Re: ssl bump
Andrey K <[email protected]> Mon, 20 Jul 2026 06:50:21 +0300
| Newsgroups | gmane.comp.web.squid.general |
|---|---|
| Message-ID | <CADJd0Y17XdGP_zcUjLVBzcWiBK=ruN3r_7CLGNNB__4nfAp5QQ@mail.gmail.com> |
--===============3704309336182131292== Content-Type: multipart/alternative; boundary="000000000000dce74b065702ce4b" --000000000000dce74b065702ce4b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, *Vacheslav,* > sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate > certificates: Uninitialized SSL certificate database directory: > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen > -c -s /var/cache/squid/ssl_db/certs". > exception location: certificate_db.cc(497) load You're still using the incorrect path: /var/cache/squid/ssl_db/certs How is the sslcrtd_program directive configured in your squid.conf? > so far i managed to do this: stop squid and > sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate > certificates: Uninitialized SSL certificate database directory: > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen > -c -s /var/cache/squid/ssl_db/certs". > exception location: certificate_db.cc(497) load > 16.07.2026 16:36, Alex Rousskov =D0=BF=D0=B8=D1=88=D0=B5=D1=82: >>* On 2026-07-16 01:57, Vacheslav wrote: *>>>>>* 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited *>>>>* We need to figure out why your security_file_certgen helpers are *>>* exiting. IIRC, those helpers have not been upgraded to report their *>>* fatal failures to cache.log. There are a few tricks you can use to see *>>* what the problem is, but I would probably start with these three: *>>>>* 1. Run security_file_certgen with sslcrtd_program parameters from th= e *>>* command line, as Squid user. If you are lucky, it will complain about *>>* something before it starts waiting for the helper request. * > so far i managed to do this: stop squid and > sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate > certificates: Uninitialized SSL certificate database directory: > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen > -c -s /var/cache/squid/ssl_db/certs". > exception location: certificate_db.cc(497) load > > > > >>* 2. Redirect security_file_certgen stderr (but not stdout!) output into *>>* a dedicated log file. It may be possible to do that right on the *>>* sslcrtd_program line, without wrapping the helper into another script. *> > how to do that? > >>* 3. Enable full debugging, reproduce the problem with a single *>>* transaction, and send a link to the corresponding compressed cache.log *>>* file for analysis as detailed at *>>* https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-= transaction <https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-tran= saction> *>>> >> God willing and we be living i'll try this later =D0=BF=D1=82, 17 =D0=B8=D1=8E=D0=BB. 2026=E2=80=AF=D0=B3. =D0=B2 15:52, Ale= x Rousskov <[email protected] >: > On 2026-07-17 01:31, Vacheslav wrote: > > > 16.07.2026 18:19, Andrey K =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > >> @Vacheslav: > >> > sudo /usr/libexec/squid/security_file_certgen -c -s > >> > /var/cache/squid/ssl_db/certs -M 4MB > >> You specified the wrong path (the correct one is > >> /var/cache/squid/ssl_db ). > > > > > > good catch: > > now running: > > sudo -u squid /usr/libexec/squid/security_file_certgen -s > > /var/cache/squid/ssl_db -M 4MB > > ^C > > produces nothing. > > That lack of output is a good sign -- the helper managed to start > successfully. > > > > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited > > Helpers are still dying, but it looks like they do it while handling > traffic. > > > >> 2. Redirect security_file_certgen stderr (but not stdout!) output > >> into a dedicated log file. It may be possible to do that right on > >> the sslcrtd_program line, without wrapping the helper into another > >> script. > > > how to do that? > > Try using shell redirection when specifying how to run the helper. > Something along these lines may work: > > sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log > > I also recommend using a single helper for the initial tests: > > sslcrtd_children 1 startup=3D1 idle=3D1 > > > HTH, > > Alex. > > > > 2026/07/17 08:17:35| Removing PID file (/run/squid.pid) > > 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functiona= l > > IPv6 loopback. > > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > > acl name: to_localhost > > configuration context: Default Configuration(15) acl > > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > > acl name: to_localhost > > configuration context: Default Configuration(15) acl > > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > > acl name: to_linklocal > > configuration context: Default Configuration(16) acl > > 2026/07/17 08:18:54| Processing Configuration File: > > /etc/squid/squid.conf (depth 0) > > 2026/07/17 08:18:55| Created PID file (/run/squid.pid) > > 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected > > non-functional IPv6 loopback. > > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > > acl name: to_localhost > > configuration context: Default Configuration(15) acl > > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > > acl name: to_localhost > > configuration context: Default Configuration(15) acl > > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > > acl name: to_linklocal > > configuration context: Default Configuration(16) acl > > 2026/07/17 08:18:55 kid1| Processing Configuration File: > > /etc/squid/squid.conf (depth 0) > > 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid > > 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for > > x86_64-suse-linux-gnu... > > 2026/07/17 08:18:55 kid1| Service Name: squid > > 2026/07/17 08:18:55 kid1| Process ID 3685 > > 2026/07/17 08:18:55 kid1| Process Roles: worker > > 2026/07/17 08:18:55 kid1| With 4096 file descriptors available > > 2026/07/17 08:18:55 kid1| Initializing IP Cache... > > 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 > > 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from > /etc/resolv.conf > > 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from > /etc/resolv.conf > > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 > > 'security_file_certgen' processes > > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient= ' > > processes > > 2026/07/17 08:18:55 kid1| Logfile: opening log > > daemon:/var/log/squid/access.log > > 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log > > /var/log/squid/access.log > > 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39 > > 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite > > every 3600/3600 sec > > 2026/07/17 08:18:56 kid1| Store logging disabled > > 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated > > 311926 objects > > 2026/07/17 08:18:56 kid1| Target number of buckets: 15596 > > 2026/07/17 08:18:56 kid1| Using 16384 Store buckets > > 2026/07/17 08:18:56 kid1| Max Mem size: 983040 KB > > 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB > > 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean > log) > > 2026/07/17 08:18:56 kid1| Using Least Load store dir selection > > 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid > > 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons. > > 2026/07/17 08:18:56 kid1| HTCP Disabled. > > 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44 > > 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0 > > 2026/07/17 08:18:56 kid1| Adaptation support is off. > > 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections > > at conn28 local=3D0.0.0.0:8080 remote=3D[::] FD 42 flags=3D9 > > listening port: 8080 > > 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected > > non-functional IPv6 loopback. > > 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ... > > 2026/07/17 08:18:56 pinger| ICMP socket opened. > > 2026/07/17 08:18:56 pinger| ICMPv6 socket opened > > 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of > 217945) > > 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944 > > entries) > > 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk. > > 217944 Entries scanned > > 0 Invalid entries > > 0 With invalid flags > > 217944 Objects loaded > > 0 Objects expired > > 0 Objects canceled > > 0 Duplicate URLs purged > > 0 Swapfile clashes avoided > > Took 2.85 seconds (76435.29 objects/sec). > > 2026/07/17 08:18:59 kid1| Beginning Validation Procedure > > 2026/07/17 08:18:59 kid1| Completed Validation Procedure > > Validated 217930 Entries > > store_swap_size =3D 2764788.00 KB > > 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects > > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ER= R=3D1 > > current master transaction: master57 > > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master55 > > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master55 > > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master57 > > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master57 > > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master55 > > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master57 > > > > ........ > > > > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master57 > > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ER= R=3D1 > > current master transaction: master57 > > 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection > > problem: failure > > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ER= R=3D1 > > current master transaction: master57 > > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited > > current master transaction: master57 > > 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running > > (need 1/5) > > active processes: 4 > > processes configured to start at (re)configuration: 5 > > current master transaction: master57 > > 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 > > 'security_file_certgen' processes > > current master transaction: master57 > > 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests > > 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to > > finish > > 2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080 > > listening port: 8080 > > 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44 > > 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: > > daemon:/var/log/squid/access.log: error writing ((32) Broken pipe) > > connection: conn2846 local=3D10.0.0.18:8080 remote=3D10.1.0.17:532= 55 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting... > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:5= 3255 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| 65536 entries written so far. > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:5= 3255 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| 131072 entries written so far. > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:5= 3255 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| 196608 entries written so far. > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:5= 3255 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| Finished. Wrote 217944 entries. > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:5= 3255 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| Took 0.08 seconds (2736133.78 entries/sec). > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.16.0.7:5= 3255 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well! > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:5= 3255 > > flags=3D1 > > 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated > abnormally. > > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:5= 3255 > > flags=3D1 > > CPU Usage: 10.098 seconds =3D 7.758 user + 2.340 sys > > Maximum Resident Size: 314320 KB > > Page faults with physical i/o: 0 > >> > >> To recreate a certificate database you should do: > >> > >> sudo rm -rf /var/cache/squid/ssl_db > >> sudo /usr/libexec/squid/security_file_certgen -c > >> -s /var/cache/squid/ssl_db -M 4MB > >> sudo chown -R squid:squid /var/cache/squid/ssl_db > >> > >> =D1=87=D1=82, 16 =D0=B8=D1=8E=D0=BB. 2026=E2=80=AF=D0=B3. =D0=B2 16:36= , Alex Rousskov > >> <[email protected]>: > >> > >> On 2026-07-16 01:57, Vacheslav wrote: > >> > >> > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited > >> > >> We need to figure out why your security_file_certgen helpers are > >> exiting. IIRC, those helpers have not been upgraded to report thei= r > >> fatal failures to cache.log. There are a few tricks you can use to > >> see > >> what the problem is, but I would probably start with these three: > >> > >> 1. Run security_file_certgen with sslcrtd_program parameters from > the > >> command line, as Squid user. If you are lucky, it will complain > about > >> something before it starts waiting for the helper request. > >> > >> 2. Redirect security_file_certgen stderr (but not stdout!) output > >> into a > >> dedicated log file. It may be possible to do that right on the > >> sslcrtd_program line, without wrapping the helper into another > script. > >> > >> 3. Enable full debugging, reproduce the problem with a single > >> transaction, and send a link to the corresponding compressed > >> cache.log > >> file for analysis as detailed at > >> > https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-tra= nsaction > >> > >> > >> Cheers, > >> > >> Alex. > >> > >> _______________________________________________ > >> squid-users mailing list > >> [email protected] > >> https://lists.squid-cache.org/listinfo/squid-users > >> > > > > _______________________________________________ > squid-users mailing list > [email protected] > https://lists.squid-cache.org/listinfo/squid-users > --000000000000dce74b065702ce4b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><pre style=3D"white-space:pre-wrap;color:rgb(0,0,0)">Hello= , <i style=3D"font-family:Arial,Helvetica,sans-serif;background-color:trans= parent">Vacheslav,<br></i><br> <pre style=3D"white-space:pre-wrap">> sudo -u squid /usr/libexec/squid/s= ecurity_file_certgen -s=20 > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate=20 > certificates: Uninitialized SSL certificate database directory:=20 > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_= certgen=20 > -c -s /var/cache/squid/ssl_db/certs". > =C2=A0 =C2=A0 exception location: certificate_db.cc(497) load</pre> You're still using the incorrect path: <code dir=3D"ltr" class=3D"gmail= -KDcb0c" style=3D"font-size:14px;margin:0px;border-bottom:0.8px solid rgb(2= 40,242,245)">/var/cache/squid/ssl_db/certs</code> How is the <code dir=3D"ltr" class=3D"gmail-KDcb0c" style=3D"font-size:14px= ;margin:0px;border-bottom:0.8px solid rgb(240,242,245)">sslcrtd_program</co= de> directive configured in your squid.conf? > so far i managed to do this: stop squid and > sudo -u squid /usr/libexec/squid/security_file_certgen -s=20 > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate=20 > certificates: Uninitialized SSL certificate database directory:=20 > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_= certgen=20 > -c -s /var/cache/squid/ssl_db/certs". > =C2=A0 =C2=A0 exception location: certificate_db.cc(497) load <br> <pre style=3D"white-space:pre-wrap">> 16.07.2026 16:36, Alex Rousskov = =D0=BF=D0=B8=D1=88=D0=B5=D1=82: >><i> On 2026-07-16 01:57, Vacheslav wrote: </i>>><i> </i>>>><i> 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlp= r1 exited </i>>><i> </i>>><i> We need to figure out why your security_file_certgen helper= s are=20 </i>>><i> exiting. IIRC, those helpers have not been upgraded to repo= rt their=20 </i>>><i> fatal failures to cache.log. There are a few tricks you can= use to see=20 </i>>><i> what the problem is, but I would probably start with these = three: </i>>><i> </i>>><i> 1. Run security_file_certgen with sslcrtd_program parameter= s from the=20 </i>>><i> command line, as Squid user. If you are lucky, it will comp= lain about=20 </i>>><i> something before it starts waiting for the helper request. </i> > so far i managed to do this: stop squid and > sudo -u squid /usr/libexec/squid/security_file_certgen -s=20 > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate=20 > certificates: Uninitialized SSL certificate database directory:=20 > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_= certgen=20 > -c -s /var/cache/squid/ssl_db/certs". > =C2=A0 =C2=A0 exception location: certificate_db.cc(497) load > > > > >><i> 2. Redirect security_file_certgen stderr (but not stdout!) outp= ut into=20 </i>>><i> a dedicated log file. It may be possible to do that right o= n the=20 </i>>><i> sslcrtd_program line, without wrapping the helper into anot= her script. </i>> > how to do that? > >><i> 3. Enable full debugging, reproduce the problem with a single= =20 </i>>><i> transaction, and send a link to the corresponding compresse= d cache.log=20 </i>>><i> file for analysis as detailed at=20 </i>>><i> <a href=3D"https://wiki.squid-cache.org/SquidFaq/BugReporti= ng#debugging-a-single-transaction">https://wiki.squid-cache.org/SquidFaq/Bu= gReporting#debugging-a-single-transaction</a>=20 </i>>><i> </i>> >> God willing and we be living i'll try this later</pre> <br></pre></div><br><div class=3D"gmail_quote gmail_quote_container"><div d= ir=3D"ltr" class=3D"gmail_attr">=D0=BF=D1=82, 17 =D0=B8=D1=8E=D0=BB. 2026= =E2=80=AF=D0=B3. =D0=B2 15:52, Alex Rousskov <<a href=3D"mailto:rousskov= @measurement-factory.com">[email protected]</a>>:<br></di= v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde= r-left:1px solid rgb(204,204,204);padding-left:1ex">On 2026-07-17 01:31, Va= cheslav wrote:<br> <br> > 16.07.2026 18:19, Andrey K =D0=BF=D0=B8=D1=88=D0=B5=D1=82:<br> >> @Vacheslav:<br> >> > sudo /usr/libexec/squid/security_file_certgen -c -s<br> >> > /var/cache/squid/ssl_db/certs -M 4MB<br> >> You specified the wrong path (the correct one is <br> >> /var/cache/squid/ssl_db ).