On 2026-07-17 01:31, Vacheslav wrote:

16.07.2026 18:19, Andrey K пишет:
@Vacheslav:
> sudo /usr/libexec/squid/security_file_certgen -c -s
> /var/cache/squid/ssl_db/certs -M 4MB
You specified the wrong path (the correct one is /var/cache/squid/ssl_db ).


good catch:
now running:
 sudo -u squid /usr/libexec/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB
^C
produces nothing.

That lack of output is a good sign -- the helper managed to start successfully.


2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited

Helpers are still dying, but it looks like they do it while handling traffic.


2. Redirect security_file_certgen stderr (but not stdout!) output
into a dedicated log file. It may be possible to do that right on
the sslcrtd_program line, without wrapping the helper into another
script.

how to do that?

Try using shell redirection when specifying how to run the helper. Something along these lines may work:

    sslcrtd_program /usr/local/... -M 4MB >> /tmp/sslcrtd.error.log

I also recommend using a single helper for the initial tests:

    sslcrtd_children 1 startup=1 idle=1


HTH,

Alex.


2026/07/17 08:17:35| Removing PID file (/run/squid.pid)
2026/07/17 08:18:54| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.
2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/17 08:18:54| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_linklocal
     configuration context: Default Configuration(16) acl
2026/07/17 08:18:54| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/07/17 08:18:55| Created PID file (/run/squid.pid)
2026/07/17 08:18:55 kid1| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.
2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_localhost
     configuration context: Default Configuration(15) acl
2026/07/17 08:18:55 kid1| aclIpParseIpData: IPv6 has not been enabled.
     acl name: to_linklocal
     configuration context: Default Configuration(16) acl
2026/07/17 08:18:55 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2026/07/17 08:18:55 kid1| Set Current Directory to /var/cache/squid
2026/07/17 08:18:55 kid1| Starting Squid Cache version 7.6 for x86_64-suse-linux-gnu...
2026/07/17 08:18:55 kid1| Service Name: squid
2026/07/17 08:18:55 kid1| Process ID 3685
2026/07/17 08:18:55 kid1| Process Roles: worker
2026/07/17 08:18:55 kid1| With 4096 file descriptors available
2026/07/17 08:18:55 kid1| Initializing IP Cache...
2026/07/17 08:18:55 kid1| DNS IPv4 socket created at 0.0.0.0, FD 7
2026/07/17 08:18:55 kid1| Adding nameserver 10.6.30.40 from /etc/resolv.conf
2026/07/17 08:18:55 kid1| Adding nameserver 10.10.10.5 from /etc/resolv.conf
2026/07/17 08:18:55 kid1| helperOpenServers: Starting 5/5 'security_file_certgen' processes 2026/07/17 08:18:55 kid1| helperOpenServers: Starting 8/16 'ufdbgclient' processes 2026/07/17 08:18:55 kid1| Logfile: opening log daemon:/var/log/squid/access.log 2026/07/17 08:18:55 kid1| Logfile Daemon: opening log /var/log/squid/access.log
2026/07/17 08:18:56 kid1| Unlinkd pipe opened on FD 39
2026/07/17 08:18:56 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2026/07/17 08:18:56 kid1| Store logging disabled
2026/07/17 08:18:56 kid1| Swap maxSize 3072000 + 983040 KB, estimated 311926 objects
2026/07/17 08:18:56 kid1| Target number of buckets: 15596
2026/07/17 08:18:56 kid1| Using 16384 Store buckets
2026/07/17 08:18:56 kid1| Max Mem  size: 983040 KB
2026/07/17 08:18:56 kid1| Max Swap size: 3072000 KB
2026/07/17 08:18:56 kid1| Rebuilding storage in /var/cache/squid (clean log)
2026/07/17 08:18:56 kid1| Using Least Load store dir selection
2026/07/17 08:18:56 kid1| Set Current Directory to /var/cache/squid
2026/07/17 08:18:56 kid1| Finished loading MIME types and icons.
2026/07/17 08:18:56 kid1| HTCP Disabled.
2026/07/17 08:18:56 kid1| Pinger socket opened on FD 44
2026/07/17 08:18:56 kid1| Squid plugin modules loaded: 0
2026/07/17 08:18:56 kid1| Adaptation support is off.
2026/07/17 08:18:56 kid1| Accepting SSL bumped HTTP Socket connections at conn28 local=0.0.0.0:8080 remote=[::] FD 42 flags=9
     listening port: 8080
2026/07/17 08:18:56 pinger| WARNING: BCP 177 violation. Detected non-functional IPv6 loopback.
2026/07/17 08:18:56 pinger| Initialising ICMP pinger ...
2026/07/17 08:18:56 pinger| ICMP socket opened.
2026/07/17 08:18:56 pinger| ICMPv6 socket opened
2026/07/17 08:18:56 kid1| Indexing cache entries: 1.84% (4000 out of 217945)
2026/07/17 08:18:59 kid1| Done reading /var/cache/squid swaplog (217944 entries)
2026/07/17 08:18:59 kid1| Finished rebuilding storage from disk.
      217944 Entries scanned
           0 Invalid entries
           0 With invalid flags
      217944 Objects loaded
           0 Objects expired
           0 Objects canceled
           0 Duplicate URLs purged
           0 Swapfile clashes avoided
     Took 2.85 seconds (76435.29 objects/sec).
2026/07/17 08:18:59 kid1| Beginning Validation Procedure
2026/07/17 08:18:59 kid1| Completed Validation Procedure
     Validated 217930 Entries
     store_swap_size = 2764788.00 KB
2026/07/17 08:18:59 kid1| storeLateRelease: released 0 objects
2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master57
2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master55
2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master55
2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master57
2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master57
2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master55
2026/07/17 08:18:59 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master57

