[squid-users] ssl bump

Vacheslav m_zouhairy at ckta.by
Mon Jul 20 05:27:07 UTC 2026
Previous message (by thread): [squid-users] ssl bump
Next message (by thread): [squid-users] ssl bump
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

17.07.2026 15:44, Alex Rousskov пишет:
> On 2026-07-17 01:31, Vacheslav wrote:
>
>> 16.07.2026 18:19, Andrey K пишет:
>>> @Vacheslav:
>>> > sudo /usr/libexec/squid/security_file_certgen -c -s
>>> > /var/cache/squid/ssl_db/certs -M 4MB
>>> You specified the wrong path (the correct one is 
>>> /var/cache/squid/ssl_db ).
>>
>>
>> good catch:
>> now running:
>>   sudo -u squid /usr/libexec/squid/security_file_certgen -s 
>> /var/cache/squid/ssl_db -M 4MB
>> ^C
>> produces nothing.
>
> That lack of output is a good sign -- the helper managed to start 
> successfully.
>
>
>> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>
> Helpers are still dying, but it looks like they do it while handling 
> traffic.
>
>
>>> 2. Redirect security_file_certgen stderr (but not stdout!) output
>>> into a dedicated log file. It may be possible to do that right on
>>> the sslcrtd_program line, without wrapping the helper into another
>>> script.
>
>> how to do that?
>
> Try using shell redirection when specifying how to run the helper. 
> Something along these lines may work:
>
>     sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log
>
> I also recommend using a single helper for the initial tests:
>
>     sslcrtd_children 1 startup=1 idle=1
>
>
> HTH,
>
> Alex.
>
now the configuration looks like this:

acl     tls_s1_connect            at_step SslBump1
acl     tls_s2_client_hello     at_step SslBump2
acl     tls_s3_server_hello     at_step SslBump3

# define acls for sites that must not be actively bumped

acl     tls_allowed_hsts        ssl::server_name  .akamaihd.net
acl     tls_allowed_hsts        ssl::server_name  .proxy.skko.by
#acl     tls_server_is_bank         ssl::server_name  .abnamro.nl
#acl     tls_server_is_bank         ssl::server_name  .abnamro.com
acl     tls_server_is_bank         ssl::server_name 
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"
acl     tls_to_splice             any-of  tls_allowed_hsts        
tls_server_is_bank

# TLS/SSL bumping steps

ssl_bump         peek                tls_s1_connect         # peek at 
TLS/SSL connect data
ssl_bump         splice                 tls_to_splice        # splice 
some: no active bump
ssl_bump         stare                 all                    # 
stare(peek) at server
                                                         # properties of 
the webserver
ssl_bump         bump                                    # bump if we 
can (if the stare succeeded)

ssl_bump peek tls_s1_connect
ssl_bump splice all


#ssl_bump peek all
#####3ssl_bump splice all


sslcrtd_program /usr/libexec/squid/security_file_certgen -s 
/var/cache/squid/ssl_db -M 4MB >> /tmp/sslcrtd.error.log
sslcrtd_children 1 startup=1 idle=1

ssl_bump server-first all

sslproxy_cert_error allow all

and it produces:


