[squid-users] ssl bump

Vacheslav m_zouhairy at ckta.by
Thu Jul 16 05:57:44 UTC 2026
Previous message (by thread): [squid-users] ssl bump
Next message (by thread): [squid-users] ssl bump
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

14.07.2026 18:13, Alex Rousskov пишет:
> On 2026-07-14 01:06, Vacheslav wrote: >> sudo /usr/libexec/squid/security_file_certgen -c -s /var/cache/ >> 
squid/ssl_db/certs -M 4MB Initialization SSL db... 2026/07/14 >> 
07:42:00 sslcrtd_program| FATAL: Cannot generate certificates: >> Cannot 
create /var/cache/squid/ssl_db/certs exception location: >> 
certificate_db.cc(374) Create > >> /var/cache/squid/ssl_db/certs certs 
is empty > >> how to solve the problem? > > The FATAL failure you quoted 
above is probably because "/var/cache/ > squid /ssl_db/certs" directory 
already exists. You should probably > remove that directory (and 
anything else in "/var/cache/squid/ > ssl_db") if you want to 
re-initialize the certificate database from > scratch. had to stop 
ufdbguard and squid  and delete the ssl_db folder and chown -R 
squid:squid the ssl_db folder so that would work > > >> 2026/07/14 
07:37:49 sslcrtd_program| FATAL: Cannot generate >> certificates: 
Unknown bytes unit: M > > This failure is probably a Squid 
misconfiguration: AFAICT, > Certificate generator shipped with Squid has 
two parameters that > support byte units: "-b" and "-m". Those 
parameters support "B", > "KB", "MB", "GB" byte units but not "M". > > 
The generator program name and its parameters are specified using > 
"sslcrtd_program" directive in "squid.conf". The default uses "-M > 4MB" 
parameter. I am guessing you have customized that default. > > This 
misconfiguration ought to lead to the following errors (that > you have 
also seen/shared): > >> 2026/07/14 07:37:49 kid1| WARNING: 
sslcrtd_program #Hlpr1 exited >> 2026/07/14 07:37:49 kid1| Too few 
sslcrtd_program processes are >> running (need 1/5) 2026/07/14 07:37:49 
kid1| FATAL: The >> sslcrtd_program helpers are crashing too rapidly, 
need help! > > > HTH, > > Alex. > sorry about that i failed to copy the 
whole line now it is MB.

  now the non working configuration looks like this:

http_port 8080 ssl-bump  cert=/etc/squid/certs/myCA.pem 
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB




##acl step1 at_step SslBump1
##ssl_bump peek step1
##ssl_bump bump all

#########sslcrtd_program /usr/libexec/squid/security_file_certgen -s 
/var/lib/squid/ssl_db -M 4MB
#########sslcrtd_children 5

acl     tls_s1_connect            at_step SslBump1
acl     tls_s2_client_hello     at_step SslBump2
acl     tls_s3_server_hello     at_step SslBump3

# define acls for sites that must not be actively bumped

acl     tls_allowed_hsts        ssl::server_name  .akamaihd.net
acl     tls_allowed_hsts        ssl::server_name  .proxy.skko.by
#acl     tls_server_is_bank         ssl::server_name  .abnamro.nl
#acl     tls_server_is_bank         ssl::server_name  .abnamro.com
acl     tls_server_is_bank         ssl::server_name 
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"
acl     tls_to_splice             any-of  tls_allowed_hsts        
tls_server_is_bank

# TLS/SSL bumping steps

ssl_bump         peek                tls_s1_connect         # peek at 
TLS/SSL connect data
ssl_bump         splice                 tls_to_splice        # splice 
some: no active bump
ssl_bump         stare                 all                    # 
stare(peek) at server
                                                         # properties of 
the webserver
ssl_bump         bump                                    # bump if we 
can (if the stare succeeded)

ssl_bump peek tls_s1_connect
ssl_bump splice all


#ssl_bump peek all
#######ssl_bump splice all


sslcrtd_program /usr/libexec/squid/security_file_certgen -s 
/var/cache/squid/ssl_db/certs -M 4MB
sslcrtd_children 5

ssl_bump server-first all

sslproxy_cert_error allow all

produces:

