<div dir="ltr"><pre style="white-space:pre-wrap;color:rgb(0,0,0)">Hello, Vacheslav, <pre style="white-space:pre-wrap">> sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate > certificates: Uninitialized SSL certificate database directory: > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen > -c -s /var/cache/squid/ssl_db/certs". > exception location: certificate_db.cc(497) load</pre> You're still using the incorrect path: <code dir="ltr" class="gmail-KDcb0c" style="font-size:14px;margin:0px;border-bottom:0.8px solid rgb(240,242,245)">/var/cache/squid/ssl_db/certs</code> How is the <code dir="ltr" class="gmail-KDcb0c" style="font-size:14px;margin:0px;border-bottom:0.8px solid rgb(240,242,245)">sslcrtd_program</code> directive configured in your squid.conf? > so far i managed to do this: stop squid and > sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate > certificates: Uninitialized SSL certificate database directory: > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen > -c -s /var/cache/squid/ssl_db/certs". > exception location: certificate_db.cc(497) load <pre style="white-space:pre-wrap">> 16.07.2026 16:36, Alex Rousskov пишет: >> On 2026-07-16 01:57, Vacheslav wrote: >> >>> 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited >> >> We need to figure out why your security_file_certgen helpers are >> exiting. IIRC, those helpers have not been upgraded to report their >> fatal failures to cache.log. There are a few tricks you can use to see >> what the problem is, but I would probably start with these three: >> >> 1. Run security_file_certgen with sslcrtd_program parameters from the >> command line, as Squid user. If you are lucky, it will complain about >> something before it starts waiting for the helper request. > so far i managed to do this: stop squid and > sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db/certs -M 4MB > 2026/07/17 08:15:13 sslcrtd_program| FATAL: Cannot generate > certificates: Uninitialized SSL certificate database directory: > /var/cache/squid/ssl_db/certs. To initialize, run "security_file_certgen > -c -s /var/cache/squid/ssl_db/certs". > exception location: certificate_db.cc(497) load > > > > >> 2. Redirect security_file_certgen stderr (but not stdout!) output into >> a dedicated log file. It may be possible to do that right on the >> sslcrtd_program line, without wrapping the helper into another script. > > how to do that? > >> 3. Enable full debugging, reproduce the problem with a single >> transaction, and send a link to the corresponding compressed cache.log >> file for analysis as detailed at >> <a href="https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction">https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction</a> >> > >> God willing and we be living i'll try this later</pre> </pre></div> <div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">пт, 17 июл. 2026 г. в 15:52, Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com">rousskov@measurement-factory.com</a>>: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 2026-07-17 01:31, Vacheslav wrote: > 16.07.2026 18:19, Andrey K пишет: >> @Vacheslav: >> > sudo /usr/libexec/squid/security_file_certgen -c -s >> > /var/cache/squid/ssl_db/certs -M 4MB >> You specified the wrong path (the correct one is >> /var/cache/squid/ssl_db ). > > > good catch: > now running: > sudo -u squid /usr/libexec/squid/security_file_certgen -s > /var/cache/squid/ssl_db -M 4MB > ^C > produces nothing. That lack of output is a good sign -- the helper managed to start successfully. > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited Helpers are still dying, but it looks like they do it while handling traffic. >> 2. Redirect security_file_certgen stderr (but not stdout!) output >> into a dedicated log file. It may be possible to do that right on >> the sslcrtd_program line, without wrapping the helper into another >> script. > how to do that? Try using shell redirection when specifying how to run the helper. Something along these lines may work: sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log I also recommend using a single helper for the initial tests: sslcrtd_children 1 startup=1 idle=1 HTH, Alex. > 2026/07/17 08:17:35| Removing PID file (/run/squid.pid) > 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functional > IPv6 loopback. > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_linklocal > configuration context: Default Configuration(16) acl > 2026/07/17 08:18:54| Processing Configuration File: > /etc/squid/squid.conf (depth 0) > 2026/07/17 08:18:55| Created PID file (/run/squid.pid) > 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected > non-functional IPv6 loopback. > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_localhost > configuration context: Default Configuration(15) acl > 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. > acl name: to_linklocal > configuration context: Default Configuration(16) acl > 2026/07/17 08:18:55 kid1| Processing Configuration File: > /etc/squid/squid.conf (depth 0) > 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid > 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for > x86_64-suse-linux-gnu... > 2026/07/17 08:18:55 kid1| Service Name: squid > 2026/07/17 08:18:55 kid1| Process ID 3685 > 2026/07/17 08:18:55 kid1| Process Roles: worker > 2026/07/17 08:18:55 kid1| With 4096 file descriptors available > 2026/07/17 08:18:55 kid1| Initializing IP Cache... > 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 > 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from /etc/resolv.conf > 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 > 'security_file_certgen' processes > 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' > processes > 2026/07/17 08:18:55 kid1| Logfile: opening log > daemon:/var/log/squid/access.log > 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log > /var/log/squid/access.log > 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39 > 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite > every 3600/3600 sec > 2026/07/17 08:18:56 kid1| Store logging disabled > 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated > 311926 objects > 2026/07/17 08:18:56 kid1| Target number of buckets: 15596 > 2026/07/17 08:18:56 kid1| Using 16384 Store buckets > 2026/07/17 08:18:56 kid1| Max Mem size: 983040 KB > 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB > 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean log) > 2026/07/17 08:18:56 