Mostly for posterity. I spent a day or two figuring out that Squid tunnels HTTPS back to the client, which is likely to break if your path mtu is not what Squid expects of it. My proxy lives across a VPN, reached from a tagged VLAN over a PPPoE internet connection. All these layers squeeze my mtu down to 1420. The vnet jail running squid had 1500 set up by default. Changing it to 1420 made the proxy magically work.