Re: ssl bump
Andrey K <[email protected]> Thu, 23 Jul 2026 12:53:36 +0300
| Newsgroups | gmane.comp.web.squid.general |
|---|---|
| Message-ID | <CADJd0Y0ww6v4o6Z2VTXiVxLvDgcXxzJztX-8cDkc9S=W=KddUA@mail.gmail.com> |
--===============1776172026134425610== Content-Type: multipart/alternative; boundary="000000000000840eb60657443b93" --000000000000840eb60657443b93 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, Vacheslav, It seems that the logs from 2026/07/23 no longer show any security_file_certgen crashes, but the browser errors are still there. Is it possible that the browsers are simply rejecting the new proxy certificate because it's not trusted? On 23.07.2026=E2=80=AF08:22, Vacheslav <[email protected]> wrote: > > > 20.07.2026 20:15, Alex Rousskov =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > > On 2026-07-20 01:27, Vacheslav wrote: > > 17.07.2026 15:44, Alex Rousskov =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > > On 2026-07-17 01:31, Vacheslav wrote: > > 16.07.2026 18:19, Andrey K =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > > @Vacheslav: > > sudo /usr/libexec/squid/security_file_certgen -c -s > > /var/cache/squid/ssl_db/certs -M 4MB > You specified the wrong path (the correct one is /var/cache/squid/ssl_db > ). > > > > good catch: > now running: > sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db -M 4MB > ^C > produces nothing. > > > That lack of output is a good sign -- the helper managed to start > successfully. > > > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited > > > Helpers are still dying, but it looks like they do it while handling > traffic. > > > 2. Redirect security_file_certgen stderr (but not stdout!) output > into a dedicated log file. It may be possible to do that right on > the sslcrtd_program line, without wrapping the helper into another > script. > > > how to do that? > > > Try using shell redirection when specifying how to run the helper. > Something along these lines may work: > > sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log > > > > My bad. I missed "2" to redirect stderr rather than stdout. Fixed below. > The missing file descriptor is _not_ the reason your test is not working > though (as detailed below). > > > now the configuration looks like this: > > sslcrtd_program /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db -M 4MB >> /tmp/sslcrtd.error.log > > > > To capture stderr: > > sslcrtd_program /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db -M 4MB 2>> /tmp/sslcrtd.error.log > > > in tmp there is no sslcrtd.error.log file. > > > > AFAICT, your Squid does not start sslcrtd_program helper. What does "squi= d > -v" say? If there is no '--enable-ssl-crtd' there, then you need to rebui= ld > your Squid executable from scratch. Also, at least one http_port or > https_port directive in your squid.conf should have both > "generate-host-certificates" and "ssl-bump" options. > > > sudo squid -v | grep "enable-ssl-crtd" > ........'--enable-arp-acl' '--enable-ssl-crtd'............. > > When done right, you should see the debugging file created in /tmp/ and, > in cache log, Squid logging "Starting ..." lines mentioning your helper > (similar to your existing lines for the ufdbgclient helper). > > here is the configuration with the 8080 sslbump port open: > > > forwarded_for delete > > delay_pools 1 > delay_class 1 3 > delay_access 1 allow slower > delay_access 1 deny all > delay_parameters 1 128000/128000 -1/-1 128000/64000 > > http_access allow localnet > http_access allow localhost > > > > # And finally deny all other access to this proxy > http_access deny all > > # Squid normally listens to port 3128 > #http_port 8080 > > > > http_port 8080 ssl-bump cert=3D/etc/squid/certs/myCA.pem > generate-host-certificates=3Don dynamic_cert_mem_cache_size=3D8MB > > > > > ##acl step1 at_step SslBump1 > ##ssl_bump peek step1 > ##ssl_bump bump all > > ##sslcrtd_program /usr/libexec/squid/security_file_certgen -s > /var/lib/squid/ssl_db -M 4MB > ##sslcrtd_children 5 > > acl tls_s1_connect at_step SslBump1 > acl tls_s2_client_hello at_step SslBump2 > acl tls_s3_server_hello at_step SslBump3 > > # define acls for sites that must not be actively bumped > > acl tls_allowed_hsts ssl::server_name .akamaihd.ne= t > acl tls_allowed_hsts ssl::server_name . > proxy.skko.by > #acl tls_server_is_bank ssl::server_name . > abnamro.nl > #acl tls_server_is_bank ssl::server_name . > abnamro.com > acl tls_server_is_bank ssl::server_name > "/usr/local/ufdbguard/blacklists/finance/domains.squidsplice" > acl tls_to_splice any-of > tls_allowed_hsts tls_server_is_bank > > # TLS/SSL bumping steps > > ssl_bump peek tls_s1_connect # peek at > TLS/SSL connect data > ssl_bump splice tls_to_splice # splice > some: no active bump > ssl_bump stare all # > stare(peek) at server > # properties of > the webserver > ssl_bump bump # bump if we can > (if the stare succeeded) > > ssl_bump peek tls_s1_connect > ssl_bump splice all > > > #ssl_bump peek all > ############ssl_bump splice all > > > sslcrtd_program /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db -M 4MB 2>> /tmp/sslcrtd.error.log > sslcrtd_children 1 startup=3D1 idle=3D1 > > ssl_bump server-first all > > sslproxy_cert_error allow all > > #tls_outgoing_options options=3DNO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE > cipher=3DHIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!D= SS > > # Uncomment and adjust the following to add a disk cache directory. > # Updates: chrome and acrobat > #refresh_pattern -i gvt1.com/.*\.(exe|ms[i|u|f|p]|dat|zip|psf) > <http://gvt1.com/.*%5C.