<br> > <br> > <br> > good catch:<br> > now running:<br> >=C2=A0 =C2=A0sudo -u squid /usr/libexec/squid/security_file_certgen -s = <br> > /var/cache/squid/ssl_db -M 4MB<br> > ^C<br> > produces nothing.<br> <br> That lack of output is a good sign -- the helper managed to start <br> successfully.<br> <br> <br> > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited<br> <br> Helpers are still dying, but it looks like they do it while handling <br> traffic.<br> <br> <br> >> 2. Redirect security_file_certgen stderr (but not stdout!) output<= br> >> into a dedicated log file. It may be possible to do that right on<= br> >> the sslcrtd_program line, without wrapping the helper into another= <br> >> script.<br> <br> > how to do that?<br> <br> Try using shell redirection when specifying how to run the helper. <br> Something along these lines may work:<br> <br> =C2=A0 =C2=A0 =C2=A0sslcrtd_program /usr/local/... -M 4MB >> /tmp/ssl= crtd.error.log<br> <br> I also recommend using a single helper for the initial tests:<br> <br> =C2=A0 =C2=A0 =C2=A0sslcrtd_children 1 startup=3D1 idle=3D1<br> <br> <br> HTH,<br> <br> Alex.<br> <br> <br> > 2026/07/17 08:17:35| Removing PID file (/run/squid.pid)<br> > 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-function= al <br> > IPv6 loopback.<br> > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.<br> >=C2=A0 =C2=A0 =C2=A0 acl name: to_localhost<br> >=C2=A0 =C2=A0 =C2=A0 configuration context: Default Configuration(15) a= cl<br> > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.<br> >=C2=A0 =C2=A0 =C2=A0 acl name: to_localhost<br> >=C2=A0 =C2=A0 =C2=A0 configuration context: Default Configuration(15) a= cl<br> > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.<br> >=C2=A0 =C2=A0 =C2=A0 acl name: to_linklocal<br> >=C2=A0 =C2=A0 =C2=A0 configuration context: Default Configuration(16) a= cl<br> > 2026/07/17 08:18:54| Processing Configuration File: <br> > /etc/squid/squid.conf (depth 0)<br> > 2026/07/17 08:18:55| Created PID file (/run/squid.pid)<br> > 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected <br> > non-functional IPv6 loopback.<br> > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.= <br> >=C2=A0 =C2=A0 =C2=A0 acl name: to_localhost<br> >=C2=A0 =C2=A0 =C2=A0 configuration context: Default Configuration(15) a= cl<br> > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.= <br> >=C2=A0 =C2=A0 =C2=A0 acl name: to_localhost<br> >=C2=A0 =C2=A0 =C2=A0 configuration context: Default Configuration(15) a= cl<br> > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.= <br> >=C2=A0 =C2=A0 =C2=A0 acl name: to_linklocal<br> >=C2=A0 =C2=A0 =C2=A0 configuration context: Default Configuration(16) a= cl<br> > 2026/07/17 08:18:55 kid1| Processing Configuration File: <br> > /etc/squid/squid.conf (depth 0)<br> > 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid<br= > > 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for <br> > x86_64-suse-linux-gnu...<br> > 2026/07/17 08:18:55 kid1| Service Name: squid<br> > 2026/07/17 08:18:55 kid1| Process ID 3685<br> > 2026/07/17 08:18:55 kid1| Process Roles: worker<br> > 2026/07/17 08:18:55 kid1| With 4096 file descriptors available<br> > 2026/07/17 08:18:55 kid1| Initializing IP Cache...<br> > 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7<br> > 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from /etc/resol= v.conf<br> > 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from /etc/resol= v.conf<br> > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 <br> > 'security_file_certgen' processes<br> > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgc= lient' <br> > processes<br> > 2026/07/17 08:18:55 kid1| Logfile: opening log <br> > daemon:/var/log/squid/access.log<br> > 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log <br> > /var/log/squid/access.log<br> > 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39<br> > 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite = <br> > every 3600/3600 sec<br> > 2026/07/17 08:18:56 kid1| Store logging disabled<br> > 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated = <br> > 311926 objects<br> > 2026/07/17 08:18:56 kid1| Target number of buckets: 15596<br> > 2026/07/17 08:18:56 kid1| Using 16384 Store buckets<br> > 2026/07/17 08:18:56 kid1| Max Mem=C2=A0 size: 983040 KB<br> > 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB<br> > 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clea= n log)<br> > 2026/07/17 08:18:56 kid1| Using Least Load store dir selection<br> > 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid<br= > > 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons.