<html><head></head><body bgcolor="#ffffff" text="#4c4c4c" link="#8793c1" vlink="#8793c1"><div>Topic says it...this setup has been working well for a long time, but now there are some sites that are failing the TLS handshake. Here's my setup:</div><div><br></div><div><font face="monospace">acl localnet src 192.168.1.0/24</font></div><div><font face="monospace">acl SSL_ports port 443</font></div><div><font face="monospace">acl Safe_ports port 80</font></div><div><font face="monospace">acl Safe_ports port 443</font></div><div><font face="monospace">acl CONNECT method CONNECT</font></div><div><font face="monospace">acl allowed_http_sites url_regex "/opt/etc/squid/http_url.txt"</font></div><div><font face="monospace"><br></font></div><div><font face="monospace">http_access deny !Safe_ports</font></div><div><font face="monospace">http_access deny CONNECT !SSL_Ports</font></div><div><font face="monospace">http_access allow SSL_ports</font></div><div><font face="monospace">http_access allow allowed_http_sites</font></div><div><font face="monospace">http_access deny all</font></div><div><font face="monospace"><br></font></div><div><br></div><div><font face="monospace">ssl_bump peek all</font></div><div><font face="monospace">acl allowed_https_sites ssl::server_name_regex "/opt/etc/squid/http_url.txt"</font></div><div><font face="monospace">ssl_bump splice allowed_https_sites</font></div><div><font face="monospace">ssl_bump terminate all</font></div><div><font face="monospace"><br></font></div><div><font face="monospace">sslproxy_cert_error allow all</font></div><div><font face="monospace">sslproxy_capath /etc/ssl/certs</font></div><div><font face="monospace">sslproxy_flags DONT_VERIFY_PEER </font></div><div><font face="monospace">#sslproxy_options ALL</font></div><div><font face="monospace"><br></font></div><div><font face="monospace">sslcrtd_program /opt/libexec/ssl_crtd -s /opt/var/ssl_db -M 4MB</font></div><div><font face="monospace">sslcrtd_children 5</font></div><div><font face="monospace"><br></font></div><div><font face="monospace">http_port 3128 intercept</font></div><div><font face="monospace">https_port 3129 intercept ssl-bump cert=/opt/etc/squid/certs/sslsplit_ca_cert.pem cafile=/opt/etc/squid/certs/sslsplit_ca_cert.pem key=/opt/etc/squid/certs/sslsplit_ca_key.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB sslflags=NO_SESSION_REUSE</font></div><div><font face="monospace"><br></font></div><div><br></div><div><font face="monospace">logformat mine %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %ssl::>sni %ssl::>cert_subject %>Hs %<st %Ss:%Sh </font></div><div><font face="monospace"><br></font></div><div><font face="monospace">access_log syslog:daemon.info mine </font></div><div><font face="monospace"><br></font></div><div><font face="monospace">refresh_pattern -i (cgi-bin|\?)<span class="Apple-tab-span" style="white-space:pre"> </span>0<span class="Apple-tab-span" style="white-space:pre"> </span>0%<span class="Apple-tab-span" style="white-space:pre"> </span>0</font></div><div><font face="monospace">refresh_pattern .<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>0<span class="Apple-tab-span" style="white-space:pre"> </span>20%<span class="Apple-tab-span" style="white-space:pre"> </span>4320</font></div><div><font face="monospace"><br></font></div><div><font face="monospace">coredump_dir /opt/var </font></div><div><font face="monospace"><br></font></div><div><font face="monospace"></font>For example, the file http_url.txt contains:<font face="monospace"><br></font></div><div><br></div><div><font face="monospace">account\.elderscrollsonline\.com</font></div><div><font face="monospace">\.elderscrollsonline\.com</font></div><div><font face="monospace">elderscrollsonline\.com</font></div><div><font face="monospace"><br></font></div><div><font face="monospace"></font><font face="monospace"><br></font></div><div>After doing some reading it looks like this is http2 traffic: <a href="https://wiki.squid-cache.org/Features/HTTP2">https://wiki.squid-cache.org/Features/HTTP2</a>.</div><div><br></div><div>Is there anything I can do to continue using squid with more and more sites using http2? Pcap enclosed..thank you.</div><div><br></div><div>James</div></body></html>