<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#26a269" bgcolor="#000000">
<br>
<br>
<div class="moz-cite-prefix">24.07.2026 16:08, Alex Rousskov пишет:<br>
</div>
<blockquote type="cite"
cite="mid:6b09165f-a841-4762-a11c-6f49ba4053be@measurement-factory.com">On
2026-07-23 07:38, Vacheslav wrote:
<br>
<blockquote type="cite">
<br>
<br>
23.07.2026 12:53, Andrey K пишет:
<br>
<blockquote type="cite">It seems that the logs from 2026/07/23
no longer show any security_file_certgen crashes,
<br>
</blockquote>
</blockquote>
<br>
I also assume that sslcrtd_program helpers no longer exit.
<br>
<br>
<br>
<blockquote type="cite">
<blockquote type="cite">but the browser errors are still there.
Is it possible that the browsers are simply rejecting the new
proxy certificate because it's not trusted?
<br>
</blockquote>
</blockquote>
<br>
<blockquote type="cite">even though i imported the new
certificate, the browser was using the old certificate with the
same certificate name, so i reissued the new der certificate and
imported it into firefox and now it visible as the new
certificate but the websites are not opening as they display a
mixed certificate between the site and the squid certificate.
<br>
</blockquote>
<br>
In a working setup, we expect:
<br>
<br>
A) A browser receiving a site certificate generated by Squid.
<br>
This site certificate (A) is signed by CA certificate (B).
<br>
<br>
B) CA certificate in /etc/squid/certs/squid-ca-cert-key.pem
<br>
Squid http_port configured to use certificate (B).
<br>
Browser configured to trust certificate (B).
<br>
<br>
<br>
How does the above differ from what you observe?
<br>
<br>
Alex. <br>
</blockquote>
<br>
i'm getting in firefox <a id="errorCode"
data-l10n-id="fp-cert-error-code" data-l10n-name="error-code-link"
data-telemetry-id="error_code_link"
data-l10n-args="{"error": "SEC_ERROR_UNKNOWN_ISSUER"}">Код
ошибки: SEC_ERROR_UNKNOWN_ISSUER<br>
i had trusted squid-ca-cert.der in firefox and now i tried to
trust squid-ca-cert-key.pem but it complained that it is already
trusted.</a>
<blockquote type="cite"
cite="mid:6b09165f-a841-4762-a11c-6f49ba4053be@measurement-factory.com"><br>
<br>
<blockquote type="cite">now the conf reconfigured is:
<br>
http_port 8080 ssl-bump
cert=/etc/squid/certs/squid-ca-cert-key.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB
<br>
</blockquote>
<br>
<br>
<br>
</blockquote>
<br>
</body>
</html>