Hello List, I've finally got a squid3 (squid3.4-4, compiled from sources on Debian) with SSL interception solution working quite decently. Now, trying to make it to work better I found some entries in the cache.log file, like these: 2014/07/28 16:07:15 kid1| fwdNegotiateSSL: Error negotiating SSL connection on FD 683: error:14092105:SSL routines:SSL3_GET_SERVER_HELLO:wrong cipher returned (1/-1/0) 2014/07/28 16:07:15 kid1| fwdNegotiateSSL: Error negotiating SSL connection on FD 160: error:14092105:SSL routines:SSL3_GET_SERVER_HELLO:wrong cipher returned (1/-1/0) 2014/07/28 16:07:37 kid1| clientNegotiateSSL: Error negotiating SSL connection on FD 117: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (1/0) 2014/07/28 16:07:40 kid1| UPGRADE WARNING: URL rewriter reponded with garbage ' 10.10.25.74/- - GET'. Future Squid will treat this as part of the URL. 2014/07/28 16:07:52 kid1| clientNegotiateSSL: Error negotiating SSL connection on FD 922: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (1/0) 2014/07/28 16:08:55 kid1| UPGRADE WARNING: URL rewriter reponded with garbage ' 10.10.25.75/- - GET'. Future Squid will treat this as part of the URL. I've been looking for solutions to this with no luck. So, these are my questions: 1) is it possible to check or view a FD content in order to troubleshoot this? 2) could you please share some light to solve this? 3) how do I apply a patch to upgrade my actual squid solution? Thank you! Ikna The SSL part of squid.conf: http_port 3129 http_port 3128 intercept https_port 3127 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=512MB cert=/etc/squid3/certs/ssl/public2.pem key=/etc/squid3/certs/ssl/private.pem options=NO_SSLv2,NO_SSLv3 capath=/etc/ssl/certs acl SSL_whitelist dstdomain "/etc/squid3/acl/ssl_whitelist.acl" acl SSL_whitelist_ip dst "/etc/squid3/acl/ssl_whitelist_ip.acl" ssl_bump none localhost ssl_bump none SSL_whitelist ssl_bump none SSL_whitelist_ip ssl_bump server-first all sslproxy_capath /etc/ssl/certs sslproxy_options NO_SSLv2,NO_SSLv3 sslproxy_cert_error allow all sslcrtd_program /usr/lib/squid3/ssl_crtd -s /usr/lib/ssl_db -M 200MB sslcrtd_children 40
