Re: ssl bump
Vacheslav <[email protected]> Mon, 20 Jul 2026 08:27:07 +0300
| Newsgroups | gmane.comp.web.squid.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============0229563251922914620== Content-Type: multipart/alternative; boundary="------------tmsRd40zJiC0cJr24nJ4j82v" Content-Language: en-US, ru-RU This is a multi-part message in MIME format. --------------tmsRd40zJiC0cJr24nJ4j82v Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit 17.07.2026 15:44, Alex Rousskov пишет: > On 2026-07-17 01:31, Vacheslav wrote: > >> 16.07.2026 18:19, Andrey K пишет: >>> @Vacheslav: >>> > sudo /usr/libexec/squid/security_file_certgen -c -s >>> > /var/cache/squid/ssl_db/certs -M 4MB >>> You specified the wrong path (the correct one is >>> /var/cache/squid/ssl_db ). >> >> >> good catch: >> now running: >> sudo -u squid /usr/libexec/squid/security_file_certgen -s >> /var/cache/squid/ssl_db -M 4MB >> ^C >> produces nothing. > > That lack of output is a good sign -- the helper managed to start > successfully. > > >> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited > > Helpers are still dying, but it looks like they do it while handling > traffic. > > >>> 2. Redirect security_file_certgen stderr (but not stdout!) output >>> into a dedicated log file. It may be possible to do that right on >>> the sslcrtd_program line, without wrapping the helper into another >>> script. > >> how to do that? > > Try using shell redirection when specifying how to run the helper. > Something along these lines may work: > > sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log > > I also recommend using a single helper for the initial tests: > > sslcrtd_children 1 startup=1 idle=1 > > > HTH, > > Alex. > now the configuration looks like this: acl tls_s1_connect at_step SslBump1 acl tls_s2_client_hello at_step SslBump2 acl tls_s3_server_hello at_step SslBump3 # define acls for sites that must not be actively bumped acl tls_allowed_hsts ssl::server_name .akamaihd.net acl tls_allowed_hsts ssl::server_name .proxy.skko.by #acl tls_server_is_bank ssl::server_name .abnamro.nl #acl tls_server_is_bank ssl::server_name .abnamro.com acl tls_server_is_bank ssl::server_name "/usr/local/ufdbguard/blacklists/finance/domains.squidsplice" acl tls_to_splice any-of tls_allowed_hsts tls_server_is_bank # TLS/SSL bumping steps ssl_bump peek tls_s1_connect # peek at TLS/SSL connect data ssl_bump splice tls_to_splice # splice some: no active bump ssl_bump stare all # stare(peek) at server # properties of the webserver ssl_bump bump # bump if we can (if the stare succeeded) ssl_bump peek tls_s1_connect ssl_bump splice all #ssl_bump peek all #####3ssl_bump splice all sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB >> /tmp/sslcrtd.error.log sslcrtd_children 1 startup=1 idle=1 ssl_bump server-first all sslproxy_cert_error allow all and it produces: 2026/07/20 08:10:07| Removing PID file (/run/squid.pid) 2026/07/20 08:10:08| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. 2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled. acl name: to_linklocal configuration context: Default Configuration(16) acl 2026/07/20 08:10:08| Processing Configuration File: /etc/squid/squid.conf (depth 0) 2026/07/20 08:10:08| Created PID file (/run/squid.pid) 2026/07/20 08:10:08 kid1| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. 2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled. acl name: to_linklocal configuration context: Default Configuration(16) acl 2026/07/20 08:10:08 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0) 2026/07/20 08:10:09 kid1| Set Current Directory to /var/cache/squid 2026/07/20 08:10:09 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu... 2026/07/20 08:10:09 kid1| Service Name: squid 2026/07/20 08:10:09 kid1| Process ID 151924 2026/07/20 08:10:09 kid1| Process Roles: worker 2026/07/20 08:10:09 kid1| With 4096 file descriptors available 2026/07/20 08:10:09 kid1| Initializing IP Cache... 2026/07/20 08:10:09 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 2026/07/20 08:10:09 kid1| Adding nameserver 10.16.30.46 from /etc/resolv.conf 2026/07/20 08:10:09 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf 2026/07/20 08:10:09 kid1| helperOpenServers: Starting 1/1 'security_file_certgen' processes 2026/07/20 08:10:09 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes 2026/07/20 08:10:09 kid1| Logfile: opening log daemon:/var/log/squid/access.log 2026/07/20 08:10:09 kid1| Logfile Daemon: opening log /var/log/squid/access.log 2026/07/20 08:10:09 kid1| Unlinkd pipe opened on FD 31 2026/07/20 08:10:09 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec 2026/07/20 08:10:09 kid1| Store logging disabled 2026/07/20 08:10:09 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects 2026/07/20 08:10:09 kid1| Target number of buckets: 15596 2026/07/20 08:10:09 kid1| Using 16384 Store buckets 2026/07/20 08:10:09 kid1| Max Mem size: 983040 KB 2026/07/20 08:10:09 kid1| Max Swap size: 3072000 KB 2026/07/20 08:10:09 kid1| Rebuilding storage in /var/cache/squid (clean log) 2026/07/20 08:10:09 kid1| Using Least Load store dir selection 2026/07/20 08:10:09 kid1| Set Current Directory to /var/cache/squid 2026/07/20 08:10:09 kid1| Finished loading MIME types and icons. 