Peace, my squid certificate has expired, so i regenerated a new one and
tried to enable ssl bump without success.
here is the configuration:
http_port 8080 ssl-bump cert=/etc/squid/certs/myCA.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=8MB
acl tls_s1_connect at_step SslBump1
acl tls_s2_client_hello at_step SslBump2
acl tls_s3_server_hello at_step SslBump3
# define acls for sites that must not be actively bumped
acl tls_allowed_hsts ssl::server_name .akamaihd.net
acl tls_allowed_hsts ssl::server_name .proxy.skko.by
acl tls_server_is_bank ssl::server_name
"/usr/local/ufdbguard/blacklists/finance/domains.squidsplice"
acl tls_to_splice any-of tls_allowed_hsts
tls_server_is_bank
# TLS/SSL bumping steps
ssl_bump peek tls_s1_connect # peek at
TLS/SSL connect data
ssl_bump splice tls_to_splice # splice
some: no active bump
ssl_bump stare all #
stare(peek) at server
# properties of
the webserver
ssl_bump bump # bump if we
can (if the stare succeeded)
ssl_bump peek tls_s1_connect
ssl_bump splice all
#ssl_bump peek all
####ssl_bump splice all
sslcrtd_program /usr/libexec/squid/security_file_certgen -s
/var/cache/squid/ssl_db -M 4M
sslcrtd_children 5
ssl_bump server-first all
sslproxy_cert_error allow all
that produces in cache.log:
Logfile: opening log daemon:/var/log/squid/access.log
2026/07/14 07:37:45 kid1| Logfile Daemon: opening log
/var/log/squid/access.log
2026/07/14 07:37:45 kid1| Unlinkd pipe opened on FD 39
2026/07/14 07:37:45 kid1| Local cache digest enabled; rebuild/rewrite
every 3600/3600 sec
2026/07/14 07:37:45 kid1| Store logging disabled
2026/07/14 07:37:45 kid1| Swap maxSize 3072000 + 983040 KB, estimated
311926 objects
2026/07/14 07:37:45 kid1| Target number of buckets: 15596
2026/07/14 07:37:45 kid1| Using 16384 Store buckets
2026/07/14 07:37:45 kid1| Max Mem size: 983040 KB
2026/07/14 07:37:45 kid1| Max Swap size: 3072000 KB
2026/07/14 07:37:45 kid1| Rebuilding storage in /var/cache/squid (clean log)
2026/07/14 07:37:45 kid1| Using Least Load store dir selection
2026/07/14 07:37:45 kid1| Set Current Directory to /var/cache/squid
2026/07/14 07:37:45 kid1| Finished loading MIME types and icons.
2026/07/14 07:37:45 kid1| HTCP Disabled.
2026/07/14 07:37:45 kid1| Pinger socket opened on FD 44
2026/07/14 07:37:45 kid1| Squid plugin modules loaded: 0
2026/07/14 07:37:45 kid1| Adaptation support is off.
2026/07/14 07:37:45 kid1| Accepting SSL bumped HTTP Socket connections
at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
listening port: 8080
2026/07/14 07:37:45 pinger| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.
2026/07/14 07:37:45 pinger| Initialising ICMP pinger ...
2026/07/14 07:37:45 pinger| ICMP socket opened.
2026/07/14 07:37:45 pinger| ICMPv6 socket opened
2026/07/14 07:37:45 kid1| Indexing cache entries: 1.83% (4000 out of 218271)
2026/07/14 07:37:48 kid1| Done reading /var/cache/squid swaplog (218270
entries)
2026/07/14 07:37:48 kid1| Finished rebuilding storage from disk.
218270 Entries scanned
0 Invalid entries
0 With invalid flags
218270 Objects loaded
0 Objects expired
0 Objects canceled
0 Duplicate URLs purged
0 Swapfile clashes avoided
Took 3.01 seconds (72461.41 objects/sec).
2026/07/14 07:37:48 kid1| Beginning Validation Procedure
2026/07/14 07:37:48 kid1| Completed Validation Procedure
Validated 218255 Entries
store_swap_size = 2764788.00 KB
2026/07/14 07:37:49 kid1| storeLateRelease: released 0 objects
2026/07/14 07:37:49 kid1| WARNING: sslcrtd_program #Hlpr1 exited
2026/07/14 07:37:49 kid1| Too few sslcrtd_program processes are running
(need 1/5)
active processes: 4
processes configured to start at (re)configuration: 5
2026/07/14 07:37:49 kid1| Closing HTTP(S) port 0.0.0.0:8080
listening port: 8080
2026/07/14 07:37:49 kid1| storeDirWriteCleanLogs: Starting...