(exe%7Cms%5Bi%7Cu%7Cf%7Cp%5D%7Cdat%7Czip%7Cpsf)> > 43200 80% 129600 reload-into-ims > #refresh_pattern -i adobe.com/.*\.(exe|ms[i|u|f|p]|dat|zip|psf) > <http://adobe.com/.*%5C.(exe%7Cms%5Bi%7Cu%7Cf%7Cp%5D%7Cdat%7Czip%7Cpsf)> > 43200 80% 129600 reload-into-ims > > > > #range_offset_limit 200 MB > #maximum_object_size 200 MB > #quick_abort_min -1 > > # DONT MODIFY THESE LINES > #refresh_pattern \^ftp: 1440 20% 10080 > #refresh_pattern \^gopher: 1440 0% 1440 > #refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 > #refresh_pattern . 0 20% 43200 > > cache_dir ufs /var/cache/squid 3000 16 256 > > # Leave coredumps in the first cache dir > coredump_dir /var/cache/squid > > cache_mem 960 MB > > netdb_filename none > > logformat squidx %err_code/%err_detail > #access_log daemon:/var/log/squid/accessX.log squidx > #access_log squidx > > # > # Add any of your own refresh_pattern entries above these. > # > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 > refresh_pattern . 0 20% 4320 > > url_rewrite_extras "%>a/%>A %un %>rm bump_mode=3D%ssl::bump_mode > sni=3D\"%ssl::>sni\" referer=3D\"%{Referer}>h\"" > url_rewrite_program /usr/local/ufdbguard/bin/ufdbgclient -m 4 -l > /var/log/squid/ > url_rewrite_children 16 startup=3D8 idle=3D2 concurrency=3D4 queue-size= =3D64 > #debug_options ALL,1 33,2 28,9 > > HTH, > > Alex. > > > i finally noticed an empty sslcrtd.error.log file in /tmp created on > 20.07.2026, for some reason i was looking for a folder, stupid me. > > i'm getting certificate errors when browsing sites in firefox. some sites > provide a warning to proceed to site (dangerous) other sites just put 3 t= ab > one of them is to see the certificate. > > here is the cache.log: > > > 2026/07/23 07:32:59 kid1| Processing Configuration File: > /etc/squid/squid.conf (depth 0) > 2026/07/23 07:32:59 kid1| Set Current Directory to /var/cache/squid > 2026/07/23 07:32:59 kid1| Starting Squid Cache version 7.6 for > x86_64-suse-linux-gnu... > 2026/07/23 07:32:59 kid1| Service Name: squid > 2026/07/23 07:32:59 kid1| Process ID 3183 > 2026/07/23 07:32:59 kid1| Process Roles: worker > 2026/07/23 07:32:59 kid1| With 4096 file descriptors available > 2026/07/23 07:32:59 kid1| Initializing IP Cache... > 2026/07/23 07:32:59 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 > 2026/07/23 07:32:59 kid1| Adding nameserver 10.16.30.46 from > /etc/resolv.conf > 2026/07/23 07:32:59 kid1| Adding nameserver 10.10.10.5 from > /etc/resolv.conf > 2026/07/23 07:32:59 kid1| helperOpenServers: Starting 1/1 > 'security_file_certgen' processes > 2026/07/23 07:32:59 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' > processes > 2026/07/23 07:32:59 kid1| Logfile: opening log > daemon:/var/log/squid/access.log > 2026/07/23 07:32:59 kid1| Logfile Daemon: opening log > /var/log/squid/access.log > 2026/07/23 07:33:00 kid1| Unlinkd pipe opened on FD 31 > 2026/07/23 07:33:00 kid1| Local cache digest enabled; rebuild/rewrite > every 3600/3600 sec > 2026/07/23 07:33:00 kid1| Store logging disabled > 2026/07/23 07:33:00 kid1| Swap maxSize 3072000 + 983040 KB, estimated > 311926 objects > 2026/07/23 07:33:00 kid1| Target number of buckets: 15596 > 2026/07/23 07:33:00 kid1| Using 16384 Store buckets > 2026/07/23 07:33:00 kid1| Max Mem size: 983040 KB > 2026/07/23 07:33:00 kid1| Max Swap size: 3072000 KB > 2026/07/23 07:33:00 kid1| Rebuilding storage in /var/cache/squid (clean > log) > 2026/07/23 07:33:00 kid1| Using Least Load store dir selection > 2026/07/23 07:33:00 kid1| Set Current Directory to /var/cache/squid > 2026/07/23 07:33:00 kid1| Finished loading MIME types and icons. > 2026/07/23 07:33:00 kid1| HTCP Disabled. > 2026/07/23 07:33:00 kid1| Pinger socket opened on FD 36 > 2026/07/23 07:33:00 kid1| Squid plugin modules loaded: 0 > 2026/07/23 07:33:00 kid1| Adaptation support is off. > 2026/07/23 07:33:00 kid1| Accepting SSL bumped HTTP Socket connections at > conn20 local=3D0.0.0.0:8080 remote=3D[::] FD 34 flags=3D9 > listening port: 8080 > 2026/07/23 07:33:00 pinger| WARNING: BCP 177 violation. Detected > non-functional IPv6 loopback. > 2026/07/23 07:33:00 pinger| Initialising ICMP pinger ... > 2026/07/23 07:33:00 pinger| ICMP socket opened. > 2026/07/23 07:33:00 pinger| ICMPv6 socket opened > 2026/07/23 07:33:00 kid1| Indexing cache entries: 1.84% (4000 out of > 216863) > 2026/07/23 07:33:03 kid1| Done reading /var/cache/squid swaplog (216862 > entries) > 2026/07/23 07:33:03 kid1| Finished rebuilding storage from disk. > 216862 Entries scanned > 0 Invalid entries > 0 With invalid flags > 216862 Objects loaded > 0 Objects expired > 0 Objects canceled > 0 Duplicate URLs purged > 0 Swapfile clashes avoided > Took 3.16 seconds (68526.49 objects/sec). > 2026/07/23 07:33:03 kid1| Beginning Validation Procedure > 2026/07/23 07:33:03 kid1| Completed Validation Procedure > Validated 216848 Entries > store_swap_size =3D 2764352.00 KB > 2026/07/23 07:33:03 kid1| storeLateRelease: released 0 objects > 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ERR= =3D1 > current master transaction: master58 > 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master58 > 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master58 > ......... > > > 2026/07/17 08:17:35| Removing PID file (/run/squid.pid) > 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functional > IPv6 loopback. > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_linklocal > configuration context: Default Configuration(16) acl > 2026/07/17 08:18:54| Processing Configuration File: /etc/squid/squid.conf > (depth 0) > 2026/07/17 08:18:55| Created PID file (/run/squid.pid) > 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected > non-functional