- stunnel-users - stunnel.org

question regarding TLS connection.
by Daniel Trickett 26 Jun '18

26 Jun '18

Hi We are using stunnel 5.44. We are having an issue connecting with a customer who is not supporting TLS 1.1, only 1.2 and 1.3. When I look in the log, I see the following. Why do I see the SSLv3 note in the line? The below leads me to believe that we connect to the customer, but they say that we are not. 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server certificate A 2018.06.25 11:37:24 LOG6[7]: Client certificate not requested 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server done A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write client key exchange A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write change cipher spec A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write finished A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 flush data 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read finished A 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) requested 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) succeeded 2018.06.25 11:37:24 LOG7[7]: 0 client renegotiation(s) requested 2018.06.25 11:37:24 LOG7[7]: 0 session reuse(s) 2018.06.25 11:37:24 LOG6[7]: TLS connected: new session negotiated Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence - 7/2/2018 - 7/6/2018 MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email daniel.trickett(a)emdmillipore.com<mailto:[email protected]> This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel 5.47 released
by Michal Trojnara 23 Jun '18

23 Jun '18

Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

2 1

Stunnel 5.45 and 5.46 crashes upon reconnect HTTPS
by Javier 22 Jun '18

22 Jun '18

Hi, isn't annoying when you are using an old version, 5.44, and all goes fine, you notice you are outdated and then comes the problems after update? :-P The thing is that yesterday I needed the HTTPS server so I run Stunnel 5.44 for my non-SSL app and all was fine. I updated to 5.46 just because I forgot the last time and didn't even run again because I didn't need it. Today I used it and... I had a crash. I tested 5.45 to trace versions back, and it crashes as well. Back to 5.44 and no crash. The crash happens when there is a reload/reconnect/multiconnect (example, 2 connections html+images) by the browser when connects to an HTTPS server. It only happens when using a SNI service. I've been able to trace back the log on those versions and when fails in 5.45 and 5.46 is at the time when it needs to switch to the SNI service. (log from 5.44) SNI: requested servername: xxx SNI: matched pattern: xxx SNI: switched to service [xxx] <<<<----- BEFORE SWITCH, IT CRASHES on 5.45 and 5.46 Imagine you load https://xxx/. The first time is fine, the second, crashes stunnel. Not happening with 5.44. I haven't seen any change to SNI in manual so... :-? These are the configs for the used virtual servers. Nothing has been changed, anyway: [SSL] client = no accept = y.y.y.1:4747 connect = y.y.y.2:443 [SSL-xxx-SNI] client = no sni = SSL:xxx connect = y.y.y.2:443 cert = pem key = pem Don't mind the port numbers. They aren't in conflict. Running on Windows 2000. Regards.

3 4

Reg : Stunnel + RSYNC Usage with TLSv1.2
by Sakthivel Ganesamoorthy 20 Jun '18

20 Jun '18

Hi, I have configured a server and client for Stunnel + Rsync usage over TLSv1.2. It is working fine, but I wanted to verify the "Cipher Key" exchange mechanism between "Server & Client" via "Wireshark". When I captured the logs via "Wireshark", it shows everything as TCP messages and I don't see any "Client Hello message (or) Cipher Key exchange message (or) any of the TLSv1.2" handshake messages. Please let me know whether I'm missing something here. Thanks, Sakthi

1 0

stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Hello, I am trying to test stunnel to see if it can provide the functionality we need. We are a Windows shop. What we need is for multiple client machines (I call these C1, C2, C3) to connect to our server (S). Server S will connect to a remote SFTP server (port 22). I call the remote SFTP server "R". C1, C2, C3 and S are all inside our firewall. Currently S can connect and send files to R using SFTP (port 22). The problem is that R does not accept a range of IP addresses, and has a limit on the number of IP addresses they can accept. So, what I need is for C1, C2, C3 to be able to connect to server R using S as a jump host. >From R's perspective, it should be like the connection is coming from S. Question 1: can stunnel be used to accomplish this? Question 2: I have installed stunnel in a test server ("stunnel -install" actually from the bin folder), and configured the conf like this: [sftp] accept=127.0.0.1:22 connect=some.remote.server.com:22 I tried to use Winscp SFTP client to test a connection, but it times out. I then checked S, and I don't see anything listening on port 22. I did "netstat -a" and I don't see anything listening on port 22. Was something wrong in the "stunnel -install" command? Shouldn't it be listening on port 22? Also, I uncommented the entry for log, but I don't see any log file in the stunnel folder/subfolders ; Debugging stuff (may be useful for troubleshooting) debug = info output = stunnel.log Thanks for your help, Cecilia

