<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hey Yuri,<br>
<br>
I will try to test it with couple versions of 4.0.x.<br>
But it's weird...<br>
The reason it's weird is since some kind of trust or understand this
test:<br>
<a class="moz-txt-link-freetext" href="https://www.ssllabs.com/ssltest/analyze.html?d=www.cloudflare.com&s=198.41.214.162&latest">https://www.ssllabs.com/ssltest/analyze.html?d=www.cloudflare.com&s=198.41.214.162&latest</a><br>
<br>
I am not an SSL expert in general but I can use openssl client to
test and verify things.<br>
I have tested this scenario with openssl like this:<br>
# openssl s_client -cipher 'ECDHE-ECDSA-AES256-SHA' -connect
<a class="moz-txt-link-abbreviated" href="http://www.cloudflare.com:443">www.cloudflare.com:443</a><br>
CONNECTED(00000003)<br>
139990857013152:error:14077410:SSL
routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake
failure:s23_clnt.c:744:<br>
---<br>
no peer certificate available<br>
---<br>
No client certificate CA names sent<br>
---<br>
SSL handshake has read 7 bytes and written 119 bytes<br>
---<br>
New, (NONE), Cipher is (NONE)<br>
Secure Renegotiation IS NOT supported<br>
Compression: NONE<br>
Expansion: NONE<br>
---<br>
<br>
And it seems that openssl does something which might be my fault but
if squid 3.5.16 works fine with it and 4.0.8 it might be connected
to the connection between openssl library to the service and squid
only displays the issue in the nice html page.<br>
I do not know what service cloudflare uses and how it all works but
if openssl states that there is an issue with what the service is
either sending or itself analyzing then the issue is in the openssl
level rather then squid.<br>
<br>
I am sure that both cloudflare and openssl and squid users, admins
and devs wants to resolve the issue.<br>
<br>
Eliezer<br>
<br>
<div class="moz-cite-prefix">On 12/04/2016 18:29, Yuri Voinov wrote:<br>
</div>
<blockquote cite="mid:570D144F.7020206@gmail.com" type="cite">
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
UPDATE:<br>
<br>
Every failed connect produce the next sequence in access.log:<br>
<br>
1460474791.631 15444 192.168.100.103 NONE_ABORTED/200 0 CONNECT
198.41.215.162:443 - ORIGINAL_DST/198.41.215.162 -<br>
1460474791.658 0 192.168.100.103 NONE/503 3951 GET <a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://www.cloudflare.com/*"><a class="moz-txt-link-freetext" href="https://www.cloudflare.com/*">https://www.cloudflare.com/*</a></a>
- HIER_NONE/- text/html<br>
<br>
Note: 198.41.215.162 is current cloudflare.com IP.<br>
<br>
Also: NONE_ABORTED/200 is often occurs in access.log with another
accessible sites.<br>
<br>
12.04.16 20:03, Yuri Voinov пишет:<br>
<span style="white-space: pre;">>
> UPDATE:
>
> <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://i1.someimage.com/b8w5dFz.png">https://i1.someimage.com/b8w5dFz.png</a>
>
> This is answer from Cloudflare support.
>
> But: 3.5.16 can deal with ECDSA TLS 1.2 but 4.0.8 not?
>
> 12.04.16 17:55, Yuri Voinov пишет:
> > Does anybody faces this problem with 4.0.8:
>
> > <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://i1.someimage.com/3lD2cvV.png">https://i1.someimage.com/3lD2cvV.png</a>
>
> > ?
>
> > It accomplished this error in cache.log:
>
> > 2016/04/12 17:39:38 kid1| Error negotiating SSL on FD
54:
> error:00000000:lib(0):func(0):reason(0) (5/0/0)
>
> > and "NONE/503" in access.log.
>
> > Without proxy works like sharm. 3.5.16 with the similar
squid.conf
> works like sharm.
>
> > NB: Cloudflare support said, that they key feature for
SSL is SNI and
> ECDSA now. AFAIK, 4.0.8 is fully supports this features.
>
> > Any advice will be helpful.
>
> > Yes, I know this looks like DDoS protection on
Cloudflare. But WTF?
> Any workaround required. Half-Internet is hosted on
Cloudflare.
>
> > WBR, Yuri
>
></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJXDRRPAAoJENNXIZxhPexGmZcIAI1gcVCHUjCrDk0vI/f7omMP
<br>
ALa5XYk0VrsoOioc5cIh0DuIRN8THqkdXxtRXdKnxC8hgRfvOxN6h7NFilZhVAiT
<br>
tvgQkmKxAXXkCXik03AYU5DBoElMDcCgznksAxcckvXGCyWxN7pFwSY2p87WPHa/
<br>
5G/K5BTG1rf30OjVYIMPRtsfkHyA5xWIPNHKcbu6bCsV7H+oXh8x8oCNHdF06Q1i
<br>
s3U1kiFEudOKC1bMGVY4RJlzqDgGdANsHMSh0/v3rS4it5KBFxPsuz/DDcU1DlkO
<br>
MIEMF7FgvxORtgBZPUnxa+sF5gunZqDuv2R2aJuxJpYK2OriOC7+e40dZiw7xpQ=
<br>
=/LGq
<br>
-----END PGP SIGNATURE-----
<br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
squid-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
</pre>
</blockquote>
<br>
</body>
</html>