<div dir="ltr"><div>Hi,</div><div><br></div>I have the same issue as Nil. I have set No_DEFAULT_CA and also did "generate-host-certificates=off". I see with these changes <span style="color:rgb(80,0,80);font-size:12.8px">it takes more time reach 2GB but it does reach there (in about 6 hours for me with peak usage).</span><div><br></div><div>These were my settings. </div><div><br></div><div><div>https_port <a href="http://192.168.0.10:3129" target="_blank">192.168.0.10:3129</a> generate-host-certificates=off dynamic_cert_mem_cache_size=<wbr>4MB cert=/etc/squid/myserver.pem intercept ssl-bump sslflags=NO_DEFAULT_CA</div></div><div><div>https_port <a href="http://192.168.0.10:3128" target="_blank">192.168.0.10:3128</a> generate-<wbr>host-certificates=off dynamic_cert_mem_cache_size=<wbr>4MB cert=/etc/squid/myserver.pem intercept ssl-bump sslflags=NO_DEFAULT_CA</div><div><br></div><div>I did a 10 minutes test to compare the behavior in Squid 3.3 and squid 3.5. My test scenario was kept exactly same except for following diff in squid 3.5.</div></div><div><br></div><div><div>acl exceptions ssl::server_name_regex "/etc/squid/exception_list.txt"</div><div>acl step1 at_step SslBump1</div><div>acl step2 at_step SslBump2</div><div>ssl_bump peek step1 all !exceptions</div><div>ssl_bump splice step2 !exceptions</div></div><div><br></div><div>Here are the results after 10mins -</div><div><br></div><div>1. When I didn't use NO_DEFAULT_CA and generate-host-certificates=on</div><div><br></div><div>Squid 3.3 = 550MB</div><div>Squid 3.5 = 1.1GB</div><div><br></div><div>2. When I use NO_DEFAULT_CA and generate-host-certificates=off</div><div><br></div><div>Squid 3.3 = 402MB<br></div><div><div>Squid 3.5 = 560MB</div></div><div><br></div><div>So it looks like Squid 3.5 have higher mem usage than 3.3 in both cases which makes me wonder, is it that more CAs are being loaded into cache in 3.5 ?</div><div><br></div><div>Also, is there any more change I can do to my config to arrest the memory growth to 2GB in 3.5 in my production system ? I got only 4Gb RAM.</div><div><br></div><div><br></div><div>Thanks and Regards,<br></div><div>Davis</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 26, 2017 at 8:38 AM, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 26/04/17 10:53, Yuri Voinov wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Ok, but how NO_DEFAULT_CA should help with this?<br>
</blockquote>
<br></span>
It prevents OpenSSL copying that 1MB into each incoming client connections memory. The CAs are only useful there when you have some of the global CAs as root for client certificates - in which case you still only want to trust the roots you paid for service and not all of them.<br>
<br>
Just something to try if there are huge memory issues with TLS/SSL proxying. The default behaviour is fixed for Squid-4 with the config options changes. But due to being a major surprise for anyone already relying on global roots for client certs it remains a problem in 3.5.<div class="HOEnZb"><div class="h5"><br>
<br>
Amos<br>
<br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/l<wbr>istinfo/squid-users</a><br>
</div></div></blockquote></div><br></div>