Re: ssl bump
Vacheslav <[email protected]> Thu, 16 Jul 2026 08:57:44 +0300
| Newsgroups | gmane.comp.web.squid.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============3250830806322873869==
Content-Type: multipart/alternative;
boundary="------------eFqWRWvfq0W6HTMdOCmDxeaO"
Content-Language: en-US, ru-RU
This is a multi-part message in MIME format.
--------------eFqWRWvfq0W6HTMdOCmDxeaO
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
14.07.2026 18:13, Alex Rousskov пишет:
> On 2026-07-14 01:06, Vacheslav wrote: >> sudo /usr/libexec/squid/security_file_certgen -c -s /var/cache/ >>
squid/ssl_db/certs -M 4MB Initialization SSL db... 2026/07/14 >>
07:42:00 sslcrtd_program| FATAL: Cannot generate certificates: >> Cannot
create /var/cache/squid/ssl_db/certs exception location: >>
certificate_db.cc(374) Create > >> /var/cache/squid/ssl_db/certs certs
is empty > >> how to solve the problem? > > The FATAL failure you quoted
above is probably because "/var/cache/ > squid /ssl_db/certs" directory
already exists. You should probably > remove that directory (and
anything else in "/var/cache/squid/ > ssl_db") if you want to
re-initialize the certificate database from > scratch. had to stop
ufdbguard and squid and delete the ssl_db folder and chown -R
squid:squid the ssl_db folder so that would work > > >> 2026/07/14
07:37:49 sslcrtd_program| FATAL: Cannot generate >> certificates:
Unknown bytes unit: M > > This failure is probably a Squid
misconfiguration: AFAICT, > Certificate generator shipped with Squid has
two parameters that > support byte units: "-b" and "-m". Those
parameters support "B", > "KB", "MB", "GB" byte units but not "M". > >
The generator program name and its parameters are specified using >
"sslcrtd_program" directive in "squid.conf". The default uses "-M > 4MB"
parameter. I am guessing you have customized that default. > > This
misconfiguration ought to lead to the following errors (that > you have
also seen/shared): > >> 2026/07/14 07:37:49 kid1| WARNING:
sslcrtd_program #Hlpr1 exited >> 2026/07/14 07:37:49 kid1| Too few
sslcrtd_program processes are >> running (need 1/5) 2026/07/14 07:37:49
kid1| FATAL: The >> sslcrtd_program helpers are crashing too rapidly,
need help! > > > HTH, > > Alex. > sorry about that i failed to copy the
whole line now it is MB.
now the non working configuration looks like this:
http_port 8080 ssl-bump cert=/etc/squid/certs/myCA.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB
##acl step1 at_step SslBump1
##ssl_bump peek step1
##ssl_bump bump all
#########sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/lib/squid/ssl_db -M 4MB
#########sslcrtd_children 5
acl tls_s1_connect at_step SslBump1
acl tls_s2_client_hello at_step SslBump2
acl tls_s3_server_hello at_step SslBump3
# define acls for sites that must not be actively bumped
acl tls_allowed_hsts ssl::server_name .akamaihd.net
acl tls_allowed_hsts ssl::server_name .proxy.skko.by
#acl tls_server_is_bank ssl::server_name .abnamro.nl
#acl tls_server_is_bank ssl::server_name .abnamro.com
acl tls_server_is_bank ssl::server_name
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"
acl tls_to_splice any-of tls_allowed_hsts
tls_server_is_bank
# TLS/SSL bumping steps
ssl_bump peek tls_s1_connect # peek at
TLS/SSL connect data
ssl_bump splice tls_to_splice # splice
some: no active bump
ssl_bump stare all #
stare(peek) at server