2026/07/20 08:10:07| Removing PID file (/run/squid.pid)
2026/07/20 08:10:08| WARNING: BCP 177 violation. Detected non-functional 
IPv6 loopback.
2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/20 08:10:08| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_linklocal
     configuration context: Default Configuration(16) acl
2026/07/20 08:10:08| Processing Configuration File: 
/etc/squid/squid.conf (depth 0)
2026/07/20 08:10:08| Created PID file (/run/squid.pid)
2026/07/20 08:10:08 kid1| WARNING: BCP 177 violation. Detected 
non-functional IPv6 loopback.
2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/20 08:10:08 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_linklocal
     configuration context: Default Configuration(16) acl
2026/07/20 08:10:08 kid1| Processing Configuration File: 
/etc/squid/squid.conf (depth 0)
2026/07/20 08:10:09 kid1| Set Current Directory to /var/cache/squid
2026/07/20 08:10:09 kid1| Starting Squid Cache version 7.6 for 
x86_64-suse-linux-gnu...
2026/07/20 08:10:09 kid1| Service Name: squid
2026/07/20 08:10:09 kid1| Process ID 151924
2026/07/20 08:10:09 kid1| Process Roles: worker
2026/07/20 08:10:09 kid1| With 4096 file descriptors available
2026/07/20 08:10:09 kid1| Initializing IP Cache...
2026/07/20 08:10:09 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
2026/07/20 08:10:09 kid1| Adding nameserver 10.16.30.46 from 
/etc/resolv.conf
2026/07/20 08:10:09 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf
2026/07/20 08:10:09 kid1| helperOpenServers: Starting 1/1 
'security_file_certgen' processes
2026/07/20 08:10:09 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' 
processes
2026/07/20 08:10:09 kid1| Logfile: opening log 
daemon:/var/log/squid/access.log
2026/07/20 08:10:09 kid1| Logfile Daemon: opening log 
/var/log/squid/access.log
2026/07/20 08:10:09 kid1| Unlinkd pipe opened on FD 31
2026/07/20 08:10:09 kid1| Local cache digest enabled; rebuild/rewrite 
every 3600/3600 sec
2026/07/20 08:10:09 kid1| Store logging disabled
2026/07/20 08:10:09 kid1| Swap maxSize 3072000 + 983040 KB, estimated 
311926 objects
2026/07/20 08:10:09 kid1| Target number of buckets: 15596
2026/07/20 08:10:09 kid1| Using 16384 Store buckets
2026/07/20 08:10:09 kid1| Max Mem  size: 983040 KB
2026/07/20 08:10:09 kid1| Max Swap size: 3072000 KB
2026/07/20 08:10:09 kid1| Rebuilding storage in /var/cache/squid (clean log)
2026/07/20 08:10:09 kid1| Using Least Load store dir selection
2026/07/20 08:10:09 kid1| Set Current Directory to /var/cache/squid
2026/07/20 08:10:09 kid1| Finished loading MIME types and icons.
2026/07/20 08:10:09 kid1| HTCP Disabled.
2026/07/20 08:10:09 kid1| Pinger socket opened on FD 36
2026/07/20 08:10:09 kid1| Squid plugin modules loaded: 0
2026/07/20 08:10:09 kid1| Adaptation support is off.
2026/07/20 08:10:09 kid1| Accepting SSL bumped HTTP Socket connections 
at conn20 local=0.0.0.0:8080 remote=[::] FD 34 flags=9
     listening port: 8080
2026/07/20 08:10:09 pinger| WARNING: BCP 177 violation. Detected 
non-functional IPv6 loopback.
2026/07/20 08:10:09 pinger| Initialising ICMP pinger ...
2026/07/20 08:10:09 pinger| ICMP socket opened.
2026/07/20 08:10:09 pinger| ICMPv6 socket opened
2026/07/20 08:10:09 kid1| Indexing cache entries: 1.83% (4000 out of 218046)
2026/07/20 08:10:12 kid1| Done reading /var/cache/squid swaplog (218045 
entries)
2026/07/20 08:10:12 kid1| Finished rebuilding storage from disk.
      218045 Entries scanned
           0 Invalid entries
           0 With invalid flags
      218045 Objects loaded
           0 Objects expired
           0 Objects canceled
           0 Duplicate URLs purged
           0 Swapfile clashes avoided
     Took 2.95 seconds (73845.97 objects/sec).
2026/07/20 08:10:12 kid1| Beginning Validation Procedure
2026/07/20 08:10:12 kid1| Completed Validation Procedure
     Validated 218031 Entries
     store_swap_size = 2764796.00 KB
2026/07/20 08:10:12 kid1| storeLateRelease: released 0 objects
2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:12 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:13 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:16 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:17 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:17 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:19 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:20 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: URL-rewrite produces invalid request: 
CONNECT 
https://blockedhttps.urlfilterdb.com/cgi-bin/URLblocked.cgi?remark=defaultbumpedhttpsredir&allcats=!ms-data-collection,!ads,tracker,!urlshortener&clientgroup=allSystems-not-within-working-hours&category=ms-data-collection&url=securepubads.g.doubleclick.net%3A443 
HTTP/1.1
     current master transaction: master57
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:21 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master59
2026/07/20 08:10:22 kid1| ERROR: Cannot accept a TLS connection

