[squid-users] ssl bump

Alex Rousskov rousskov at measurement-factory.com
Mon Jul 20 17:15:03 UTC 2026
Previous message (by thread): [squid-users] ssl bump
Next message (by thread): [squid-users] ssl bump
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On 2026-07-20 01:27, Vacheslav wrote:
> 17.07.2026 15:44, Alex Rousskov пишет:
>> On 2026-07-17 01:31, Vacheslav wrote:
>>
>>> 16.07.2026 18:19, Andrey K пишет:
>>>> @Vacheslav:
>>>> > sudo /usr/libexec/squid/security_file_certgen -c -s
>>>> > /var/cache/squid/ssl_db/certs -M 4MB
>>>> You specified the wrong path (the correct one is 
>>>> /var/cache/squid/ssl_db ).
>>>
>>>
>>> good catch:
>>> now running:
>>>   sudo -u squid /usr/libexec/squid/security_file_certgen -s 
>>> /var/cache/squid/ssl_db -M 4MB
>>> ^C
>>> produces nothing.
>>
>> That lack of output is a good sign -- the helper managed to start 
>> successfully.
>>
>>
>>> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>>
>> Helpers are still dying, but it looks like they do it while handling 
>> traffic.
>>
>>
>>>> 2. Redirect security_file_certgen stderr (but not stdout!) output
>>>> into a dedicated log file. It may be possible to do that right on
>>>> the sslcrtd_program line, without wrapping the helper into another
>>>> script.
>>
>>> how to do that?
>>
>> Try using shell redirection when specifying how to run the helper. 
>> Something along these lines may work:
>>
>>     sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log


My bad. I missed "2" to redirect stderr rather than stdout. Fixed below. 
The missing file descriptor is _not_ the reason your test is not working 
though (as detailed below).


> now the configuration looks like this:
> 
> sslcrtd_program /usr/libexec/squid/security_file_certgen -s 
> /var/cache/squid/ssl_db -M 4MB >> /tmp/sslcrtd.error.log


To capture stderr:

sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/cache/squid/ssl_db -M 4MB 2>> /tmp/sslcrtd.error.log


> in tmp there is no sslcrtd.error.log file.


AFAICT, your Squid does not start sslcrtd_program helper. What does 
"squid -v" say? If there is no '--enable-ssl-crtd' there, then you need 
to rebuild your Squid executable from scratch. Also, at least one 
http_port or https_port directive in your squid.conf should have both 
"generate-host-certificates" and "ssl-bump" options.

When done right, you should see the debugging file created in /tmp/ and, 
in cache log, Squid logging "Starting ..." lines mentioning your helper 
(similar to your existing lines for the ufdbgclient helper).


HTH,

Alex.