3 3

Re: [stunnel-users] stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Thank you so much for the info! I will try this out. From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Harris, Douglas (SSC/SPC) Sent: Wednesday, June 20, 2018 5:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel used as jump host for SFTP You can accomplish this in Windows. Just add a port forwarding rule to S: netsh interface portproxy add v4tov4 listenport=22 listenaddress=[IP of S] connectport=22 connectaddress=[IP of R] -Doug

1 0

stunnel PSK support via custome openssl engine
by Tarakeshwar Rao 14 Jun '18

14 Jun '18

Dear Stunnel-users, >From Stunnel man pages, I could see that we could read PSK secret from plain text file with following option: PSKsecrets = psk.txt Could it possible to use custom openssl engine to read PSK file from HSM. I know that this works for reading TLS keys. I am not sure how I could do it for PSK. Thanks for your support, Regards, Tarak

1 0

is it possible to make stunnel works for dbmail timsieved?
by cktmwe＠gmail.com 12 Jun '18

12 Jun '18

hello everyone, I'm currently try to stunnel sieve traffic to local dbmail timsieved, unfortunately I couldn't get it to work, my first question, does stunnel support sieve manage protocol? secondly if it does, how can I config the service? what I've done so far. timsieved started on 127.0.0.1:2000, connect and manage all works, I saw connection in dbmail log, then define sieve service block in stunnel.conf, restart stunnel, but if I connect our.public.ip:4190, timsieved becames no connection at all, dbmail log kept silent. traffic from port 4190 is already accepted in iptables. config that I used. > [sieve] > accept = our.public.ip:4190 > connect = 127.0.0.1:2000 > software version: stunnel-5.43 dbmail-3.2.3 Thanks.

2 1

Slow DNS lookups when DNS does not respond
by Guillermo Rodriguez Garcia 08 Jun '18

08 Jun '18

Hi all, I have stunnel setup on a Linux box and I am experiencing very slow DNS lookup times when DNS does not respond. On this same system, anything that results in a DNS lookup (e.g. ping, ...) takes about 20 seconds before it times out and fails. However with stunnel (and a single service configured) the lookup takes more than 1 minute (approx 80 seconds). Is there any way to configure this? Thank you, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

Windows 2016 Server: [!] bind: Address already in use (WSAEADDRINUSE) (10048)
by Martin Schweizer 06 Jun '18

06 Jun '18

Hello List My problem: If I run stunnel I regular get the below error: [.] stunnel 5.46 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [smtps] [ ] GUI message loop initialized [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [smtps] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [smtps] [ ] Listening file descriptor created (FD=676) [ ] Setting accept socket options (FD=676) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket >>> [!] bind: Address already in use (WSAEADDRINUSE) (10048) <<<< [!] Error binding service [smtps] to 192.168.10.62:11465 [!] Could not bind any accepting port [ ] Deallocating section defaults [ ] Unbinding service [smtps] [ ] Service [smtps] closed [ ] Deallocating section [smtps] I had the same problem with the previous versions aswell. To temporary resolv the problem I have to change the listen port to another number. Reread the config file and let the stunnel GUI open. Then all is working until I close the GUI (not each time but most of). My system: - Windows 2016 Server - stunnel-5.46 - stunnel installed as service and GUI My config file (relevant part): taskbar = yes client=yes [smtps] ;delay = yes accept = 192.168.10.62:11466 connect = server.domain.ch:465 cert = stunnel.pem local = 192.168.10.53 (this is dedicated address) I found a similar threat in the archives (but on Linux): https://www.stunnel.org/pipermail/stunnel-users/2018-February/005935.html Here is Microsoft's describtion about WSAEADDRINUSE) (10048): https://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).… All helps are welcome. Kind regards, -- Martin Schweizer PC-Service M. Schweizer GmbH; Bannholzstrasse 6; Postfach 132; CH-8608 Bubikon; Tel. +41 55 243 30 00; Fax: +41 55 243 33 22