<br> > 2026/07/17 08:18:56 kid1| HTCP Disabled.<br> > 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44<br> > 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0<br> > 2026/07/17 08:18:56 kid1| Adaptation support is off.<br> > 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections= <br> > at conn28 local=3D<a href=3D"http://0.0.0.0:8080" rel=3D"noreferrer" t= arget=3D"_blank">0.0.0.0:8080</a> remote=3D[::] FD 42 flags=3D9<br> >=C2=A0 =C2=A0 =C2=A0 listening port: 8080<br> > 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected <br> > non-functional IPv6 loopback.<br> > 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ...<br> > 2026/07/17 08:18:56 pinger| ICMP socket opened.<br> > 2026/07/17 08:18:56 pinger| ICMPv6 socket opened<br> > 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 2= 17945)<br> > 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (21794= 4 <br> > entries)<br> > 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk.<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0217944 Entries scanned<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Invalid entries<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 With invalid flags<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0217944 Objects loaded<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Objects expired<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Objects canceled<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Duplicate URLs purged<br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Swapfile clashes avoided<br= > >=C2=A0 =C2=A0 =C2=A0 Took 2.85 seconds (76435.29 objects/sec).<br> > 2026/07/17 08:18:59 kid1| Beginning Validation Procedure<br> > 2026/07/17 08:18:59 kid1| Completed Validation Procedure<br> >=C2=A0 =C2=A0 =C2=A0 Validated 217930 Entries<br> >=C2=A0 =C2=A0 =C2=A0 store_swap_size =3D 2764788.00 KB<br> > 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects<br> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000418+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master55<br> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master55<br> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master55<br> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > <br> > ........<br> > <br> > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000416+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection<br> >=C2=A0 =C2=A0 =C2=A0 problem: failure<br> >=C2=A0 =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA= 000418+TLS_IO_ERR=3D1<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are runnin= g <br> > (need 1/5)<br> >=C2=A0 =C2=A0 =C2=A0 active processes: 4<br> >=C2=A0 =C2=A0 =C2=A0 processes configured to start at (re)configuration= : 5<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 <br> > 'security_file_certgen' processes<br> >=C2=A0 =C2=A0 =C2=A0 current master transaction: master57<br> > 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests<br= > > 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to= <br> > finish<br> > 2026/07/17 08:21:33 kid1| Closing HTTP(S) port <a href=3D"http://0.0.0= .0:8080" rel=3D"noreferrer" target=3D"_blank">0.0.0.0:8080</a><br> >=C2=A0 =C2=A0 =C2=A0 listening port: 8080<br> > 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44<br> > 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: <br> > daemon:/var/log/squid/access.log: error writing ((32) Broken pipe)<br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 0.0.18:8080" rel=3D"noreferrer" target=3D"_blank">10.0.0.18:8080</a> remote= =3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_blank">= 10.1.0.17:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting...<br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.1.0.17:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0 =C2=A065536 entries written so = far.<br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.1.0.17:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0 131072 entries written so far.<= br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.1.0.17:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0 196608 entries written so far.