<!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body text="#26a269" bgcolor="#000000"> <div class="moz-cite-prefix">23.07.2026 12:53, Andrey K пишет: </div> <blockquote type="cite" cite="mid:CADJd0Y0ww6v4o6Z2VTXiVxLvDgcXxzJztX-8cDkc9S=W=KddUA@mail.gmail.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr"> <div dir="ltr">Hello, Vacheslav, <div> </div> <div>It seems that the logs from 2026/07/23 no longer show any security_file_certgen crashes, but the browser errors are still there. Is it possible that the browsers are simply rejecting the new proxy certificate because it's not trusted?</div> </div> </div> </blockquote> even though i imported the new certificate, the browser was using the old certificate with the same certificate name, so i reissued the new der certificate and imported it into firefox and now it visible as the new certificate but the websites are not opening as they display a mixed certificate between the site and the squid certificate. now the conf reconfigured is: http_port 8080 ssl-bump cert=/etc/squid/certs/squid-ca-cert-key.pem generate-host-certificates=on dynamic_cert_mem_cache_size=8MB <blockquote type="cite" cite="mid:CADJd0Y0ww6v4o6Z2VTXiVxLvDgcXxzJztX-8cDkc9S=W=KddUA@mail.gmail.com"> <div dir="ltr"> <div dir="ltr"> <div> </div> </div> <div class="gmail_quote gmail_quote_container"> <div dir="ltr" class="gmail_attr">On 23.07.2026 08:22, Vacheslav <<a href="mailto:m_zouhairy@ckta.by" moz-do-not-send="true" class="moz-txt-link-freetext">m_zouhairy@ckta.by</a>> wrote: </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div bgcolor="#000000"> <div>20.07.2026 20:15, Alex Rousskov пишет: </div> <blockquote type="cite">On 2026-07-20 01:27, Vacheslav wrote: <blockquote type="cite">17.07.2026 15:44, Alex Rousskov пишет: <blockquote type="cite">On 2026-07-17 01:31, Vacheslav wrote: <blockquote type="cite">16.07.2026 18:19, Andrey K пишет: <blockquote type="cite">@Vacheslav: > sudo /usr/libexec/squid/security_file_certgen -c -s > /var/cache/squid/ssl_db/certs -M 4MB You specified the wrong path (the correct one is /var/cache/squid/ssl_db ). </blockquote> good catch: now running: sudo -u squid /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB ^C produces nothing. </blockquote> That lack of output is a good sign -- the helper managed to start successfully. <blockquote type="cite">2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited </blockquote> Helpers are still dying, but it looks like they do it while handling traffic. <blockquote type="cite"> <blockquote type="cite">2. Redirect security_file_certgen stderr (but not stdout!) output into a dedicated log file. It may be possible to do that right on the sslcrtd_program line, without wrapping the helper into another script. </blockquote> </blockquote> <blockquote type="cite">how to do that? </blockquote> Try using shell redirection when specifying how to run the helper. Something along these lines may work: sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log </blockquote> </blockquote> My bad. I missed "2" to redirect stderr rather than stdout. Fixed below. The missing file descriptor is _not_ the reason your test is not working though (as detailed below). <blockquote type="cite">now the configuration looks like this: sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB >> /tmp/sslcrtd.error.log </blockquote> To capture stderr: sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB 2>> /tmp/sslcrtd.error.log <blockquote type="cite">in tmp there is no sslcrtd.error.log file. </blockquote> AFAICT, your Squid does not start sslcrtd_program helper. What does "squid -v" say? If there is no '--enable-ssl-crtd' there, then you need to rebuild your Squid executable from scratch. Also, at least one http_port or https_port directive in your squid.conf should have both "generate-host-certificates" and "ssl-bump" options. </blockquote> sudo squid -v | grep "enable-ssl-crtd" ........'--enable-arp-acl' '--enable-ssl-crtd'............. <blockquote type="cite">When done right, you should see the debugging file created in /tmp/ and, in cache log, Squid logging "Starting ..." lines mentioning your helper (similar to your existing lines for the ufdbgclient helper). </blockquote> here is the configuration with the 8080 sslbump port open: forwarded_for delete delay_pools 1 delay_class 1 3 delay_access 1 allow slower delay_access 1 deny all delay_parameters 1 128000/128000 -1/-1 128000/64000 http_access allow localnet http_access allow localhost # And finally deny all other access to this proxy http_access deny all # Squid normally listens to port 3128 #http_port 8080 http_port 8080 ssl-bump cert=/etc/squid/certs/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=8MB ##acl step1 at_step SslBump1 ##ssl_bump peek step1 ##ssl_bump bump all ##sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 4MB ##sslcrtd_children 5 acl tls_s1_connect at_step SslBump1 acl tls_s2_client_hello at_step SslBump2 acl tls_s3_server_hello at_step SslBump3 # define acls for sites that must not be actively bumped acl tls_allowed_hsts ssl::server_name .