IPv6 loopback. > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_linklocal > configuration context: Default Configuration(16) acl > 2026/07/17 08:18:55 kid1| Processing Configuration File: > /etc/squid/squid.conf (depth 0) > 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid > 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for > x86_64-suse-linux-gnu... > 2026/07/17 08:18:55 kid1| Service Name: squid > 2026/07/17 08:18:55 kid1| Process ID 3685 > 2026/07/17 08:18:55 kid1| Process Roles: worker > 2026/07/17 08:18:55 kid1| With 4096 file descriptors available > 2026/07/17 08:18:55 kid1| Initializing IP Cache... > 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 > 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from > /etc/resolv.conf > 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from > /etc/resolv.conf > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 > 'security_file_certgen' processes > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' > processes > 2026/07/17 08:18:55 kid1| Logfile: opening log > daemon:/var/log/squid/access.log > 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log > /var/log/squid/access.log > 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39 > 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite > every 3600/3600 sec > 2026/07/17 08:18:56 kid1| Store logging disabled > 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated > 311926 objects > 2026/07/17 08:18:56 kid1| Target number of buckets: 15596 > 2026/07/17 08:18:56 kid1| Using 16384 Store buckets > 2026/07/17 08:18:56 kid1| Max Mem size: 983040 KB > 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB > 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean > log) > 2026/07/17 08:18:56 kid1| Using Least Load store dir selection > 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid > 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons. > 2026/07/17 08:18:56 kid1| HTCP Disabled. > 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44 > 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0 > 2026/07/17 08:18:56 kid1| Adaptation support is off. > 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections at > conn28 local=3D0.0.0.0:8080 remote=3D[::] FD 42 flags=3D9 > listening port: 8080 > 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected > non-functional IPv6 loopback. > 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ... > 2026/07/17 08:18:56 pinger| ICMP socket opened. > 2026/07/17 08:18:56 pinger| ICMPv6 socket opened > 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of > 217945) > 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944 > entries) > 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk. > 217944 Entries scanned > 0 Invalid entries > 0 With invalid flags > 217944 Objects loaded > 0 Objects expired > 0 Objects canceled > 0 Duplicate URLs purged > 0 Swapfile clashes avoided > Took 2.85 seconds (76435.29 objects/sec). > 2026/07/17 08:18:59 kid1| Beginning Validation Procedure > 2026/07/17 08:18:59 kid1| Completed Validation Procedure > Validated 217930 Entries > store_swap_size =3D 2764788.00 KB > 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ERR= =3D1 > current master transaction: master57 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master55 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master55 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master57 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master57 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master55 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master57 > > ........ > > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master57 > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR= =3D1 > current master transaction: master57 > 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ERR= =3D1 > current master transaction: master57 > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited > current master transaction: master57 > 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running > (need 1/5) > active processes: 4 > processes configured to start at (re)configuration: 5 > current master transaction: master57 > 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 > 'security_file_certgen' processes > current master transaction: master57 > 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests > 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to > finish > 2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080 > listening port: 8080 > 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44 > 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: > daemon:/var/log/squid/access.log: error writing ((32) Broken pipe) > connection: conn2846 local=3D10.0.0.18:8080 remote=3D10.1.0.17:53255 > flags=3D1 > 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting... > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:532= 55 > flags=3D1 > 2026/07/17 08:21:33 kid1| 65536 entries written so far. > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:532= 55 > flags=3D1 > 2026/07/17 08:21:33 kid1| 131072 entries written so far. > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:532= 55 > flags=3D1 > 2026/07/17 08:21:33 kid1| 196608 entries written so far. > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:532= 55 > flags=3D1 > 2026/07/17 08:21:33 kid1| Finished. Wrote 217944 entries. > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:532= 55 > flags=3D1 > 2026/07/17 08:21:33 kid1| Took 0.08 seconds (2736133.78 entries/sec). > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.16.0.7:532= 55 > flags=3D1 > 