[squid-users] ssl bump

[Vacheslav]

27.07.2026 07:54, Vacheslav пишет:
>
>
> 24.07.2026 16:08, Alex Rousskov пишет:
>> On 2026-07-23 07:38, Vacheslav wrote:
>>>
>>>
>>> 23.07.2026 12:53, Andrey K пишет:
>>>> It seems that the logs from 2026/07/23 no longer show any 
>>>> security_file_certgen crashes,
>>
>> I also assume that sslcrtd_program helpers no longer exit.
>>
>>
>>>> but the browser errors are still there. Is it possible that the 
>>>> browsers are simply rejecting the new proxy certificate because 
>>>> it's not trusted?
>>
>>> even though i imported the new certificate, the browser was using 
>>> the old certificate with the same certificate name, so i reissued 
>>> the new der certificate and imported it into firefox and now it 
>>> visible as the new certificate but the websites are not opening as 
>>> they display a mixed certificate between the site and the squid 
>>> certificate.
>>
>> In a working setup, we expect:
>>
>> A) A browser receiving a site certificate generated by Squid.
>>    This site certificate (A) is signed by CA certificate (B).
>>
>> B) CA certificate in /etc/squid/certs/squid-ca-cert-key.pem
>>    Squid http_port configured to use certificate (B).
>>    Browser configured to trust certificate (B).
>>
>>
>> How does the above differ from what you observe?
>>
>> Alex.
>
> i'm getting in firefox Код ошибки: SEC_ERROR_UNKNOWN_ISSUER
> i had trusted squid-ca-cert.der in firefox and now i tried to trust 
> squid-ca-cert-key.pem but it complained that it is already trusted.

some sites are opening while others complain of SEC_ERROR_UNKNOWN_ISSUER 
like linkedin and hotmail
>>
>>
>>> now the conf reconfigured is:
>>> http_port 8080 ssl-bump cert=/etc/squid/certs/squid-ca-cert-key.pem 
>>> generate-host-certificates=on dynamic_cert_mem_cache_size=8MB
>>
>>
>>
>
>
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> https://lists.squid-cache.org/listinfo/squid-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20260727/d552239f/attachment.htm>