<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Hi users :)</p>
<p><br>
</p>
<p>What I want to do: I have a dedicated server and I want to make it as a transparent adblocker through a VPN. So I have installed and configured OpenVPN and route my traffic from the VPN tun into the squid proxy.</p>
<p><br>
</p>
<p>What is the problem: Websites based on http work great but those based on httpS doesn't work at all. </p>
<p><br>
</p>
<p>I have already tried two squid configurations and look for that problem in the user mail list history but I can't find any workaround that works.</p>
<p><br>
</p>
<p>My compilation options (squid 3.5.15 -with-openssl is enabled):</p>
<p>'--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid3' '--srcdir=.' '--disable-maintainer-mode'
'--disable-dependency-tracking' '--disable-silent-rules' 'BUILDCXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -fPIE -pie -Wl,-z,relro -Wl,-z,now' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--libexecdir=/usr/lib/squid'
'--mandir=/usr/share/man' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-icap-client' '--enable-follow-x-forwarded-for'
'--enable-auth-basic=DB,fake,getpwnam,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,smb_lm' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,unix_group,wbinfo_group'
'--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-openssl=/etc/ssl' '--enable-ssl-crtd' '--with-swapdir=/var/spool/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid.pid'
'--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--enable-build-info= linux' '--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wall' 'LDFLAGS=-fPIE
-pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security'<br>
</p>
<p><br>
</p>
<p>My iptable conf (port 22: my ssh server/ input port 443: my OpenVPN server):</p>
<p></p>
<div>-P INPUT DROP</div>
<div>-P FORWARD DROP</div>
<div>-P OUTPUT DROP</div>
<div>-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT</div>
<div>-A INPUT -i lo -j ACCEPT</div>
<div>-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT</div>
<div>-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT</div>
<div>-A INPUT -p udp -m udp --dport 53 -j ACCEPT</div>
<div>-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT</div>
<div>-A INPUT -i tun0 -j ACCEPT</div>
<div><span style="font-size:12pt">-A FORWARD -i tun0 -j ACCEPT</span><br>
</div>
<div>-A FORWARD -o tun0 -j ACCEPT</div>
<div>-A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT</div>
<div>-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT</div>
<div><span style="font-size:12pt">-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT</span><br>
</div>
<div>-A OUTPUT -o lo -j ACCEPT</div>
<div>-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT</div>
<div>-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT</div>
<div>-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT</div>
<div>-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT</div>
<div>-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT</div>
<div>-A OUTPUT -o tun0 -j ACCEPT</div>
<div><span style="font-size:12pt">-A OUTPUT -p icmp -j ACCEPT</span></div>
<div><span style="font-size:12pt"><br class="Apple-interchange-newline">
<span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px">My iptable conf (nat table):</span><br>
</span></div>
<div><span style="font-size:12pt">
<div>-P PREROUTING ACCEPT</div>
<div>-P INPUT ACCEPT</div>
<div>-P OUTPUT ACCEPT</div>
<div>-P POSTROUTING ACCEPT</div>
<div>-A PREROUTING -s 10.8.0.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129</div>
<div>-A PREROUTING -s 10.8.0.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3130</div>
<div>-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE</div>
<div><br>
</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px"><span style="font-size:12pt">This iptables configuration works great to route vpn input trafic into squid.</span></div>
</div>
</span></div>
<p><br>
</p>