kid1| Using Least Load store dir selection > 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid > 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons. > 2026/07/17 08:18:56 kid1| HTCP Disabled. > 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44 > 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0 > 2026/07/17 08:18:56 kid1| Adaptation support is off. > 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections > at conn28 local=<a href="http://0.0.0.0:8080" rel="noreferrer" target="_blank">0.0.0.0:8080</a> remote=[::] FD 42 flags=9 > listening port: 8080 > 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected > non-functional IPv6 loopback. > 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ... > 2026/07/17 08:18:56 pinger| ICMP socket opened. > 2026/07/17 08:18:56 pinger| ICMPv6 socket opened > 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 217945) > 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944 > entries) > 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk. > 217944 Entries scanned > 0 Invalid entries > 0 With invalid flags > 217944 Objects loaded > 0 Objects expired > 0 Objects canceled > 0 Duplicate URLs purged > 0 Swapfile clashes avoided > Took 2.85 seconds (76435.29 objects/sec). > 2026/07/17 08:18:59 kid1| Beginning Validation Procedure > 2026/07/17 08:18:59 kid1| Completed Validation Procedure > Validated 217930 Entries > store_swap_size = 2764788.00 KB > 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 > current master transaction: master57 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master55 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master55 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master57 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master57 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master55 > 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master57 > > ........ > > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master57 > 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 > current master transaction: master57 > 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection > problem: failure > error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 > current master transaction: master57 > 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited > current master transaction: master57 > 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running > (need 1/5) > active processes: 4 > processes configured to start at (re)configuration: 5 > current master transaction: master57 > 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 > 'security_file_certgen' processes > current master transaction: master57 > 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests > 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to > finish > 2026/07/17 08:21:33 kid1| Closing HTTP(S) port <a href="http://0.0.0.0:8080" rel="noreferrer" target="_blank">0.0.0.0:8080</a> > listening port: 8080 > 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44 > 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: > daemon:/var/log/squid/access.log: error writing ((32) Broken pipe) > connection: conn2846 local=<a href="http://10.0.0.18:8080" rel="noreferrer" target="_blank">10.0.0.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting... > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| 65536 entries written so far. > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| 131072 entries written so far. > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| 196608 entries written so far. > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| Finished. Wrote 217944 entries. > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| Took 0.08 seconds (2736133.78 entries/sec). > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.16.0.7:53255" rel="noreferrer" target="_blank">10.16.0.7:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well! > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated abnormally. > connection: conn2846 local=<a href="http://10.10.10.18:8080" rel="noreferrer" target="_blank">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" rel="noreferrer" target="_blank">10.1.0.17:53255</a> > flags=1 > CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys > Maximum Resident Size: 314320 KB > Page faults with physical i/o: 0 >> >> To recreate a certificate database you should do: >> >> sudo rm -rf /var/cache/squid/ssl_db >> sudo /usr/libexec/squid/security_file_certgen -c >> -s /var/cache/squid/ssl_db -M 4MB >> sudo chown -R squid:squid /var/cache/squid/ssl_db >> >> чт, 16 июл. 2026 г. в 16:36, Alex Rousskov >> <<a href="mailto:rousskov@measurement-factory.com" target="_blank">rousskov@measurement-factory.com</a>>: >> >> On 2026-07-16 01:57, Vacheslav wrote: >> >> > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited >> >> We need to figure out why your security_file_certgen helpers are >> exiting. IIRC, those helpers have not been upgraded to report their >> fatal failures to cache.log. There are a few tricks you can use to >> see >> what the problem is, but I would probably start with these three: >> >> 1. Run security_file_certgen with sslcrtd_program parameters from the >> command line, as Squid user. If you are lucky, it will complain about >> something before it starts waiting for the helper request. >> >> 2. Redirect security_file_certgen stderr (but not stdout!) output >> into a >> dedicated log file. It may be possible to do that right on the >> sslcrtd_program line, without wrapping the helper into another script. >> >> 3. Enable full debugging, reproduce the problem with a single >> transaction, and send a link to the corresponding compressed >> cache.log >> file for analysis as detailed at >> <a href="https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction" rel="noreferrer" target="_blank">https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction</a> >> >> >> Cheers, >> >> Alex. >> >> _______________________________________________ >> squid-users mailing list >> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a> >> <a href="https://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">https://lists.squid-cache.org/listinfo/squid-users</a> >> > _______________________________________________ squid-users mailing list <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a> <a href="https://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">https://lists.squid-cache.org/listinfo/squid-users</a> </blockquote></div>