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well! > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:532= 55 > flags=3D1 > 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated > abnormally. > connection: conn2846 local=3D10.10.10.18:8080 remote=3D10.1.0.17:532= 55 > flags=3D1 > CPU Usage: 10.098 seconds =3D 7.758 user + 2.340 sys > Maximum Resident Size: 314320 KB > Page faults with physical i/o: 0 > > > To recreate a certificate database you should do: > > sudo rm -rf /var/cache/squid/ssl_db > sudo /usr/libexec/squid/security_file_certgen -c > -s /var/cache/squid/ssl_db -M 4MB > sudo chown -R squid:squid /var/cache/squid/ssl_db > > =D1=87=D1=82, 16 =D0=B8=D1=8E=D0=BB. 2026=E2=80=AF=D0=B3. =D0=B2 16:36, A= lex Rousskov > <[email protected]> <[email protected]>: > > On 2026-07-16 01:57, Vacheslav wrote: > > > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited > > We need to figure out why your security_file_certgen helpers are > exiting. IIRC, those helpers have not been upgraded to report their > fatal failures to cache.log. There are a few tricks you can use to > see > what the problem is, but I would probably start with these three: > > 1. Run security_file_certgen with sslcrtd_program parameters from the > command line, as Squid user. If you are lucky, it will complain about > something before it starts waiting for the helper request. > > 2. Redirect security_file_certgen stderr (but not stdout!) output > into a > dedicated log file. It may be possible to do that right on the > sslcrtd_program line, without wrapping the helper into another script= . > > 3. Enable full debugging, reproduce the problem with a single > transaction, and send a link to the corresponding compressed > cache.log > file for analysis as detailed at > > https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-tra= nsaction > > > Cheers, > > Alex. > > _______________________________________________ > squid-users mailing list > [email protected] > https://lists.squid-cache.org/listinfo/squid-users > > > > > > > _______________________________________________ > squid-users mailing list > [email protected] > https://lists.squid-cache.org/listinfo/squid-users > --000000000000840eb60657443b93 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr">Hello, Vacheslav,<div><br></div><div>It s= eems that the logs from 2026/07/23 no longer show any security_file_certgen= crashes, but the browser errors are still there. Is it possible that the b= rowsers are simply rejecting the new proxy certificate because it's not= trusted?</div><div><br></div><div><br></div></div><br><div class=3D"gmail_= quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On 23.07= .2026=E2=80=AF08:22, Vacheslav <<a href=3D"mailto:[email protected]">m_= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote" = style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pa= dding-left:1ex"><u></u> =20 =20 =20 <div bgcolor=3D"#000000"> <br> <br> <div>20.07.2026 20:15, Alex Rousskov =D0=BF=D0=B8=D1=88=D0=B5=D1=82:<br= > </div> <blockquote type=3D"cite">On 2026-07-20 01:27, Vacheslav wrote: <br> <blockquote type=3D"cite">17.07.2026 15:44, Alex Rousskov =D0=BF=D0= =B8=D1=88=D0=B5=D1=82: <br> <blockquote type=3D"cite">On 2026-07-17 01:31, Vacheslav wrote: <br> <br> <blockquote type=3D"cite">16.07.2026 18:19, Andrey K =D0=BF=D0=B8= =D1=88=D0=B5=D1=82: <br> <blockquote type=3D"cite">@Vacheslav: <br> > sudo /usr/libexec/squid/security_file_certgen -c -s <br> > /var/cache/squid/ssl_db/certs -M 4MB <br> You specified the wrong path (the correct one is /var/cache/squid/ssl_db ). <br> </blockquote> <br> <br> good catch: <br> now running: <br> =C2=A0=C2=A0sudo -u squid /usr/libexec/squid/security_file_cert= gen -s /var/cache/squid/ssl_db -M 4MB <br> ^C <br> produces nothing. <br> </blockquote> <br> That lack of output is a good sign -- the helper managed to start successfully. <br> <br> <br> <blockquote type=3D"cite">2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited <br> </blockquote> <br> Helpers are still dying, but it looks like they do it while handling traffic. <br> <br> <br> <blockquote type=3D"cite"> <blockquote type=3D"cite">2. Redirect security_file_certgen stderr (but not stdout!) output <br> into a dedicated log file. It may be possible to do that right on <br> the sslcrtd_program line, without wrapping the helper into another <br> script. <br> </blockquote> </blockquote> <br> <blockquote type=3D"cite">how to do that? <br> </blockquote> <br> Try using shell redirection when specifying how to run the helper. Something along these lines may work: <br> <br> =C2=A0=C2=A0=C2=A0 sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log <br> </blockquote> </blockquote> <br> <br> My bad. I missed "2" to redirect stderr rather than stdout.= Fixed below. The missing file descriptor is _not_ the reason your test is not working though (as detailed below). <br> <br> <br> <blockquote type=3D"cite">now the configuration looks like this: <br> <br> sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB >> /tmp/sslcrtd.error.log <br> </blockquote> <br> <br> To capture stderr: <br> <br> sslcrtd_program /usr/libexec/squid/security_file_certgen -s <br> /var/cache/squid/ssl_db -M 4MB 2>> /tmp/sslcrtd.error.log <br> <br> <br> <blockquote type=3D"cite">in tmp there is no sslcrtd.error.log file. <br> </blockquote> <br> <br> AFAICT, your Squid does not start sslcrtd_program helper. What does "squid -v" say? If there is no '--enable-ssl-crtd&= #39; there, then you need to rebuild your Squid executable from scratch. Also, at least one http_port or https_port directive in your squid.conf should have both "generate-host-certificates" and "ssl= -bump" options.