[squid-users] Clarification of what I should be seeing in the log files.

[Amos Jeffries]

On 25/02/2016 8:11 a.m., Yuri Voinov wrote:
> 
> This entries is a sign of normal https tunneling phase. You simple don't
> know how HTTPS works. :)
> 

And to clarify that...

There is no GET at the beginning of HTTPS unless the user wrongly enters
http:// into their UA. In which case it *might* try HTTP and the server
redirect it to the proper https:// URL.

On the other hand HSTS security extensions instruct browsers to always
use HTTPS - meaning that browsers essentially decide for themselves that
any http:// the user enters for that domain really means https://. So
again all Squid sees is a CONNECT.

Amos