<p>1st squid conf I've tried (based on this tutorial <a href="http://monblog.system-linux.net/blog/2013/03/23/mettre-en-oeuvre-squid-transparent-https-sous-debian/" id="LPlnk853063" title="http://monblog.system-linux.net/blog/2013/03/23/mettre-en-oeuvre-squid-transparent-https-sous-debian/
Ctrl+Cliquer ou appuyer pour suivre le lien">http://monblog.system-linux.net/blog/2013/03/23/mettre-en-oeuvre-squid-transparent-https-sous-debian/</a> and
others):</p>
<p></p>
<div>#</div>
<div># Recommended minimum configuration:</div>
<div>#</div>
<div><br>
</div>
<div># Example rule allowing access from your local networks.</div>
<div># Adapt to list your (internal) IP networks from where browsing</div>
<div># should be allowed</div>
<div>acl localnet src 10.8.0.0/24<span class="Apple-tab-span" style="white-space:pre">
</span># RFC1918 possible internal network</div>
<div>acl localnet src fc00::/7 # RFC 4193 local private network range</div>
<div>acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines</div>
<div><br>
</div>
<div>acl SSL_ports port 443</div>
<div>acl Safe_ports port 80<span class="Apple-tab-span" style="white-space:pre"> </span>
# http</div>
<div>acl Safe_ports port 21<span class="Apple-tab-span" style="white-space:pre"> </span>
# ftp</div>
<div>acl Safe_ports port 443<span class="Apple-tab-span" style="white-space:pre">
</span># https</div>
<div>acl Safe_ports port 70<span class="Apple-tab-span" style="white-space:pre"> </span>
# gopher</div>
<div>acl Safe_ports port 210<span class="Apple-tab-span" style="white-space:pre">
</span># wais</div>
<div>acl Safe_ports port 1025-65535<span class="Apple-tab-span" style="white-space:pre">
</span># unregistered ports</div>
<div>acl Safe_ports port 280<span class="Apple-tab-span" style="white-space:pre">
</span># http-mgmt</div>
<div>acl Safe_ports port 488<span class="Apple-tab-span" style="white-space:pre">
</span># gss-http</div>
<div>acl Safe_ports port 591<span class="Apple-tab-span" style="white-space:pre">
</span># filemaker</div>
<div>acl Safe_ports port 777<span class="Apple-tab-span" style="white-space:pre">
</span># multiling http</div>
<div>acl CONNECT method CONNECT</div>
<div><br>
</div>
<div>#</div>
<div># Recommended minimum Access Permission configuration:</div>
<div>#</div>
<div># Deny requests to certain unsafe ports</div>
<div>http_access deny !Safe_ports</div>
<div><br>
</div>
<div># Deny CONNECT to other than secure SSL ports</div>
<div>http_access deny CONNECT !SSL_ports</div>
<div><br>
</div>
<div># Only allow cachemgr access from localhost</div>
<div>http_access allow localhost manager</div>
<div>http_access deny manager</div>
<div><br>
</div>
<div># We strongly recommend the following be uncommented to protect innocent</div>
<div># web applications running on the proxy server who think the only</div>
<div># one who can access services on "localhost" is a local user</div>
<div>#http_access deny to_localhost</div>
<div><br>
</div>
<div>#</div>
<div># INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS</div>
<div>#</div>
<div><br>
</div>
<div># Example rule allowing access from your local networks.</div>
<div># Adapt localnet in the ACL section to list your (internal) IP networks</div>
<div># from where browsing should be allowed</div>
<div>http_access allow localnet</div>
<div>http_access allow localhost</div>
<div><br>
</div>
<div># And finally deny all other access to this proxy</div>
<div>http_access deny all</div>
<div><br>
</div>
<div><br>
</div>
<div># Squid normally listens to port 3128</div>
<div>http_port 10.8.0.1:3128</div>
<div>http_port 10.8.0.1:3129 transparent</div>
<div>https_port 10.8.0.1:3130 intercept ssl-bump key=/etc/squid/ssl_cert2/key.key cert=/etc/squid/ssl_cert2/cert.pem</div>
<div><br>
</div>
<div># Uncomment and adjust the following to add a disk cache directory.</div>
<div>#cache_dir ufs /var/spool/squid 100 16 256</div>
<div><br>
</div>
<div># Leave coredumps in the first cache dir</div>
<div>coredump_dir /var/spool/squid</div>
<div><br>
</div>
<div>#</div>
<div># Add any of your own refresh_pattern entries above these.</div>
<div>#</div>
<div>refresh_pattern ^ftp:<span class="Apple-tab-span" style="white-space:pre"> </span>