>>> 2026/07/17 08:17:35| Removing PID file (/run/squid.pid)
>>> 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected 
>>> non-functional IPv6 loopback.
>>> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
>>>      acl name: to_localhost
>>>      configuration context: Default Configuration(15) acl
>>> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
>>>      acl name: to_localhost
>>>      configuration context: Default Configuration(15) acl
>>> 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
>>>      acl name: to_linklocal
>>>      configuration context: Default Configuration(16) acl
>>> 2026/07/17 08:18:54| Processing Configuration File: 
>>> /etc/squid/squid.conf (depth 0)
>>> 2026/07/17 08:18:55| Created PID file (/run/squid.pid)
>>> 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected 
>>> non-functional IPv6 loopback.
>>> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
>>>      acl name: to_localhost
>>>      configuration context: Default Configuration(15) acl
>>> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
>>>      acl name: to_localhost
>>>      configuration context: Default Configuration(15) acl
>>> 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
>>>      acl name: to_linklocal
>>>      configuration context: Default Configuration(16) acl
>>> 2026/07/17 08:18:55 kid1| Processing Configuration File: 
>>> /etc/squid/squid.conf (depth 0)
>>> 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid
>>> 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for 
>>> x86_64-suse-linux-gnu...
>>> 2026/07/17 08:18:55 kid1| Service Name: squid
>>> 2026/07/17 08:18:55 kid1| Process ID 3685
>>> 2026/07/17 08:18:55 kid1| Process Roles: worker
>>> 2026/07/17 08:18:55 kid1| With 4096 file descriptors available
>>> 2026/07/17 08:18:55 kid1| Initializing IP Cache...
>>> 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
>>> 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from 
>>> /etc/resolv.conf
>>> 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from 
>>> /etc/resolv.conf
>>> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 
>>> 'security_file_certgen' processes
>>> 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 
>>> 'ufdbgclient' processes
>>> 2026/07/17 08:18:55 kid1| Logfile: opening log 
>>> daemon:/var/log/squid/access.log
>>> 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log 
>>> /var/log/squid/access.log
>>> 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39
>>> 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite 
>>> every 3600/3600 sec
>>> 2026/07/17 08:18:56 kid1| Store logging disabled
>>> 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated 
>>> 311926 objects
>>> 2026/07/17 08:18:56 kid1| Target number of buckets: 15596
>>> 2026/07/17 08:18:56 kid1| Using 16384 Store buckets
>>> 2026/07/17 08:18:56 kid1| Max Mem  size: 983040 KB
>>> 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB
>>> 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid 
>>> (clean log)
>>> 2026/07/17 08:18:56 kid1| Using Least Load store dir selection
>>> 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid
>>> 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons.
>>> 2026/07/17 08:18:56 kid1| HTCP Disabled.
>>> 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44
>>> 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0
>>> 2026/07/17 08:18:56 kid1| Adaptation support is off.
>>> 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket 
>>> connections at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
>>>      listening port: 8080
>>> 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected 
>>> non-functional IPv6 loopback.
>>> 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ...
>>> 2026/07/17 08:18:56 pinger| ICMP socket opened.
>>> 2026/07/17 08:18:56 pinger| ICMPv6 socket opened
>>> 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 
>>> 217945)
>>> 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog 
>>> (217944 entries)
>>> 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk.
>>>       217944 Entries scanned
>>>            0 Invalid entries
>>>            0 With invalid flags
>>>       217944 Objects loaded
>>>            0 Objects expired
>>>            0 Objects canceled
>>>            0 Duplicate URLs purged
>>>            0 Swapfile clashes avoided
>>>      Took 2.85 seconds (76435.29 objects/sec).
>>> 2026/07/17 08:18:59 kid1| Beginning Validation Procedure
>>> 2026/07/17 08:18:59 kid1| Completed Validation Procedure
>>>      Validated 217930 Entries
>>>      store_swap_size = 2764788.00 KB
>>> 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects
>>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
>>>      current master transaction: master57
>>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master55
>>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master55
>>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master57
>>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master57
>>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master55
>>> 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master57
>>>
>>> ........
>>>
>>> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master57
>>> 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
>>>      current master transaction: master57
>>> 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection
>>>      problem: failure
>>>      error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
>>>      current master transaction: master57
>>> 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>>>      current master transaction: master57
>>> 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are 
>>> running (need 1/5)
>>>      active processes: 4
>>>      processes configured to start at (re)configuration: 5
>>>      current master transaction: master57
>>> 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 
>>> 'security_file_certgen' processes
>>>      current master transaction: master57
>>> 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests
>>> 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections 
>>> to finish
>>> 2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080
>>>      listening port: 8080
>>> 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44
>>> 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: 
>>> daemon:/var/log/squid/access.log: error writing ((32) Broken pipe)
>>>      connection: conn2846 local=10.0.0.18:8080 remote=10.1.0.17:53255 
>>> flags=1
>>> 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting...
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.1.0.17:53255 flags=1
>>> 2026/07/17 08:21:33 kid1|     65536 entries written so far.
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.1.0.17:53255 flags=1
>>> 2026/07/17 08:21:33 kid1|    131072 entries written so far.
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.1.0.17:53255 flags=1
>>> 2026/07/17 08:21:33 kid1|    196608 entries written so far.
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.1.0.17:53255 flags=1
>>> 2026/07/17 08:21:33 kid1|   Finished.  Wrote 217944 entries.
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.1.0.17:53255 flags=1
>>> 2026/07/17 08:21:33 kid1|   Took 0.08 seconds (2736133.78 entries/sec).
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.16.0.7:53255 flags=1
>>> 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well!
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.1.0.17:53255 flags=1
>>> 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated 
>>> abnormally.
>>>      connection: conn2846 local=10.10.10.18:8080 
>>> remote=10.1.0.17:53255 flags=1
>>> CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys
>>> Maximum Resident Size: 314320 KB
>>> Page faults with physical i/o: 0
>>>>
>>>> To recreate a certificate database you should do:
>>>>
>>>> sudo rm -rf /var/cache/squid/ssl_db
>>>> sudo /usr/libexec/squid/security_file_certgen -c 
>>>> -s /var/cache/squid/ssl_db -M 4MB
>>>> sudo chown -R squid:squid /var/cache/squid/ssl_db
>>>>
>>>> чт, 16 июл. 2026 г. в 16:36, Alex Rousskov 
>>>> <rousskov at measurement-factory.com>:
>>>>
>>>>     On 2026-07-16 01:57, Vacheslav wrote:
>>>>
>>>>     > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited
>>>>
>>>>     We need to figure out why your security_file_certgen helpers are
>>>>     exiting. IIRC, those helpers have not been upgraded to report their
>>>>     fatal failures to cache.log. There are a few tricks you can use to
>>>>     see
>>>>     what the problem is, but I would probably start with these three:
>>>>
>>>>     1. Run security_file_certgen with sslcrtd_program parameters 
>>>> from the
>>>>     command line, as Squid user. If you are lucky, it will complain 
>>>> about
>>>>     something before it starts waiting for the helper request.
>>>>
>>>>     2. Redirect security_file_certgen stderr (but not stdout!) output
>>>>     into a
>>>>     dedicated log file. It may be possible to do that right on the
>>>>     sslcrtd_program line, without wrapping the helper into another 
>>>> script.
>>>>
>>>>     3. Enable full debugging, reproduce the problem with a single
>>>>     transaction, and send a link to the corresponding compressed
>>>>     cache.log
>>>>     file for analysis as detailed at
>>>> https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction
>>>>
>>>>
>>>>     Cheers,
>>>>
>>>>     Alex.
>>>>
>>>>     _______________________________________________
>>>>     squid-users mailing list
>>>> squid-users at lists.squid-cache.org
>>>> https://lists.squid-cache.org/listinfo/squid-users
>>>>
>>>
>>
>
Previous message (by thread): [squid-users] ssl bump
Next message (by thread): [squid-users] ssl bump
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
More information about the squid-users mailing list