NethServer 6

Not 100% sure where to log this but it is a high priority as it not only produces security issues for anyone using SSL web filtering but will also cause NethServer to break clients with web filtering over the next few months.

Currently NethServer is running squid that is shipped with CentOS - CentOS 7 only provides Squid 3.3.8 and it only generates certificates using SHA-1 algorithms which are now classed as a security risk. Browsers such as Google Chrome will be removing support for SHA-1 certificates in January 2017 which means all devices making use of the web filtering will start to be restricted as to the content that they can access.

I have tested an install of Squid 3.5.22 which supports SHA-2 certificates and can confirm that so far it has worked throughout some limited testing. I am not yet sure whether an upgrade works but I don't see any reason why it wouldn't work.

The steps to upgrade are as following:
Modify /etc/yum.repos.d/CentOS-Base.repo and add "exclude=squid*" to the bottom of the [base] repo section

Create /etc/yum.repos.d/squid.repo with the following contents:
[squid]
name=Squid repo for CentOS
baseurl=http://www1.ngtech.co.il/repo/centos/$releasever/$basearch/
failovermethod=priority
enabled=1
gpgcheck=0

Then install/upgrade squid and all of it's respective libraries. It may be worth removing all old versions before installing.
The packaged needed to be installed are:
squid
squid-helpers (Used to provide ssl_crtd and other useful binaries)

Then run:
/usr/lib64/squid/ssl_crtd -c -s /var/lib/ssl_db

After this, start/restart squid and it will be up and running again but this time with SHA2 support.