Squid cache_peer: Do Not Mark a Forward Parent as originserver

A cache_peer line can name a parent and still tell Squid to speak to it as though it were the origin website.

The switch responsible is originserver. Squid documents it for accelerator arrangements where the peer is a web server. It is not a generic flag meaning “send the original request through this parent.”

If the next hop is an ordinary HTTP forward proxy, review whether that flag belongs there at all. A basic parent declaration instead has the shape:

cache_peer parent.example parent 8080 0 no-query name=upstream

The parent may be your own service; for a permitted public-parent test with no parent-proxy credentials configured, take an HTTP candidate from the HTTP proxy list. Retain the intended client authorization, peer eligibility, authentication, and direct-fallback policy. This excerpt only identifies the peer's role.

proxy-only, sometimes copied beside originserver, concerns storing objects retrieved from that peer. Removing both flags at once does not establish that both caused the protocol failure.

Look at what the next service expects: a website request, a forward-proxy request, or a tunnel-establishment exchange. A valid hostname and reachable port cannot make those contracts interchangeable. Correcting the peer role is more specific than repeatedly changing TLS certificates on a connection whose request semantics were wrong.