<html><head></head><body bgcolor="#ffffff" text="#3d3d3d" link="#19b6ee" vlink="#3d3d3d"><div>On Sat, 2018-06-09 at 07:17 -0600, James Lay wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On Sun, 2018-06-10 at 01:13 +1200, Amos Jeffries wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>On 10/06/18 01:02, James Lay wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre><br></pre><pre>So in my config file I have:</pre><pre><br></pre><pre>sslcrtd_program /opt/libexec/ssl_crtd -s /opt/var/ssl_db -M 4MB</pre><pre><br></pre><pre>However I do not see this after compiling and installing. Has this gone</pre><pre>away in 4? Thank you.</pre><pre><br></pre><pre>James</pre><pre></pre><pre><br></pre><pre><br></pre><pre>It's now called security_file_certgen.</pre><pre><br></pre><pre><<a href="http://www.squid-cache.org/Versions/v4/squid-4.0.24-RELEASENOTES.html#ss2.4>">http://www.squid-cache.org/Versions/v4/squid-4.0.24-RELEASENOTES.html#ss2.4></a></pre><pre><br></pre><pre>Amos</pre><pre><br></pre></blockquote><div><br></div><div>Thanks Amos...I'll read this before asking anymore questions ☺</div><div><br></div><div>James</div><pre>_______________________________________________</pre><pre>squid-users mailing list</pre><pre><a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a></pre><pre><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></pre><pre><br></pre></blockquote><div><br></div><div>So ok...after making the changes to the config to account for new security_file_certgen and tls_outgoing_options (thanks Amos!) I am greeted with (hostname changed from real):</div><div><br></div><div><font face="monospace" size="3">FATAL: mimeLoadIcon: cannot parse internal URL: http://<hostname>:0/squid-internal-static/icons/silk/image.png</font></div><div><font face="monospace" size="3"><br></font></div><div>Here's my config line:</div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">./configure --prefix=/opt/squid --with-openssl=/opt/libressl --sysconfdir=/opt/squid/etc --enable-ssl --enable-ssl-crtd --enable-linux-netfilter --enable-follow-x-forwarded-for --with-large-files --enable-xternal-acl-helpers=none</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3"></font></div><div>full config (I realize this might not be the most secure on the planet, for now this is a dev box and I'm just testing functionality):</div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">acl localnet src 192.168.1.0/24</font></div><div><font face="monospace" size="3">acl SSL_ports port 443</font></div><div><font face="monospace" size="3">acl Safe_ports port 80</font></div><div><font face="monospace" size="3">acl Safe_ports port 443</font></div><div><font face="monospace" size="3">acl CONNECT method CONNECT</font></div><div><font face="monospace" size="3">acl allowed_http_sites url_regex "/opt/squid/etc/http_url.txt"</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">http_access deny !Safe_ports</font></div><div><font face="monospace" size="3">http_access deny CONNECT !SSL_Ports</font></div><div><font face="monospace" size="3">http_access allow SSL_ports</font></div><div><font face="monospace" size="3">http_access allow allowed_http_sites</font></div><div><font face="monospace" size="3">http_access deny all</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">acl broken_ips dst "/opt/squid/etc/broken_ips.txt"</font></div><div><font face="monospace" size="3">ssl_bump splice broken_ips</font></div><div><font face="monospace" size="3">acl broken_https_sites ssl::server_name_regex "/opt/squid/etc/broken_url.txt"</font></div><div><font face="monospace" size="3">ssl_bump splice broken_https_sites</font></div><div><font face="monospace" size="3">ssl_bump peek all</font></div><div><font face="monospace" size="3">acl allowed_https_sites ssl::server_name_regex "/opt/squid/etc/http_url.txt"</font></div><div><font face="monospace" size="3">ssl_bump splice allowed_https_sites</font></div><div><font face="monospace" size="3">ssl_bump terminate all</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">sslproxy_cert_error allow all</font></div><div><font face="monospace" size="3">tls_outgoing_options capath=/etc/ssl/certs flags=DONT_VERIFY_PEER</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">sslcrtd_program /opt/squid/libexec/security_file_certgen -s /opt/squid/var/ -M 4MB</font></div><div><font face="monospace" size="3">sslcrtd_children 5</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">http_port gateway:3128 intercept</font></div><div><font face="monospace" size="3">https_port gateway:3129 intercept ssl-bump cert=/opt/squid/etc/certs/sslsplit_ca_cert.pem cafile=/opt/squid/etc/certs/sslsplit_ca_cert.pem key=/opt/squid/etc/certs/sslsplit_ca_key.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB sslflags=NO_SESSION_REUSE</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">logformat mine %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %ssl::>sni %ssl::>cert_subject %>Hs %<st %Ss:%Sh</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">access_log syslog:daemon.info mine</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">refresh_pattern -i (cgi-bin|\?) 0 0% 0</font></div><div><font face="monospace" size="3">refresh_pattern . 0 20% 4320</font></div><div><font face="monospace" size="3"><br></font></div><div><font face="monospace" size="3">coredump_dir /opt/squid/var</font></div><div><font face="monospace" size="3"></font></div><div><font face="monospace" size="3"><br></font></div><div>At this point I have no clue what to do next...any troubleshooting steps would be wonderful. Thank you.</div><div><font face="monospace" size="3"><span class="-x-evo-signature" id="none"></span></font></div></body></html>