Why do some HTTPS / TLS (might be TLS 1.3 only?) connections take so long to show up in Squid Proxy's access.log?
Running Squid Proxy 4.15 on Rocky Linux (have tried other Linux variants with earlier Squid versions). First thought certain sites were not going through the configured proxy (Firefox HTTP / HTTPS proxy settings), but then observed that the response time was in minutes and learned that Squid only writes to the access log once the request completes. Here's a sample:
07/Sep/2022:15:12:56 dns_time=- url="www.virustotal.com:443" duration_ms=173168 bytes=644252 mime=- src=##.##.##.##:50251 dest=74.125.34.46:443 http_method=CONNECT status=200 http_user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0" squid_req_hier=TCP_TUNNEL:HIER_DIRECT
The browser experience when visiting this site is normal and when observing network connectivity via Firefox debug, there are no in-process network calls that correlate to the 2.8m response time logged by Squid within access.log. When troubleshooting or trying to get an understanding of proxy traffic via access.log entries, this delay makes it quite difficult to derive patterns or test proper connectivity without waiting long periods of time. I've combed through http://www.squid-cache.org/Doc/config/logformat/ and other config items under http://www.squid-cache.org/Doc/config/ and cannot identify anything to log this entry more quickly or figure what is taking so long.
Here is my Squid configuration:
acl SSL_ports port 443
acl Safe_ports port 443
acl CONNECT method CONNECT
http_access allow !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow all
http_access deny all
http_port 3128
tls_outgoing_options min-version=1.2
logformat splunk_fun %tg dns_time=%dt url="%ru" duration_ms=%tr bytes=%st mime=%mt src=%>a:%>p dest=%<a:%<p http_method=%rm status=%>Hs http_user_agent="%{User-Agent}>h" squid_req_hier=%Ss:%Sh
access_log daemon:/var/log/squid/access.log splunk_fun
Any insight into lengthy HTTPS / TLS response times (not impacting end-user browser performance) would be greatly appreciated.