# properties of
the webserver
ssl_bump bump # bump if we
can (if the stare succeeded)
ssl_bump peek tls_s1_connect
ssl_bump splice all
#ssl_bump peek all
#######ssl_bump splice all
sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/cache/squid/ssl_db/certs -M 4MB
sslcrtd_children 5
ssl_bump server-first all
sslproxy_cert_error allow all
produces:
2026/07/16 08:34:21 kid1| Logfile: opening log
daemon:/var/log/squid/access.log
2026/07/16 08:34:21 kid1| Logfile Daemon: opening log
/var/log/squid/access.log
2026/07/16 08:34:21 kid1| Unlinkd pipe opened on FD 39
2026/07/16 08:34:21 kid1| Local cache digest enabled; rebuild/rewrite
every 3600/3600 sec
2026/07/16 08:34:21 kid1| Store logging disabled
2026/07/16 08:34:21 kid1| Swap maxSize 3072000 + 983040 KB, estimated
311926 objects
2026/07/16 08:34:21 kid1| Target number of buckets: 15596
2026/07/16 08:34:21 kid1| Using 16384 Store buckets
2026/07/16 08:34:21 kid1| Max Mem size: 983040 KB
2026/07/16 08:34:21 kid1| Max Swap size: 3072000 KB
2026/07/16 08:34:21 kid1| Rebuilding storage in /var/cache/squid (clean log)
2026/07/16 08:34:21 kid1| Using Least Load store dir selection
2026/07/16 08:34:21 kid1| Set Current Directory to /var/cache/squid
2026/07/16 08:34:21 kid1| Finished loading MIME types and icons.
2026/07/16 08:34:21 kid1| HTCP Disabled.
2026/07/16 08:34:21 kid1| Pinger socket opened on FD 44
2026/07/16 08:34:21 kid1| Squid plugin modules loaded: 0
2026/07/16 08:34:21 kid1| Adaptation support is off.
2026/07/16 08:34:21 kid1| Accepting SSL bumped HTTP Socket connections
at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
listening port: 8080
2026/07/16 08:34:21 pinger| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.
2026/07/16 08:34:21 pinger| Initialising ICMP pinger ...
2026/07/16 08:34:21 pinger| ICMP socket opened.
2026/07/16 08:34:21 pinger| ICMPv6 socket opened
2026/07/16 08:34:21 kid1| Indexing cache entries: 1.84% (4000 out of 217767)
2026/07/16 08:34:24 kid1| Done reading /var/cache/squid swaplog (217766
entries)
2026/07/16 08:34:24 kid1| Finished rebuilding storage from disk.
217766 Entries scanned
0 Invalid entries
0 With invalid flags
217766 Objects loaded
0 Objects expired
0 Objects canceled
0 Duplicate URLs purged
0 Swapfile clashes avoided
Took 2.85 seconds (76411.43 objects/sec).
2026/07/16 08:34:24 kid1| Beginning Validation Procedure
2026/07/16 08:34:24 kid1| Completed Validation Procedure
Validated 217752 Entries
store_swap_size = 2764796.00 KB
2026/07/16 08:34:24 kid1| storeLateRelease: released 0 objects
2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited
2026/07/16 08:34:24 kid1| Too few sslcrtd_program processes are running
(need 1/5)
active processes: 4
processes configured to start at (re)configuration: 5
2026/07/16 08:34:24 kid1| Closing HTTP(S) port 0.0.0.0:8080
listening port: 8080
2026/07/16 08:34:24 kid1| storeDirWriteCleanLogs: Starting...
2026/07/16 08:34:24 kid1| 65536 entries written so far.
2026/07/16 08:34:25 kid1| 131072 entries written so far.
2026/07/16 08:34:25 kid1| 196608 entries written so far.
2026/07/16 08:34:25 kid1| Finished. Wrote 217766 entries.
2026/07/16 08:34:25 kid1| Took 0.07 seconds (3283861.63 entries/sec).
2026/07/16 08:34:25 kid1| FATAL: The sslcrtd_program helpers are
crashing too rapidly, need help!
2026/07/16 08:34:25 kid1| Squid Cache (Version 7.6): Terminated abnormally.
