That .csr File Is Still a Certificate Request
Identify certificate requests, issued certificates, and private keys before assigning files to a proxy's TLS configuration.
server.csr is usually a request asking a certificate authority to issue a certificate. Pointing a proxy's certificate option at it does not finish that process.
Look inside the PEM file:
-----BEGIN CERTIFICATE REQUEST-----
-----BEGIN CERTIFICATE-----
-----BEGIN PRIVATE KEY-----These labels describe different objects. A request is not an issued certificate, and neither is its private key. Renaming a file to .pem changes none of them.
For a TLS listener identifying the proxy, use the issued certificate for that proxy name and its matching key, in the arrangement the software documents. openssl req inspects certificate requests; openssl x509 inspects certificates. Use the parser for the object you have. For Squid 6.13, use the issued certificate and matching key in its TLS listener.
A normal server certificate also differs from a CA used for authorized interception. It does not grant authority to sign unrelated website certificates.
Confirm object types and key pairing before investigating hostname checks or network reachability. TLS cannot use a certificate that was never supplied.