[squid-users] ssl bump
Andrey K
ankor2023 at gmail.com
Mon Jul 20 03:50:21 UTC 2026
Hello,
*Vacheslav,*
> sudo -u squid /usr/libexec/squid/security_file_certgen -s
> /var/cache/squid/ssl_db/certs -M 4MB
> 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate
> certificates: Uninitialized SSL certificate database directory:
> /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen
> -c -s /var/cache/squid/ssl_db/certs".
> exception location: certificate_db.cc(497) load
You're still using the incorrect path: /var/cache/squid/ssl_db/certs How is
the sslcrtd_program directive configured in your squid.conf? > so far i
managed to do this: stop squid and > sudo -u squid
/usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db/certs
-M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate >
certificates: Uninitialized SSL certificate database directory: >
/var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen >
-c -s /var/cache/squid/ssl_db/certs". > exception location:
certificate_db.cc(497) load
> 16.07.2026 16:36, Alex Rousskov пишет:
>>* On 2026-07-16 01:57, Vacheslav wrote:
*>>>>>* 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited
*>>>>* We need to figure out why your security_file_certgen helpers are
*>>* exiting. IIRC, those helpers have not been upgraded to report their
*>>* fatal failures to cache.log. There are a few tricks you can use to see
*>>* what the problem is, but I would probably start with these three:
*>>>>* 1. Run security_file_certgen with sslcrtd_program parameters from the
*>>* command line, as Squid user. If you are lucky, it will complain about
*>>* something before it starts waiting for the helper request.
*
> so far i managed to do this: stop squid and
> sudo -u squid /usr/libexec/squid/security_file_certgen -s
> /var/cache/squid/ssl_db/certs -M 4MB
> 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate
> certificates: Uninitialized SSL certificate database directory:
> /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen
> -c -s /var/cache/squid/ssl_db/certs".
> exception location: certificate_db.cc(497) load
>
>
>
>
>>* 2. Redirect security_file_certgen stderr (but not stdout!) output into
*>>* a dedicated log file. It may be possible to do that right on the
*>>* sslcrtd_program line, without wrapping the helper into another script.
*>
> how to do that?
>
>>* 3. Enable full debugging, reproduce the problem with a single
*>>* transaction, and send a link to the corresponding compressed cache.log
*>>* file for analysis as detailed at
*>>* https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction
<https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction>
*>>>
>> God willing and we be living i'll try this later
пт, 17 июл. 2026 г. в 15:52, Alex Rousskov <rousskov at measurement-factory.com
>:
> On 2026-07-17 01:31, Vacheslav wrote:
>
> > 16.07.2026 18:19, Andrey K пишет:
> >> @Vacheslav:
> >> > sudo /usr/libexec/squid/security_file_certgen -c -s
> >> > /var/cache/squid/ssl_db/certs -M 4MB
> >> You specified the wrong path (the correct one is
> >> /var/cache/squid/ssl_db ).
> >
> >
> > good catch:
> > now running:
> > sudo -u squid /usr/libexec/squid/security_file_certgen -s
> > /var/cache/squid/ssl_db -M 4MB
> > ^C
> > produces nothing.
>
> That lack of output is a good sign -- the helper managed to start
> successfully.
>
>
> > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>
> Helpers are still dying, but it looks like they do it while handling
> traffic.
>
>
> >> 2. Redirect security_file_certgen stderr (but not stdout!) output
> >> into a dedicated log file. It may be possible to do that right on
> >> the sslcrtd_program line, without wrapping the helper into another
> >> script.
>
> > how to do that?
>
> Try using shell redirection when specifying how to run the helper.
> Something along these lines may work:
>
> sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log
>
> I also recommend using a single helper for the initial tests:
>
> sslcrtd_children 1 startup=1 idle=1
>
>
> HTH,
>
> Alex.
>
>
> > 2026/07/17 08:17:35| Removing PID file (/run/squid.pid)
> > 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functional
> > IPv6 loopback.
> > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
> > acl name: to_localhost
> > configuration context: Default Configuration(15) acl
> > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
> > acl name: to_localhost
> > configuration context: Default Configuration(15) acl
> > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
> > acl name: to_linklocal
> > configuration context: Default Configuration(16) acl
> > 2026/07/17 08:18:54| Processing Configuration File:
> > /etc/squid/squid.conf (depth 0)
> > 2026/07/17 08:18:55| Created PID file (/run/squid.pid)
> > 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected
> > non-functional IPv6 loopback.
> > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
> > acl name: to_localhost
> > configuration context: Default Configuration(15) acl
> > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
> > acl name: to_localhost
> > configuration context: Default Configuration(15) acl
> > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
> > acl name: to_linklocal
> > configuration context: Default Configuration(16) acl
> > 2026/07/17 08:18:55 kid1| Processing Configuration File:
> > /etc/squid/squid.conf (depth 0)
> > 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid
> > 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for
> > x86_64-suse-linux-gnu...
> > 2026/07/17 08:18:55 kid1| Service Name: squid
> > 2026/07/17 08:18:55 kid1| Process ID 3685
> > 2026/07/17 08:18:55 kid1| Process Roles: worker
> > 2026/07/17 08:18:55 kid1| With 4096 file descriptors available
> > 2026/07/17 08:18:55 kid1| Initializing IP Cache...