<a href="http://akamaihd.net" target="_blank" moz-do-not-send="true">akamaihd.net</a> acl tls_allowed_hsts ssl::server_name .<a href="http://proxy.skko.by" target="_blank" moz-do-not-send="true">proxy.skko.by</a> #acl tls_server_is_bank ssl::server_name .<a href="http://abnamro.nl" target="_blank" moz-do-not-send="true">abnamro.nl</a> #acl tls_server_is_bank ssl::server_name .<a href="http://abnamro.com" target="_blank" moz-do-not-send="true">abnamro.com</a> acl tls_server_is_bank ssl::server_name "/usr/local/ufdbguard/blacklists/finance/domains.squidsplice" acl tls_to_splice any-of tls_allowed_hsts tls_server_is_bank # TLS/SSL bumping steps ssl_bump peek tls_s1_connect # peek at TLS/SSL connect data ssl_bump splice tls_to_splice # splice some: no active bump ssl_bump stare all # stare(peek) at server # properties of the webserver ssl_bump bump # bump if we can (if the stare succeeded) ssl_bump peek tls_s1_connect ssl_bump splice all #ssl_bump peek all ############ssl_bump splice all sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB 2>> /tmp/sslcrtd.error.log sslcrtd_children 1 startup=1 idle=1 ssl_bump server-first all sslproxy_cert_error allow all #tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS # Uncomment and adjust the following to add a disk cache directory. # Updates: chrome and acrobat #refresh_pattern -i <a href="http://gvt1.com/.*%5C.(exe%7Cms%5Bi%7Cu%7Cf%7Cp%5D%7Cdat%7Czip%7Cpsf)" target="_blank" moz-do-not-send="true">gvt1.com/.*\.(exe|ms[i|u|f|p]|dat|zip|psf)</a> 43200 80% 129600 reload-into-ims #refresh_pattern -i <a href="http://adobe.com/.*%5C.(exe%7Cms%5Bi%7Cu%7Cf%7Cp%5D%7Cdat%7Czip%7Cpsf)" target="_blank" moz-do-not-send="true">adobe.com/.*\.(exe|ms[i|u|f|p]|dat|zip|psf)</a> 43200 80% 129600 reload-into-ims #range_offset_limit 200 MB #maximum_object_size 200 MB #quick_abort_min -1 # DONT MODIFY THESE LINES #refresh_pattern \^ftp: 1440 20% 10080 #refresh_pattern \^gopher: 1440 0% 1440 #refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 #refresh_pattern . 0 20% 43200 cache_dir ufs /var/cache/squid 3000 16 256 # Leave coredumps in the first cache dir coredump_dir /var/cache/squid cache_mem 960 MB netdb_filename none logformat squidx %err_code/%err_detail #access_log daemon:/var/log/squid/accessX.log squidx #access_log squidx # # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 url_rewrite_extras "%>a/%>A %un %>rm bump_mode=%ssl::bump_mode sni=\"%ssl::>sni\" referer=\"%{Referer}>h\"" url_rewrite_program /usr/local/ufdbguard/bin/ufdbgclient -m 4 -l /var/log/squid/ url_rewrite_children 16 startup=8 idle=2 concurrency=4 queue-size=64 #debug_options ALL,1 33,2 28,9 <blockquote type="cite">HTH, Alex. </blockquote> i finally noticed an empty sslcrtd.error.log file in /tmp created on 20.07.2026, for some reason i was looking for a folder, stupid me. i'm getting certificate errors when browsing sites in firefox. some sites provide a warning to proceed to site (dangerous) other sites just put 3 tab one of them is to see the certificate. here is the cache.log: 2026/07/23 07:32:59 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0) 2026/07/23 07:32:59 kid1| Set Current Directory to /var/cache/squid 2026/07/23 07:32:59 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu... 2026/07/23 07:32:59 kid1| Service Name: squid 2026/07/23 07:32:59 kid1| Process ID 3183 2026/07/23 07:32:59 kid1| Process Roles: worker 2026/07/23 07:32:59 kid1| With 4096 file descriptors available 2026/07/23 07:32:59 kid1| Initializing IP Cache... 2026/07/23 07:32:59 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 2026/07/23 07:32:59 kid1| Adding nameserver 10.16.30.46 from /etc/resolv.conf 2026/07/23 07:32:59 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf 2026/07/23 07:32:59 kid1| helperOpenServers: Starting 1/1 'security_file_certgen' processes 2026/07/23 07:32:59 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes 2026/07/23 07:32:59 kid1| Logfile: opening log daemon:/var/log/squid/access.log 2026/07/23 07:32:59 kid1| Logfile Daemon: opening log /var/log/squid/access.log 2026/07/23 07:33:00 kid1| Unlinkd pipe opened on FD 31 2026/07/23 07:33:00 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec 2026/07/23 07:33:00 kid1| Store logging disabled 2026/07/23 07:33:00 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects 2026/07/23 07:33:00 kid1| Target number of buckets: 15596 2026/07/23 07:33:00 kid1| Using 16384 Store buckets 2026/07/23 07:33:00 kid1| Max Mem size: 983040 KB 2026/07/23 07:33:00 kid1| Max Swap size: 3072000 KB 2026/07/23 07:33:00 kid1| Rebuilding storage in /var/cache/squid (clean log) 2026/07/23 07:33:00 kid1| Using Least Load store dir selection 2026/07/23 07:33:00 kid1| Set Current Directory to /var/cache/squid 2026/07/23 07:33:00 kid1| Finished loading MIME types and icons. 2026/07/23 07:33:00 kid1| HTCP Disabled. 