CPU Usage: 3.678 seconds = 2.249 user + 1.429 sys
Maximum Resident Size: 271856 KB
Page faults with physical i/o: 0
2026/07/16 08:34:25 kid1| Closing Pinger socket on FD 44
2026/07/16 08:34:25| Removing PID file (/run/squid.pid)
now the working configuration:
http_port 8080 ssl-bump cert=/etc/squid/certs/myCA.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB
##acl step1 at_step SslBump1
##ssl_bump peek step1
##ssl_bump bump all
#########sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/lib/squid/ssl_db -M 4MB
#########sslcrtd_children 5
acl tls_s1_connect at_step SslBump1
acl tls_s2_client_hello at_step SslBump2
acl tls_s3_server_hello at_step SslBump3
# define acls for sites that must not be actively bumped
acl tls_allowed_hsts ssl::server_name .akamaihd.net
acl tls_allowed_hsts ssl::server_name .proxy.skko.by
#acl tls_server_is_bank ssl::server_name .abnamro.nl
#acl tls_server_is_bank ssl::server_name .abnamro.com
acl tls_server_is_bank ssl::server_name
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"
acl tls_to_splice any-of tls_allowed_hsts
tls_server_is_bank
# TLS/SSL bumping steps
##ssl_bump peek tls_s1_connect # peek at
TLS/SSL connect data
##ssl_bump splice tls_to_splice # splice
some: no active bump
##ssl_bump stare all #
stare(peek) at server
# properties of
the webserver
##ssl_bump bump # bump if we
can (if the stare succeeded)
##ssl_bump peek tls_s1_connect
##ssl_bump splice all
#ssl_bump peek all
ssl_bump splice all
produces:
2026/07/16 08:40:11| WARNING: BCP 177 violation. Detected non-functional
IPv6 loopback.
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_localhost
configuration context: Default Configuration(15) acl
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_localhost
configuration context: Default Configuration(15) acl
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_linklocal
configuration context: Default Configuration(16) acl
2026/07/16 08:40:11| Processing Configuration File:
/etc/squid/squid.conf (depth 0)
2026/07/16 08:40:11| Created PID file (/run/squid.pid)
2026/07/16 08:40:11 kid1| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_localhost
configuration context: Default Configuration(15) acl
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_localhost
configuration context: Default Configuration(15) acl
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_linklocal
configuration context: Default Configuration(16) acl
2026/07/16 08:40:11 kid1| Processing Configuration File:
/etc/squid/squid.conf (depth 0)
2026/07/16 08:40:12 kid1| Set Current Directory to /var/cache/squid
2026/07/16 08:40:12 kid1| Starting Squid Cache version 7.6 for
x86_64-suse-linux-gnu...
2026/07/16 08:40:12 kid1| Service Name: squid
2026/07/16 08:40:12 kid1| Process ID 168491
2026/07/16 08:40:12 kid1| Process Roles: worker
2026/07/16 08:40:12 kid1| With 4096 file descriptors available
2026/07/16 08:40:12 kid1| Initializing IP Cache...
2026/07/16 08:40:12 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
2026/07/16 08:40:12 kid1| Adding nameserver 10.6.30.3 from /etc/resolv.conf
2026/07/16 08:40:12 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf
2026/07/16 08:40:12 kid1| helperOpenServers: Starting 5/32
'security_file_certgen' processes
2026/07/16 08:40:12 kid1| helperOpenServers: Starting 8/16 'ufdbgclient'
processes
2026/07/16 08:40:12 kid1| Logfile: opening log
daemon:/var/log/squid/access.log
2026/07/16 08:40:12 kid1| Logfile Daemon: opening log
/var/log/squid/access.log
2026/07/16 08:40:12 kid1| Unlinkd pipe opened on FD 39
2026/07/16 08:40:12 kid1| Local cache digest enabled; rebuild/rewrite
every 3600/3600 sec
2026/07/16 08:40:12 kid1| Store logging disabled
2026/07/16 08:40:12 kid1| Swap maxSize 3072000 + 983040 KB, estimated
311926 objects
2026/07/16 08:40:12 kid1| Target number of buckets: 15596
2026/07/16 08:40:12 kid1| Using 16384 Store buckets
2026/07/16 08:40:12 kid1| Max Mem size: 983040 KB
2026/07/16 08:40:12 kid1| Max Swap size: 3072000 KB
2026/07/16 08:40:12 kid1| Rebuilding storage in /var/cache/squid (clean log)
2026/07/16 08:40:12 kid1| Using Least Load store dir selection
2026/07/16 08:40:12 kid1| Set Current Directory to /var/cache/squid
2026/07/16 08:40:12 kid1| Finished loading MIME types and icons.
