security_file_certgen(8)

📦
version 7.7 · 9 versions
, in alpine 3.23, alpine 3.24, arch rolling

💅 security_file_certgen — the Squid SSL certificate generator, bestie edition 🎀

okay so this is security_file_certgen, from the System Manager's Manual, and she's the SSL certificate generator for Squid — version 1.1 if we're being specific ✨. Think of her as the backstage makeup artist: Squid hands her a hostname, she hands back a signed certificate, and the whole SSL-bump situation just works. Slay.

✨ SYNOPSIS ✨

security_file_certgen [-cdhv] [-s directory -M size ] [-b fs_block_size
]

that's the whole vibe right there 💅

🦋 DESCRIPTION 🦋

so security_file_certgen is an installed binary. that's it, that's the sentence.

but like — why does she exist? because generating and signing SSL certificates takes time, and Squid is a busy queen who can't be doing all that herself. so Squid uses this helper as an external process to handle the work 🫶. communication happens via TCP sockets bound to the loopback interface (very private, very exclusive, iykyk).

and here's the iconic part: this helper can use a disk cache of certificates to improve response times on repeated requests 💖. she can also operate without a cache, generating new certificates on every single request. no cache, no problem, just main character energy.

🌸 OPTIONS 🌸

  • -b fs_block_size — file system block size in bytes. you need this for processing the natural size of a certificate on disk. default value is 2048 bytes. the following suffixes are accepted: B, KB, MB, GB. when no suffix is set, B is assumed ✨
  • -c — initialize the SSL storage database and exit. requires the -s and -M options to determine the storage location and size being created. one and done, periodt 💅
  • -d — write debug info to stderr. for when you're literally so curious 🕵️
  • -h — display the binary help and command line syntax info using stderr 🎀
  • -s directory — directory path of the SSL storage database. requires the -M option, they're a package deal fr fr
  • -M size — maximum size of SSL certificate disk storage. same suffixes supported by the -b option can be used 💖
  • -v — display the binary version details using stderr 👑

💀 KNOWN ISSUES 💀

SSL errors after changing the CA

certificates are stored in this database in signed form. after any change to the signing CA in squid.conf, be sure to erase and reinitialize the certificate database. like, be sure. this is not a drill bestie 😭

Certificate chaining

the versions 1.0 to 1.1 of this helper will not add chained intermediate CA certificates. the client must have a full chain of trust from the root CA all the way down to the end certificate generated by this program. signing with an intermediate CA means you need to install both the root and the intermediate public CA on the clients. both. not one. both 🙈

🌈 CONFIGURATION 🌈

before this helper can be used with disk storage, the storage area for new certificates must be initialized manually. yes, manually, with your own two hands. this is done from the command line using the -c parameter 💅

for example:

/usr/lib/squid/security_file_certgen -c -s
/var/cache/squid/ssl_db -M 4MB

certificates are stored in this database in signed form. after any change to the signing CA in squid.conf, be sure to erase and re-initialize the certificate database. (yes this is the second time she's saying it. that's how serious it is 🔥)

for simple configuration, the helper defaults can be used. only HTTP listening port options are required to enable generation and set the signing CA certificate ✨

for example:

http_port 3128 ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB
cert=/etc/squid/ssl_cert/example.com.pem

for more customized configuration, the helper certificate storage directory location and size can be altered with the sslcrtd_program configuration directive. the number of helper processes running can be configured with the and ssl_crtd_children configuration directive 🧚

for example:

sslcrtd_program /usr/lib/squid/security_file_certgen -s
/var/cache/squid/ssl_db -M 4MB
sslcrtd_children 5

to operate without disk storage, the helper should be configured explicitly without the -s and -M parameters 🦋

for example:

sslcrtd_program /usr/lib/squid/security_file_certgen

🫶 AUTHOR 🫶

this program was written by Christos Tsantilas <christos@chtsanti.net>

this manual was written by Christos Tsantilas <christos@chtsanti.net> and Amos Jeffries <amosjeffries@squid-cache.org>

 * Copyright (C) 1996-2026 The Squid Software Foundation and
contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.

💜 QUESTIONS 💜

questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org> — they're lovely, don't be shy 💌

🔥 REPORTING BUGS 🔥

bug reports need to be made in English. see https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

report bugs or bug fixes using https://bugs.squid-cache.org/ 🐛

report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org> 🚨

report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org> ✨

⭐ SEE ALSO ⭐

okay that's the whole page bestie, go forth and generate some certificates 💅✨

this gem is part of the System Manager's Manual, and this landing page is dated like any good security_file_certgen(8) footer — signed, sealed, and slaying 🎀💖

📦 where this page comes from