1440<span class="Apple-tab-span" style="white-space:pre"> </span>20%<span class="Apple-tab-span" style="white-space:pre">
</span>10080</div>
<div>refresh_pattern ^gopher:<span class="Apple-tab-span" style="white-space:pre">
</span>1440<span class="Apple-tab-span" style="white-space:pre"> </span>0%<span class="Apple-tab-span" style="white-space:pre">
</span>1440</div>
<div>refresh_pattern -i (/cgi-bin/|\?) 0<span class="Apple-tab-span" style="white-space:pre">
</span>0%<span class="Apple-tab-span" style="white-space:pre"> </span>0</div>
<div>refresh_pattern .<span class="Apple-tab-span" style="white-space:pre"> </span>
0<span class="Apple-tab-span" style="white-space:pre"> </span>20%<span class="Apple-tab-span" style="white-space:pre">
</span>4320</div>
<div><br>
</div>
<div>2nd conf I have tried (based on many tutorials and the official squid wiki especially to configure Ssl Bump/Peek and Slice function):</div>
<div>
<div>#</div>
<div># Recommended minimum configuration:</div>
<div>#</div>
<div><br>
</div>
<div># Example rule allowing access from your local networks.</div>
<div># Adapt to list your (internal) IP networks from where browsing</div>
<div># should be allowed</div>
<div>acl localnet src 10.8.0.0/24<span class="Apple-tab-span" style="white-space:pre">
</span># RFC1918 possible internal network</div>
<div>acl localnet src fc00::/7 # RFC 4193 local private network range</div>
<div>acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines</div>
<div><br>
</div>
<div>acl SSL_ports port 443</div>
<div>acl Safe_ports port 80<span class="Apple-tab-span" style="white-space:pre"> </span>
# http</div>
<div>acl Safe_ports port 21<span class="Apple-tab-span" style="white-space:pre"> </span>
# ftp</div>
<div>acl Safe_ports port 443<span class="Apple-tab-span" style="white-space:pre">
</span># https</div>
<div>acl Safe_ports port 70<span class="Apple-tab-span" style="white-space:pre"> </span>
# gopher</div>
<div>acl Safe_ports port 210<span class="Apple-tab-span" style="white-space:pre">
</span># wais</div>
<div>acl Safe_ports port 1025-65535<span class="Apple-tab-span" style="white-space:pre">
</span># unregistered ports</div>
<div>acl Safe_ports port 280<span class="Apple-tab-span" style="white-space:pre">
</span># http-mgmt</div>
<div>acl Safe_ports port 488<span class="Apple-tab-span" style="white-space:pre">
</span># gss-http</div>
<div>acl Safe_ports port 591<span class="Apple-tab-span" style="white-space:pre">
</span># filemaker</div>
<div>acl Safe_ports port 777<span class="Apple-tab-span" style="white-space:pre">
</span># multiling http</div>
<div>acl CONNECT method CONNECT</div>
<div><br>
</div>
<div>#</div>
<div># Recommended minimum Access Permission configuration:</div>
<div>#</div>
<div># Deny requests to certain unsafe ports</div>
<div>http_access deny !Safe_ports</div>
<div><br>
</div>
<div># Deny CONNECT to other than secure SSL ports</div>
<div>http_access deny CONNECT !SSL_ports</div>
<div><br>
</div>
<div># Only allow cachemgr access from localhost</div>
<div>http_access allow localhost manager</div>
<div>http_access deny manager</div>
<div><br>
</div>
<div># We strongly recommend the following be uncommented to protect innocent</div>
<div># web applications running on the proxy server who think the only</div>
<div># one who can access services on "localhost" is a local user</div>
<div>#http_access deny to_localhost</div>
<div><br>
</div>
<div>#</div>
<div># INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS</div>
<div>#</div>
<div><br>
</div>
<div># Example rule allowing access from your local networks.</div>
<div># Adapt localnet in the ACL section to list your (internal) IP networks</div>
<div># from where browsing should be allowed</div>
<div>http_access allow localnet</div>
<div>http_access allow localhost</div>
<div><br>
</div>
<div># And finally deny all other access to this proxy</div>
<div>http_access deny all</div>
<div><br>
</div>
<div><br>
</div>
<div>always_direct allow all </div>
<div>sslproxy_cert_error allow all</div>
<div>sslproxy_cafile /etc/ssl/certs/ca-certificates.crt</div>
<div>sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB</div>
