# Install certificate authority for upstream proxy?

**URL:** <https://community.ipfire.org/t/install-certificate-authority-for-upstream-proxy/10402>\
**Category:** Network\
**Created:** [28 September 2023 00:01 UTC](https://community.ipfire.org/t/install-certificate-authority-for-upstream-proxy/10402 "2023-09-28T00:01:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sevenqueue](https://community.ipfire.org/user_avatar/community.ipfire.org/sevenqueue/32/9756_2.png) [@sevenqueue](https://community.ipfire.org/u/sevenqueue)\
**Post date:** [28 September 2023 00:01 UTC](https://community.ipfire.org/t/install-certificate-authority-for-upstream-proxy/10402/1 "2023-09-28T00:01:29Z")

</div>

Hello,

How does one add a CA for an upstream proxy?

Would it need to be added by hand in /etc/ssl/certs somehow considering update-ca-certificates is unavailable…

# cat ./upstream-ca.crt \>\> /etc/ssl/certs/ca-bundle.crt

Thanks.

---

<div class="post-metadata">

**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\
**Post date:** [28 September 2023 17:47 UTC](https://community.ipfire.org/t/install-certificate-authority-for-upstream-proxy/10402/2 "2023-09-28T17:47:45Z")

</div>

Hello @sevenqueue. Welcome to our community.

IPFire has [removed](https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=88b1e637ac581b836bcdfa4a44deeef2d8ff9711) SSL support in Squid years ago. Without SSL bumping mode, Squid generally operates as a pass-through for SSL traffic, which means it wouldn’t inspect or manipulate the SSL certificate from the upstream proxy. Therefore, you would not need to install the CA certificate of the upstream proxy in Squid running on IPFire in that scenario. The SSL handshake and certificate verification would be done directly between the client and the upstream proxy.

---

<div class="post-metadata">

**Author:** ![sevenqueue](https://community.ipfire.org/user_avatar/community.ipfire.org/sevenqueue/32/9756_2.png) [@sevenqueue](https://community.ipfire.org/u/sevenqueue)\
**Post date:** [29 September 2023 13:58 UTC](https://community.ipfire.org/t/install-certificate-authority-for-upstream-proxy/10402/3 "2023-09-29T13:58:54Z")

</div>

I probably should have mentioned I needed to add the cert for pakfire otherwise it blocked updates etc. The above cat command did the trick.

Thanks.