2026/07/16 08:40:12 kid1| HTCP Disabled.
2026/07/16 08:40:12 kid1| Pinger socket opened on FD 44
2026/07/16 08:40:12 kid1| Squid plugin modules loaded: 0
2026/07/16 08:40:12 kid1| Adaptation support is off.
2026/07/16 08:40:12 kid1| Accepting SSL bumped HTTP Socket connections
at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
listening port: 8080
2026/07/16 08:40:12 pinger| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.
2026/07/16 08:40:12 pinger| Initialising ICMP pinger ...
2026/07/16 08:40:12 pinger| ICMP socket opened.
2026/07/16 08:40:12 pinger| ICMPv6 socket opened
2026/07/16 08:40:12 kid1| Indexing cache entries: 1.84% (4000 out of 217767)
2026/07/16 08:40:15 kid1| Done reading /var/cache/squid swaplog (217766
entries)
2026/07/16 08:40:15 kid1| Finished rebuilding storage from disk.
217766 Entries scanned
0 Invalid entries
0 With invalid flags
217766 Objects loaded
0 Objects expired
0 Objects canceled
0 Duplicate URLs purged
0 Swapfile clashes avoided
Took 2.91 seconds (74726.47 objects/sec).
2026/07/16 08:40:15 kid1| Beginning Validation Procedure
2026/07/16 08:40:15 kid1| Completed Validation Procedure
Validated 217752 Entries
store_swap_size = 2764796.00 KB
2026/07/16 08:40:15 kid1| storeLateRelease: released 0 objects
2026/07/16 08:40:17 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=sb.scorecardresearch.com%3A443
HTTP/1.1
current master transaction: master57
2026/07/16 08:40:49 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:40:49 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:40:50 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=stats.g.doubleclick.net%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:40:52 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:41:36 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:41:37 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:41:38 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:41:38 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:41:39 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443
HTTP/1.1
current master transaction: master55
2026/07/16 08:41:39 kid1| ERROR: URL-rewrite produces invalid request:
CONNECT
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443
HTTP/1.1
current master transaction: master55
--------------eFqWRWvfq0W6HTMdOCmDxeaO
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#26a269" bgcolor="#000000">
<br>
<br>
14.07.2026 18:13, Alex Rousskov пишет:<br>
<span style="white-space: pre-wrap; display: block; width: 98vw;">> On 2026-07-14 01:06, Vacheslav wrote:
>> sudo /usr/libexec/squid/security_file_certgen -c -s /var/cache/
>> squid/ssl_db/certs -M 4MB Initialization SSL db... 2026/07/14
>> 07:42:00 sslcrtd_program| FATAL: Cannot generate certificates:
>> Cannot create /var/cache/squid/ssl_db/certs exception location:
>> certificate_db.cc(374) Create
>
>> /var/cache/squid/ssl_db/certs certs is empty
>
>> how to solve the problem?
>
> The FATAL failure you quoted above is probably because "/var/cache/
> squid /ssl_db/certs" directory already exists. You should probably
> remove that directory (and anything else in "/var/cache/squid/
> ssl_db") if you want to re-initialize the certificate database from
> scratch.