<div># Squid normally listens to port 3128</div>
<div>http_port 10.8.0.1:3128</div>
<div>http_port 10.8.0.1:3129 transparent</div>
<div>https_port 10.8.0.1:3130 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=6MB cert=/etc/squid/ssl_cert/myCA.pem</div>
<div><br>
</div>
<div>acl step1 at_step SslBump1</div>
<div>acl step2 at_step SslBump2</div>
<div>acl step3 at_step SslBump3</div>
<div><br>
</div>
<div>ssl_bump peek step1 all</div>
<div>ssl_bump stare step2</div>
<div>ssl_bump bump step3</div>
<div><br>
</div>
<div><br>
</div>
<div># Uncomment and adjust the following to add a disk cache directory.</div>
<div>#cache_dir ufs /var/spool/squid 100 16 256</div>
<div><br>
</div>
<div># Leave coredumps in the first cache dir</div>
<div>coredump_dir /var/spool/squid</div>
<div><br>
</div>
<div>#</div>
<div># Add any of your own refresh_pattern entries above these.</div>
<div>#</div>
<div>refresh_pattern ^ftp:<span class="Apple-tab-span" style="white-space:pre"> </span>
1440<span class="Apple-tab-span" style="white-space:pre"> </span>20%<span class="Apple-tab-span" style="white-space:pre">
</span>10080</div>
<div>refresh_pattern ^gopher:<span class="Apple-tab-span" style="white-space:pre">
</span>1440<span class="Apple-tab-span" style="white-space:pre"> </span>0%<span class="Apple-tab-span" style="white-space:pre">
</span>1440</div>
<div>refresh_pattern -i (/cgi-bin/|\?) 0<span class="Apple-tab-span" style="white-space:pre">
</span>0%<span class="Apple-tab-span" style="white-space:pre"> </span>0</div>
<div>refresh_pattern .<span class="Apple-tab-span" style="white-space:pre"> </span>
0<span class="Apple-tab-span" style="white-space:pre"> </span>20%<span class="Apple-tab-span" style="white-space:pre">
</span>4320</div>
<div><br>
</div>
<div><br>
</div>
<div>Unfortunately none of these conf work.</div>
<div><br>
</div>
<div>With the first conf:</div>
<div>If i try to connect to <a href="https://openclassrooms.com/" id="LPlnk724252">https://openclassrooms.com/</a> for example I get a warning about that the certificate is not trust. I can overpass this warning (by clicking on "continue on this website (dangerous)")
but after few seconds I get an error generated by squid:</div>
<div>
<div>"L'erreur suivante s'est produite en essayant d'accéder à l'URL : https://openclassrooms.com/</div>
<div>La connexion 190.93.240.239 a échouée.</div>
<div>Le système a retourné : (110) Connection timed out < ----- Important line</div>
<div>L'hôte distant ou le réseau sont peut-être défaillant. Veuillez renouveler votre requête.</div>
<div>Votre administrateur proxy est webmaster."</div>
<div><br>
</div>
<div>In access.log I get:</div>
</div>
<div>
<div>1459756883.952 42 10.8.0.6 TCP_MISS/200 565 GET http://www.google-analytics.com/__utm.gif? - ORIGINAL_DST/216.58.214.78 image/gif</div>
<div>1459756885.636 14 10.8.0.6 TCP_MISS/204 262 GET http://www.gstatic.com/generate_204 - ORIGINAL_DST/216.58.214.67 -</div>
<div>1459756890.842 17 10.8.0.6 TCP_MISS/302 505 GET http://openclassrooms.com/ - ORIGINAL_DST/190.93.240.239 -</div>
<div>1459756891.129 14 10.8.0.6 TCP_MISS/204 262 GET http://www.gstatic.com/generate_204 - ORIGINAL_DST/216.58.214.67 -</div>
<div>1459756961.902 60814 10.8.0.6 TCP_MISS/503 4850 GET https://openclassrooms.com/ - ORIGINAL_DST/190.93.240.239 text/html</div>
<div><br>
</div>
<div>In cache.log there is nothing especial.</div>
<div><br>
</div>
<div>When I try to connect to <a href="https://www.google.fr" id="LPlnk244955" title="https://www.google.fr
Ctrl+Cliquer ou appuyer pour suivre le lien">
https://www.google.fr</a> I get a warning (from my browser, here Chrome) but I can't overpass it (due to HSTS technologie).</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>With the second conf (which is supposed to dynamically generate certificate from the original certificate to overpass HSTS - at least this I did think but it doesn't work):</div>
<div>Both of google or openclassroom websites generate the same result:</div>
<div>On browser I get a <span>ERR_TIMED_OUT.</span></div>
<div><span><br>
</span></div>
<div><span>In access.log:</span></div>