1 0

port-only accept value binds to 127.0.0.1, instead of the wildcard address
by Poor Yorick 30 May '18

30 May '18

The stunnel 6.45 documentation for "accept" states, "If no host specified, defaults to all IPv4 addresses for the local host." In this case, stunnel actually binds to 127.0.0.1. Indeed, inspection of the relevant code paths reveals that addr_list->passive is never set to 1 in this case. To get stunnel to bind to all addresses, 0.0.0.0 must be explicitly specified. Furthermore, inspection of the code path for the "local" option reveals that addr_list->passive is set to 1 in this case, which seems to be backwards: The documentation for getaddrinfo states that AI_PASSIVE is ignored in this case. The logic for these two cases seems to be reversed. -- Yorick

1 0

stunnel 5.46 released
by Michal Trojnara 28 May '18

28 May '18

Dear Users, I have released version 5.46 of stunnel. Version 5.46, 2018.05.28, urgency: MEDIUM * New features - The default cipher list was updated to a safer value: "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK". * Bugfixes - Default accept address restored to INADDR_ANY. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 76aab48c28743d78e4b2f6b2dfe49994b6ca74126046c179444f699fae7a84c7 stunnel-5.46.tar.gz 721cc4d7c385743df767a32a53c11477def2440ae20ad4538d8e685f7b7d6538 stunnel-5.46-win32-installer.exe d08a3b3598868064db08d6f0e3a97e3c49dedbf6c8d7f348a613b832eca16dd6 stunnel-5.46-android.zip Best regards, Mike

1 0

Stunnel stopps in Windows Failover Cluster
by Tobias Gillstöm 28 May '18

28 May '18

Hi, I'm having problems with Stunnel in a Windows Failover Cluster. When a failover happens and the stunnel service changes node that it's running on, the service changes node just fine but the stunnel service dosen't appear to be doing anything? If anyone has some prior knowledge about Stunnel in a Windows Failover Cluster i would appreciate the help :)

1 0

stunnel and CAPI on Windows
by Brian Ipsen 23 May '18

23 May '18

Hi I am trying to use the Microsoft certificate store/API for client validation of Windows hosts towards an F5. Everything works, when we use file-based certificates - but for security purposes I would prefer to use the windows certificate store, and set the private key on the client as non-exportable... I have enabled the engineId = capi in the global section of stunnel.conf - and for the required client/service I have: [F5CertAdmin] client=yes accept = 127.0.0.1:1679 connect = w.x.y.z:443 delay = yes sni = ssl79admpki.xxxx.com CApath = C:\Program Files (x86)\stunnel\config\certs CAFile = C:\Program Files (x86)\stunnel\config\certs\GlobalSign-Cert-Chain.pem verify = 2 engineId = capi key = BaaSClientCertificateCP cert = BaaSClientCertificateCP I have a certificate in the local computer certificate store with the supplied name - but stunnel is not able to locate it... Is it because it will look under the user account? If yes, will it look under the local machine when running as local system ? The output from stunnel says: [ ] Initializing service [F5CertAdmin] [ ] Ciphers: HIGH:!DH:!aNULL:!SSLv2 [ ] TLS options: 0x03000004 (+0x03000000, -0x00000000) [ ] Client certificate engine (capi) enabled [ ] Loading certificate from engine ID: BaaSClientCertificateCP [!] ENGINE_ctrl_cmd: Peer suddenly disconnected [ ] Initializing private key on engine ID: BaaSClientCertificateCP [!] ENGINE_load_private_key: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [ ] Loading certificate from file: BaaSClientCertificateCP [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [F5CertAdmin]: Failed to initialize TLS context @am6pr03mb3813.eurprd03.prod.outlook.com>Any advice appreciated... Thanks Brian

