# Analyze HTTPS traffic with proxy

**URL:** https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802
**Category:** Help
**Tags:** suricata
**Created:** [September 25, 2022, 11:05pm UTC](https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802 "2022-09-25T23:05:25Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Carmine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/carmine/32/1623_2.png) [@Carmine](https://forum.suricata.io/u/Carmine)
#### Post date: [September 25, 2022, 11:05pm UTC](https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802/1 "2022-09-25T23:05:25Z")

</div>

Hi, I would like to have an opinion from you on the system that I want to realize.  
The need is to analyze also HTTPS traffic and I suppose to use SquidProxy (because PolarProxy is too expensive) to have a clear view of it and create a MITM (transparent from the client’s point of view). How should I configure Suricata to work with SquidProxy? Have you some guide? Thanks!

---

<div class="post-metadata">

### Author: ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [October 8, 2022, 9:12pm UTC](https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802/2 "2022-10-08T21:12:55Z")

</div>

You can’t forward the logs so you would have to either set Suricata before or after the proxy in the network (or run two instances on both sides) to look into the traffic.

---

<div class="post-metadata">

### Author: ![Carmine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/carmine/32/1623_2.png) [@Carmine](https://forum.suricata.io/u/Carmine)
#### Post date: [October 11, 2022, 8:29am UTC](https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802/3 "2022-10-11T08:29:03Z")

</div>

Thanks a lot. I decided to mirror all the traffic on my IDS without reversing the SSL traffic.

---

<div class="post-metadata">

### Author: ![WayneTsun](https://avatars.discourse-cdn.com/v4/letter/w/0ea827/32.png) [@WayneTsun](https://forum.suricata.io/u/WayneTsun)
#### Post date: [October 11, 2022, 12:18pm UTC](https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802/4 "2022-10-11T12:18:47Z")

</div>

You might also want to check out ipfire [https://www.ipfire.org](https://www.ipfire.org). In addition to the firewall, you also have the Squid Proxy and, of course, suricata there. Goes together perfectly.

---

<div class="post-metadata">

### Author: ![Carmine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/carmine/32/1623_2.png) [@Carmine](https://forum.suricata.io/u/Carmine)
#### Post date: [October 11, 2022, 2:41pm UTC](https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802/5 "2022-10-11T14:41:32Z")

</div>

I will have a look at it. Thanks a lot!

---

<div class="post-metadata">

### Author: ![hyj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/hyj/32/3199_2.png) [@hyj](https://forum.suricata.io/u/hyj)
#### Post date: [October 24, 2024, 8:02am UTC](https://forum.suricata.io/t/analyze-https-traffic-with-proxy/2802/6 "2024-10-24T08:02:43Z")

</div>

Have you solved it? Can you tell me a detailed tutorial
