<div dir="ltr">Hi, <div><br></div><div>I was using stunnel 5.28; Upgraded to 5.31b2</div><div><br></div><div>re-testing with 5.31b2, adding 'key=CN', debug=info</div><div>--- Config</div><div><div>debug = info<br></div><div>engine = capi<br></div><div>engineCtrl = debug_level:2</div><div>engineCtrl = debug_file:c:\keys\capi.txt</div><div>key = 1.2.3.4</div><div>CAfile = c:\cacert.pem<br></div><div>verify = 2</div><div>#options = NO_TLSv1.1</div><div>[test]<br></div><div>engineId = capi</div><div>client = yes</div><div>accept = <a href="http://0.0.0.0:9001">0.0.0.0:9001</a></div><div>connect = <a href="http://1.2.3.4:9000">1.2.3.4:9000</a></div></div><div><br></div><div>--- Stunnel log file</div><div><div>LOG5[main]: Reading configuration from file stunnel.conf</div><div>LOG5[main]: UTF-8 byte order mark detected </div><div>LOG6[main]: Engine #1 (capi) initialized</div><div>LOG5[main]: FIPS mode disabled</div><div>LOG6[main]: Initializing service [test]</div><div>LOG6[main]: Client certificate engine (capi) enabled</div><div>LOG4[main]: Service [test] uses "verify = 2" without subject checks</div><div>LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates</div><div>LOG5[main]: Configuration successful</div><div>LOG5[10]: Service [test] accepted connection from <a href="http://127.0.0.1:49960">127.0.0.1:49960</a></div><div>LOG6[10]: s_connect: connecting <a href="http://1.2.3.4:9000">1.2.3.4:9000</a></div><div>LOG5[10]: s_connect: connected <a href="http://1.2.3.4:9000">1.2.3.4:9000</a></div><div>LOG5[10]: Service [test] connected remote server from <a href="http://10.0.2.15:49961">10.0.2.15:49961</a></div><div>LOG6[10]: SNI: sending servername: 1.2.3.4</div><div>LOG6[10]: Certificate accepted at depth=1: C=US, ST=New Yorl, O=company1, OU=depdev, CN=1.2.3.4, emailAddress=<a href="mailto:e@mail.com">e@mail.com</a></div><div>LOG5[10]: Certificate accepted at depth=0: C=US, ST=New York, L=New York, O=company1, OU=depdev, CN=1.2.3.4, emailAddress=<a href="mailto:e@mail.com">e@mail.com</a></div><div>LOG6[10]: No client CA list</div><div>LOG6[10]: No client CA list</div><div>LOG6[10]: No client CA list</div><div>LOG6[10]: No client CA list</div><div>LOG6[10]: No client CA list</div><div>LOG6[10]: No client CA list</div><div>LOG6[10]: No client CA list</div><div>LOG6[10]: No client CA list</div><div>LOG3[10]: SSL_connect: 14094410: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure</div><div>LOG5[10]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket</div></div><div><br></div><div>--- capi.txt</div><div>Opening Certificate Store: MY</div><div><br></div><div>Thank you, </div><div>Shay </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Feb 19, 2016 at 9:51 PM, Michał Trojnara <span dir="ltr"><<a href="mailto:Michal.Trojnara@stunnel.org" target="_blank">Michal.Trojnara@stunnel.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
</span><span class="">On 18.02.2016 10:47, Shay Cohen wrote:<br>
> But in this case it does not get the certificate (for some reason).<br>
><br>
</span>I forgot to ask the obvious question:<br>
Which version of stunnel do you use?<br>
<br>
At least for the private key, you may specify its name with<br>
"key = <the common name of your client certificate>".<br>
I haven't tested it for the "cert" option and the CAPI engine.<br>
<br>
I also updated stunnel to include some additional details for client<br>
certificates requested by the server:<br>
<a href="https://www.stunnel.org/downloads/beta/stunnel-5.31b2-installer.exe" rel="noreferrer" target="_blank">https://www.stunnel.org/downloads/beta/stunnel-5.31b2-installer.exe</a><br>
Please send us the log files it produces with "debug = info".<br>
<span class=""><br>
Best regards,<br>
Mike<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
</span>Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" rel="noreferrer" target="_blank">http://www.enigmail.net/</a><br>
<br>
iQIcBAEBCAAGBQJWx3JDAAoJEC78f/DUFuAUG40P/1uTdRdTUjogRj6CzxVgjOmt<br>
K2NKa3x7xy5gu4ahoX6LK6oBaMIpjObunwjYL1Kp11OBUE2dqXAMYy6bfQ0HLNN6<br>
tjqTgL1k1bs1ea5yzcsici7dqymCL7gMNn7vHaguX9GigOMQtrLrGHwllAC03Rz+<br>
VVyMSY+x44sTn5H/09oaOs9bY1sJlwfoiivZEgrEI0H5xLHQpaI9li5QOZKU5XOa<br>
Am50a50/mWk8r56YEOzA3pYA9MxoGtQSj+e6Njn/3h883sdMEMRw5i28DOucUcId<br>
u26MSrmf6po4LHWKlw08G6Dge/09/RRhvaC31IKPguhuKRJfMI7+5upQ+MITNlwd<br>
/YU0YI7TnfdZNSjZ+dxA1ZdoP2SnpVFVyBExqglgKymd2Ej+8IjW1M+IlUJgGFPX<br>
vSzOanVs6/lsW3PTTz2KcNiCpINsp/Uz9jNHhrXq+laaQLfzuyyZv4JdZrGnBcE1<br>
Emni7a56lu7rcXjUGvq/YfqZ3bZyCD4OQPXfPmuYDMNPjHisqdJlQOnUUeKvwI0E<br>
mVc302UB8sF1/jalb4mTsgC3Wr94KTItuvg+7DQG+9aF991MDBxoIzlMStKyrnX/<br>
U5+Cvv2OO5Zg/1YfywVV6z+cgee05zM+ACq3v8hlEEFkeFBZ3CPVKvJO+FvQ84l9<br>
Kfi7i0cgZFzeCA+c7Tkr<br>
=NpFK<br>
<div class="HOEnZb"><div class="h5">-----END PGP SIGNATURE-----<br>
_______________________________________________<br>
stunnel-users mailing list<br>
<a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><br>
<a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" rel="noreferrer" target="_blank">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br>
</div></div></blockquote></div><br></div>