1 0

stunnel 5.45 released
by Michal Trojnara 21 May '18

21 May '18

Dear Users, I have released version 5.45 of stunnel. Version 5.45, 2018.05.21, urgency: MEDIUM * New feature sponsored by https://loadbalancer.org/ - Implemented delayed deallocation of service sections after configuration file reload. * Other new features - OpenSSL DLLs updated to version 1.0.2o. - Deprecated the sslVersion option. - The "socket" option is now also available in service sections. - Implemented try-restart in the SysV init script (thx to Peter Pentchev). - TLS 1.3 compliant session handling for OpenSSL 1.1.1. - Default "failover" value changed from "rr" to "prio". - New "make check" tests. * Bugfixes - A service no longer refuses to start if binding fails for some (but not all) addresses:ports. - Fixed compression handling with OpenSSL 1.1.0 and later. - _beginthread() replaced with safer _beginthreadex(). - Fixed exception handling in libwrap. - Fixed exec+connect services. - Fixed automatic resolver delaying. - Fixed a Gentoo cross-compilation bug (thx to Joe Harvell). - A number of "make check" framework fixes. - Fixed false postive memory leak logs. - Build fixes for OpenSSL versions down to 0.9.7. - Fixed (again) round-robin failover in the FORK threading model. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 548244839b8a4bf4dffea46c97893b203d1b9eed118c3dd6a9ac4d8d02592ee3 stunnel-5.45.tar.gz fc13a224c7ec1290035efe8317c53d62a0980a5ab2efe8930b06aae269fbe873 stunnel-5.45-win32-installer.exe 29025eaed007c62856f16c7a8a22f9713eee9762ed95009f6f91f729c35c0bc0 stunnel-5.45-android.zip Best regards, Mike

1 0

configuring Stunnel
by support 20 May '18

20 May '18

The config as described hereby did work properly a few times giving a secured connection. All of a sudden this is no longer working? Any suggestions? Namens IMS evba Paul Waegemans +32475341310 <mailto:[email protected]> support(a)imseuro.be <http://eu.ntrsupport.com/inquiero/web/digisign/digisign.asp?login=I23EBF509 C6B51A9E700D43&lang=nl>

1 0

UTF8 BOM in PSKsecrets file
by Jakob Hirsch 17 May '18

17 May '18

Hi! I just found out (after a while of troubleshooting) that stunnel does not handle UTF-8 BOM in the PSKsecrets file, i.e. the BOM is considered part of the identity (tested with 5.44, 5.45b4 and 5.45b6 on Windows 10 1709). It was a little tricky to figure this out, as the BOM is apparently filtered out in the logs, e.g. the server just says 'No key found for PSK identity "client1"'. Ok, nobody says that this is supported or that you should do it, it just happens automatically when you click "Edit Configuration" in the Windows GUI and click "Save as" (out of convenience, because you will already be in the config directory then), because the sample config has a BOM and Notepad will also insert a BOM in the new file. I don't know how much work it would be to handle the BOM correctly or at least print a warning (didn't look at the code, sorry), a warning in the manual would probably sufficient, as it could be that I'm the first one to stumble over this (at least I didn't find anything about it on the net). Regards (and thanks for this nice piece of software) Jakob

