[squid-users] ssl bump

[Alex Rousskov]

On 2026-07-23 07:38, Vacheslav wrote:
> 
> 
> 23.07.2026 12:53, Andrey K пишет:
>> It seems that the logs from 2026/07/23 no longer show any 
>> security_file_certgen crashes,

I also assume that sslcrtd_program helpers no longer exit.


>> but the browser errors are still there. 
>> Is it possible that the browsers are simply rejecting the new proxy 
>> certificate because it's not trusted?

> even though i imported the new certificate, the browser was using the 
> old certificate with the same certificate name, so i reissued the new 
> der certificate and imported it into firefox and now it visible as the 
> new certificate but the websites are not opening as they display a mixed 
> certificate between the site and the squid certificate.

In a working setup, we expect:

A) A browser receiving a site certificate generated by Squid.
    This site certificate (A) is signed by CA certificate (B).

B) CA certificate in /etc/squid/certs/squid-ca-cert-key.pem
    Squid http_port configured to use certificate (B).
    Browser configured to trust certificate (B).


How does the above differ from what you observe?

Alex.


> now the conf reconfigured is:
> http_port 8080 ssl-bump  cert=/etc/squid/certs/squid-ca-cert-key.pem 
> generate-host-certificates=on dynamic_cert_mem_cache_size=8MB