Features

Stunnel is a general-purpose TLS offloading and load-balancing proxy. Available features depend on the operating system, the linked OpenSSL library, and build-time options. Run stunnel -version to inspect a particular installation.

TLS and DTLS Proxying

• Server mode for accepting TLS and forwarding plaintext to an application.
• Client mode for adding TLS to applications that cannot use it directly.
• TLS over TCP and DTLS over UDP with transport = udp.
• IPv4, IPv6, and Unix-domain sockets.
• Remote backends with connect and local programs with exec.
• Multiple independent services in one process.
• Configuration fragments loaded in alphabetical order with include.

Authentication and Trust

• X.509 server and client certificates.
• Public-key infrastructure validation with verifyChain.
• DNS name, IP address, and email identity checks with checkHost, checkIP, and checkEmail.
• Mutual TLS for authenticating individual clients.
• Certificate pinning with verifyPeer.
• TLS pre-shared keys with per-client identities.
• Certificate and key files in PEM or PKCS#12 form.
• Certificate and key URIs supplied by OpenSSL engines or providers.
• Certificate revocation lists and OCSP validation.
• SNI in client mode and SNI-based virtual services in server mode.
• Redirection of clients that fail certificate authentication.

See the authentication guide for secure configuration examples.

Cryptographic Policy

• TLS 1.3 and earlier versions supported according to the linked OpenSSL library.
• Independent TLS 1.3 ciphersuites and TLS 1.2-or-earlier ciphers policies.
• Minimum and maximum protocol versions with sslVersionMin and sslVersionMax.
• Configurable curves and OpenSSL security levels.
• Forward secrecy with modern key exchange.
• Session tickets, session IDs, and configurable session resumption.
• FIPS operation when stunnel, OpenSSL, and the selected provider are built and configured for the applicable validated module and security policy.

The defaults provided by current stunnel and OpenSSL releases are recommended unless a documented security or interoperability policy requires an override.

OpenSSL Integration

• OpenSSL 3 providers selected with provider.
• Provider parameters on supported OpenSSL releases with providerParameter.
• OSSL_STORE resources, including external trust stores, through CAstore.
• Hardware-backed and external keys through provider or engine URIs.
• Legacy OpenSSL engine support for compatibility.
• Integrations such as PKCS#11 and Microsoft CNG when the corresponding module is installed.

Providers are preferred for new OpenSSL 3 integrations. Engines remain useful for compatibility with existing deployments.

Routing, Load Balancing, and Network Integration

• Multiple connect targets.
• Round-robin distribution or priority-based failover.
• Delayed DNS resolution for dynamic or temporarily unavailable DNS.
• Binding outgoing connections to a selected source address.
• HAProxy PROXY protocol version 1 for passing the original client address.
• Transparent source and destination proxying on supported Unix platforms.
• SOCKS versions 4, 4a, and 5 inside TLS.
• Name-based virtual services using SNI.

Application-Protocol Negotiation

Stunnel can negotiate TLS or related framing for supported application protocols rather than requiring TLS to start immediately on a dedicated port. Current handlers include:

• HTTP CONNECT proxies.
• IMAP, LDAP, NNTP, POP3, and SMTP STARTTLS.
• PostgreSQL TLS negotiation.
• SOCKS.
• HAProxy PROXY protocol.
• Selected compatibility protocols such as CIFS and CapWIN.

The exact list is build- and version-dependent; consult man stunnel for the installed release.

Operations

• Foreground or background operation on Unix.
• Native Windows service and GUI modes.
• Systemd socket activation when compiled with systemd support.
• Configuration reload without terminating established connections.
• Log-file reopening for external rotation.
• Active-connection reporting on Unix.
• Logging to syslog, standard error, or a file.
• Configurable connection identifiers for log correlation.
• UTF-8 configuration and log files.
• Configurable connection, idle, shutdown, and OCSP timeouts.

Isolation and Access Control

• Unix privilege dropping with setuid and setgid.
• Optional chroot isolation.
• Service-manager and container sandbox compatibility.
• Binding plaintext listeners to loopback, Unix sockets, or other trusted interfaces.
• Optional TCP Wrappers integration in builds that include libwrap.

Operating-system firewalls, service-manager controls, and TLS client authentication are preferred over TCP Wrappers for new deployments.

Performance and Scalability

• Concurrent connection handling using the threading and socket models selected at build time.
• TLS session resumption.
• Load distribution across multiple backends.
• Configurable internal session cache.
• External sessiond cache for legacy clustered session-ID deployments.
• Configurable thread stack size and socket options.

Performance depends on the workload, TLS policy, OpenSSL build, hardware, operating system, and network. See Performance for current vendor measurements and the reproducible methodology.

Compatibility Features

Inetd mode, local exec services, OpenSSL engines, TCP Wrappers, IDENT checks, and TLS compression remain available in suitable builds for legacy integrations. They are not recommended as defaults for new deployments.

TLS compression is security-sensitive and unavailable with TLS 1.3. It must not be enabled when attacker-controlled and confidential data can be compressed together.