1 0

Windows Server 2012 R2
by Daniel McArdell 17 May '18

17 May '18

Hello, I have joined the mail group in the hope that someone can help with problems I am having running on our Server machine. I downloaded "stunnel-5.45b6-win64-installer" and installed it on our Server. When I run the executable I get: 2018.05.17 12:48:33 LOG5[main]: stunnel 5.45 on x64-pc-msvc-1913 platform 2018.05.17 12:48:33 LOG5[main]: Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 2018.05.17 12:48:33 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2018.05.17 12:48:33 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.17 12:48:33 LOG5[main]: UTF-8 byte order mark detected 2018.05.17 12:48:33 LOG5[main]: Configuration successful The shortcut [cid:[email protected]] I was expecting to get a GUI interface but that does not happen. Can someone tell me what is going wrong. I feel as though I have missed something obvious. Daniel McArdell | Senior Analyst Programmer | Products & Technology | BNZ<http://www.bnz.co.nz/> L6 Custom House, 17 Whitmore St, Wellington 6011 DDI +64 4 4746679 (extn 76679) | F +64 4 4746023 | M +64 29 2220451 | E Daniel_McArdell(a)bnz.co.nz<mailto:[email protected]?Subject=> CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. This email was sent by the Bank of New Zealand. You can contact us on 0800 ASK BNZ (0800 275 269). Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Bank of New Zealand.

1 0

stunnel with client-auth via proxy-server
by jack.reacher＠gmx.de 16 May '18

16 May '18

2 1

Stunnel running as service on Windows Server 2008 R2 but Stunnel All Users shortcut on the desktop reports that it server is down?
by Alex Birchall 16 May '18

16 May '18

Hello, I have Stunnel running as a service on a Windows Server 2008 R2. But the shortcut on the desktop "Stunnel All Users", when launched, informs me that the server is down due to an "invalid configuration file". In the config file, if Stunnel is being run as a service, should it be "client = no" or "server = yes"? Many thanks. Best regards, Alex

2 2

SMTP Authentication failed
by Ian Coetzee 15 May '18

15 May '18

Hi List, I have just joined the stunnel community. I am in the process of migrating our mailserver's public facing ports to stunnel for PCI compliance reasons. So far i have managed to get working: - imap (143/tcp) with starttls - imaps (993/tcp) - pop3 (110/tcp) with starttls - pop3s (995/tcp) My trouble is with smtp(25/tcp,587/tcp) with starttls. I have now tried a couple different mail clients and everyone of them tells me that the server does not support the authentication protocols. I have installed stunnel 5.44. Tee relevant parts in my config: [mail2-imap] protocol = imap accept = 143 connect = <mail-fqdn>:143 [mail2-imaps] accept = 993 connect = <mail-fqdn>:143 [mail2-pop3] protocol = pop3 accept = 110 connect = <mail-fqdn>:110 [mail2-pop3s] accept = 995 connect = <mail-fqdn>:110 [mail2-smtp] protocol = smtp accept = 25 connect = <mail-fqdn>:25 [mail2-smtps] accept = 465 connect = <mail-fqdn>:465 [mail2-smtps-submission] debug = 7 protocol = smtp accept = 587 connect = <mail-fqdn>:587 In the logfile I have the following entries upon connecting 2018.04.30 09:20:50 LOG7[5]: Service [mail2-smtps-submission] started 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on local socket 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] accepted connection from 