in tmp there is no sslcrtd.error.log file. there is 
certs-20260716-080709 folder and another folder with similar name with 
certs subfolder which is empty. there are also ssl_db-20260716-080509 
folders with certs folder that have certs.
>
>> 2026/07/17 08:17:35| Removing PID file (/run/squid.pid)
>> 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected 
>> non-functional IPv6 loopback.
>> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
>>      acl name: to_localhost
>>      configuration context: Default Configuration(15) acl
>> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
>>      acl name: to_localhost
>>      configuration context: Default Configuration(15) acl
>> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
>>      acl name: to_linklocal
>>      configuration context: Default Configuration(16) acl
>> 2026/07/17 08:18:54| Processing Configuration File: 
>> /etc/squid/squid.conf (depth 0)
>> 2026/07/17 08:18:55| Created PID file (/run/squid.pid)
>> 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected 
>> non-functional IPv6 loopback.
>> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
>>      acl name: to_localhost
>>      configuration context: Default Configuration(15) acl
>> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
>>      acl name: to_localhost
>>      configuration context: Default Configuration(15) acl
>> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
>>      acl name: to_linklocal
>>      configuration context: Default Configuration(16) acl
>> 2026/07/17 08:18:55 kid1| Processing Configuration File: 
>> /etc/squid/squid.conf (depth 0)
>> 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid
>> 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for 
>> x86_64-suse-linux-gnu...
>> 2026/07/17 08:18:55 kid1| Service Name: squid
>> 2026/07/17 08:18:55 kid1| Process ID 3685
>> 2026/07/17 08:18:55 kid1| Process Roles: worker
>> 2026/07/17 08:18:55 kid1| With 4096 file descriptors available
>> 2026/07/17 08:18:55 kid1| Initializing IP Cache...
>> 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
>> 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from 
>> /etc/resolv.conf
>> 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from 
>> /etc/resolv.conf
>> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 
>> 'security_file_certgen' processes
>> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 
>> 'ufdbgclient' processes
>> 2026/07/17 08:18:55 kid1| Logfile: opening log 
>> daemon:/var/log/squid/access.log
>> 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log 
>> /var/log/squid/access.log
>> 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39
>> 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite 
>> every 3600/3600 sec
>> 2026/07/17 08:18:56 kid1| Store logging disabled
>> 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated 
>> 311926 objects
>> 2026/07/17 08:18:56 kid1| Target number of buckets: 15596
>> 2026/07/17 08:18:56 kid1| Using 16384 Store buckets
>> 2026/07/17 08:18:56 kid1| Max Mem  size: 983040 KB
>> 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB
>> 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid 
>> (clean log)
>> 2026/07/17 08:18:56 kid1| Using Least Load store dir selection
>> 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid
>> 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons.
>> 2026/07/17 08:18:56 kid1| HTCP Disabled.
>> 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44
>> 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0
>> 2026/07/17 08:18:56 kid1| Adaptation support is off.
>> 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket 
>> connections at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
>>      listening port: 8080
>> 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected 
>> non-functional IPv6 loopback.
>> 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ...
>> 2026/07/17 08:18:56 pinger| ICMP socket opened.
>> 2026/07/17 08:18:56 pinger| ICMPv6 socket opened
>> 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 
>> 217945)
>> 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog 
>> (217944 entries)
>> 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk.
>>       217944 Entries scanned
>>            0 Invalid entries
>>            0 With invalid flags
>>       217944 Objects loaded
>>            0 Objects expired
>>            0 Objects canceled
>>            0 Duplicate URLs purged
>>            0 Swapfile clashes avoided
>>      Took 2.85 seconds (76435.29 objects/sec).
>> 2026/07/17 08:18:59 kid1| Beginning Validation Procedure
>> 2026/07/17 08:18:59 kid1| Completed Validation Procedure
>>      Validated 217930 Entries
>>      store_swap_size = 2764788.00 KB
>> 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects
>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
>>      current master transaction: master57
>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master55
