squid-cache.org

	Configures whether and where Squid records pre-master secret and
	related encryption details for TLS connections accepted or established
	by Squid. These connections include connections accepted at
	https_port, TLS connections opened to origin servers/cache_peers/ICAP
	services, and TLS tunnels bumped by Squid using the SslBump feature.
	This log (a.k.a. SSLKEYLOGFILE) is meant for triage with traffic
	inspection tools like Wireshark.

	    tls_key_log <destination> [options] [if [!]<acl>...]

	WARNING: This log allows anybody to decrypt the corresponding
	encrypted TLS connections, both in-flight and postmortem.

	At most one log file is supported at this time. Repeated tls_key_log
	directives are treated as fatal configuration errors. By default, no
	log is created or updated.

	If the log file does not exist, Squid creates it. Otherwise, Squid
	appends an existing log file.

	The directive is consulted whenever a TLS connection is accepted or
	established by Squid. TLS connections that fail the handshake may be
	logged if Squid got enough information to form a log record. A record
	is logged only if all of the configured ACLs match.

	While transport-related ACLs like src and dst should work, Squid may
	not have access to higher-level information. For example, when logging
	accepted https_port connections, Squid does not yet have access to the
	expected HTTPS request. Similarly, an HTTPS response is not available
	when logging most TLS connections established by Squid.

	The log record format is meant to be compatible with TLS deciphering
	features of Wireshark which relies on fields like CLIENT_RANDOM and
	RSA Master-Key. A single log record usually spans multiple lines.
	Technical documentation for that format is maintained inside the
	Wireshark code (e.g., see tls_keylog_process_lines() comments as of
	Wireshark commit e3d44136f0f0026c5e893fa249f458073f3b7328). TLS key
	log does not support custom record formats.

	This clause only supports fast acl types.
	See https://wiki.squid-cache.org/SquidFaq/SquidAcl for details.

	See access_log's <module>:<place> parameter for a list of supported
	logging destinations.

	TLS key log supports all access_log key=value options with the
	exception of logformat=name.

	Requires Squid built with OpenSSL support.