2026/07/14 07:37:49 kid1| 65536 entries written so far.
2026/07/14 07:37:49 kid1| 131072 entries written so far.
2026/07/14 07:37:49 kid1| 196608 entries written so far.
2026/07/14 07:37:49 kid1| Finished. Wrote 218270 entries.
2026/07/14 07:37:49 kid1| Took 0.08 seconds (2835117.16 entries/sec).
2026/07/14 07:37:49 kid1| FATAL: The sslcrtd_program helpers are
crashing too rapidly, need help!
2026/07/14 07:37:49 kid1| Squid Cache (Version 7.6): Terminated abnormally.
CPU Usage: 3.853 seconds = 2.203 user + 1.651 sys
Maximum Resident Size: 271744 KB
Page faults with physical i/o: 0
2026/07/14 07:37:49 kid1| Closing Pinger socket on FD 44
2026/07/14 07:37:49 kid1| WARNING: BCP 177 violation. Detected
non-functional IPv6 loopback.
2026/07/14 07:37:49 kid1| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_localhost
configuration context: Default Configuration(15) acl
2026/07/14 07:37:49 kid1| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_localhost
configuration context: Default Configuration(15) acl
2026/07/14 07:37:49 kid1| aclIpParseIpData: IPv6 has not been enabled.
acl name: to_linklocal
configuration context: Default Configuration(16) acl
2026/07/14 07:37:49 kid1| Processing Configuration File:
/etc/squid/squid.conf (depth 0)
2026/07/14 07:37:49 kid1| Set Current Directory to /var/cache/squid
2026/07/14 07:37:49 kid1| Starting Squid Cache version 7.6 for
x86_64-suse-linux-gnu...
2026/07/14 07:37:49 kid1| Service Name: squid
2026/07/14 07:37:49 kid1| Process ID 54511
2026/07/14 07:37:49 kid1| Process Roles: worker
2026/07/14 07:37:49 kid1| With 4096 file descriptors available
2026/07/14 07:37:49 kid1| Initializing IP Cache...
2026/07/14 07:37:49 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
2026/07/14 07:37:49 kid1| Adding nameserver 10.86.0.26 from /etc/resolv.conf
2026/07/14 07:37:49 kid1| Adding nameserver 10.10.10.3 from /etc/resolv.conf
2026/07/14 07:37:49 kid1| helperOpenServers: Starting 5/5
'security_file_certgen' processes
2026/07/14 07:37:49 kid1| helperOpenServers: Starting 8/16 'ufdbgclient'
processes
2026/07/14 07:37:49 sslcrtd_program| FATAL: Cannot generate
certificates: Unknown bytes unit: M
exception location: security_file_certgen.cc(101) parseBytesUnits
2026/07/14 07:37:49 sslcrtd_program| FATAL: Cannot generate
certificates: Unknown bytes unit: M
exception location: security_file_certgen.cc(101) parseBytesUnits
2026/07/14 07:37:49 sslcrtd_program| FATAL: Cannot generate
certificates: Unknown bytes unit: M
exception location: security_file_certgen.cc(101) parseBytesUnits
2026/07/14 07:37:49 sslcrtd_program| FATAL: Cannot generate
certificates: Unknown bytes unit: M
exception location: security_file_certgen.cc(101) parseBytesUnits
2026/07/14 07:37:49 sslcrtd_program| FATAL: Cannot generate
certificates: Unknown bytes unit: M
exception location: security_file_certgen.cc(101) parseBytesUnits
running the command:
sudo /usr/libexec/squid/security_file_certgen -c -s
/var/cache/squid/ssl_db/certs -M 4MB
Initialization SSL db...
2026/07/14 07:42:00 sslcrtd_program| FATAL: Cannot generate
certificates: Cannot create /var/cache/squid/ssl_db/certs
exception location: certificate_db.cc(374) Create
/var/cache/squid/ssl_db/certs certs is empty
how to solve the problem?
_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users