41.13.8.49:56890 2018.04.30 09:20:50 LOG6[5]: s_connect: connecting 10.10.11.2:587 2018.04.30 09:20:50 LOG7[5]: s_connect: s_poll_wait 10.10.11.2:587: waiting 10 seconds 2018.04.30 09:20:50 LOG5[5]: s_connect: connected 10.10.11.2:587 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] connected remote server from 10.10.11.11:42466 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.04.30 09:20:50 LOG7[5]: Remote descriptor (FD=23) initialized 2018.04.30 09:20:50 LOG7[5]: RFC 2487 detected 2018.04.30 09:20:50 LOG7[5]: <- 220 <mail-fqdn> ESMTP Postfix 2018.04.30 09:20:50 LOG7[5]: -> 220 <mail-fqdn> stunnel for ESMTP Postfix 2018.04.30 09:20:51 LOG7[5]: <- EHLO [100.125.153.220] 2018.04.30 09:20:51 LOG7[5]: -> 250-<mail-fqdn> 2018.04.30 09:20:51 LOG7[5]: -> 250 STARTTLS 2018.04.30 09:20:51 LOG7[5]: <- STARTTLS 2018.04.30 09:20:51 LOG7[5]: -> 220 Go ahead 2018.04.30 09:20:51 LOG6[5]: Peer certificate not required 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): before/accept initialization 2018.04.30 09:20:51 LOG7[5]: SNI: no virtual services defined 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write certificate A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write key exchange A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server done A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client certificate A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read client key exchange A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read certificate verify A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write change cipher spec A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:52 LOG7[5]: New session callback 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) requested 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) succeeded 2018.04.30 09:20:52 LOG7[5]: 0 server renegotiation(s) requested 2018.04.30 09:20:52 LOG7[5]: 0 session reuse(s) 2018.04.30 09:20:52 LOG7[5]: 2 internal session cache item(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache fill-up(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache miss(es) 2018.04.30 09:20:52 LOG7[5]: 0 external session cache hit(s) 2018.04.30 09:20:52 LOG7[5]: 0 expired session(s) retrieved 2018.04.30 09:20:52 LOG6[5]: TLS accepted: new session negotiated 2018.04.30 09:20:52 LOG6[5]: No peer certificate received 2018.04.30 09:20:52 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.04.30 09:20:52 LOG7[5]: Compression: null, expansion: null 2018.04.30 09:20:52 LOG6[5]: Read socket closed (read hangup) 2018.04.30 09:20:52 LOG7[5]: Sending close_notify alert 2018.04.30 09:20:52 LOG7[5]: TLS alert (write): warning: close notify 2018.04.30 09:20:52 LOG6[5]: SSL_shutdown successfully sent close_notify alert 2018.04.30 09:20:52 LOG6[5]: TLS fd: Connection reset by peer (104) 2018.04.30 09:20:52 LOG6[5]: TLS socket closed (SSL_read) 2018.04.30 09:20:52 LOG7[5]: Sent socket write shutdown 2018.04.30 09:20:52 LOG5[5]: Connection closed: 156 byte(s) sent to TLS, 30 byte(s) sent to socket 2018.04.30 09:20:52 LOG7[5]: Remote descriptor (FD=23) closed 2018.04.30 09:20:52 LOG7[5]: Local descriptor (FD=22) closed 2018.04.30 09:20:52 LOG7[5]: Service [mail2-smtps-submission] finished (4 left) This is the error I am getting from K9-Mail The google mail app just tells me: Alpine (linux commandline smtp client) Any advise from the gurus? Kind regards Ian