=C2=A0<br> </blockquote> <br> sudo squid -v | grep "enable-ssl-crtd"<br> ........'--enable-arp-acl' '--enable-ssl-crtd'.........= ....<br> <br> <blockquote type=3D"cite">When done right, you should see the debugging file created in /tmp/ and, in cache log, Squid logging "Starting ..." lines menti= oning your helper (similar to your existing lines for the ufdbgclient helper).=C2=A0<br> </blockquote> here is the configuration with the 8080 sslbump port open:<br> <br> <br> forwarded_for delete<br> <br> delay_pools 1<br> delay_class 1 3<br> delay_access 1 allow slower<br> delay_access 1 deny all<br> delay_parameters 1 128000/128000 -1/-1 128000/64000<br> <br> http_access allow localnet=C2=A0<br> http_access allow localhost<br> <br> <br> <br> # And finally deny all other access to this proxy<br> http_access deny all<br> <br> # Squid normally listens to port 3128<br> #http_port 8080<br> <br> <br> <br> http_port 8080 ssl-bump=C2=A0 cert=3D/etc/squid/certs/myCA.pem generate-host-certificates=3Don dynamic_cert_mem_cache_size=3D8MB<br> <br> <br> <br> <br> ##acl step1 at_step SslBump1=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<br> ##ssl_bump peek step1=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<br> ##ssl_bump bump all<br> <br> ##sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 4MB<br> ##sslcrtd_children 5<br> <br> acl=C2=A0 =C2=A0 =C2=A0tls_s1_connect=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 at_step SslBump1<br> acl=C2=A0 =C2=A0 =C2=A0tls_s2_client_hello=C2=A0 =C2=A0 =C2=A0at_step S= slBump2<br> acl=C2=A0 =C2=A0 =C2=A0tls_s3_server_hello=C2=A0 =C2=A0 =C2=A0at_step S= slBump3<br> <br> # define acls for sites that must not be actively bumped<br> <br> acl=C2=A0 =C2=A0 =C2=A0tls_allowed_hsts=C2=A0 =C2=A0 =C2=A0 =C2=A0 ssl:= :server_name=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.<a href=3D"http://akamaihd.net" target=3D"_blank">akamaihd.net</= a><br> acl=C2=A0 =C2=A0 =C2=A0tls_allowed_hsts=C2=A0 =C2=A0 =C2=A0 =C2=A0 ssl:= :server_name=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.<a href=3D"http://proxy.skko.by" target=3D"_blank">proxy.skko.by= </a><br> #acl=C2=A0 =C2=A0 =C2=A0tls_server_is_bank=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0ssl::server_name=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.<a href=3D"http://abnamro.nl" target=3D"_blank">abnamro.nl</a><b= r> #acl=C2=A0 =C2=A0 =C2=A0tls_server_is_bank=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0ssl::server_name=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.<a href=3D"http://abnamro.com" target=3D"_blank">abnamro.com</a>= <br> acl=C2=A0 =C2=A0 =C2=A0tls_server_is_bank=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0ssl::server_name=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 "/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"= <br> acl=C2=A0 =C2=A0 =C2=A0tls_to_splice=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0any-of=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0tls_allowed_hsts=C2=A0 =C2=A0 =C2=A0 =C2=A0 tls_server_is_bank<br= > <br> # TLS/SSL bumping steps<br> <br> ssl_bump=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0peek=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 tls_s1_connect=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0# peek at TLS/SSL connect data<br> ssl_bump=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0splice=C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0tls_to_splice=C2=A0 =C2=A0 =C2=A0 = =C2=A0 # splice some: no active bump<br> ssl_bump=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0stare=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0all=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # stare(peek) at server<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # properties of the webserver<br> ssl_bump=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0bump=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 # bump if we can (if the stare succeeded)<br> <br> ssl_bump peek tls_s1_connect<br> ssl_bump splice all<br> <br> <br> #ssl_bump peek all<br> ############ssl_bump splice all<br> <br> <br> sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB 2>> /tmp/sslcrtd.error.log<br> sslcrtd_children 1 startup=3D1 idle=3D1<br> <br> ssl_bump server-first all<br> <br> sslproxy_cert_error allow all<br> <br> #tls_outgoing_options options=3DNO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE cipher=3DHIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS= <br> <br> # Uncomment and adjust the following to add a disk cache directory.<br> # Updates: chrome and acrobat<br> #refresh_pattern -i <a href=3D"http://gvt1.com/.*%5C.(exe%7Cms%5Bi%7Cu%= 7Cf%7Cp%5D%7Cdat%7Czip%7Cpsf)" target=3D"_blank">gvt1.com/.*\.(exe|ms[i|u|f= |p]|dat|zip|psf)</a> 43200 80% 129600 reload-into-ims<br> #refresh_pattern -i <a href=3D"http://adobe.com/.*%5C.(exe%7Cms%5Bi%7Cu= %7Cf%7Cp%5D%7Cdat%7Czip%7Cpsf)" target=3D"_blank">adobe.com/.*\.(exe|ms[i|u= |f|p]|dat|zip|psf)</a> 43200 80% 129600 reload-into-ims<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<br> <br> #range_offset_limit 200 MB=C2=A0<br> #maximum_object_size 200 MB<br> #quick_abort_min -1<br> <br> # DONT MODIFY THESE LINES<br> #refresh_pattern \^ftp:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01440=C2= =A0 =C2=A0 20%=C2=A0 =C2=A0 =C2=A010080<br> #refresh_pattern \^gopher:=C2=A0 =C2=A0 =C2=A0 =C2=A0 1440=C2=A0 =C2=A0= 0%=C2=A0 =C2=A0 =C2=A0 1440<br> #refresh_pattern -i (/cgi-bin/|\?) 0=C2=A0 =C2=A0 =C2=A0 0%=C2=A0 =C2= =A0 =C2=A0 0<br> #refresh_pattern .