<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>Hi,</div>
</div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div><br>
</div>
<div>I have worked out a simple fix for this bug <a href="http://bugs.squid-cache.org/show_bug.cgi?id=4337">http://bugs.squid-cache.org/show_bug.cgi?id=4337</a></div>
<div><br>
</div>
<div>To test I’ve copied the code which adds the certificate to the chain from ConnStateData::getSslContextDone to ConnStateData::getSslContextStart inside the sslBump decision (if (sslServerBump && (sslServerBump->act.step1 == Ssl::bumpPeek || sslServerBump->act.step1
== Ssl::bumpStare)))</div>
<div><br>
</div>
<div>Addition:</div>
<div><br>
</div>
<div> SSL_CTX * ctx = SSL_get_SSL_CTX(ssl);</div>
<div> X509 *cert = port->signingCert.get();</div>
<div> if (SSL_CTX_add_extra_chain_cert(ctx, cert)) {</div>
<div> // increase the certificate lock</div>
<div> CRYPTO_add(&(cert->references),1,CRYPTO_LOCK_X509);</div>
<div> } else {</div>
<div> const int ssl_error = ERR_get_error();</div>
<div> debugs(33, DBG_IMPORTANT, "WARNING: can not add signing certificate to SSL context chain: " << ERR_error_string(ssl_error, NULL));</div>
<div> }</div>
<div> Ssl::addChainToSslContext(ctx, port->certsToChain.get());</div>
<div><br>
</div>
<div>There will be a better way of this (definitely one that doesn’t involve duplication of code) but it at least pin-points the problem.</div>
<div><br>
</div>
</div>
</div>
</span>
</body>
</html>