<div dir="ltr"><div dir="ltr">Hi,<div>the setup is exactly what you suggested but still the ERROR shows up.</div><div>Here the startup sequence about context creation:</div><div><br></div><div><div>2019/04/05 06:29:48.050| Initializing https:// proxy context</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(38) SBuf: SBuf950 created from id SBuf110</div><div>2019/04/05 06:29:48.050| 24,8| Tokenizer.cc(174) skip: skipping char '1'</div><div>2019/04/05 06:29:48.050| 24,5| Tokenizer.cc(25) consume: consuming 1 bytes</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(497) consume: SBuf950 consume 1</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(38) SBuf: SBuf951 created from id SBuf950</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(70) ~SBuf: SBuf951 destructed</div><div>2019/04/05 06:29:48.050| 24,8| Tokenizer.cc(174) skip: skipping char '.'</div><div>2019/04/05 06:29:48.050| 24,5| Tokenizer.cc(25) consume: consuming 1 bytes</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(497) consume: SBuf950 consume 1</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(38) SBuf: SBuf952 created from id SBuf950</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(70) ~SBuf: SBuf952 destructed</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(38) SBuf: SBuf953 created from id SBuf950</div><div>2019/04/05 06:29:48.050| 24,5| Tokenizer.cc(25) consume: consuming 1 bytes</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(497) consume: SBuf950 consume 1</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(38) SBuf: SBuf954 created from id SBuf950</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(70) ~SBuf: SBuf954 destructed</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(70) ~SBuf: SBuf953 destructed</div><div>2019/04/05 06:29:48.050| 24,8| SBuf.cc(70) ~SBuf: SBuf950 destructed</div><div>2019/04/05 06:29:48.051| 83,9| support.cc(586) InitClientContext: Setting certificate verification callback.</div><div>2019/04/05 06:29:48.051| 83,8| PeerOptions.cc(647) updateContextCa: Setting CA certificate locations.</div><div>2019/04/05 06:29:48.051| 83,8| PeerOptions.cc(630) loadSystemTrustedCa: Setting default system Trusted CA. ctx=0x55dcadedcd20</div><div>2019/04/05 06:29:48.052| 24,8| SBuf.cc(30) SBuf: SBuf955 created</div><div>2019/04/05 06:29:48.052| 24,7| SBuf.cc(85) assign: assigning SBuf955 from SBuf118</div><div>2019/04/05 06:29:48.052| 24,8| SBuf.cc(38) SBuf: SBuf956 created from id SBuf955</div><div>2019/04/05 06:29:48.053| 24,8| SBuf.cc(70) ~SBuf: SBuf956 destructed</div><div>2019/04/05 06:29:48.053| 24,8| SBuf.cc(70) ~SBuf: SBuf955 destructed</div><div>2019/04/05 06:29:48.053| Initializing http_port <a href="http://0.0.0.0:3128">0.0.0.0:3128</a> TLS contexts</div><div>2019/04/05 06:29:48.053| Using certificate in /etc/squid/squidCA.pem</div><div>2019/04/05 06:29:48.053| 24,7| SBuf.cc(160) rawSpace: reserving 1 for SBuf217</div><div>2019/04/05 06:29:48.053| 24,7| SBuf.cc(167) rawSpace: SBuf217 not growing</div><div>2019/04/05 06:29:48.053| 24,7| SBuf.cc(160) rawSpace: reserving 1 for SBuf217</div><div>2019/04/05 06:29:48.053| 24,8| SBuf.cc(886) cow: SBuf217 new size:23</div><div>2019/04/05 06:29:48.053| 24,8| SBuf.cc(857) reAlloc: SBuf217 new size: 23</div><div>2019/04/05 06:29:48.054| 24,9| MemBlob.cc(56) MemBlob: constructed, this=0x55dcadedd7c0 id=blob1225 reserveSize=23</div><div>2019/04/05 06:29:48.054| 24,8| MemBlob.cc(101) memAlloc: blob1225 memAlloc: requested=23, received=40</div><div>2019/04/05 06:29:48.054| 24,7| SBuf.cc(865) reAlloc: SBuf217 new store capacity: 40</div><div>2019/04/05 06:29:48.054| 83,3| KeyData.cc(105) loadX509ChainFromFile: Using certificate chain in /etc/squid/squidCA.pem</div><div>2019/04/05 06:29:48.054| 83,3| KeyData.cc(123) loadX509ChainFromFile: Adding issuer CA: /CN=nobody</div><div>2019/04/05 