<= br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.1.0.17:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0Finished.=C2=A0 Wrote 217944 ent= ries.<br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.1.0.17:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0Took 0.08 seconds (2736133.78 en= tries/sec).<br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.16.0.7:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.16.0.7:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well!<b= r> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.1.0.17:53255</a> <br> > flags=3D1<br> > 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated abnorm= ally.<br> >=C2=A0 =C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"http://10.= 10.10.18:8080" rel=3D"noreferrer" target=3D"_blank">10.10.10.18:8080</a> re= mote=3D<a href=3D"http://10.1.0.17:53255" rel=3D"noreferrer" target=3D"_bla= nk">10.1.0.17:53255</a> <br> > flags=3D1<br> > CPU Usage: 10.098 seconds =3D 7.758 user + 2.340 sys<br> > Maximum Resident Size: 314320 KB<br> > Page faults with physical i/o: 0<br> >><br> >> To recreate a certificate database you should do:<br> >><br> >> sudo rm -rf /var/cache/squid/ssl_db<br> >> sudo /usr/libexec/squid/security_file_certgen -c <br> >> -s=C2=A0/var/cache/squid/ssl_db -M 4MB<br> >> sudo chown -R squid:squid /var/cache/squid/ssl_db<br> >><br> >> =D1=87=D1=82, 16 =D0=B8=D1=8E=D0=BB. 2026=E2=80=AF=D0=B3. =D0=B2 1= 6:36, Alex Rousskov <br> >> <<a href=3D"mailto:[email protected]" target=3D"= _blank">[email protected]</a>>:<br> >><br> >>=C2=A0 =C2=A0 =C2=A0On 2026-07-16 01:57, Vacheslav wrote:<br> >><br> >>=C2=A0 =C2=A0 =C2=A0> 2026/07/16 08:34:24 kid1| WARNING: sslcrtd= _program #Hlpr1 exited<br> >><br> >>=C2=A0 =C2=A0 =C2=A0We need to figure out why your security_file_ce= rtgen helpers are<br> >>=C2=A0 =C2=A0 =C2=A0exiting. IIRC, those helpers have not been upgr= aded to report their<br> >>=C2=A0 =C2=A0 =C2=A0fatal failures to cache.log. There are a few tr= icks you can use to<br> >>=C2=A0 =C2=A0 =C2=A0see<br> >>=C2=A0 =C2=A0 =C2=A0what the problem is, but I would probably start= with these three:<br> >><br> >>=C2=A0 =C2=A0 =C2=A01. Run security_file_certgen with sslcrtd_progr= am parameters from the<br> >>=C2=A0 =C2=A0 =C2=A0command line, as Squid user. If you are lucky, = it will complain about<br> >>=C2=A0 =C2=A0 =C2=A0something before it starts waiting for the help= er request.<br> >><br> >>=C2=A0 =C2=A0 =C2=A02. Redirect security_file_certgen stderr (but n= ot stdout!) output<br> >>=C2=A0 =C2=A0 =C2=A0into a<br> >>=C2=A0 =C2=A0 =C2=A0dedicated log file. It may be possible to do th= at right on the<br> >>=C2=A0 =C2=A0 =C2=A0sslcrtd_program line, without wrapping the help= er into another script.<br> >><br> >>=C2=A0 =C2=A0 =C2=A03. Enable full debugging, reproduce the problem= with a single<br> >>=C2=A0 =C2=A0 =C2=A0transaction, and send a link to the correspondi= ng compressed<br> >>=C2=A0 =C2=A0 =C2=A0cache.log<br> >>=C2=A0 =C2=A0 =C2=A0file for analysis as detailed at<br> >>=C2=A0 =C2=A0 =C2=A0<a href=3D"https://wiki.squid-cache.org/SquidFa= q/BugReporting#debugging-a-single-transaction" rel=3D"noreferrer" target=3D= "_blank">https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-sin= gle-transaction</a><br> >><br> >><br> >>=C2=A0 =C2=A0 =C2=A0Cheers,<br> >><br> >>=C2=A0 =C2=A0 =C2=A0Alex.<br> >><br> >>=C2=A0 =C2=A0 =C2=A0_______________________________________________= <br> >>=C2=A0 =C2=A0 =C2=A0squid-users mailing list<br> >>=C2=A0 =C2=A0 =C2=A0<a href=3D"mailto:[email protected]= .org" target=3D"_blank">[email protected]</a><br> >>=C2=A0 =C2=A0 =C2=A0<a href=3D"https://lists.squid-cache.org/listin= fo/squid-users" rel=3D"noreferrer" target=3D"_blank">https://lists.squid-ca= che.org/listinfo/squid-users</a><br> >><br> > <br> <br> _______________________________________________<br> squid-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">squi= [email protected]</a><br> <a href=3D"https://lists.squid-cache.org/listinfo/squid-users" rel=3D"noref= errer" target=3D"_blank">https://lists.squid-cache.org/listinfo/squid-users= </a><br> </blockquote></div> --000000000000dce74b065702ce4b-- --===============3704309336182131292== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ squid-users mailing list [email protected] https://lists.squid-cache.org/listinfo/squid-users --===============3704309336182131292==--