wrapper' '--enable-external-acl-helpers=kerberos_ldap_group,wbinfo_group,LDAP_group,delayer,file_userip,SQL_session,unix_group,session,time_quota' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-storeio=aufs,diskd,ufs,rock' '--enable-wccpv2' '--enable-esi' '--enable-ssl' '--enable-ssl-crtd' '--enable-icmp' '--with-aio' '--with-default-user=squid' '--with-filedescriptors=16384' '--with-dl' '--with-openssl' '--with-pthreads' '--with-included-ltdl' '--disable-arch-native' '--enable-ecap' 'PKG_CONFIG_PATH=/usr/local/lib/pkgconfig' '--without-nettle' '--enable-ltdl-convenience' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic' 'LDFLAGS=-Wl,-z,relro' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC'

squid.conf

auth_param negotiate program /usr/local/bin/negotiate_wrapper --kerberos /usr/lib64/squid/negotiate_kerberos_auth -r$
auth_param negotiate children 200 startup=50 idle=10
auth_param negotiate keep_alive off
auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 100 startup=20 idle=5
auth_param ntlm keep_alive off
auth_param basic program /usr/lib64/squid/basic_ldap_auth -v 3 -P -R -b "dc=sth,dc=local" -D [email protected]$
auth_param basic children 20
auth_param basic realm "SQUID Proxy Server Basic authentication"
auth_param basic credentialsttl 2 hours
external_acl_type memberof ttl=3600 ipv4 %LOGIN /usr/lib64/squid/ext_ldap_group_acl -v 3 -P -R -K -b "DC=sth,DC=loca$
acl auth proxy_auth REQUIRED
acl InternetDeny external memberof "/etc/squid/acl/group_deny"
acl InternetFull external memberof "/etc/squid/acl/group_full"
acl InternetDenyByBlackList external memberof "/etc/squid/acl/group_deny_by_blacklist"
acl InternetAllowByWhiteList external memberof "/etc/squid/acl/group_allow_by_whitelist"
acl SitesAllow dstdomain "/etc/squid/acl/sites_allow"
acl SitesDeny dstdomain "/etc/squid/acl/sites_deny"
acl SitesPriority dstdomain "/etc/squid/acl/sites_priority"
acl WUServersLocal src "/etc/squid/acl/computers_wsus"
acl WUSitesGlobal dstdomain "/etc/squid/acl/sites_wsus"
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access allow localnet manager
http_access deny manager
http_access allow localnet CONNECT
http_access allow WUSitesGlobal WUServersLocal
http_access allow SitesPriority localnet
http_access deny !auth
http_access deny InternetDeny all
http_access allow SitesAllow localnet
http_access deny InternetAllowByWhiteList
http_access allow InternetFull auth localnet
http_access deny SitesDeny localnet
http_access allow InternetDenyByBlackList
http_access allow localhost
http_access allow localnet #for allow tcp_denied 407
http_access deny all
http_port 3128
https_port 3129 intercept ssl-bump connection-auth=off cert=/etc/squid/squidCA.pem #options=ALL:NO_SSLv3:NO_SSLv2 # $
tls_outgoing_options min-version=1.0
tls_outgoing_options flags=DONT_VERIFY_PEER
always_direct allow all
ssl_bump server-first all
sslproxy_cert_error allow all
acl blocked ssl::server_name "/etc/squid/acl/blocked_https.txt"
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump terminate blocked
ssl_bump splice all
sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB
cache_mem 4096 MB
maximum_object_size_in_memory 4096 MB
minimum_object_size 3 KB
cache_replacement_policy heap GDSF
cache_dir aufs /var/spool/squid 20000 49 256
cache_swap_low 90
cache_swap_high 95
maximum_object_size_in_memory 512 KB
memory_replacement_policy lru
logfile_rotate 4
snmp_port 3401
acl snmppublic snmp_community public
acl cacheAdmin snmp_community public
acl zabbix src 192.168.1.60/32
snmp_access allow snmppublic localhost
snmp_access allow snmppublic cacheAdmin
snmp_access allow snmppublic zabbix
snmp_access deny all
cache_log /var/log/squid/cache.log
debug_options ALL
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_mgr [email protected]
httpd_suppress_version_string on
visible_hostname PROXY

Answer 1

Using squid means this cannot be excluded, because squid has nothing to do with it. The certificate is missing a CDP and the client is configured to check revocation lists. Accordingly, the donkey (and this warns the donkey) says that "she didn't."
If this is a third-party certificate, then it is better to disable the check of revocation lists. If this is a certificate that is used for bumping ("https support" - did you mean bumping that allows you to control https traffic?) - then you need to add a CDP to it, even if there is a dummy empty CRL.