<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>SciFi wrote:</div><blockquote type="cite"><div>2012.01.11 20:48:52 LOG5[25326:2697274688]: stunnel 4.52 on x86_64-apple-darwin10.8.0 platform<br>2012.01.11 20:48:52 LOG5[25326:2697274688]: Compiled with OpenSSL 1.1.0-dev xx XXX xxxx<br>2012.01.11 20:48:52 LOG5[25326:2697274688]: Running with OpenSSL 0.9.8r 8 Feb 2011<br>2012.01.11 20:48:52 LOG5[25326:2697274688]: Update OpenSSL shared libraries or rebuild stunnel<br></div></blockquote>[cut]<br><blockquote type="cite"><div>Program received signal EXC_BAD_ACCESS, Could not access memory.<br>Reason: KERN_PROTECTION_FAILURE at address: 0x00000020<br>[Switching to process 25326 thread 0x1403]<br>0x94b0b2d6 in X509_get_subject_name ()<br>(gdb) bt<br>#0 0x94b0b2d6 in X509_get_subject_name ()<br>#1 0x0000f213 in verify_callback ()<br></div></blockquote>[cut]<br><blockquote type="cite"><div>I'm sorry, that's about as deep as I know to go. ;)<br></div></blockquote><div><br></div><div>The level of details is perfectly fine. Different numeric part of the OpenSSL version number indicates major changes in code *and* data structures. This is very likely to cause crashes. The architecture details of 0.9.8 and 1.1.0 are very different.</div><div><br></div><div>I modified stunnel to make it independent from the layout of X509_STORE_CTX data structure:</div><div><a href="ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.52b3.tar.gz">ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.52b3.tar.gz</a></div><div>It's still better to run stunnel with the version of OpenSSL it was compiled with.</div><div><br></div><blockquote type="cite"><div>But I should be able to do more tests with detailed instructions if needed.<br><br>For now, I will comment-out the "verify" line, and use this build with your basic .conf file even tho it makes me remain highly paranoid. ;(<br></div></blockquote><div><br></div><div>That's good. Without certificate-based authentication, SSL is vulnerable to man-in-the-middle attacks.</div><br></div><div>Mike</div><br></body></html>