<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p><font face="Calibri">Hello,</font></p>
<p><font face="Calibri">this has recently started me up more then
let it go. For a while chrome is upgrading in-page links to
https. It is supposed to work something like
<a class="moz-txt-link-freetext" href="https://www.bleepingcomputer.com/news/google/google-chrome-now-auto-upgrades-to-secure-connections-for-all-users/">https://www.bleepingcomputer.com/news/google/google-chrome-now-auto-upgrades-to-secure-connections-for-all-users/</a></font></p>
<p><font face="Calibri">But there is a catch for me - my squid
returns something like:</font></p>
<p><font face="Calibri">(104) Connection reset by peer (TLS code:
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104)<br>
Failed to establish a secure connection: [No Error]<br>
</font></p>
<p><font face="Calibri">or</font></p>
<p><font face="Calibri">[No Error] (TLS code:
SQUID_TLS_ERR_CONNECT+TLS_LIB_ERR=1408F10B+TLS_IO_ERR=1)<br>
Failed to establish a secure connection: error:1408F10B:SSL
routines:ssl3_get_record:wrong version number</font></p>
<p><font face="Calibri">to the user - via error page<br>
</font></p>
<p><font face="Calibri">Log file:</font></p>
<p><font face="Calibri">1712122364.809 1172 10.0.0.1
NONE_NONE_ABORTED/000 0 CONNECT 46.255.231.158:443 - HIER_NONE/-
- SNI redir.netcentrum.cz BumpMode peek - - - ServerNegoTLS -
ServerRecTLS - ServerRecVer - ServerNegCiph - Error:
ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104<br>
1712122366.296 23 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104<br>
1712122366.293 21 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104<br>
1712122367.111 20 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104<br>
1712122367.114 21 10.0.0.1 NONE_NONE_ABORTED/000 0 CONNECT
46.255.231.158:443 - HIER_NONE/- - SNI redir.netcentrum.cz
BumpMode peek - - - ServerNegoTLS - ServerRecTLS - ServerRecVer
- ServerNegCiph - Error: ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104<br>
<br>
</font></p>
<p><font face="Calibri">In fact - this seems to be http only sites
like -
<a class="moz-txt-link-freetext" href="https://www.ssllabs.com/ssltest/analyze.html?d=www.jarovnet.org">https://www.ssllabs.com/ssltest/analyze.html?d=www.jarovnet.org</a>
or
<a class="moz-txt-link-freetext" href="https://www.ssllabs.com/ssltest/analyze.html?d=redir.netcentrum.cz&s=46.255.231.158&latest">https://www.ssllabs.com/ssltest/analyze.html?d=redir.netcentrum.cz&s=46.255.231.158&latest</a>.
See this snapshot from centrum web mail page source code "Více
informací o tomto zapezpečení naleznete v <a
href=<a class="moz-txt-link-rfc2396E" href="http://napoveda.centrum.cz/index.php?/Knowledgebase/Article/View/18/1/">"http://napoveda.centrum.cz/index.php?/Knowledgebase/Article/View/18/1/"</a>
"<br>
</font></p>
<p><font face="Calibri">So - what is supposed to be happening is
chrome should fallback to http if there is a problem with https
- i think the most obvious reason to fall back would be no
output at all. So I think my effort should target the situation
when squid says ERR_SECURE_CONNECT_FAIL |
SQUID_TLS_ERR_CONNECT+TLS_IO_ERR=5+errno=104 and to remain
silent to the client.</font></p>
<p><font face="Calibri">Is there a way to do it - ie. do not show
error page for not able to connect to server at all? I'd like
every other problems (ie. bad/selfsigned/not matched certificate
etc.) pushed to the client's eyes. I have implemented
<a class="moz-txt-link-freetext" href="https://www.squid-cache.org/Doc/config/on_unsupported_protocol/">https://www.squid-cache.org/Doc/config/on_unsupported_protocol/</a>
like in the example - but it is for an accepted TCP connections.
I'd like to handle SSL errors - such as not being able to
connect at all. - could it be done with
<a class="moz-txt-link-freetext" href="https://www.squid-cache.org/Doc/config/sslproxy_cert_error/">https://www.squid-cache.org/Doc/config/sslproxy_cert_error/</a>?</font></p>
<p><font face="Calibri">LL<br>
</font></p>
<p><br>
</p>
</body>
</html>