Why Browsers May Hide Squid’s HTTPS Block Page

The proxy's custom block page appears for an HTTP site. For an HTTPS site, the browser displays a tunnel error instead. Replacing the HTML template again may change nothing.

With an explicit HTTP proxy, an HTTPS visit usually begins with CONNECT. The browser is asking the proxy to open a tunnel to a host and port. If Squid rejects that request, the website's TLS session never starts.

The rejection can have an HTTP status and response content. You can inspect that failed CONNECT response with curl independently of the browser's error page. That does not require the browser to present the supplied HTML as the destination's webpage. A browser may discard the CONNECT error body and use its own proxy error interface; exact presentation depends on the client.

If Squid's rejection already contains the intended deny_info body, editing its text, stylesheet or file permissions does not change which response stage the browser handles. Keep the rejection status and access log available to establish whether CONNECT was denied and why. A generic browser page can hide policy details while the proxy correctly enforces the rule.

Serving a block page inside an intercepted HTTPS connection is another architecture, involving TLS termination, client trust and certificate handling. It is not enabled by editing deny_info, and a custom template supplies no authority to impersonate the blocked site. Choose that design only if required; otherwise use the client's available error reporting and the proxy's operational logs.