<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">Hi,</span><br class=""><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">I have a couple of questions regarding failover with stunnel:</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">1. I would like to know if there is a way to use failover with two servers with two different set of TLS cert/key.</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">The following rule doesn't work, because the cert and key parameters are overwritten, but it shows what I would like to achieve:</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">[failover]</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">accept = <a href="http://127.0.0.1:4441/" target="_blank" style="color: rgb(17, 85, 204);" class="">127.0.0.1:4441</a></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">cert = cert_1.cert</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">key = key_1.pem</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">connect = server-1:1234</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">cert = cert_2.cert</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">key = key_2.pem</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">connect = server-2:1234</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">2. On the same topic, I would like to know if there is an option that could open the local port (accept) only when the connection (connect) is established?</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">The problem I'm facing is that I use a PAC profile with failover on several stunnel entries: "return PROXY <a href="http://127.0.0.1:4441/" target="_blank" style="color: rgb(17, 85, 204);" class="">127.0.0.1:4441</a>; PROXY <a href="http://127.0.0.1:4442/" target="_blank" style="color: rgb(17, 85, 204);" class="">127.0.0.1:4442</a>; PROXY <a href="http://127.0.0.1:4443/" target="_blank" style="color: rgb(17, 85, 204);" class="">127.0.0.1:4443</a>;". However, when one of the remote server is down (i.e. server-1), it is not easily detected by web-browsers (Chrome does not seem to detect it well), and so instead of switching to the next PROXY, it simply dies on the first one. If the port 4441 relative to server-1 (which is unavailable) was closed, then the webrowser could easily detect it and switch to the second server with port 4442.</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">3. Is there another way to tweak stunnel behavior when a remote server is down?</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">I'm thinking about a couple of things, like being able to switch to a different rule set:</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">[failover1]</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">accept = <a href="http://127.0.0.1:4441/" target="_blank" style="color: rgb(17, 85, 204);" class="">127.0.0.1:4441</a></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">cert = cert_1.cert</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">key = key_1.pem</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">connect = server-1:1234</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">connect = <a href="http://127.0.0.1:4442/" target="_blank" style="color: rgb(17, 85, 204);" class="">127.0.0.1:4442</a> ; This is failover2</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">[failover2]</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">accept = <a href="http://127.0.0.1:4442/" target="_blank" style="color: rgb(17, 85, 204);" class="">127.0.0.1:4442</a></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">cert = cert_2.cert</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">key = key_2.pem</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">connect = server-2:1234</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">Or maybe there are some options that I'm not aware of to timeout connections more efficiently: so that Chrome (or other clients using HTTP proxies) will immediately know that stunnel cannot connect to the remote server and so that the proxy is down.</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">Thank you for your help.</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">Cheers,</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.8px; widows: 1; background-color: rgb(255, 255, 255);" class="">Thireus.</div></body></html>