[MEGOLDVA]squid3 - https oldalak blokkolása - update (squid -ssl bekapcsolása leírás)

Sajnos felmerült az igény a cégünknél ,hogy lenne pár ember akiknél engedélyezni kellene a facebook, twitter, stb-t, így nem tudom a dns-ből tiltani, csakis a proxy szerverről megoldható. Bármelyik más http oldalat tudok blokkolni, illetve a kivétel IP-re tudom engedélyezni, de a https oldalakat nem tudom megfogni. A tűzfal másik gépen van, ezért nem tudok rákérni egy whois-t a domain-ra, és nem is szeretném rárakni.

squid 3.3.8
squid.conf
http_port XX.XX.XX.XX:3128
visible_hostname proxy2.cegem.hu
dns_nameservers 10.XX.XX.XX

#eset gateway beállítása
icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_header X-Client-Username

icap_service service_req reqmod_precache bypass=1 icap://127.0.0.1:1355/av_scan
icap_service service_resp respmod_precache bypass=1 icap://127.0.0.1:1355/av_scan
adaptation_access service_req allow all
adaptation_access service_resp allow all

acl belso src 10.XX.XX.0/23
acl belso src 10.XX.XX.0/23 #belso
acl kivetel src "/etc/squid3/kivetel"

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http

#block list
acl block dstdomain "/etc/squid3/block"
deny_info http://webserver.cegem.hu/hiba/hiba.html block
acl ipblock src "/etc/squid3/ipblock"

http_access deny !Safe_ports
http_access allow block kivetel
http_access deny block belso
http_access allow belso
http_access deny all

Segítségeteket előre is köszönöm.
------------
Megoldás:
update: ubuntu 14.04 squid- 3.3.8 ssl bekapcsolás:

http://docs.diladele.com/administrator_guide_4_0/system_configuration/h…

sudo apt-get install devscripts build-essential fakeroot libssl-dev
mkdir squid && cd squid
sudo apt-get source squid3
sudo apt-get build-dep squid3
sudo dpkg-source -x squid3_3.3.8-1ubuntu6.3.dsc

sudo nano squid3-3.3.8/debian/rules
beleírni:
--enable-ssl \
--enable-ssl-crtd
sudo nano squid3-3.3.8/src/ssl/gadgets.cc
static int extensions[]= {
//NID_key_usage,

cd squid3-3.3.8 && dpkg-buildpackage -rfakeroot -b

squid fordítása /ssl bekapcsolása:
sudo service squid3 stop
sudo apt-get install ssl-cert
sudo dpkg --install squid3-common_3.3.8-1ubuntu6.3_all.deb
sudo dpkg --install squid3_3.3.8-1ubuntu6.3_amd64.deb
sudo dpkg --install squidclient_3.3.8-1ubuntu6.3_amd64.deb

sudo ln -s /usr/lib/squid3/ssl_crtd /bin/ssl_crtd
sudo /bin/ssl_crtd -c -s /var/spool/squid3_ssldb
sudo chown -R proxy:proxy /var/spool/squid3_ssldb
sudo service squid3 restart
sudo squid3 -v |grep ssl elvileg be le kapcsolva

squid.conf:
http_port 10.XX.XX.XXX:3128 ssl-bump dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/ssl/proxy2.cegem.hu.crt key=/etc/squid3/ssl/proxy2.cegem.hu.key

sslcrtd_program /usr/lib/squid3/ssl_crtd -s /var/spool/squid3_ssldb -M 4MB
visible_hostname proxy2.cegem.hu
dns_nameservers 10.XX.XX.XX

#eset gateway beállítása
icap_enable on
icap_preview_enable on
icap_persistent_connections on
adaptation_send_client_ip on

icap_send_client_ip on
icap_send_client_username on
icap_client_username_header X-Client-Username

icap_service service_req reqmod_precache bypass=1 icap://127.0.0.1:1355/av_scan
icap_service service_resp respmod_precache bypass=1 icap://127.0.0.1:1355/av_scan
adaptation_access service_req allow all
adaptation_access service_resp allow all

forward_max_tries 25
shutdown_lifetime 3 seconds

acl belso src 10.XX.XX.0/23
acl belso src 10.XX.XX.0/23
acl kivetel src "/etc/squid3/kivetel"

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl SSL method CONNECT
acl CONNECT method CONNECT

#block list
acl block dstdomain "/etc/squid3/block"
deny_info http://webserver.cegem.hu/hiba/hiba.html block

http_access deny !Safe_ports
http_access deny CONNECT !SSL_Ports
http_access allow block kivetel
http_access deny block
http_access allow belso
http_access deny all