2026/07/23 07:33:00 kid1| Pinger socket opened on FD 36 2026/07/23 07:33:00 kid1| Squid plugin modules loaded: 0 2026/07/23 07:33:00 kid1| Adaptation support is off. 2026/07/23 07:33:00 kid1| Accepting SSL bumped HTTP Socket connections at conn20 local=<a href="http://0.0.0.0:8080" target="_blank" moz-do-not-send="true">0.0.0.0:8080</a> remote=[::] FD 34 flags=9 listening port: 8080 2026/07/23 07:33:00 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. 2026/07/23 07:33:00 pinger| Initialising ICMP pinger ... 2026/07/23 07:33:00 pinger| ICMP socket opened. 2026/07/23 07:33:00 pinger| ICMPv6 socket opened 2026/07/23 07:33:00 kid1| Indexing cache entries: 1.84% (4000 out of 216863) 2026/07/23 07:33:03 kid1| Done reading /var/cache/squid swaplog (216862 entries) 2026/07/23 07:33:03 kid1| Finished rebuilding storage from disk. 216862 Entries scanned 0 Invalid entries 0 With invalid flags 216862 Objects loaded 0 Objects expired 0 Objects canceled 0 Duplicate URLs purged 0 Swapfile clashes avoided Took 3.16 seconds (68526.49 objects/sec). 2026/07/23 07:33:03 kid1| Beginning Validation Procedure 2026/07/23 07:33:03 kid1| Completed Validation Procedure Validated 216848 Entries store_swap_size = 2764352.00 KB 2026/07/23 07:33:03 kid1| storeLateRelease: released 0 objects 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master58 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master58 2026/07/23 07:33:03 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master58 ......... <blockquote type="cite"> <blockquote type="cite"> <blockquote type="cite"> <blockquote type="cite">2026/07/17 08:17:35| Removing PID file (/run/squid.pid) 2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled. acl name: to_linklocal configuration context: Default Configuration(16) acl 2026/07/17 08:18:54| Processing Configuration File: /etc/squid/squid.conf (depth 0) 2026/07/17 08:18:55| Created PID file (/run/squid.pid) 2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. acl name: to_localhost configuration context: Default Configuration(15) acl 2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled. acl name: to_linklocal configuration context: Default Configuration(16) acl 2026/07/17 08:18:55 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0) 2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid 2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu... 2026/07/17 08:18:55 kid1| Service Name: squid 2026/07/17 08:18:55 kid1| Process ID 3685 2026/07/17 08:18:55 kid1| Process Roles: worker 2026/07/17 08:18:55 kid1| With 4096 file descriptors available 2026/07/17 08:18:55 kid1| Initializing IP Cache... 2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7 2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from /etc/resolv.conf 2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 'security_file_certgen' processes 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes 2026/07/17 08:18:55 kid1| Logfile: opening log daemon:/var/log/squid/access.log 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log /var/log/squid/access.log 2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39 2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec 2026/07/17 08:18:56 kid1| Store logging disabled 2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects 2026/07/17 08:18:56 kid1| Target number of buckets: 15596 2026/07/17 08:18:56 kid1| Using 16384 Store buckets 2026/07/17 08:18:56 kid1| Max Mem size: 983040 KB 2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB 2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean log) 2026/07/17 08:18:56 kid1| Using Least Load store dir selection 2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid 2026/07/17 08:18:56 kid1| Finished loading MIME types and icons. 2026/07/17 08:18:56 kid1| HTCP Disabled. 2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44 2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0 2026/07/17 08:18:56 kid1| Adaptation support is off. 2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections at conn28 local=<a href="http://0.0.0.0:8080" target="_blank" moz-do-not-send="true">0.0.0.0:8080</a> remote=[::] FD 42 flags=9 listening port: 8080 2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback. 2026/07/17 08:18:56 pinger| Initialising ICMP pinger ... 2026/07/17 08:18:56 pinger| ICMP socket opened. 2026/07/17 08:18:56 pinger| ICMPv6 socket opened 2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 217945) 2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944 entries) 2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk. 217944 Entries scanned 0 Invalid entries 0 With invalid flags 217944 Objects loaded 0 Objects expired 0 Objects canceled 0 Duplicate URLs purged 0 Swapfile clashes avoided Took 2.85 seconds (76435.29 objects/sec). 2026/07/17 08:18:59 kid1| Beginning Validation Procedure 2026/07/17 08:18:59 kid1| Completed Validation Procedure Validated 217930 Entries store_swap_size = 2764788.00 KB 2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master57 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master55 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master55 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master57 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master57 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master55 2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master57 ........ 