2026/07/20 08:10:09 kid1| HTCP Disabled. 2026/07/20 08:10:09 kid1| Pinger socket opened on FD 36 2026/07/20 08:10:09 kid1| Squid plugin modules loaded: 0 2026/07/20 08:10:09 kid1| Adaptation support is off. 2026/07/20 08:10:09 kid1| Accepting SSL bumped HTTP Socket connections at conn20 local=0.0.0.0:8080 remote=[::] FD 34 flags=9 listening port: 8080 2026/07/20 08:10:09 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. 2026/07/20 08:10:09 pinger| Initialising ICMP pinger ... 2026/07/20 08:10:09 pinger| ICMP socket opened. 2026/07/20 08:10:09 pinger| ICMPv6 socket opened 2026/07/20 08:10:09 kid1| Indexing cache entries: 1.83% (4000 out of 218046) 2026/07/20 08:10:12 kid1| Done reading /var/cache/squid swaplog (218045 entries) 2026/07/20 08:10:12 kid1| Finished rebuilding storage from disk. 218045 Entries scanned 0 Invalid entries 0 With invalid flags 218045 Objects loaded 0 Objects expired 0 Objects canceled 0 Duplicate URLs purged 0 Swapfile clashes avoided Took 2.95 seconds (73845.97 objects/sec). 2026/07/20 08:10:12 kid1| Beginning Validation Procedure 2026/07/20 08:10:12 kid1| Completed Validation Procedure Validated 218031 Entries store_swap_size = 2764796.00 KB 2026/07/20 08:10:12 kid1| storeLateRelease: released 0 objects 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:16 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:17 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:17 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:19 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:20 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: URL-rewrite produces invalid request: CONNECT https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=securepubads.g.doubleclick.net%3A443 HTTP/1.1 current master transaction: master57 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master59 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection in tmp there is no sslcrtd.error.log file. there is certs-20260716-080709 folder and another folder with similar name with certs subfolder which is empty. there are also ssl_db-20260716-080509 folders with certs folder that have certs. > >> 2026/07/17 08:17:35| Removing PID file (/run/squid.pid) >> 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected >> non-functional IPv6 loopback. >> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. >> acl name: to_localhost >> configuration context: Default Configuration(15) acl >> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. >> acl name: to_localhost >> configuration context: Default Configuration(15) acl >> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. >> acl name: to_linklocal >> configuration context: Default Configuration(16) acl >> 2026/07/17 08:18:54| Processing Configuration File: >> /etc/squid/squid.conf (depth 0) >> 2026/07/17 08:18:55| Created PID file (/run/squid.pid) >> 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected >> non-functional IPv6 loopback. >> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. >> acl name: to_localhost >> configuration context: Default Configuration(15) acl >> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. >> acl name: to_localhost >> configuration context: Default Configuration(15) acl >> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. >> acl name: to_linklocal >> configuration context: Default Configuration(16) acl >> 2026/07/17 08:18:55 kid1| Processing Configuration File: >> /etc/squid/squid.conf (depth 0) >> 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid >> 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for >> x86_64-suse-linux-gnu... >> 2026/07/17 08:18:55 kid1| Service Name: squid >> 2026/07/17 08:18:55 kid1| Process ID 3685 >> 2026/07/17 08:18:55 kid1| Process Roles: worker >> 2026/07/17 08:18:55 kid1| With 4096 file descriptors available >> 2026/07/17 08:18:55 kid1| Initializing IP Cache... >> 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 >> 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from >> /etc/resolv.conf >> 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from >> /etc/resolv.conf >> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 >> 'security_file_certgen' processes >> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 >> 'ufdbgclient' processes >> 2026/07/17 08:18:55 kid1| Logfile: opening log >> daemon:/var/log/squid/access.log >> 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log >> /var/log/squid/access.log >> 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39 >> 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite >> every 3600/3600 sec >> 2026/07/17 08:18:56 kid1| Store logging disabled >> 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated >> 311926 objects >> 2026/07/17 08:18:56 kid1| Target number of buckets: 15596 >> 2026/07/17 08:18:56 kid1| Using 16384 Store buckets >> 2026/07/17 08:18:56 kid1| Max Mem size: 983040 KB >> 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB >> 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid >> (clean log) >> 2026/07/17 08:18:56 kid1| Using Least Load store dir selection >> 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid >> 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons. >> 2026/07/17 08:18:56 kid1| HTCP Disabled. >> 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44 >> 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0 >> 2026/07/17 08:18:56 kid1| Adaptation support is off. >> 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket >> connections at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9 >> listening port: 8080 >> 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected >> non-functional IPv6 loopback. >> 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ... >> 2026/07/17 08:18:56 pinger| ICMP socket opened. >> 2026/07/17 08:18:56 pinger| ICMPv6 socket opened >> 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of >> 217945) >> 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog >> (217944 entries) >> 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk. >> 217944 Entries scanned >> 0 Invalid entries >> 0 With invalid flags >> 217944 Objects loaded >> 0 Objects expired >> 0 Objects canceled >> 0 Duplicate URLs purged >> 0 Swapfile clashes avoided >> Took 2.85 seconds (76435.29 objects/sec). >> 2026/07/17 08:18:59 kid1| Beginning Validation Procedure >> 2026/07/17 08:18:59 kid1| Completed Validation Procedure >> Validated 217930 Entries >> store_swap_size = 2764788.00 KB >> 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects >> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 >> current master transaction: master57 >> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master55 >> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master55 >> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master57 >> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master57 >> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master55 >> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master57 >> >> ........ >> >> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master57 >> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 >> current master transaction: master57 >> 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection >> problem: failure >> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 >> current master transaction: master57 >> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited >> current master transaction: master57 >> 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are >> running (need 1/5) >> active processes: 4 >> processes configured to start at (re)configuration: 5 >> current master transaction: master57 >> 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 >> 'security_file_certgen' processes >> current master transaction: master57 >> 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests >> 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections >> to finish >> 2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080 >> listening port: 8080 >> 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44 >> 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: >> daemon:/var/log/squid/access.log: error writing ((32) Broken pipe) >> connection: conn2846 local=10.0.0.18:8080 remote=10.1.0.17:53255 >> flags=1 >> 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting... >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.1.0.17:53255 flags=1 >> 2026/07/17 08:21:33 kid1| 65536 entries written so far. >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.1.0.17:53255 flags=1 >> 2026/07/17 08:21:33 kid1| 131072 entries written so far. >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.1.0.17:53255 flags=1 >> 2026/07/17 08:21:33 kid1| 196608 entries written so far. >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.1.0.17:53255 flags=1 >> 2026/07/17 08:21:33 kid1| Finished. Wrote 217944 entries. >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.1.0.17:53255 flags=1 >> 2026/07/17 08:21:33 kid1| Took 0.08 seconds (2736133.78 entries/sec). >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.16.0.7:53255 flags=1 >> 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well! >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.1.0.17:53255 flags=1 >> 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated >> abnormally. >> connection: conn2846 local=10.10.10.18:8080 >> remote=10.1.0.17:53255 flags=1 >> CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys >> Maximum Resident Size: 314320 KB >> Page faults with physical i/o: 0 >>> >>> To recreate a certificate database you should do: >>> >>> sudo rm -rf /var/cache/squid/ssl_db >>> sudo /usr/libexec/squid/security_file_certgen -c >>> -s /var/cache/squid/ssl_db -M 4MB >>> sudo chown -R squid:squid /var/cache/squid/ssl_db >>> >>> чт, 16 июл. 2026 г. в 16:36, Alex Rousskov >>> <[email protected]>: >>> >>> On 2026-07-16 01:57, Vacheslav wrote: >>> >>> > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited >>> >>> We need to figure out why your security_file_certgen helpers are >>> exiting. IIRC, those helpers have not been upgraded to report their >>> fatal failures to cache.log. There are a few tricks you can use to >>> see >>> what the problem is, but I would probably start with these three: >>> >>> 1. Run security_file_certgen with sslcrtd_program parameters >>> from the >>> command line, as Squid user. If you are lucky, it will complain >>> about >>> something before it starts waiting for the helper request. >>> >>> 2. Redirect security_file_certgen stderr (but not stdout!) output >>> into a >>> dedicated log file. It may be possible to do that right on the >>> sslcrtd_program line, without wrapping the helper into another >>> script. >>> >>> 3. Enable full debugging, reproduce the problem with a single >>> transaction, and send a link to the corresponding compressed >>> cache.log >>> file for analysis as detailed at >>> https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction >>> >>> >>> Cheers, >>> >>> Alex. >>> >>> _______________________________________________ >>> squid-users mailing list >>> [email protected] >>> https://lists.squid-cache.org/listinfo/squid-users >>> >> > --------------tmsRd40zJiC0cJr24nJ4j82v Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body text="#26a269" bgcolor="#000000"> <br> <br> <div class="moz-cite-prefix">17.07.2026 15:44, Alex Rousskov пишет:<br> </div> <blockquote type="cite" cite="mid:[email protected]">On 2026-07-17 01:31, Vacheslav wrote: <br> <br> <blockquote type="cite">16.07.2026 18:19, Andrey K пишет: <br> <blockquote type="cite">@Vacheslav: <br> > sudo /usr/libexec/squid/security_file_certgen -c -s <br> > /var/cache/squid/ssl_db/certs -M 4MB <br> You specified the wrong path (the correct one is /var/cache/squid/ssl_db ). <br> </blockquote> <br> <br> good catch: <br> now running: <br> sudo -u squid /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB <br> ^C <br> produces nothing. <br> </blockquote> <br> That lack of output is a good sign -- the helper managed to start successfully. <br> <br> <br> <blockquote type="cite">2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited <br> </blockquote> <br> Helpers are still dying, but it looks like they do it while handling traffic. <br> <br> <br> <blockquote type="cite"> <blockquote type="cite">2. Redirect security_file_certgen stderr (but not stdout!) output <br> into a dedicated log file. It may be possible to do that right on <br> the sslcrtd_program line, without wrapping the helper into another <br> script. <br> </blockquote> </blockquote> <br> <blockquote type="cite">how to do that? <br> </blockquote> <br> Try using shell redirection when specifying how to run the helper. Something along these lines may work: <br> <br> sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log <br> <br> I also recommend using a single helper for the initial tests: <br> <br> sslcrtd_children 1 startup=1 idle=1 <br> <br> <br> HTH, <br> <br> Alex. <br> <br> </blockquote> now the configuration looks like this:<br> <br> acl tls_s1_connect at_step SslBump1<br> acl tls_s2_client_hello at_step SslBump2<br> acl tls_s3_server_hello at_step SslBump3<br> <br> # define acls for sites that must not be actively bumped<br> <br> acl tls_allowed_hsts ssl::server_name .akamaihd.net<br> acl tls_allowed_hsts ssl::server_name .proxy.skko.by<br> #acl tls_server_is_bank ssl::server_name .abnamro.nl<br> #acl tls_server_is_bank ssl::server_name .abnamro.com<br> acl tls_server_is_bank ssl::server_name "/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"<br> acl tls_to_splice any-of tls_allowed_hsts tls_server_is_bank<br> <br> # TLS/SSL bumping steps<br> <br> ssl_bump peek tls_s1_connect # peek at TLS/SSL connect data<br> ssl_bump splice tls_to_splice # splice some: no active bump<br> ssl_bump stare all # stare(peek) at server<br> # properties of the webserver<br> ssl_bump bump # bump if we can (if the stare succeeded)<br> <br> ssl_bump peek tls_s1_connect<br> ssl_bump splice all<br> <br> <br> #ssl_bump peek all<br> #####3ssl_bump splice all<br> <br> <br> sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB >> /tmp/sslcrtd.error.log<br> sslcrtd_children 1 startup=1 idle=1<br> <br> ssl_bump server-first all<br> <br> sslproxy_cert_error allow all<br> <br> and it produces:<br> <br> <br> 2026/07/20 08:10:07| Removing PID file (/run/squid.pid)<br> 2026/07/20 08:10:08| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.