</span>had to stop ufdbguard and squid and delete the ssl_db folder and
chown -R squid:squid the ssl_db folder so that would work <span
style="white-space: pre-wrap; display: block; width: 98vw;">>
>
>> 2026/07/14 07:37:49 sslcrtd_program| FATAL: Cannot generate
>> certificates: Unknown bytes unit: M
>
> This failure is probably a Squid misconfiguration: AFAICT,
> Certificate generator shipped with Squid has two parameters that
> support byte units: "-b" and "-m". Those parameters support "B",
> "KB", "MB", "GB" byte units but not "M".
>
> The generator program name and its parameters are specified using
> "sslcrtd_program" directive in "squid.conf". The default uses "-M
> 4MB" parameter. I am guessing you have customized that default.
>
> This misconfiguration ought to lead to the following errors (that
> you have also seen/shared):
>
>> 2026/07/14 07:37:49 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>> 2026/07/14 07:37:49 kid1| Too few sslcrtd_program processes are
>> running (need 1/5) 2026/07/14 07:37:49 kid1| FATAL: The
>> sslcrtd_program helpers are crashing too rapidly, need help!
>
>
> HTH,
>
> Alex.
>
</span>sorry about that i failed to copy the whole line now it is MB.<br>
<br>
now the non working configuration looks like this:<br>
<br>
http_port 8080 ssl-bump cert=/etc/squid/certs/myCA.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB<br>
<br>
<br>
<br>
<br>
##acl step1 at_step SslBump1 <br>
##ssl_bump peek step1 <br>
##ssl_bump bump all<br>
<br>
#########sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/lib/squid/ssl_db -M 4MB<br>
#########sslcrtd_children 5<br>
<br>
acl tls_s1_connect at_step SslBump1<br>
acl tls_s2_client_hello at_step SslBump2<br>
acl tls_s3_server_hello at_step SslBump3<br>
<br>
# define acls for sites that must not be actively bumped<br>
<br>
acl tls_allowed_hsts ssl::server_name
.akamaihd.net<br>
acl tls_allowed_hsts ssl::server_name
.proxy.skko.by<br>
#acl tls_server_is_bank ssl::server_name
.abnamro.nl<br>
#acl tls_server_is_bank ssl::server_name
.abnamro.com<br>
acl tls_server_is_bank ssl::server_name
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"<br>
acl tls_to_splice any-of
tls_allowed_hsts tls_server_is_bank<br>
<br>
# TLS/SSL bumping steps<br>
<br>
ssl_bump peek tls_s1_connect # peek
at TLS/SSL connect data<br>
ssl_bump splice tls_to_splice #
splice some: no active bump<br>
ssl_bump stare all #
stare(peek) at server<br>
# properties
of the webserver<br>
ssl_bump bump # bump if
we can (if the stare succeeded)<br>
<br>
ssl_bump peek tls_s1_connect<br>
ssl_bump splice all<br>
<br>
<br>
#ssl_bump peek all<br>
#######ssl_bump splice all<br>
<br>
<br>
sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/cache/squid/ssl_db/certs -M 4MB<br>
sslcrtd_children 5<br>
<br>
ssl_bump server-first all<br>
<br>
sslproxy_cert_error allow all<br>
<br>
produces:<br>
<br>
2026/07/16 08:34:21 kid1| Logfile: opening log
daemon:/var/log/squid/access.log<br>
2026/07/16 08:34:21 kid1| Logfile Daemon: opening log
/var/log/squid/access.log<br>
2026/07/16 08:34:21 kid1| Unlinkd pipe opened on FD 39<br>
2026/07/16 08:34:21 kid1| Local cache digest enabled;
rebuild/rewrite every 3600/3600 sec<br>
2026/07/16 08:34:21 kid1| Store logging disabled<br>
2026/07/16 08:34:21 kid1| Swap maxSize 3072000 + 983040 KB,
estimated 311926 objects<br>
2026/07/16 08:34:21 kid1| Target number of buckets: 15596<br>
