Allow One Extra HTTPS Port Through Squid

An HTTPS service on port 8443 can fail through a correctly configured Squid proxy even when ordinary HTTPS on 443 works. Inspect the CONNECT denial and the destination-port policy before changing the client's proxy protocol.

In a typical Squid 6.13 access policy, two checks matter: the destination must pass Safe_ports, and CONNECT must pass SSL_ports. Adding the port to only one ACL can leave the other denial in effect.

Extend the existing definitions deliberately

For a policy allowing ordinary web ports and one additional HTTPS port:

acl Safe_ports port 80 443 8443
acl SSL_ports port 443 8443

Replace or edit the corresponding definitions rather than leaving an unexpected older set of values in place. Preserve the normal unsafe-port and CONNECT-denial rules, as well as the intended client restrictions.

Keep the exception narrow

If the additional port is needed only for one controlled destination, add a targeted denial before the client allow rule:

acl extra_tls_port port 8443
acl approved_tls_target dst 203.0.113.20/32
http_access deny CONNECT extra_tls_port !approved_tls_target

The address is a documentation placeholder. Use the destination you administer or are authorized to access, and account for its actual address changes. This limits the extra-port exception rather than permitting every target on 8443.

Parse the complete active configuration and review rule order. A correctly written denial placed after a matching client allow will not provide the intended restriction.

Test the approved hostname with its real certificate and port, then test a controlled target that should remain denied. Keeping TLS verification enabled distinguishes destination identity errors from proxy policy errors. Do not remove the whole CONNECT safeguard to make one custom-port request work.