Hi Amos,
Upgrading to Squid 4.1 resolved the issue. I had to run
/usr/lib64/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB
to get squid to start. But after that all worked well. We'll do a bit more testing before we roll out to our production servers.
Thanks very much for your help.
Regards,
On Sun, 18 Jul 2021 at 16:45, Amos Jeffries <squid3@xxxxxxxxxxxxx> wrote:
On 16/07/21 4:38 pm, David Mills wrote:
> Hi Amos,
>
> sorry for the big delay here - I've had lots of other things to attend
> to. It turned on the logging you suggested. For a failed "apt update"
> attempt on the client I get the following attached access.log and cache.log.
>
> Are any of the lines
>
> 2021/07/16 04:28:01.423 kid1| 83,5| bio.cc(396) adjustSSL: Extension
> 13 does not supported!
>
> ...
>
> 20212021/07/16 04:28:32.465 kid1| 83,2| client_side.cc(3749)
> Squid_SSL_accept: Error negotiating SSL connection on FD 11: Aborted
> by client: 5
> ...
>
> 2021/07/16 04:28:02.452 kid1| Error negotiating SSL on FD 17:
> error:140920F8:SSL routines:ssl3_get_server_hello:unknown cipher
> returned (1/-1/0)
>
> ...
>
> 2021/07/16 04:28:01.413 kid1| 83,2| client_side.cc(4293)
> clientPeekAndSpliceSSL: SSL_accept failed.
>
>
> important?
>
Very. It means the libssl Squid is built with and using is not able to
understand the TLS the server is sending.
Squid-4 should be more tolerant of this particular issue, or at least
able to follow the on_unsupported_protocol directive when it is encountered.
Older Squid depend more directly on the library TLS parsing - which
cannot handle unknown values well.
Amos
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
DISCLAIMER: Acusensus puts the privacy and security of its clients, its data and information at the core of everything we do. The information contained in this email (including attachments) is intended only for the use of the person(s) to whom it is addressed to, as it may be confidential and contain legally privileged information. If you have received this email in error, please delete all copies and notify the sender immediately. Any views or opinions presented are solely those of the author and do not necessarily represent the views of Acusensus Pty Ltd. Please consider the environment before printing this email.
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
