title: squid ssl-bump 3.5.4: error - Error negotiating SSL connection on FD 10: Success (0)
body: <p>I am trying to install squid 3.5.4 (on docker, running debian 8) and run it in ssl-bump mode.
  Compilation:</p>
  
  <pre><code>./configure --prefix=/opt/squid --srcdir=. --disable-maintainer-mode \
  --disable-dependency-tracking --disable-silent-rules --enable-inline\
  --disable-arch-native --enable-async-io=8 \
  --enable-storeio=ufs,aufs,diskd,rock \
  --enable-removal-policies=lru,heap --enable-delay-pools \
  --enable-cache-digests --enable-icap-client \
  --enable-follow-x-forwarded-for \
  --enable-auth-basic=DB,fake,getpwnam,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB \
  --enable-auth-digest=file,LDAP \
  --enable-auth-negotiate=kerberos,wrapper \
  --enable-auth-ntlm=fake,smb_lm \
  --enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,unix_group,wbinfo_group \
  --enable-url-rewrite-helpers=fake --enable-eui \
   --enable-esi --enable-icmp --enable-zph-qos \
  --disable-translation --with-filedescriptors=65536 \
  --with-large-files --with-default-user=squid \
  --enable-linux-netfilter \
  CFLAGS="-g -O2 -fPIE -Wall" LDFLAGS="-fPIE -pie -Wl,-z,relro -Wl,-z,now" CPPFLAGS="-D_FORTIFY_SOURCE=2" \
  CXXFLAGS="-g -O2 -fPIE " --enable-ssl --with-openssl --enable-ssl-crtd
  </code></pre>
  
  <p>Changed configuration (squid.conf) (rest is default):</p>
  
  <pre><code># Squid normally listens to port 3128 \
  http_port 9090
  sslcrtd_program /opt/squid/libexec/ssl_crtd -s /opt/squid/var/lib/ssl_db -M 4MB
  https_port 8080 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB key=/opt/squid/certs/private.pem cert=/opt/squid/certs/public.pem
  
  ### New configuration for Squid version 3.5
  acl step1 at_step SslBump1
  ssl_bump peek step1
  ssl_bump bump all
  ### New config ends
  sslproxy_capath /etc/ssl/certs
  sslproxy_cert_error allow all
  always_direct allow all
  sslproxy_flags DONT_VERIFY_PEER
  </code></pre>
  
  <p>Generated certificates:</p>
  
  <pre><code>openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -keyout private.pem -out public.pem
  </code></pre>
  
  <p>Generate squid certs dir and change ownership:</p>
  
  <pre><code>/opt/squid/libexec/ssl_crtd -c -s /opt/squid/var/lib/ssl_db -M 4MB
  chown -R squid:squid /opt/squid/var/lib/ssl_db
  </code></pre>
  
  <p>CA Root certs are present in the default path</p>
  
  <pre><code>squid@525f5d9c759a:/opt/squid/certs$ ls -lsthr  /etc/ssl/certs | wc -l
  741
  </code></pre>
  
  <p>I am testing this configuration, using HTTP CONNECT, configuring the proxy directly in the browser.</p>
  
  <blockquote>
    <p>ISSUE:</p>
  </blockquote>
  
  <p>I get the following error when the browser request hits the proxy</p>
  
  <pre><code>8zjv9ksCWknblqfZ3rjWczvKNRboHpu940olZAbvSP0JWSXhFfRRTIsHIHD2/rt/
  n5/qsURq/WLodLffFxuk+bLVTDZu
  -----END PRIVATE KEY-----
  
  2015/05/04 15:13:46.468 kid1| client_side.cc(3981) sslCrtdHandleReply: Certificate for 172.17.0.7 was successfully recieved from ssl_crtd
  2015/05/04 15:13:46.468 kid1| client_side.cc(3664) httpsCreate: will negotate SSL on local=172.17.0.7:2222 remote=172.17.42.1:40686 FD 10 flags=33
  2015/05/04 15:13:46.468 kid1| AsyncCall.cc(26) AsyncCall: The AsyncCall ConnStateData::requestTimeout constructed, this=0x7f0357a16c10 [call105]
  </code></pre>
  
  <p><strong><em>2015/05/04 15:13:46.468 kid1| Error negotiating SSL connection on FD 10: Success (0)</em></strong></p>
  
  <pre><code>2015/05/04 15:13:46.468 kid1| AsyncCall.cc(93) ScheduleCall: comm.cc(730) will call ConnStateData::connStateClosed(FD -1, data=0x7f03575d43b8) [call95]
  2015/05/04 15:13:46.468 kid1| AsyncCallQueue.cc(55) fireNext: entering ConnStateData::connStateClosed(FD -1, data=0x7f03575d43b8)
  2015/05/04 15:13:46.468 kid1| AsyncCall.cc(38) make: make call ConnStateData::connStateClosed [call95]
  2015/05/05 10:00:25| pinger: Initialising ICMP pinger ...
  2015/05/05 10:00:25|  icmp_sock: (1) Operation not permitted
  2015/05/05 10:00:25| pinger: Unable to start ICMP pinger.
  2015/05/05 10:00:25|  icmp_sock: (1) Operation not permitted
  2015/05/05 10:00:25| pinger: Unable to start ICMPv6 pinger.
  2015/05/05 10:00:25| FATAL: pinger: Unable to open any ICMP sockets.
  </code></pre>
  
  <p>Sending a curl request shows this:</p>
  
  <pre><code>curl --proxy https://localhost:8080 -w '\n' https://google.com -v
  * Rebuilt URL to: https://google.com/
  *   Trying ::1...
  * Connected to localhost (::1) port 8080 (#0)
  * Establish HTTP proxy tunnel to google.com:443
  &gt; CONNECT google.com:443 HTTP/1.1
  &gt; Host: google.com:443
  &gt; User-Agent: curl/7.42.0
  &gt; Proxy-Connection: Keep-Alive
  &gt; 
  * Proxy CONNECT aborted
  * Connection #0 to host localhost left intact
  
  curl: (56) Proxy CONNECT aborted
  </code></pre>
  
  <p>Can anyone help with this?</p>