<br> 2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled.<br> acl name: to_localhost<br> configuration context: Default Configuration(15) acl<br> 2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled.<br> acl name: to_localhost<br> configuration context: Default Configuration(15) acl<br> 2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled.<br> acl name: to_linklocal<br> configuration context: Default Configuration(16) acl<br> 2026/07/20 08:10:08| Processing Configuration File: /etc/squid/squid.conf (depth 0)<br> 2026/07/20 08:10:08| Created PID file (/run/squid.pid)<br> 2026/07/20 08:10:08 kid1| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.<br> 2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled.<br> acl name: to_localhost<br> configuration context: Default Configuration(15) acl<br> 2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled.<br> acl name: to_localhost<br> configuration context: Default Configuration(15) acl<br> 2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled.<br> acl name: to_linklocal<br> configuration context: Default Configuration(16) acl<br> 2026/07/20 08:10:08 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0)<br> 2026/07/20 08:10:09 kid1| Set Current Directory to /var/cache/squid<br> 2026/07/20 08:10:09 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu...<br> 2026/07/20 08:10:09 kid1| Service Name: squid<br> 2026/07/20 08:10:09 kid1| Process ID 151924<br> 2026/07/20 08:10:09 kid1| Process Roles: worker<br> 2026/07/20 08:10:09 kid1| With 4096 file descriptors available<br> 2026/07/20 08:10:09 kid1| Initializing IP Cache...<br> 2026/07/20 08:10:09 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7<br> 2026/07/20 08:10:09 kid1| Adding nameserver 10.16.30.46 from /etc/resolv.conf<br> 2026/07/20 08:10:09 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf<br> 2026/07/20 08:10:09 kid1| helperOpenServers: Starting 1/1 'security_file_certgen' processes<br> 2026/07/20 08:10:09 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes<br> 2026/07/20 08:10:09 kid1| Logfile: opening log daemon:/var/log/squid/access.log<br> 2026/07/20 08:10:09 kid1| Logfile Daemon: opening log /var/log/squid/access.log<br> 2026/07/20 08:10:09 kid1| Unlinkd pipe opened on FD 31<br> 2026/07/20 08:10:09 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec<br> 2026/07/20 08:10:09 kid1| Store logging disabled<br> 2026/07/20 08:10:09 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects<br> 2026/07/20 08:10:09 kid1| Target number of buckets: 15596<br> 2026/07/20 08:10:09 kid1| Using 16384 Store buckets<br> 2026/07/20 08:10:09 kid1| Max Mem size: 983040 KB<br> 2026/07/20 08:10:09 kid1| Max Swap size: 3072000 KB<br> 2026/07/20 08:10:09 kid1| Rebuilding storage in /var/cache/squid (clean log)<br> 2026/07/20 08:10:09 kid1| Using Least Load store dir selection<br> 2026/07/20 08:10:09 kid1| Set Current Directory to /var/cache/squid<br> 2026/07/20 08:10:09 kid1| Finished loading MIME types and icons.<br> 2026/07/20 08:10:09 kid1| HTCP Disabled.<br> 2026/07/20 08:10:09 kid1| Pinger socket opened on FD 36<br> 2026/07/20 08:10:09 kid1| Squid plugin modules loaded: 0<br> 2026/07/20 08:10:09 kid1| Adaptation support is off.<br> 2026/07/20 08:10:09 kid1| Accepting SSL bumped HTTP Socket connections at conn20 local=0.0.0.0:8080 remote=[::] FD 34 flags=9<br> listening port: 8080<br> 2026/07/20 08:10:09 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.<br> 2026/07/20 08:10:09 pinger| Initialising ICMP pinger ...<br> 2026/07/20 08:10:09 pinger| ICMP socket opened.<br> 2026/07/20 08:10:09 pinger| ICMPv6 socket opened<br> 2026/07/20 08:10:09 kid1| Indexing cache entries: 1.83% (4000 out of 218046)<br> 2026/07/20 08:10:12 kid1| Done reading /var/cache/squid swaplog (218045 entries)<br> 2026/07/20 08:10:12 kid1| Finished rebuilding storage from disk.<br> 218045 Entries scanned<br> 0 Invalid entries<br> 0 With invalid flags<br> 218045 Objects loaded<br> 0 Objects expired<br> 0 Objects canceled<br> 0 Duplicate URLs purged<br> 0 Swapfile clashes avoided<br> Took 2.95 seconds (73845.97 objects/sec).