<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Can you share the squid.conf so I can try to reproduce the issue here locally and verify how it could be resolved?<o:p></o:p></p><p class=MsoNormal>What OS and other relevant details such as “squid -v” output might help.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal>Eliezer<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>----<o:p></o:p></p><p class=MsoNormal>Eliezer Croitoru<o:p></o:p></p><p class=MsoNormal>NgTech, Tech Support<o:p></o:p></p><p class=MsoNormal>Mobile: +972-5-28704261<o:p></o:p></p><p class=MsoNormal>Email: <a href="mailto:ngtech1ltd@gmail.com"><span style='color:blue'>ngtech1ltd@gmail.com</span></a><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> squid-users <squid-users-bounces@lists.squid-cache.org> <b>On Behalf Of </b>ns@fabbricapolitica.com<br><b>Sent:</b> Monday, February 14, 2022 11:16<br><b>To:</b> squid-users@lists.squid-cache.org<br><b>Subject:</b> [squid-users] https interception problem with Squid 5<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>Good morning,<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>I have been using Squid as an http caching proxy for a long time.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>It's the second time I configured Squid for https caching and interception/inspection.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>The first time everything was fine<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>The second...not so much.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>I use the ssl_bump feature.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>With Squid 4.13 and Openssl v 1.1.1k-1 all works well without errors or warnings.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>With Squid v. 5.2.1 and Openssl v. 3.0.1, I got one error and one warning.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>I tried to use the same squid.conf for Squid 4 and Squid 5.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>Here are the problems with Squid 5.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>1) ERROR<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>I checked the configuration with the command "squid -k parse" and I got this error: ERROR: Unable to configure Ephemeral ECDH: error:0480006C:PEM routines::no start line<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>If I remove the curve name from tls-dh in the config file, the error disappears.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>First question: Which is the problem? How can I do to keep the curve name (prime256v1)<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>2) WARNING<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>I checked the configuration with the command "squid -k parse" and I got this warning: WARNING: Failed to decode DH parameters '/var/lib/squid/ssl_cert/squid-self-signed_dhparam.pem'<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>I generated the file for the Diffie-Hellman algorithm with this command (it worked with Squid4): openssl dhparam -outform PEM -out squid-self-signed_dhparam.pem 2048<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>Second question: Have you an idea on how to fix this?<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Verdana",sans-serif'>Thank you.<o:p></o:p></span></p></div></body></html>