........

2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master57
2026/07/17 08:21:32 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000416+TLS_IO_ERR=1
     current master transaction: master57
2026/07/17 08:21:33 kid1| ERROR: Cannot accept a TLS connection
     problem: failure
     error detail: SQUID_TLS_ERR_ACCEPT+TLS_LIB_ERR=A000418+TLS_IO_ERR=1
     current master transaction: master57
2026/07/17 08:21:33 kid1| WARNING: sslcrtd_program #Hlpr1 exited
     current master transaction: master57
2026/07/17 08:21:33 kid1| Too few sslcrtd_program processes are running (need 1/5)
     active processes: 4
     processes configured to start at (re)configuration: 5
     current master transaction: master57
2026/07/17 08:21:33 kid1| helperOpenServers: Starting 1/5 'security_file_certgen' processes
     current master transaction: master57
2026/07/17 08:21:33 kid1| Preparing for shutdown after 761 requests
2026/07/17 08:21:33 kid1| Waiting 30 seconds for active connections to finish
2026/07/17 08:21:33 kid1| Closing HTTP(S) port 0.0.0.0:8080
     listening port: 8080
2026/07/17 08:21:33 kid1| Closing Pinger socket on FD 44
2026/07/17 08:21:33 kid1| ERROR: logfileHandleWrite: daemon:/var/log/squid/access.log: error writing ((32) Broken pipe)     connection: conn2846 local=10.0.0.18:8080 remote=10.1.0.17:53255 flags=1
2026/07/17 08:21:33 kid1| storeDirWriteCleanLogs: Starting...
    connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1
2026/07/17 08:21:33 kid1|     65536 entries written so far.
    connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1
2026/07/17 08:21:33 kid1|    131072 entries written so far.
    connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1
2026/07/17 08:21:33 kid1|    196608 entries written so far.
    connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1
2026/07/17 08:21:33 kid1|   Finished.  Wrote 217944 entries.
    connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1
2026/07/17 08:21:33 kid1|   Took 0.08 seconds (2736133.78 entries/sec).
    connection: conn2846 local=10.10.10.18:8080 remote=10.16.0.7:53255 flags=1
2026/07/17 08:21:33 kid1| FATAL: I don't handle this error well!
    connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1
2026/07/17 08:21:33 kid1| Squid Cache (Version 7.6): Terminated abnormally.
    connection: conn2846 local=10.10.10.18:8080 remote=10.1.0.17:53255 flags=1
CPU Usage: 10.098 seconds = 7.758 user + 2.340 sys
Maximum Resident Size: 314320 KB
Page faults with physical i/o: 0

To recreate a certificate database you should do:

sudo rm -rf /var/cache/squid/ssl_db
sudo /usr/libexec/squid/security_file_certgen -c -s /var/cache/squid/ssl_db -M 4MB
sudo chown -R squid:squid /var/cache/squid/ssl_db

чт, 16 июл. 2026 г. в 16:36, Alex Rousskov <[email protected]>:

    On 2026-07-16 01:57, Vacheslav wrote:

    > 2026/07/16 08:34:24 kid1| WARNING: sslcrtd_program #Hlpr1 exited

    We need to figure out why your security_file_certgen helpers are
    exiting. IIRC, those helpers have not been upgraded to report their
    fatal failures to cache.log. There are a few tricks you can use to
    see
    what the problem is, but I would probably start with these three:

    1. Run security_file_certgen with sslcrtd_program parameters from the
    command line, as Squid user. If you are lucky, it will complain about
    something before it starts waiting for the helper request.

    2. Redirect security_file_certgen stderr (but not stdout!) output
    into a
    dedicated log file. It may be possible to do that right on the
    sslcrtd_program line, without wrapping the helper into another script.

    3. Enable full debugging, reproduce the problem with a single
    transaction, and send a link to the corresponding compressed
    cache.log
    file for analysis as detailed at
    
https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction


    Cheers,

    Alex.

    _______________________________________________
    squid-users mailing list
    [email protected]
    https://lists.squid-cache.org/listinfo/squid-users



_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

Reply via email to