<div><span>
<div>1459755020.622 59785 10.8.0.6 TAG_NONE/200 0 CONNECT 46.228.47.114:443 - ORIGINAL_DST/46.228.47.114 -</div>
<div>1459755043.645 60448 10.8.0.6 TAG_NONE/200 0 CONNECT 46.228.47.115:443 - ORIGINAL_DST/46.228.47.115 -</div>
<div>1459755045.000 60058 10.8.0.6 TAG_NONE/200 0 CONNECT 216.58.211.106:443 - ORIGINAL_DST/216.58.211.106 -</div>
<div><br>
</div>
<div>In store.log I get SOMETIMES (rarely) this:</div>
<div>
<div>2016/04/01 11:43:05| Pinger exiting.</div>
<div>2016/04/01 11:46:02 kid1| Error negotiating SSL connection on FD 27: Closed by client</div>
<div>2016/04/01 11:46:09 kid1| Error negotiating SSL connection on FD 36: Closed by client</div>
<div>2016/04/01 11:46:16 kid1| Error negotiating SSL connection on FD 30: Closed by client</div>
<div>2016/04/01 11:46:23 kid1| Error negotiating SSL connection on FD 38: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:46:31 kid1| Error negotiating SSL connection on FD 18: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:46:38 kid1| Error negotiating SSL connection on FD 43: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:46:46 kid1| Error negotiating SSL connection on FD 10: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:46:54 kid1| Error negotiating SSL connection on FD 33: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:47:32 kid1| Error negotiating SSL connection on FD 14: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:47:40 kid1| Error negotiating SSL connection on FD 28: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:47:48 kid1| Error negotiating SSL connection on FD 10: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:47:55 kid1| Error negotiating SSL connection on FD 16: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:48:03 kid1| Error negotiating SSL connection on FD 27: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:48:54 kid1| Error negotiating SSL connection on FD 10: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:49:01 kid1| Error negotiating SSL connection on FD 14: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:49:08 kid1| Error negotiating SSL connection on FD 18: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:49:15 kid1| Error negotiating SSL connection on FD 28: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:49:24 kid1| Error negotiating SSL connection on FD 36: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 11:49:31 kid1| Error negotiating SSL connection on FD 38: Closed by client</div>
<div>2016/04/01 11:49:38 kid1| Error negotiating SSL connection on FD 40: Closed by client</div>
<div>2016/04/01 11:49:45 kid1| Error negotiating SSL connection on FD 53: Closed by client</div>
<div>2016/04/01 11:49:53 kid1| Error negotiating SSL connection on FD 59: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol (1/-1)</div>
<div>2016/04/01 12:22:55 kid1| Logfile: opening log stdio:/var/log/squid/netdb.state</div>
<div>2016/04/01 12:22:55 kid1| Logfile: closing log stdio:/var/log/squid/netdb.state</div>
<div>2016/04/01 12:22:55 kid1| NETDB state saved; 4 entries, 0 msec</div>
<div>2016/04/01 13:04:35 kid1| Logfile: opening log stdio:/var/log/squid/netdb.state</div>
<div>2016/04/01 13:04:35 kid1| Logfile: closing log stdio:/var/log/squid/netdb.state</div>
<div>2016/04/01 13:04:35 kid1| NETDB state saved; 4 entries, 0 msec</div>
<div>2016/04/01 13:54:40 kid1| Logfile: opening log stdio:/var/log/squid/netdb.state</div>
<div>2016/04/01 13:54:40 kid1| Logfile: closing log stdio:/var/log/squid/netdb.state</div>
<br>
</div>
<div><br>
</div>
<div>Whatever configuration that I used I have import certificate into my browser correctly.</div>
<div><br>
</div>
<div>Can you help me ??</div>
<div><br>
</div>
<div>Thanks in advance and sorry if my English is not perfect. I can send you any other informations that you would need.</div>
<div><br>
</div>
<div><span style="font-family:Calibri,sans-serif; font-size:16px">Best regards,</span><br>
</div>
<div>Raph</div>
<br>
</span></div>
<br>
</div>
<div><br>
</div>
<div><br>
</div>
<br>
<br>
</div>
<br>
<p></p>
<p><br>
</p>
</div>
</body>
</html>