=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A00=C2=A0 =C2=A0 =C2=A0 20%=C2=A0 =C2=A0 =C2=A043200<br> <br> cache_dir ufs /var/cache/squid 3000 16 256<br> <br> # Leave coredumps in the first cache dir<br> coredump_dir /var/cache/squid<br> <br> cache_mem 960 MB<br> <br> netdb_filename none<br> <br> logformat squidx %err_code/%err_detail<br> #access_log daemon:/var/log/squid/accessX.log squidx<br> #access_log squidx<br> <br> #<br> # Add any of your own refresh_pattern entries above these.<br> #<br> refresh_pattern ^ftp:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 1440=C2=A0 =C2=A0 20%=C2=A0 =C2=A0 10080<br> refresh_pattern ^gopher:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 1440= =C2=A0 =C2=A0 0%=C2=A0 =C2=A0 1440<br> refresh_pattern -i (/cgi-bin/|\?)=C2=A0 =C2=A0 =C2=A00=C2=A0 =C2=A0 =C2= =A0 =C2=A0 0%=C2=A0 =C2=A0 0<br> refresh_pattern .=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 0=C2=A0 =C2=A0 =C2=A0 =C2=A0 20%=C2=A0 =C2=A0 4320<br> <br> url_rewrite_extras "%>a/%>A %un %>rm bump_mode=3D%ssl::bump_mode sni=3D\"%ssl::>sni\" referer=3D\"%{Referer}>h\""<br> url_rewrite_program /usr/local/ufdbguard/bin/ufdbgclient -m 4 -l /var/log/squid/<br> url_rewrite_children 16 startup=3D8 idle=3D2 concurrency=3D4 queue-size= =3D64<br> #debug_options ALL,1 33,2 28,9<br> <br> <blockquote type=3D"cite">HTH, <br> <br> Alex.=C2=A0</blockquote> <br> i finally noticed an empty sslcrtd.error.log file in /tmp created on 20.07.2026, for some reason i was looking for a folder, stupid me.<br> <br> i'm getting certificate errors when browsing sites in firefox. some sites provide a warning to proceed to site (dangerous) other sites just put 3 tab one of them is to see the certificate.<br> <br> here is the cache.log:<br> <br> <br> 2026/07/23 07:32:59 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0)<br> 2026/07/23 07:32:59 kid1| Set Current Directory to /var/cache/squid<br> 2026/07/23 07:32:59 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu...<br> 2026/07/23 07:32:59 kid1| Service Name: squid<br> 2026/07/23 07:32:59 kid1| Process ID 3183<br> 2026/07/23 07:32:59 kid1| Process Roles: worker<br> 2026/07/23 07:32:59 kid1| With 4096 file descriptors available<br> 2026/07/23 07:32:59 kid1| Initializing IP Cache...<br> 2026/07/23 07:32:59 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7<br> 2026/07/23 07:32:59 kid1| Adding nameserver 10.16.30.46 from /etc/resolv.conf<br> 2026/07/23 07:32:59 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf<br> 2026/07/23 07:32:59 kid1| helperOpenServers: Starting 1/1 'security_file_certgen' processes<br> 2026/07/23 07:32:59 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes<br> 2026/07/23 07:32:59 kid1| Logfile: opening log daemon:/var/log/squid/access.log<br> 2026/07/23 07:32:59 kid1| Logfile Daemon: opening log /var/log/squid/access.log<br> 2026/07/23 07:33:00 kid1| Unlinkd pipe opened on FD 31<br> 2026/07/23 07:33:00 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec<br> 2026/07/23 07:33:00 kid1| Store logging disabled<br> 2026/07/23 07:33:00 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects<br> 2026/07/23 07:33:00 kid1| Target number of buckets: 15596<br> 2026/07/23 07:33:00 kid1| Using 16384 Store buckets<br> 2026/07/23 07:33:00 kid1| Max Mem=C2=A0 size: 983040 KB<br> 2026/07/23 07:33:00 kid1| Max Swap size: 3072000 KB<br> 2026/07/23 07:33:00 kid1| Rebuilding storage in /var/cache/squid (clean log)<br> 2026/07/23 07:33:00 kid1| Using Least Load store dir selection<br> 2026/07/23 07:33:00 kid1| Set Current Directory to /var/cache/squid<br> 2026/07/23 07:33:00 kid1| Finished loading MIME types and icons.<br> 2026/07/23 07:33:00 kid1| HTCP Disabled.<br> 2026/07/23 07:33:00 kid1| Pinger socket opened on FD 36<br> 2026/07/23 07:33:00 kid1| Squid plugin modules loaded: 0<br> 2026/07/23 07:33:00 kid1| Adaptation support is off.<br> 2026/07/23 07:33:00 kid1| Accepting SSL bumped HTTP Socket connections at conn20 local=3D<a href=3D"http://0.0.0.0:8080" target=3D= "_blank">0.0.0.0:8080</a> remote=3D[::] FD 34 flags=3D9<br> =C2=A0 =C2=A0 listening port: 8080<br> 2026/07/23 07:33:00 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.<br> 2026/07/23 07:33:00 pinger| Initialising ICMP pinger ...<br> 2026/07/23 07:33:00 pinger| ICMP socket opened.<br> 2026/07/23 07:33:00 pinger| ICMPv6 socket opened<br> 2026/07/23 07:33:00 kid1| Indexing cache entries: 1.84% (4000 out of 216863)<br> 2026/07/23 07:33:03 kid1| Done reading /var/cache/squid swaplog (216862 entries)<br> 2026/07/23 07:33:03 kid1| Finished rebuilding storage from disk.<br> =C2=A0 =C2=A0 =C2=A0216862 Entries scanned<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Invalid entries<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 With invalid flags<br> =C2=A0 =C2=A0 =C2=A0216862 Objects loaded<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Objects expired<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Objects canceled<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Duplicate URLs purged<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Swapfile clashes avoided<br> =C2=A0 =C2=A0 Took 3.16 seconds (68526.49 objects/sec).<br> 2026/07/23 07:33:03 kid1| Beginning Validation Procedure<br> 2026/07/23 07:33:03 kid1| Completed Validation Procedure<br> =C2=A0 =C2=A0 Validated 216848 Entries<br> =C2=A0 =C2=A0 store_swap_size =3D 2764352.00 KB<br> 2026/07/23 07:33:03 kid1| storeLateRelease: released 0 objects<br> 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection<br> =C2=A0 =C2=A0 problem: failure<br> =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ERR=3D1<br> =C2=A0 =C2=A0 current master transaction: master58<br> 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection<br> =C2=A0 =C2=A0 problem: failure<br> =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1<br> =C2=A0 =C2=A0 current master transaction: master58<br> 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection<br> =C2=A0 =C2=A0 problem: failure<br> =C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1<br> =C2=A0 =C2=A0 current master transaction: master58<br> .........