06:29:48.054| Using key in /etc/squid/squidCA.pem</div><div>2019/04/05 06:29:48.054| 24,7| SBuf.cc(160) rawSpace: reserving 1 for SBuf218</div><div>2019/04/05 06:29:48.054| 24,8| SBuf.cc(886) cow: SBuf218 new size:23</div><div>2019/04/05 06:29:48.054| 24,8| SBuf.cc(857) reAlloc: SBuf218 new size: 23</div><div>2019/04/05 06:29:48.054| 24,9| MemBlob.cc(56) MemBlob: constructed, this=0x55dcadef07f0 id=blob1226 reserveSize=23</div><div>2019/04/05 06:29:48.054| 24,8| MemBlob.cc(101) memAlloc: blob1226 memAlloc: requested=23, received=40</div><div>2019/04/05 06:29:48.054| 24,9| MemBlob.cc(82) ~MemBlob: destructed, this=0x55dcaddf6c30 id=blob554 capacity=40 size=23</div><div>2019/04/05 06:29:48.054| 24,7| SBuf.cc(865) reAlloc: SBuf218 new store capacity: 40</div><div>2019/04/05 06:29:48.054| 83,8| PeerOptions.cc(647) updateContextCa: Setting CA certificate locations.</div><div>2019/04/05 06:29:48.054| 83,9| ServerOptions.cc(444) updateContextClientCa: Not requiring any client certificates</div><div>2019/04/05 06:29:48.054| 24,8| SBuf.cc(30) SBuf: SBuf957 created</div><div>2019/04/05 06:29:48.054| 24,7| SBuf.cc(85) assign: assigning SBuf957 from SBuf118</div><div>2019/04/05 06:29:48.054| 24,8| SBuf.cc(38) SBuf: SBuf958 created from id SBuf957</div><div>2019/04/05 06:29:48.054| 24,8| SBuf.cc(70) ~SBuf: SBuf958 destructed</div><div>2019/04/05 06:29:48.054| 24,8| SBuf.cc(70) ~SBuf: SBuf957 destructed</div></div><div><br></div><div>If you want I can attach all the cache log with startup and one request with error</div><div>Thanks</div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 5 Apr 2019 at 06:23, Amos Jeffries <<a href="mailto:squid3@treenet.co.nz">squid3@treenet.co.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 5/04/19 12:37 am, Davide Belloni wrote:<br>
> Hi,<br>
> this is the certificate that I'm using at the moment:<br>
> <br>
<br>
AFAICS the pieces Squid-4 needs for your config and checks for are all<br>
there.<br>
<br>
Are the pieces correctly ordered in the .pem file? key first, then CA cert.<br>
<br>
<br>
> <br>
> On Thu, 4 Apr 2019 at 12:57, Davide Belloni wrote:<br>
> <br>
> Hi, thanks very much for all the advices!<br>
> About the action to generate the certificate I've followed the squid<br>
> wiki, that doesn't modify (if I remember correctly) openssl conf to<br>
> create it .<br>
> <br>
> Do you have some link to a good howto about that?<br>
> <br>
<br>
<br>
Ah, we have several how-to's in the wiki. The SSL-Bump documentation has<br>
an example. The ConfigExamples section has one for self-signed root CA<br>
like yours, one for intermediate CA signing cert, and one for a wildcard<br>
domain cert.<br>
<br>
The one most relevant to what you have is:<br>
<<a href="https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit#Features.2FDynamicSslCert.Create_Self-Signed_Root_CA_Certificate" rel="noreferrer" target="_blank">https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit#Features.2FDynamicSslCert.Create_Self-Signed_Root_CA_Certificate</a>><br>
<br>
If this already matches what you are doing, and the PEM file content is<br>
correct, and that context creation ERROR still shows up. Then your next<br>
step would be to start Squid with the -X command line option and see if<br>
anything more specific about it shows up.<br>
(This will produce a huge amount of debug info, but you only need the<br>
startup sequence where the ERROR shows up. It should not be necessary to<br>
send traffic until the context is working.)<br>
<br>
Amos<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><br>Davide Belloni<div><a href="http://about.me/davidebelloni" target="_blank">http://about.me/davidebelloni</a><br></div><div><a href="http://www.linkedin.com/in/davidebelloni" target="_blank">http://www.linkedin.com/in/davidebelloni</a><br></div></div></div>