
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8"><br><div dir="ltr"><br><blockquote type="cite">On 22 Sep 2019, at 14:41, Alex Rousskov <rousskov@measurement-factory.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>On 9/22/19 9:18 AM, Nikolaus wrote:</span><br><span></span><br><blockquote type="cite"><span>The access.log contains error code / detail "ERR_SECURE_CONNECT_FAIL /</span><br></blockquote><blockquote type="cite"><span>SQUID_ERR_SSL_HANDSHAKE" - which is not too helpful - but the cache.log</span><br></blockquote><blockquote type="cite"><span>contains the more detailed "ERROR: negotiating TLS on FD 19:</span><br></blockquote><blockquote type="cite"><span>error:1425F175:SSL routines:ssl_choose_client_version:inappropriate</span><br></blockquote><blockquote type="cite"><span>fallback (1/-1/0)".</span><br></blockquote><span></span><br><blockquote type="cite"><span>Is a TLS fallback prevention mechanism kicking in by error? If so, how</span><br></blockquote><blockquote type="cite"><span>to fix it?</span><br></blockquote><span></span><br><span>I do not know the answers to your questions, but I am sure that it is</span><br><span>possible to figure it out by looking at either packet captures or</span><br><span>detailed debugging logs. Unfortunately, I do not have enough free time</span><br><span>to guide you through this triage. There were several similar complains</span><br><span>about "inappropriate fallback" errors on this list recently. I would</span><br><span>start by revisiting those threads for more clues.</span><br><span></span><br><span>Alex</span><br></div></blockquote>Unfortunately we have not been able to work out the inappropriate fallback issue described <a href="http://lists.squid-cache.org/pipermail/squid-users/2019-September/021047.html">http://lists.squid-cache.org/pipermail/squid-users/2019-September/021047.html</a>. If you do fix your issue, please do share. <div>John</div></div></div></body></html>