2026/07/16 08:34:21 kid1| Using 16384 Store buckets<br>
2026/07/16 08:34:21 kid1| Max Mem size: 983040 KB<br>
2026/07/16 08:34:21 kid1| Max Swap size: 3072000 KB<br>
2026/07/16 08:34:21 kid1| Rebuilding storage in /var/cache/squid
(clean log)<br>
2026/07/16 08:34:21 kid1| Using Least Load store dir selection<br>
2026/07/16 08:34:21 kid1| Set Current Directory to /var/cache/squid<br>
2026/07/16 08:34:21 kid1| Finished loading MIME types and icons.<br>
2026/07/16 08:34:21 kid1| HTCP Disabled.<br>
2026/07/16 08:34:21 kid1| Pinger socket opened on FD 44<br>
2026/07/16 08:34:21 kid1| Squid plugin modules loaded: 0<br>
2026/07/16 08:34:21 kid1| Adaptation support is off.<br>
2026/07/16 08:34:21 kid1| Accepting SSL bumped HTTP Socket
connections at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9<br>
listening port: 8080<br>
2026/07/16 08:34:21 pinger| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.<br>
2026/07/16 08:34:21 pinger| Initialising ICMP pinger ...<br>
2026/07/16 08:34:21 pinger| ICMP socket opened.<br>
2026/07/16 08:34:21 pinger| ICMPv6 socket opened<br>
2026/07/16 08:34:21 kid1| Indexing cache entries: 1.84% (4000 out of
217767)<br>
2026/07/16 08:34:24 kid1| Done reading /var/cache/squid swaplog
(217766 entries)<br>
2026/07/16 08:34:24 kid1| Finished rebuilding storage from disk.<br>
217766 Entries scanned<br>
0 Invalid entries<br>
0 With invalid flags<br>
217766 Objects loaded<br>
0 Objects expired<br>
0 Objects canceled<br>
0 Duplicate URLs purged<br>
0 Swapfile clashes avoided<br>
Took 2.85 seconds (76411.43 objects/sec).<br>
2026/07/16 08:34:24 kid1| Beginning Validation Procedure<br>
2026/07/16 08:34:24 kid1| Completed Validation Procedure<br>
Validated 217752 Entries<br>
store_swap_size = 2764796.00 KB<br>
2026/07/16 08:34:24 kid1| storeLateRelease: released 0 objects<br>
2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited<br>
2026/07/16 08:34:24 kid1| Too few sslcrtd_program processes are
running (need 1/5)<br>
active processes: 4<br>
processes configured to start at (re)configuration: 5<br>
2026/07/16 08:34:24 kid1| Closing HTTP(S) port 0.0.0.0:8080<br>
listening port: 8080<br>
2026/07/16 08:34:24 kid1| storeDirWriteCleanLogs: Starting...<br>
2026/07/16 08:34:24 kid1| 65536 entries written so far.<br>
2026/07/16 08:34:25 kid1| 131072 entries written so far.<br>
2026/07/16 08:34:25 kid1| 196608 entries written so far.<br>
2026/07/16 08:34:25 kid1| Finished. Wrote 217766 entries.<br>
2026/07/16 08:34:25 kid1| Took 0.07 seconds (3283861.63
entries/sec).<br>
2026/07/16 08:34:25 kid1| FATAL: The sslcrtd_program helpers are
crashing too rapidly, need help!<br>
2026/07/16 08:34:25 kid1| Squid Cache (Version 7.6): Terminated
abnormally.<br>
CPU Usage: 3.678 seconds = 2.249 user + 1.429 sys<br>
Maximum Resident Size: 271856 KB<br>
Page faults with physical i/o: 0<br>
2026/07/16 08:34:25 kid1| Closing Pinger socket on FD 44<br>
2026/07/16 08:34:25| Removing PID file (/run/squid.pid)<br>
<br>
now the working configuration:<br>
<br>
http_port 8080 ssl-bump cert=/etc/squid/certs/myCA.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB<br>
<br>
<br>
<br>
<br>
##acl step1 at_step SslBump1 <br>
##ssl_bump peek step1 <br>
##ssl_bump bump all<br>
<br>
#########sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/lib/squid/ssl_db -M 4MB<br>
#########sslcrtd_children 5<br>
<br>
acl tls_s1_connect at_step SslBump1<br>
acl tls_s2_client_hello at_step SslBump2<br>
