<html><head></head><body bgcolor="#232729" text="#eeeeec" link="#4a90d9" vlink="#eeeeec"><div>On Sun, 2018-06-10 at 19:55 +1200, Amos Jeffries wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>On 10/06/18 02:23, James Lay wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>On Sat, 2018-06-09 at 07:17 -0600, James Lay wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>On Sun, 2018-06-10 at 01:13 +1200, Amos Jeffries wrote:</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>On 10/06/18 01:02, James Lay wrote:</pre><pre><br></pre><pre>So in my config file I have:</pre><pre><br></pre><pre>sslcrtd_program /opt/libexec/ssl_crtd -s /opt/var/ssl_db -M 4MB</pre><pre><br></pre><pre>However I do not see this after compiling and installing. Has this gone</pre><pre>away in 4? Thank you.</pre><pre><br></pre><pre>James</pre><pre><br></pre><pre><br></pre><pre>It's now called security_file_certgen.</pre><pre><br></pre><pre><<a href="http://www.squid-cache.org/Versions/v4/squid-4.0.24-RELEASENOTES.html#ss2.4>">http://www.squid-cache.org/Versions/v4/squid-4.0.24-RELEASENOTES.html#ss2.4></a></pre><pre><br></pre><pre>Amos</pre><pre><br></pre><pre></pre><pre><br></pre><pre>Thanks Amos...I'll read this before asking anymore questions ☺</pre><pre><br></pre><pre><br></pre><pre></pre><pre><br></pre><pre>So ok...after making the changes to the config to account for new</pre><pre>security_file_certgen and tls_outgoing_options (thanks Amos!) I am</pre><pre>greeted with (hostname changed from real):</pre><pre><br></pre><pre>FATAL: mimeLoadIcon: cannot parse internal URL:</pre><pre><a href="http://<hostname>:0/squid-internal-static/icons/silk/image.png">http://<hostname>:0/squid-internal-static/icons/silk/image.png</a></pre><pre><br></pre><pre></pre><pre><br></pre><pre>There should be an error about no forward-proxy port as well. Squid</pre><pre>requires at least one port able to receive requests for those URLs from</pre><pre>clients. Port 3128 is normally that port, but you have repurposed it for</pre><pre>interception, which disqualifies it.</pre><pre><br></pre><pre>The hostname in these URLs is taken from that port's IP address</pre><pre>reverse-DNS name, or the proxies public/visible hostname. Whichever</pre><pre>meets the requirement of being resolvable in DNS.</pre><pre><br></pre><pre><br></pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre>Here's my config line:</pre><pre><br></pre><pre>./configure --prefix=/opt/squid --with-openssl=/opt/libressl</pre><pre>--sysconfdir=/opt/squid/etc --enable-ssl --enable-ssl-crtd</pre><pre>--enable-linux-netfilter --enable-follow-x-forwarded-for</pre><pre>--with-large-files --enable-xternal-acl-helpers=none</pre><pre></pre><pre><br></pre><pre>Missing 'e' on --enable-external-acl-helpers.</pre><pre><br></pre><pre>...</pre><pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote></pre><pre><br></pre><pre>sslproxy_cert_error allow all</pre><pre>tls_outgoing_options capath=/etc/ssl/certs flags=DONT_VERIFY_PEER</pre><pre></pre><pre><br></pre><pre>Please avoid DONT_VERIFY_PEER and "allow all" for cert errors. They are</pre><pre>useless for both production AND debugging since all they do is hide</pre><pre>security issues from *you*.</pre><pre><br></pre><pre>It is best to watch for security issues and fix them. Not just ignore</pre><pre>everything.</pre><pre><br></pre><pre>Amos</pre><pre>_______________________________________________</pre><pre>squid-users mailing list</pre><pre><a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a></pre><pre><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></pre><pre><br></pre></blockquote><div><br></div><div>Thanks Amos...your insight always helps. You were right on point...I did have the no forward proxy error. After adding an additional http_port squid came right up...thanks again.</div><div><br></div><div>James</div></body></html>