>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master55
>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master57
>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master57
>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master55
>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master57
>>
>> ........
>>
>> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master57
>> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>      current master transaction: master57
>> 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection
>>      problem: failure
>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
>>      current master transaction: master57
>> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>>      current master transaction: master57
>> 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are 
>> running (need 1/5)
>>      active processes: 4
>>      processes configured to start at (re)configuration: 5
>>      current master transaction: master57
>> 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 
>> 'security_file_certgen' processes
>>      current master transaction: master57
>> 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests
>> 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections 
>> to finish
>> 2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080
>>      listening port: 8080
>> 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44
>> 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: 
>> daemon:/var/log/squid/access.log: error writing ((32) Broken pipe)
>>      connection: conn2846 local=10.0.0.18:8080 remote=10.1.0.17:53255 
>> flags=1
>> 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting...
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.1.0.17:53255 flags=1
>> 2026/07/17 08:21:33 kid1|     65536 entries written so far.
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.1.0.17:53255 flags=1
>> 2026/07/17 08:21:33 kid1|    131072 entries written so far.
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.1.0.17:53255 flags=1
>> 2026/07/17 08:21:33 kid1|    196608 entries written so far.
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.1.0.17:53255 flags=1
>> 2026/07/17 08:21:33 kid1|   Finished.  Wrote 217944 entries.
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.1.0.17:53255 flags=1
>> 2026/07/17 08:21:33 kid1|   Took 0.08 seconds (2736133.78 entries/sec).
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.16.0.7:53255 flags=1
>> 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well!
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.1.0.17:53255 flags=1
>> 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated 
>> abnormally.
>>      connection: conn2846 local=10.10.10.18:8080 
>> remote=10.1.0.17:53255 flags=1
>> CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys
>> Maximum Resident Size: 314320 KB
>> Page faults with physical i/o: 0
>>>
>>> To recreate a certificate database you should do:
>>>
>>> sudo rm -rf /var/cache/squid/ssl_db
>>> sudo /usr/libexec/squid/security_file_certgen -c 
>>> -s /var/cache/squid/ssl_db -M 4MB
>>> sudo chown -R squid:squid /var/cache/squid/ssl_db
>>>
>>> чт, 16 июл. 2026 г. в 16:36, Alex Rousskov 
>>> <rousskov at measurement-factory.com>:
>>>
>>>     On 2026-07-16 01:57, Vacheslav wrote:
>>>
>>>     > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>>>
>>>     We need to figure out why your security_file_certgen helpers are
>>>     exiting. IIRC, those helpers have not been upgraded to report their
>>>     fatal failures to cache.log. There are a few tricks you can use to
>>>     see
>>>     what the problem is, but I would probably start with these three:
>>>
>>>     1. Run security_file_certgen with sslcrtd_program parameters 
>>> from the
>>>     command line, as Squid user. If you are lucky, it will complain 
>>> about
>>>     something before it starts waiting for the helper request.
>>>
>>>     2. Redirect security_file_certgen stderr (but not stdout!) output
>>>     into a
>>>     dedicated log file. It may be possible to do that right on the
>>>     sslcrtd_program line, without wrapping the helper into another 
>>> script.
>>>
>>>     3. Enable full debugging, reproduce the problem with a single
>>>     transaction, and send a link to the corresponding compressed
>>>     cache.log
>>>     file for analysis as detailed at
>>> https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction
>>>
>>>
>>>     Cheers,
>>>
>>>     Alex.
>>>
>>>     _______________________________________________
>>>     squid-users mailing list
>>> squid-users at lists.squid-cache.org
>>> https://lists.squid-cache.org/listinfo/squid-users
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20260720/cd025e3c/attachment-0001.htm>
Previous message (by thread): [squid-users] ssl bump
Next message (by thread): [squid-users] ssl bump
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
More information about the squid-users mailing list