acl tls_s3_server_hello at_step SslBump3<br>
<br>
# define acls for sites that must not be actively bumped<br>
<br>
acl tls_allowed_hsts ssl::server_name
.akamaihd.net<br>
acl tls_allowed_hsts ssl::server_name
.proxy.skko.by<br>
#acl tls_server_is_bank ssl::server_name
.abnamro.nl<br>
#acl tls_server_is_bank ssl::server_name
.abnamro.com<br>
acl tls_server_is_bank ssl::server_name
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"<br>
acl tls_to_splice any-of
tls_allowed_hsts tls_server_is_bank<br>
<br>
# TLS/SSL bumping steps<br>
<br>
##ssl_bump peek tls_s1_connect # peek
at TLS/SSL connect data<br>
##ssl_bump splice tls_to_splice #
splice some: no active bump<br>
##ssl_bump stare all #
stare(peek) at server<br>
# properties
of the webserver<br>
##ssl_bump bump # bump if
we can (if the stare succeeded)<br>
<br>
##ssl_bump peek tls_s1_connect<br>
##ssl_bump splice all<br>
<br>
<br>
#ssl_bump peek all<br>
ssl_bump splice all<br>
<br>
produces:<br>
<br>
<br>
2026/07/16 08:40:11| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.<br>
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.<br>
acl name: to_localhost<br>
configuration context: Default Configuration(15) acl<br>
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.<br>
acl name: to_localhost<br>
configuration context: Default Configuration(15) acl<br>
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.<br>
acl name: to_linklocal<br>
configuration context: Default Configuration(16) acl<br>
2026/07/16 08:40:11| Processing Configuration File:
/etc/squid/squid.conf (depth 0)<br>
2026/07/16 08:40:11| Created PID file (/run/squid.pid)<br>
2026/07/16 08:40:11 kid1| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.<br>
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been
enabled.<br>
acl name: to_localhost<br>
configuration context: Default Configuration(15) acl<br>
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been
enabled.<br>
acl name: to_localhost<br>
configuration context: Default Configuration(15) acl<br>
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been
enabled.<br>
acl name: to_linklocal<br>
configuration context: Default Configuration(16) acl<br>
2026/07/16 08:40:11 kid1| Processing Configuration File:
/etc/squid/squid.conf (depth 0)<br>
2026/07/16 08:40:12 kid1| Set Current Directory to /var/cache/squid<br>
2026/07/16 08:40:12 kid1| Starting Squid Cache version 7.6 for
x86_64-suse-linux-gnu...<br>
2026/07/16 08:40:12 kid1| Service Name: squid<br>
2026/07/16 08:40:12 kid1| Process ID 168491<br>
2026/07/16 08:40:12 kid1| Process Roles: worker<br>
2026/07/16 08:40:12 kid1| With 4096 file descriptors available<br>
2026/07/16 08:40:12 kid1| Initializing IP Cache...<br>
2026/07/16 08:40:12 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7<br>
2026/07/16 08:40:12 kid1| Adding nameserver 10.6.30.3 from
/etc/resolv.conf<br>
2026/07/16 08:40:12 kid1| Adding nameserver 10.10.10.5 from
/etc/resolv.conf<br>
2026/07/16 08:40:12 kid1| helperOpenServers: Starting 5/32
'security_file_certgen' processes<br>
2026/07/16 08:40:12 kid1| helperOpenServers: Starting 8/16
'ufdbgclient' processes<br>
2026/07/16 08:40:12 kid1| Logfile: opening log
daemon:/var/log/squid/access.log<br>
2026/07/16 08:40:12 kid1| Logfile Daemon: opening log
/var/log/squid/access.log<br>
2026/07/16 08:40:12 kid1| Unlinkd pipe opened on FD 39<br>
2026/07/16 08:40:12 kid1| Local cache digest enabled;