<br> 2026/07/20 08:10:12 kid1| Beginning Validation Procedure<br> 2026/07/20 08:10:12 kid1| Completed Validation Procedure<br> Validated 218031 Entries<br> store_swap_size = 2764796.00 KB<br> 2026/07/20 08:10:12 kid1| storeLateRelease: released 0 objects<br> 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:16 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:17 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:17 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:19 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:20 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: URL-rewrite produces invalid request: CONNECT <a class="moz-txt-link-freetext" href="https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=securepubads.g.doubleclick.net%3A443">https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=securepubads.g.doubleclick.net%3A443</a> HTTP/1.1<br> current master transaction: master57<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> problem: failure<br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1<br> current master transaction: master59<br> 2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection<br> <br> in tmp there is no sslcrtd.error.log file. there is certs-20260716-080709 folder and another folder with similar name with certs subfolder which is empty. there are also ssl_db-20260716-080509 folders with certs folder that have certs. <blockquote type="cite" cite="mid:[email protected]"><br> <blockquote type="cite">2026/07/17 08:17:35| Removing PID file (/run/squid.pid) <br> 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. <br> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. <br> acl name: to_localhost <br> configuration context: Default Configuration(15) acl <br> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. <br> acl name: to_localhost <br> configuration context: Default Configuration(15) acl <br> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. <br> acl name: to_linklocal <br> configuration context: Default Configuration(16) acl <br> 2026/07/17 08:18:54| Processing Configuration File: /etc/squid/squid.conf (depth 0) <br> 2026/07/17 08:18:55| Created PID file (/run/squid.pid) <br> 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. <br> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. <br> acl name: to_localhost <br> configuration context: Default Configuration(15) acl <br> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. <br> acl name: to_localhost <br> configuration context: Default Configuration(15) acl <br> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. <br> acl name: to_linklocal <br> configuration context: Default Configuration(16) acl <br> 2026/07/17 08:18:55 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0) <br> 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid <br> 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu... <br> 2026/07/17 08:18:55 kid1| Service Name: squid <br> 2026/07/17 08:18:55 kid1| Process ID 3685 <br> 2026/07/17 08:18:55 kid1| Process Roles: worker <br> 2026/07/17 08:18:55 kid1| With 4096 file descriptors available <br> 2026/07/17 08:18:55 kid1| Initializing IP Cache... <br> 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 <br> 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from /etc/resolv.conf <br> 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf <br> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 'security_file_certgen' processes <br> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes <br> 2026/07/17 08:18:55 kid1| Logfile: opening log daemon:/var/log/squid/access.log <br> 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log /var/log/squid/access.log <br> 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39 <br> 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec <br> 2026/07/17 08:18:56 kid1| Store logging disabled <br> 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects <br> 2026/07/17 08:18:56 kid1| Target number of buckets: 15596 <br> 2026/07/17 08:18:56 kid1| Using 16384 Store buckets <br> 2026/07/17 08:18:56 kid1| Max Mem size: 983040 KB <br> 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB <br> 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean log) <br> 2026/07/17 08:18:56 kid1| Using Least Load store dir selection <br> 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid <br> 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons. <br> 2026/07/17 08:18:56 kid1| HTCP Disabled. <br> 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44 <br> 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0 <br> 2026/07/17 08:18:56 kid1| Adaptation support is off. <br> 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9 <br> listening port: 8080 <br> 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. <br> 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ... <br> 2026/07/17 08:18:56 pinger| ICMP socket opened. <br> 2026/07/17 08:18:56 pinger| ICMPv6 socket opened <br> 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 217945) <br> 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944 entries) <br> 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk. <br> 217944 Entries scanned <br> 0 Invalid entries <br> 0 With invalid flags <br> 217944 Objects loaded <br> 0 Objects expired <br> 0 Objects canceled <br> 0 Duplicate URLs purged <br> 0 Swapfile clashes avoided <br> Took 2.85 seconds (76435.29 objects/sec). <br> 2026/07/17 08:18:59 kid1| Beginning Validation Procedure <br> 2026/07/17 08:18:59 kid1| Completed Validation Procedure <br> Validated 217930 Entries <br> store_swap_size = 2764788.00 KB <br> 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 <br> current master transaction: master57 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master55 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master55 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master57 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master57 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master55 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master57 <br> <br> ........ <br> <br> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master57 <br> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 <br> current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection <br> problem: failure <br> error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 <br> current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited <br> current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running (need 1/5) <br> active processes: 4 <br> processes configured to start at (re)configuration: 5 <br> current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 'security_file_certgen' processes <br> current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests <br> 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to finish <br> 2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080 <br> listening port: 8080 <br> 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44 <br> 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: daemon:/var/log/squid/access.log: error writing ((32) Broken pipe) <br> connection: conn2846 local=10.0.0.18:8080 remote=10.1.0.17:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting... <br> connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| 65536 entries written so far. <br> connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| 131072 entries written so far. <br> connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| 196608 entries written so far. <br> connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| Finished. Wrote 217944 entries. <br> connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| Took 0.08 seconds (2736133.78 entries/sec). <br> connection: conn2846 local=10.10.10.18:8080 remote=10.16.0.7:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well! <br> connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1 <br> 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated abnormally. <br> connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1 <br> CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys <br> Maximum Resident Size: 314320 KB <br> Page faults with physical i/o: 0 <br> <blockquote type="cite"> <br> To recreate a certificate database you should do: <br> <br> sudo rm -rf /var/cache/squid/ssl_db <br> sudo /usr/libexec/squid/security_file_certgen -c -s /var/cache/squid/ssl_db -M 4MB <br> sudo chown -R squid:squid /var/cache/squid/ssl_db <br> <br> чт, 16 июл. 2026 г. в 16:36, Alex Rousskov <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>: <br> <br> On 2026-07-16 01:57, Vacheslav wrote: <br> <br> > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited <br> <br> We need to figure out why your security_file_certgen helpers are <br> exiting. IIRC, those helpers have not been upgraded to report their <br> fatal failures to cache.log. There are a few tricks you can use to <br> see <br> what the problem is, but I would probably start with these three: <br> <br> 1. Run security_file_certgen with sslcrtd_program parameters from the <br> command line, as Squid user. If you are lucky, it will complain about <br> something before it starts waiting for the helper request. <br> <br> 2. Redirect security_file_certgen stderr (but not stdout!) output <br> into a <br> dedicated log file. It may be possible to do that right on the <br> sslcrtd_program line, without wrapping the helper into another script. <br> <br> 3. Enable full debugging, reproduce the problem with a single <br> transaction, and send a link to the corresponding compressed <br> cache.log <br> file for analysis as detailed at <br> <a class="moz-txt-link-freetext" href="https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction">https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction</a><br> <br> <br> Cheers, <br> <br> Alex. <br> <br> _______________________________________________ <br> squid-users mailing list <br> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <br> <a class="moz-txt-link-freetext" href="https://lists.squid-cache.org/listinfo/squid-users">https://lists.squid-cache.org/listinfo/squid-users</a> <br> <br> </blockquote> <br> </blockquote> <br> </blockquote> <br> </body> </html> --------------tmsRd40zJiC0cJr24nJ4j82v-- --===============0229563251922914620== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ squid-users mailing list [email protected] https://lists.squid-cache.org/listinfo/squid-users --===============0229563251922914620==--