2026/07/16 08:34:21 kid1| Logfile: opening log 
daemon:/var/log/squid/access.log
2026/07/16 08:34:21 kid1| Logfile Daemon: opening log 
/var/log/squid/access.log
2026/07/16 08:34:21 kid1| Unlinkd pipe opened on FD 39
2026/07/16 08:34:21 kid1| Local cache digest enabled; rebuild/rewrite 
every 3600/3600 sec
2026/07/16 08:34:21 kid1| Store logging disabled
2026/07/16 08:34:21 kid1| Swap maxSize 3072000 + 983040 KB, estimated 
311926 objects
2026/07/16 08:34:21 kid1| Target number of buckets: 15596
2026/07/16 08:34:21 kid1| Using 16384 Store buckets
2026/07/16 08:34:21 kid1| Max Mem  size: 983040 KB
2026/07/16 08:34:21 kid1| Max Swap size: 3072000 KB
2026/07/16 08:34:21 kid1| Rebuilding storage in /var/cache/squid (clean log)
2026/07/16 08:34:21 kid1| Using Least Load store dir selection
2026/07/16 08:34:21 kid1| Set Current Directory to /var/cache/squid
2026/07/16 08:34:21 kid1| Finished loading MIME types and icons.
2026/07/16 08:34:21 kid1| HTCP Disabled.
2026/07/16 08:34:21 kid1| Pinger socket opened on FD 44
2026/07/16 08:34:21 kid1| Squid plugin modules loaded: 0
2026/07/16 08:34:21 kid1| Adaptation support is off.
2026/07/16 08:34:21 kid1| Accepting SSL bumped HTTP Socket connections 
at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
     listening port: 8080
2026/07/16 08:34:21 pinger| WARNING: BCP 177 violation. Detected 
non-functional IPv6 loopback.
2026/07/16 08:34:21 pinger| Initialising ICMP pinger ...
2026/07/16 08:34:21 pinger| ICMP socket opened.
2026/07/16 08:34:21 pinger| ICMPv6 socket opened
2026/07/16 08:34:21 kid1| Indexing cache entries: 1.84% (4000 out of 217767)
2026/07/16 08:34:24 kid1| Done reading /var/cache/squid swaplog (217766 
entries)
2026/07/16 08:34:24 kid1| Finished rebuilding storage from disk.
      217766 Entries scanned
           0 Invalid entries
           0 With invalid flags
      217766 Objects loaded
           0 Objects expired
           0 Objects canceled
           0 Duplicate URLs purged
           0 Swapfile clashes avoided
     Took 2.85 seconds (76411.43 objects/sec).
2026/07/16 08:34:24 kid1| Beginning Validation Procedure
2026/07/16 08:34:24 kid1| Completed Validation Procedure
     Validated 217752 Entries
     store_swap_size = 2764796.00 KB
2026/07/16 08:34:24 kid1| storeLateRelease: released 0 objects
2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited
2026/07/16 08:34:24 kid1| Too few sslcrtd_program processes are running 
(need 1/5)
     active processes: 4
     processes configured to start at (re)configuration: 5
2026/07/16 08:34:24 kid1| Closing HTTP(S) port 0.0.0.0:8080
     listening port: 8080
2026/07/16 08:34:24 kid1| storeDirWriteCleanLogs: Starting...
2026/07/16 08:34:24 kid1|     65536 entries written so far.
2026/07/16 08:34:25 kid1|    131072 entries written so far.
2026/07/16 08:34:25 kid1|    196608 entries written so far.
2026/07/16 08:34:25 kid1|   Finished.  Wrote 217766 entries.
2026/07/16 08:34:25 kid1|   Took 0.07 seconds (3283861.63 entries/sec).
2026/07/16 08:34:25 kid1| FATAL: The sslcrtd_program helpers are 
crashing too rapidly, need help!
2026/07/16 08:34:25 kid1| Squid Cache (Version 7.6): Terminated abnormally.
CPU Usage: 3.678 seconds = 2.249 user + 1.429 sys
Maximum Resident Size: 271856 KB
Page faults with physical i/o: 0
2026/07/16 08:34:25 kid1| Closing Pinger socket on FD 44
2026/07/16 08:34:25| Removing PID file (/run/squid.pid)

now the working configuration:

http_port 8080 ssl-bump  cert=/etc/squid/certs/myCA.pem 
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB




##acl step1 at_step SslBump1
##ssl_bump peek step1
##ssl_bump bump all

#########sslcrtd_program /usr/libexec/squid/security_file_certgen -s 
/var/lib/squid/ssl_db -M 4MB
#########sslcrtd_children 5

acl     tls_s1_connect            at_step SslBump1
acl     tls_s2_client_hello     at_step SslBump2
acl     tls_s3_server_hello     at_step SslBump3

# define acls for sites that must not be actively bumped

acl     tls_allowed_hsts        ssl::server_name  .akamaihd.net
acl     tls_allowed_hsts        ssl::server_name  .proxy.skko.by
#acl     tls_server_is_bank         ssl::server_name  .abnamro.nl
#acl     tls_server_is_bank         ssl::server_name  .abnamro.com
acl     tls_server_is_bank         ssl::server_name 
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"
acl     tls_to_splice             any-of  tls_allowed_hsts        
tls_server_is_bank

# TLS/SSL bumping steps

##ssl_bump         peek                tls_s1_connect         # peek at 
TLS/SSL connect data
##ssl_bump         splice                 tls_to_splice        # splice 
some: no active bump
##ssl_bump         stare                 all                    # 
stare(peek) at server
                                                         # properties of 
the webserver
##ssl_bump         bump                                    # bump if we 
can (if the stare succeeded)

##ssl_bump peek tls_s1_connect
##ssl_bump splice all


#ssl_bump peek all
ssl_bump splice all

produces:


2026/07/16 08:40:11| WARNING: BCP 177 violation. Detected non-functional 
IPv6 loopback.
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/16 08:40:11| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_linklocal
     configuration context: Default Configuration(16) acl
2026/07/16 08:40:11| Processing Configuration File: 
/etc/squid/squid.conf (depth 0)
2026/07/16 08:40:11| Created PID file (/run/squid.pid)
2026/07/16 08:40:11 kid1| WARNING: BCP 177 violation. Detected 
non-functional IPv6 loopback.
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/16 08:40:11 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_linklocal
     configuration context: Default Configuration(16) acl
2026/07/16 08:40:11 kid1| Processing Configuration File: 
/etc/squid/squid.conf (depth 0)
2026/07/16 08:40:12 kid1| Set Current Directory to /var/cache/squid
2026/07/16 08:40:12 kid1| Starting Squid Cache version 7.6 for 
x86_64-suse-linux-gnu...
2026/07/16 08:40:12 kid1| Service Name: squid
2026/07/16 08:40:12 kid1| Process ID 168491
2026/07/16 08:40:12 kid1| Process Roles: worker
2026/07/16 08:40:12 kid1| With 4096 file descriptors available
2026/07/16 08:40:12 kid1| Initializing IP Cache...
2026/07/16 08:40:12 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
2026/07/16 08:40:12 kid1| Adding nameserver 10.6.30.3 from /etc/resolv.conf
2026/07/16 08:40:12 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf
2026/07/16 08:40:12 kid1| helperOpenServers: Starting 5/32 
'security_file_certgen' processes
2026/07/16 08:40:12 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' 
processes
2026/07/16 08:40:12 kid1| Logfile: opening log 
daemon:/var/log/squid/access.log
2026/07/16 08:40:12 kid1| Logfile Daemon: opening log 
/var/log/squid/access.log
2026/07/16 08:40:12 kid1| Unlinkd pipe opened on FD 39
2026/07/16 08:40:12 kid1| Local cache digest enabled; rebuild/rewrite 
every 3600/3600 sec
2026/07/16 08:40:12 kid1| Store logging disabled
2026/07/16 08:40:12 kid1| Swap maxSize 3072000 + 983040 KB, estimated 
311926 objects
2026/07/16 08:40:12 kid1| Target number of buckets: 15596
2026/07/16 08:40:12 kid1| Using 16384 Store buckets
2026/07/16 08:40:12 kid1| Max Mem  size: 983040 KB
2026/07/16 08:40:12 kid1| Max Swap size: 3072000 KB
2026/07/16 08:40:12 kid1| Rebuilding storage in /var/cache/squid (clean log)
2026/07/16 08:40:12 kid1| Using Least Load store dir selection
2026/07/16 08:40:12 kid1| Set Current Directory to /var/cache/squid
2026/07/16 08:40:12 kid1| Finished loading MIME types and icons.
2026/07/16 08:40:12 kid1| HTCP Disabled.
2026/07/16 08:40:12 kid1| Pinger socket opened on FD 44
2026/07/16 08:40:12 kid1| Squid plugin modules loaded: 0
2026/07/16 08:40:12 kid1| Adaptation support is off.
2026/07/16 08:40:12 kid1| Accepting SSL bumped HTTP Socket connections 
at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
     listening port: 8080
2026/07/16 08:40:12 pinger| WARNING: BCP 177 violation. Detected 
non-functional IPv6 loopback.
2026/07/16 08:40:12 pinger| Initialising ICMP pinger ...
2026/07/16 08:40:12 pinger| ICMP socket opened.
2026/07/16 08:40:12 pinger| ICMPv6 socket opened
2026/07/16 08:40:12 kid1| Indexing cache entries: 1.84% (4000 out of 217767)
2026/07/16 08:40:15 kid1| Done reading /var/cache/squid swaplog (217766 
entries)
2026/07/16 08:40:15 kid1| Finished rebuilding storage from disk.
      217766 Entries scanned
           0 Invalid entries
           0 With invalid flags
      217766 Objects loaded
           0 Objects expired
           0 Objects canceled
           0 Duplicate URLs purged
           0 Swapfile clashes avoided
     Took 2.91 seconds (74726.47 objects/sec).
2026/07/16 08:40:15 kid1| Beginning Validation Procedure
2026/07/16 08:40:15 kid1| Completed Validation Procedure
     Validated 217752 Entries
     store_swap_size = 2764796.00 KB
2026/07/16 08:40:15 kid1| storeLateRelease: released 0 objects
2026/07/16 08:40:17 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=sb.scorecardresearch.com%3A443 
HTTP/1.1
     current master transaction: master57
2026/07/16 08:40:49 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:40:49 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:40:50 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:40:51 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=stats.g.doubleclick.net%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:40:52 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!phishtank,searchengine,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=mc.yandex.ru%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:41:36 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:41:37 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:41:38 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:41:38 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:41:39 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443 
HTTP/1.1
     current master transaction: master55
2026/07/16 08:41:39 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ms-spying,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=vortex-win.data.microsoft.com%3A443 
HTTP/1.1
     current master transaction: master55

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20260716/8ce2833f/attachment-0001.htm>
Previous message (by thread): [squid-users] ssl bump
Next message (by thread): [squid-users] ssl bump
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
More information about the squid-users mailing list