rebuild/rewrite every 3600/3600 sec<br>
2026/07/16 08:40:12 kid1| Store logging disabled<br>
2026/07/16 08:40:12 kid1| Swap maxSize 3072000 + 983040 KB,
estimated 311926 objects<br>
2026/07/16 08:40:12 kid1| Target number of buckets: 15596<br>
2026/07/16 08:40:12 kid1| Using 16384 Store buckets<br>
2026/07/16 08:40:12 kid1| Max Mem size: 983040 KB<br>
2026/07/16 08:40:12 kid1| Max Swap size: 3072000 KB<br>
2026/07/16 08:40:12 kid1| Rebuilding storage in /var/cache/squid
(clean log)<br>
2026/07/16 08:40:12 kid1| Using Least Load store dir selection<br>
2026/07/16 08:40:12 kid1| Set Current Directory to /var/cache/squid<br>
2026/07/16 08:40:12 kid1| Finished loading MIME types and icons.<br>
2026/07/16 08:40:12 kid1| HTCP Disabled.<br>
2026/07/16 08:40:12 kid1| Pinger socket opened on FD 44<br>
2026/07/16 08:40:12 kid1| Squid plugin modules loaded: 0<br>
2026/07/16 08:40:12 kid1| Adaptation support is off.<br>
2026/07/16 08:40:12 kid1| Accepting SSL bumped HTTP Socket
connections at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9<br>
listening port: 8080<br>
2026/07/16 08:40:12 pinger| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.<br>
2026/07/16 08:40:12 pinger| Initialising ICMP pinger ...<br>
2026/07/16 08:40:12 pinger| ICMP socket opened.<br>
2026/07/16 08:40:12 pinger| ICMPv6 socket opened<br>
2026/07/16 08:40:12 kid1| Indexing cache entries: 1.84% (4000 out of
217767)<br>
2026/07/16 08:40:15 kid1| Done reading /var/cache/squid swaplog
(217766 entries)<br>
2026/07/16 08:40:15 kid1| Finished rebuilding storage from disk.<br>
217766 Entries scanned<br>
0 Invalid entries<br>
0 With invalid flags<br>
217766 Objects loaded<br>
0 Objects expired<br>
0 Objects canceled<br>
0 Duplicate URLs purged<br>
0 Swapfile clashes avoided<br>
Took 2.91 seconds (74726.47 objects/sec).<br>
2026/07/16 08:40:15 kid1| Beginning Validation Procedure<br>
2026/07/16 08:40:15 kid1| Completed Validation Procedure<br>
Validated 217752 Entries<br>
store_swap_size = 2764796.00 KB<br>
2026/07/16 08:40:15 kid1| storeLateRelease: released 0 objects<br>
2026/07/16 08:40:17 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=sb.scorecardresearch.com%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=sb.scorecardresearch.com%3A443</a>
HTTP/1.1<br>
current master transaction: master57<br>
2026/07/16 08:40:49 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:40:49 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:40:50 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=stats.g.doubleclick.net%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=stats.g.doubleclick.net%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:40:52 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:41:36 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:41:37 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:41:38 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:41:38 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:41:39 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
2026/07/16 08:41:39 kid1| ERROR: URL-rewrite produces invalid
request: CONNECT
<a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443</a>
HTTP/1.1<br>
current master transaction: master55<br>
<br>
<br>
</body>
</html>
--------------eFqWRWvfq0W6HTMdOCmDxeaO--
--===============3250830806322873869==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users
--===============3250830806322873869==--