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master57 2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1 current master transaction: master57 2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection problem: failure error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1 current master transaction: master57 2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited current master transaction: master57 2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running (need 1/5) active processes: 4 processes configured to start at (re)configuration: 5 current master transaction: master57 2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 'security_file_certgen' processes current master transaction: master57 2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests 2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to finish 2026/07/17 08:21:33 kid1| Closing HTTP(S) port <a href="http://0.0.0.0:8080" target="_blank" moz-do-not-send="true">0.0.0.0:8080</a> listening port: 8080 2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44 2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: daemon:/var/log/squid/access.log: error writing ((32) Broken pipe) connection: conn2846 local=<a href="http://10.0.0.18:8080" target="_blank" moz-do-not-send="true">10.0.0.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting... connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 2026/07/17 08:21:33 kid1| 65536 entries written so far. connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 2026/07/17 08:21:33 kid1| 131072 entries written so far. connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 2026/07/17 08:21:33 kid1| 196608 entries written so far. connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 2026/07/17 08:21:33 kid1| Finished. Wrote 217944 entries. connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 2026/07/17 08:21:33 kid1| Took 0.08 seconds (2736133.78 entries/sec). connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.16.0.7:53255" target="_blank" moz-do-not-send="true">10.16.0.7:53255</a> flags=1 2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well! connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated abnormally. connection: conn2846 local=<a href="http://10.10.10.18:8080" target="_blank" moz-do-not-send="true">10.10.10.18:8080</a> remote=<a href="http://10.1.0.17:53255" target="_blank" moz-do-not-send="true">10.1.0.17:53255</a> flags=1 CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys Maximum Resident Size: 314320 KB Page faults with physical i/o: 0 <blockquote type="cite"> To recreate a certificate database you should do: sudo rm -rf /var/cache/squid/ssl_db sudo /usr/libexec/squid/security_file_certgen -c -s /var/cache/squid/ssl_db -M 4MB sudo chown -R squid:squid /var/cache/squid/ssl_db чт, 16 июл. 2026 г. в 16:36, Alex Rousskov <a href="mailto:rousskov@measurement-factory.com" target="_blank" moz-do-not-send="true"><rousskov@measurement-factory.com></a>: On 2026-07-16 01:57, Vacheslav wrote: > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited We need to figure out why your security_file_certgen helpers are exiting. IIRC, those helpers have not been upgraded to report their fatal failures to cache.log. There are a few tricks you can use to see what the problem is, but I would probably start with these three: 1. Run security_file_certgen with sslcrtd_program parameters from the command line, as Squid user. If you are lucky, it will complain about something before it starts waiting for the helper request. 2. Redirect security_file_certgen stderr (but not stdout!) output into a dedicated log file. It may be possible to do that right on the sslcrtd_program line, without wrapping the helper into another script. 3. Enable full debugging, reproduce the problem with a single transaction, and send a link to the corresponding compressed cache.log file for analysis as detailed at <a href="https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction</a> Cheers, Alex. _______________________________________________ squid-users mailing list <a href="mailto:squid-users@lists.squid-cache.org" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">squid-users@lists.squid-cache.org</a> <a href="https://lists.squid-cache.org/listinfo/squid-users" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.squid-cache.org/listinfo/squid-users</a> </blockquote> </blockquote> </blockquote> </blockquote> </blockquote> </div> _______________________________________________ squid-users mailing list <a href="mailto:squid-users@lists.squid-cache.org" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">squid-users@lists.squid-cache.org</a> <a href="https://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.squid-cache.org/listinfo/squid-users</a> </blockquote> </div> </div> </blockquote> </body> </html>