<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#26a269" bgcolor="#000000">
<br>
<br>
<div class="moz-cite-prefix">28.07.2026 15:44, Alex Rousskov пишет:<br>
</div>
<blockquote type="cite"
cite="mid:32dc57c4-1f57-446e-8c4a-205a2053e773@measurement-factory.com">On
2026-07-27 00:57, Vacheslav wrote:
<br>
<blockquote type="cite">27.07.2026 07:54, Vacheslav пишет:
<br>
<blockquote type="cite">24.07.2026 16:08, Alex Rousskov пишет:
<br>
<blockquote type="cite">In a working setup, we expect:
<br>
<br>
A) A browser receiving a site certificate generated by
Squid.
<br>
This site certificate (A) is signed by CA certificate
(B).
<br>
<br>
B) CA certificate in /etc/squid/certs/squid-ca-cert-key.pem
<br>
Squid http_port configured to use certificate (B).
<br>
Browser configured to trust certificate (B).
<br>
<br>
<br>
How does the above differ from what you observe?
<br>
</blockquote>
</blockquote>
</blockquote>
<br>
<blockquote type="cite">
<blockquote type="cite">i'm getting in firefox Код ошибки:
SEC_ERROR_UNKNOWN_ISSUER
<br>
i had trusted squid-ca-cert.der in firefox and now i tried to
trust squid-ca-cert-key.pem but it complained that it is
already trusted.
<br>
</blockquote>
<br>
some sites are opening while others complain of
SEC_ERROR_UNKNOWN_ISSUER like linkedin and hotmail
<br>
</blockquote>
<br>
<br>
To answer my question, focus on the problematic cases but ignore
the fact that Firefox is showing SEC_ERROR_UNKNOWN_ISSUER error.
What certificate did Firefox received from Squid (that triggered
that error)? Did it get (A)?
<br>
<br>
There is usually a way to examine the received certificate in
Firefox despite SEC_ERROR_UNKNOWN_ISSUER, but I do not have a
step-by-step instructions for that. When examining the
certificate, look for Subject and Issuer fields. Do they match
those of certificate (A) used for working (i.e. no browser error)
transactions? If not, what are they, and does the issuer match the
Subject field in CA certificate (B)? <br>
<br>
</blockquote>
now hotmail and linkedin are opening, except yandex is not. in the
certificate it shows:<br>
subject: country:ru<br>
organization yandex<br>
issuer: the squid certificate that all for certificate *.yandex.tr
on the the right there is a second certificate of squid: Subject is
what i filled in when i generated the certificate and so is issuer
and everything else.
<blockquote type="cite"
cite="mid:32dc57c4-1f57-446e-8c4a-205a2053e773@measurement-factory.com">HTH,
<br>
<br>
Alex.
<br>
<br>
<br>
<br>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">now the conf reconfigured is:
<br>
http_port 8080 ssl-bump
cert=/etc/squid/certs/squid-ca-cert-key.pem
generate-host-certificates=on
dynamic_cert_mem_cache_size=8MB
<br>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>