我试图安装鱿鱼3.5.4（在docker上，运行debian 8），并运行在SSL模式。 汇编：
./configure --prefix=/opt/squid --srcdir=. --disable-maintainer-mode \ --disable-dependency-tracking --disable-silent-rules --enable-inline\ --disable-arch-native --enable-async-io=8 \ --enable-storeio=ufs,aufs,diskd,rock \ --enable-removal-policies=lru,heap --enable-delay-pools \ --enable-cache-digests --enable-icap-client \ --enable-follow-x-forwarded-for \ --enable-auth-basic=DB,fake,getpwnam,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB \ --enable-auth-digest=file,LDAP \ --enable-auth-negotiate=kerberos,wrapper \ --enable-auth-ntlm=fake,smb_lm \ --enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,unix_group,wbinfo_group \ --enable-url-rewrite-helpers=fake --enable-eui \ --enable-esi --enable-icmp --enable-zph-qos \ --disable-translation --with-filedescriptors=65536 \ --with-large-files --with-default-user=squid \ --enable-linux-netfilter \ CFLAGS="-g -O2 -fPIE -Wall" LDFLAGS="-fPIE -pie -Wl,-z,relro -Wl,-z,now" CPPFLAGS="-D_FORTIFY_SOURCE=2" \ CXXFLAGS="-g -O2 -fPIE " --enable-ssl --with-openssl --enable-ssl-crtd 更改configuration（squid.conf）（其余为默认值）：
# Squid normally listens to port 3128 \ http_port 9090 sslcrtd_program /opt/squid/libexec/ssl_crtd -s /opt/squid/var/lib/ssl_db -M 4MB https_port 8080 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB key=/opt/squid/certs/private.pem cert=/opt/squid/certs/public.pem ### New configuration for Squid version 3.5 acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all ### New config ends sslproxy_capath /etc/ssl/certs sslproxy_cert_error allow all always_direct allow all sslproxy_flags DONT_VERIFY_PEER
生成的证书：
openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -keyout private.pem -out public.pem
生成squid证书目录并更改所有权：
/opt/squid/libexec/ssl_crtd -c -s /opt/squid/var/lib/ssl_db -M 4MB chown -R squid:squid /opt/squid/var/lib/ssl_db
CA根证书存在于默认path中
squid@525f5d9c759a:/opt/squid/certs$ ls -lsthr /etc/ssl/certs | wc -l 741
我正在testing这个configuration，使用HTTP CONNECT，直接在浏览器中configuration代理。
问题：
浏览器请求遇到代理时，出现以下错误
8zjv9ksCWknblqfZ3rjWczvKNRboHpu940olZAbvSP0JWSXhFfRRTIsHIHD2/rt/ n5/qsURq/WLodLffFxuk+bLVTDZu -----END PRIVATE KEY----- 2015/05/04 15:13:46.468 kid1| client_side.cc(3981) sslCrtdHandleReply: Certificate for 172.17.0.7 was successfully recieved from ssl_crtd 2015/05/04 15:13:46.468 kid1| client_side.cc(3664) httpsCreate: will negotate SSL on local=172.17.0.7:2222 remote=172.17.42.1:40686 FD 10 flags=33 2015/05/04 15:13:46.468 kid1| AsyncCall.cc(26) AsyncCall: The AsyncCall ConnStateData::requestTimeout constructed, this=0x7f0357a16c10 [call105]
2015/05/04 15：13：46.468 kid1 | 在FD 10上协商SSL连接时出错：成功（0）
2015/05/04 15:13:46.468 kid1| AsyncCall.cc(93) ScheduleCall: comm.cc(730) will call ConnStateData::connStateClosed(FD -1, data=0x7f03575d43b8) [call95] 2015/05/04 15:13:46.468 kid1| AsyncCallQueue.cc(55) fireNext: entering ConnStateData::connStateClosed(FD -1, data=0x7f03575d43b8) 2015/05/04 15:13:46.468 kid1| AsyncCall.cc(38) make: make call ConnStateData::connStateClosed [call95] 2015/05/05 10:00:25| pinger: Initialising ICMP pinger ... 2015/05/05 10:00:25| icmp_sock: (1) Operation not permitted 2015/05/05 10:00:25| pinger: Unable to start ICMP pinger. 2015/05/05 10:00:25| icmp_sock: (1) Operation not permitted 2015/05/05 10:00:25| pinger: Unable to start ICMPv6 pinger. 2015/05/05 10:00:25| FATAL: pinger: Unable to open any ICMP sockets.
发送一个curl请求显示这个：
curl --proxy https://localhost:8080 -w '\n' https://google.com -v * Rebuilt URL to: https://google.com/ * Trying ::1... * Connected to localhost (::1) port 8080 (#0) * Establish HTTP proxy tunnel to google.com:443 > CONNECT google.com:443 HTTP/1.1 > Host: google.com:443 > User-Agent: curl/7.42.0 > Proxy-Connection: Keep-Alive > * Proxy CONNECT aborted * Connection #0 to host localhost left intact curl: (56) Proxy CONNECT aborted
有人能帮忙吗？