<br> <br> <br> <blockquote type=3D"cite"> <blockquote type=3D"cite"> <blockquote type=3D"cite"> <blockquote type=3D"cite">2026/07/17 08:17:35| Removing PID file (/run/squid.pid) <br> 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. <br> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. <br> =C2=A0=C2=A0 =C2=A0 acl name: to_localhost <br> =C2=A0=C2=A0 =C2=A0 configuration context: Default Configuratio= n(15) acl <br> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. <br> =C2=A0=C2=A0 =C2=A0 acl name: to_localhost <br> =C2=A0=C2=A0 =C2=A0 configuration context: Default Configuratio= n(15) acl <br> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. <br> =C2=A0=C2=A0 =C2=A0 acl name: to_linklocal <br> =C2=A0=C2=A0 =C2=A0 configuration context: Default Configuratio= n(16) acl <br> 2026/07/17 08:18:54| Processing Configuration File: /etc/squid/squid.conf (depth 0) <br> 2026/07/17 08:18:55| Created PID file (/run/squid.pid) <br> 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. <br> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. <br> =C2=A0=C2=A0 =C2=A0 acl name: to_localhost <br> =C2=A0=C2=A0 =C2=A0 configuration context: Default Configuratio= n(15) acl <br> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. <br> =C2=A0=C2=A0 =C2=A0 acl name: to_localhost <br> =C2=A0=C2=A0 =C2=A0 configuration context: Default Configuratio= n(15) acl <br> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. <br> =C2=A0=C2=A0 =C2=A0 acl name: to_linklocal <br> =C2=A0=C2=A0 =C2=A0 configuration context: Default Configuratio= n(16) acl <br> 2026/07/17 08:18:55 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0) <br> 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid <br> 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu... <br> 2026/07/17 08:18:55 kid1| Service Name: squid <br> 2026/07/17 08:18:55 kid1| Process ID 3685 <br> 2026/07/17 08:18:55 kid1| Process Roles: worker <br> 2026/07/17 08:18:55 kid1| With 4096 file descriptors available <br> 2026/07/17 08:18:55 kid1| Initializing IP Cache... <br> 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 <br> 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from /etc/resolv.conf <br> 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf <br> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 'security_file_certgen' processes <br> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes <br> 2026/07/17 08:18:55 kid1| Logfile: opening log daemon:/var/log/squid/access.log <br> 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log /var/log/squid/access.log <br> 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39 <br> 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec <br> 2026/07/17 08:18:56 kid1| Store logging disabled <br> 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects <br> 2026/07/17 08:18:56 kid1| Target number of buckets: 15596 <br> 2026/07/17 08:18:56 kid1| Using 16384 Store buckets <br> 2026/07/17 08:18:56 kid1| Max Mem=C2=A0 size: 983040 KB <br> 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB <br> 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean log) <br> 2026/07/17 08:18:56 kid1| Using Least Load store dir selection <br> 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid <br> 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons. <br> 2026/07/17 08:18:56 kid1| HTCP Disabled. <br> 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44 <br> 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0 <br> 2026/07/17 08:18:56 kid1| Adaptation support is off. <br> 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections at conn28 local=3D<a href=3D"http://0.0.0.0:8080" t= arget=3D"_blank">0.0.0.0:8080</a> remote=3D[::] FD 42 flags=3D9 <br> =C2=A0=C2=A0 =C2=A0 listening port: 8080 <br> 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. <br> 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ... <br> 2026/07/17 08:18:56 pinger| ICMP socket opened. <br> 2026/07/17 08:18:56 pinger| ICMPv6 socket opened <br> 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 217945) <br> 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944 entries) <br> 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk. <br> =C2=A0=C2=A0 =C2=A0 =C2=A0217944 Entries scanned <br> =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Invalid entries <br> =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 With invalid flags <br> =C2=A0=C2=A0 =C2=A0 =C2=A0217944 Objects loaded <br> =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Objects expired <br> =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Objects canceled <br> =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Duplicate URLs purge= d <br> =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 Swapfile clashes avo= ided <br> =C2=A0=C2=A0 =C2=A0 Took 2.85 seconds (76435.29 objects/sec). <br> 2026/07/17 08:18:59 kid1| Beginning Validation Procedure <br> 2026/07/17 08:18:59 kid1| Completed Validation Procedure <br> =C2=A0=C2=A0 =C2=A0 Validated 217930 Entries <br> =C2=A0=C2=A0 =C2=A0 store_swap_size =3D 2764788.00 KB <br> 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master55 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master55 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master55 <br> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> <br> ........ <br> <br> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000416+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection <br> =C2=A0=C2=A0 =C2=A0 problem: failure <br> =C2=A0=C2=A0 =C2=A0 error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=3DA000418+TLS_IO_ERR=3D1 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running (need 1/5) <br> =C2=A0=C2=A0 =C2=A0 active processes: 4 <br> =C2=A0=C2=A0 =C2=A0 processes configured to start at (re)config= uration: 5 <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 'security_file_certgen' processes <br> =C2=A0=C2=A0 =C2=A0 current master transaction: master57 <br> 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests <br> 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to finish <br> 2026/07/17 08:21:33 kid1| Closing HTTP(S) port <a href=3D"http:= //0.0.0.0:8080" target=3D"_blank">0.0.0.0:8080</a> <br> =C2=A0=C2=A0 =C2=A0 listening port: 8080 <br> 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44 <br> 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: daemon:/var/log/squid/access.log: error writing ((32) Broken pipe) <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.0.0.18:8080" target=3D"_blank">10.0.0.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting... <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0 =C2=A065536 entries writ= ten so far. <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0 131072 entries written s= o far. <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0 196608 entries written s= o far. <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0Finished.=C2=A0 Wrote 217= 944 entries. <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1|=C2=A0 =C2=A0Took 0.08 seconds (273613= 3.78 entries/sec). <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.16.0.7:53255" target=3D"_blank">1= 0.16.0.7:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well! <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated abnormally. <br> =C2=A0=C2=A0 =C2=A0 connection: conn2846 local=3D<a href=3D"htt= p://10.10.10.18:8080" target=3D"_blank">10.10.10.18:8080</a> remote=3D<a href=3D"http://10.1.0.17:53255" target=3D"_blank">1= 0.1.0.17:53255</a> flags=3D1 <br> CPU Usage: 10.098 seconds =3D 7.758 user + 2.340 sys <br> Maximum Resident Size: 314320 KB <br> Page faults with physical i/o: 0 <br> <blockquote type=3D"cite"> <br> To recreate a certificate database you should do: <br> <br> sudo rm -rf /var/cache/squid/ssl_db <br> sudo /usr/libexec/squid/security_file_certgen -c -s=C2=A0/var/cache/squid/ssl_db -M 4MB <br> sudo chown -R squid:squid /var/cache/squid/ssl_db <br> <br> =D1=87=D1=82, 16 =D0=B8=D1=8E=D0=BB. 2026=E2=80=AF=D0=B3. =D0= =B2 16:36, Alex Rousskov <a href=3D"mailto:[email protected]" target=3D= "_blank"><[email protected]></a>: <br> <br> =C2=A0=C2=A0=C2=A0 On 2026-07-16 01:57, Vacheslav wrote: <br> <br> =C2=A0=C2=A0=C2=A0 > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited <br> <br> =C2=A0=C2=A0=C2=A0 We need to figure out why your security_fi= le_certgen helpers are <br> =C2=A0=C2=A0=C2=A0 exiting. IIRC, those helpers have not been= upgraded to report their <br> =C2=A0=C2=A0=C2=A0 fatal failures to cache.log. There are a f= ew tricks you can use to <br> =C2=A0=C2=A0=C2=A0 see <br> =C2=A0=C2=A0=C2=A0 what the problem is, but I would probably = start with these three: <br> <br> =C2=A0=C2=A0=C2=A0 1. Run security_file_certgen with sslcrtd_= program parameters from the <br> =C2=A0=C2=A0=C2=A0 command line, as Squid user. If you are lu= cky, it will complain about <br> =C2=A0=C2=A0=C2=A0 something before it starts waiting for the= helper request. <br> <br> =C2=A0=C2=A0=C2=A0 2. Redirect security_file_certgen stderr (= but not stdout!) output <br> =C2=A0=C2=A0=C2=A0 into a <br> =C2=A0=C2=A0=C2=A0 dedicated log file. It may be possible to = do that right on the <br> =C2=A0=C2=A0=C2=A0 sslcrtd_program line, without wrapping the= helper into another script. <br> <br> =C2=A0=C2=A0=C2=A0 3. Enable full debugging, reproduce the pr= oblem with a single <br> =C2=A0=C2=A0=C2=A0 transaction, and send a link to the corres= ponding compressed <br> =C2=A0=C2=A0=C2=A0 cache.log <br> =C2=A0=C2=A0=C2=A0 file for analysis as detailed at <br> <a href=3D"https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-s= ingle-transaction" target=3D"_blank">https://wiki.squid-cache.org/SquidFaq/= BugReporting#debugging-a-single-transaction</a> <br> <br> <br> =C2=A0=C2=A0=C2=A0 Cheers, <br> <br> =C2=A0=C2=A0=C2=A0 Alex. <br> <br> =C2=A0=C2=A0=C2=A0 __________________________________________= _____ <br> =C2=A0=C2=A0=C2=A0 squid-users mailing list <br> <a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a> <br> <a href=3D"https://lists.squid-cache.org/listinfo/squid-users= " target=3D"_blank">https://lists.squid-cache.org/listinfo/squid-users</a> <br> <br> </blockquote> <br> </blockquote> <br> </blockquote> <br> </blockquote> <br> </blockquote> <br> </div> _______________________________________________<br> squid-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">squi= [email protected]</a><br> <a href=3D"https://lists.squid-cache.org/listinfo/squid-users" rel=3D"noref= errer" target=3D"_blank">https://lists.squid-cache.org/listinfo/squid-users= </a><br> </blockquote></div></div> --000000000000840eb60657443b93-- --===============1776172026134425610== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ squid-users mailing list [email protected] https://lists.squid-cache.org/listinfo/squid-users --===============1776172026134425610==--