> > 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
> > 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from
> /etc/resolv.conf
> > 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from
> /etc/resolv.conf
> > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5
> > 'security_file_certgen' processes
> > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient'
> > processes
> > 2026/07/17 08:18:55 kid1| Logfile: opening log
> > daemon:/var/log/squid/access.log
> > 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log
> > /var/log/squid/access.log
> > 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39
> > 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite
> > every 3600/3600 sec
> > 2026/07/17 08:18:56 kid1| Store logging disabled
> > 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated
> > 311926 objects
> > 2026/07/17 08:18:56 kid1| Target number of buckets: 15596
> > 2026/07/17 08:18:56 kid1| Using 16384 Store buckets
> > 2026/07/17 08:18:56 kid1| Max Mem size: 983040 KB
> > 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB
> > 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean
> log)
> > 2026/07/17 08:18:56 kid1| Using Least Load store dir selection
> > 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid
> > 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons.
> > 2026/07/17 08:18:56 kid1| HTCP Disabled.
> > 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44
> > 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0
> > 2026/07/17 08:18:56 kid1| Adaptation support is off.
> > 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections
> > at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
> > listening port: 8080
> > 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected
> > non-functional IPv6 loopback.
> > 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ...
> > 2026/07/17 08:18:56 pinger| ICMP socket opened.
> > 2026/07/17 08:18:56 pinger| ICMPv6 socket opened
> > 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of
> 217945)
> > 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944
> > entries)
> > 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk.
> > 217944 Entries scanned
> > 0 Invalid entries
> > 0 With invalid flags
> > 217944 Objects loaded
> > 0 Objects expired
> > 0 Objects canceled
> > 0 Duplicate URLs purged
> > 0 Swapfile clashes avoided
> > Took 2.85 seconds (76435.29 objects/sec).
> > 2026/07/17 08:18:59 kid1| Beginning Validation Procedure
> > 2026/07/17 08:18:59 kid1| Completed Validation Procedure
> > Validated 217930 Entries
> > store_swap_size = 2764788.00 KB
> > 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects
> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
> > current master transaction: master57
> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master55
> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master55
> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master57
> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master57
> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master55
> > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master57
> >
> > ........
> >
> > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master57
> > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
> > current master transaction: master57
> > 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection
> > problem: failure
> > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
> > current master transaction: master57
> > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited
> > current master transaction: master57
> > 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running
> > (need 1/5)
> > active processes: 4
> > processes configured to start at (re)configuration: 5
> > current master transaction: master57
> > 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5
> > 'security_file_certgen' processes
> > current master transaction: master57
> > 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests
> > 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to
> > finish
> > 2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080
> > listening port: 8080
> > 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44
> > 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite:
> > daemon:/var/log/squid/access.log: error writing ((32) Broken pipe)
> > connection: conn2846 local=10.0.0.18:8080 remote=10.1.0.17:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting...
> > connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| 65536 entries written so far.
> > connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| 131072 entries written so far.
> > connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| 196608 entries written so far.
> > connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| Finished. Wrote 217944 entries.
> > connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| Took 0.08 seconds (2736133.78 entries/sec).
> > connection: conn2846 local=10.10.10.18:8080 remote=10.16.0.7:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well!
> > connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255
> > flags=1
> > 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated
> abnormally.
> > connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255
> > flags=1
> > CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys
> > Maximum Resident Size: 314320 KB
> > Page faults with physical i/o: 0
> >>
> >> To recreate a certificate database you should do:
> >>
> >> sudo rm -rf /var/cache/squid/ssl_db
> >> sudo /usr/libexec/squid/security_file_certgen -c
> >> -s /var/cache/squid/ssl_db -M 4MB
> >> sudo chown -R squid:squid /var/cache/squid/ssl_db
> >>
> >> чт, 16 июл. 2026 г. в 16:36, Alex Rousskov
> >> <rousskov at measurement-factory.com>:
> >>
> >> On 2026-07-16 01:57, Vacheslav wrote:
> >>
> >> > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited
> >>
> >> We need to figure out why your security_file_certgen helpers are
> >> exiting. IIRC, those helpers have not been upgraded to report their
> >> fatal failures to cache.log. There are a few tricks you can use to
> >> see
> >> what the problem is, but I would probably start with these three:
> >>
> >> 1. Run security_file_certgen with sslcrtd_program parameters from
> the
> >> command line, as Squid user. If you are lucky, it will complain
> about
> >> something before it starts waiting for the helper request.
> >>
> >> 2. Redirect security_file_certgen stderr (but not stdout!) output
> >> into a
> >> dedicated log file. It may be possible to do that right on the
> >> sslcrtd_program line, without wrapping the helper into another
> script.
> >>
> >> 3. Enable full debugging, reproduce the problem with a single
> >> transaction, and send a link to the corresponding compressed
> >> cache.log
> >> file for analysis as detailed at
> >>
> https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction
> >>
> >>
> >> Cheers,
> >>
> >> Alex.
> >>
> >> _______________________________________________
> >> squid-users mailing list
> >> squid-users at lists.squid-cache.org
> >> https://lists.squid-cache.org/listinfo/squid-users
> >>
> >
>
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> https://lists.squid-cache.org/listinfo/squid-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20260720/b6229930/attachment-0001.htm>
More information about the squid-users
mailing list