[squid-users] ssl bump

[Vacheslav]

24.07.2026 16:08, Alex Rousskov пишет:
> On 2026-07-23 07:38, Vacheslav wrote:
>>
>>
>> 23.07.2026 12:53, Andrey K пишет:
>>> It seems that the logs from 2026/07/23 no longer show any 
>>> security_file_certgen crashes,
>
> I also assume that sslcrtd_program helpers no longer exit.
>
>
>>> but the browser errors are still there. Is it possible that the 
>>> browsers are simply rejecting the new proxy certificate because it's 
>>> not trusted?
>
>> even though i imported the new certificate, the browser was using the 
>> old certificate with the same certificate name, so i reissued the new 
>> der certificate and imported it into firefox and now it visible as 
>> the new certificate but the websites are not opening as they display 
>> a mixed certificate between the site and the squid certificate.
>
> In a working setup, we expect:
>
> A) A browser receiving a site certificate generated by Squid.
>    This site certificate (A) is signed by CA certificate (B).
>
> B) CA certificate in /etc/squid/certs/squid-ca-cert-key.pem
>    Squid http_port configured to use certificate (B).
>    Browser configured to trust certificate (B).
>
>
> How does the above differ from what you observe?
>
> Alex.

i'm getting in firefox Код ошибки: SEC_ERROR_UNKNOWN_ISSUER
i had trusted squid-ca-cert.der in firefox and now i tried to trust 
squid-ca-cert-key.pem but it complained that it is already trusted.
>
>
>> now the conf reconfigured is:
>> http_port 8080 ssl-bump cert=/etc/squid/certs/squid-ca-cert-key.pem 
>> generate-host-certificates=on dynamic_cert_mem_cache_size=8MB
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20260727/00b5d19a/attachment.htm>