FWIW, Factory can reproduce this (popular origin server) problem with and without Squid. We are adding a Squid enhancement that will work around the problem (and improve TLS support in general). Alex. > curl: (35) error:1423506E:SSL routines:ssl_next_proto_validate:bad extension