1 1

Error with negotiation OK
by Alix Janeth Jerez 15 May '18

15 May '18

Hi I am using lastest stunnel version. When i try to send an email, i get: "error permanente de SMTP: 503 Bad sequence of commands". This is the trace generated when I try to send an email. 2018.05.14 12:59:08 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:08 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:08 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:08 LOG5[main]: Configuration successful 2018.05.14 12:59:08 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:08 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:08 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:08 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:08 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:22 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:22 LOG7[main]: FD=324 ifds=r-x ofds=r-- 2018.05.14 12:59:22 LOG7[main]: Dispatching signals from the signal pipe 2018.05.14 12:59:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.05.14 12:59:22 LOG7[main]: Running on Windows 6.1 2018.05.14 12:59:22 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:22 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:22 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:22 LOG7[main]: Compression disabled 2018.05.14 12:59:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.05.14 12:59:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2018.05.14 12:59:22 LOG7[main]: PRNG seeded successfully 2018.05.14 12:59:22 LOG6[main]: Initializing service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.05.14 12:59:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, 0x00000000) 2018.05.14 12:59:22 LOG6[main]: Loading certificate from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Certificate loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Loading private key from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Private key loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG7[main]: Private key check succeeded 2018.05.14 12:59:22 LOG5[main]: Configuration successful 2018.05.14 12:59:22 LOG7[main]: Unbinding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed (FD=568) 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed 2018.05.14 12:59:22 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:22 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:22 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:34 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:34 LOG7[main]: FD=324 ifds=r-x ofds=--- 2018.05.14 12:59:34 LOG7[main]: Service [pseudo-ssmtp] accepted (FD=584) from 172.31.41.84:53557 2018.05.14 12:59:34 LOG7[main]: Creating a new thread 2018.05.14 12:59:34 LOG7[main]: New thread created 2018.05.14 12:59:34 LOG7[37]: Service [pseudo-ssmtp] started 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on local socket 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] accepted connection from 172.31.41.84:53557 2018.05.14 12:59:34 LOG6[37]: failover: round-robin, starting at entry #1 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 212.227.15.158:465 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 212.227.15.158:465: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 212.227.15.158:465 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] connected remote server from 172.31.41.84:53558 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on remote socket 2018.05.14 12:59:34 LOG7[37]: Remote descriptor (FD=552) initialized 2018.05.14 12:59:34 LOG6[37]: SNI: sending servername: smtp.1and1.es 2018.05.14 12:59:34 LOG6[37]: Peer certificate required 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): before/connect initialization 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv2/v3 write client hello A 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv3 read server hello A 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG7[37]: OCSP: Ignoring root certificate 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Connected t2.symcb.com:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Response received 2018.05.14 12:59:34 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:34 LOG6[37]: OCSP: This update: May 13 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG6[37]: OCSP: Next update: May 20 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG6[37]: CERT: Host name "smtp.1and1.es" matched with "smtp.1and1.es" 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:35 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Connected tj.symcd.com:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Response received 2018.05.14 12:59:35 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:35 LOG6[37]: OCSP: This update: May 14 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG6[37]: OCSP: Next update: May 21 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:35 LOG5[37]: Certificate accepted at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server certificate A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server key exchange A 2018.05.14 12:59:35 LOG6[37]: Client certificate not requested 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server done A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write client key exchange A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write change cipher spec A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write finished A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 flush data 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read finished A 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) requested 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) succeeded 2018.05.14 12:59:35 LOG7[37]: 0 client renegotiation(s) requested 2018.05.14 12:59:35 LOG7[37]: 0 session reuse(s) 2018.05.14 12:59:35 LOG6[37]: TLS connected: new session negotiated 2018.05.14 12:59:35 LOG7[37]: Peer certificate was cached (5543 bytes) 2018.05.14 12:59:35 LOG6[37]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.14 12:59:35 LOG7[37]: Compression: null, expansion: null 2018.05.14 12:59:53 LOG3[36]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2018.05.14 12:59:53 LOG5[36]: Connection closed: 15 byte(s) sent to TLS, 166 byte(s) sent to socket I can't find the error. Thanks in advance for your help. Best regards, Alix

2 5

stunnel-5.44 fails cross compile due to wrong include path in Gentoo....fix available
by Joe Harvell 14 May '18

14 May '18

The src/Makefile.am hardcodes -I/usr/kerberos/include. When cross compiling it should be including -I$(SYSROOT)//usr/kerberos/include. I patched configure.ac and Makefile.am, taking advantage of the existing --with-sysroot configure option. The Gentoo bug report: https://bugs.gentoo.org/654374 The patch to configure.ac and Makefile.am: https://654374.bugs.gentoo.org/attachment.cgi?id=528968 I was unable to find a bug reporting system for stunnel. So I guess this is it. Please source this fix. --- Joe Harvell

1 1

help with tls config in stunnel
by Daniel Trickett 10 May '18

10 May '18

Hi, We are running stunnel 5.44 on Solaris. Our b2b legacy system is using TLS 1.0. We have a supplier who recently switched to TLS 1.2 and we can no longer connect to the site from our b2b. How can I configure stunnel to connect to the supplier site using TLS 1.2? TIA. Dan T This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

How to tell if commuications are encrypted?
by Alex Birchall 10 May '18

10 May '18

Hello, I have Stunnel installed on Windows Server 2008 R2, running as a service. I have it installed as a client on a Windows POS 2009 device. This setup is working, in that the client is operating correctly and using Stunnel. But how can I tell if communications between the Stunnel client and the Stunnel server are being encrypted, rather than Stunnel just doing port forwarding? I did read the client needs to have access to the server's certificate, but at the moment it does not. Alex

2 1

Stunnel to Outlook
by DPS Support 09 May '18

09 May '18

I am trying to get a device on my network to send pop email notifications to my outlook account but can't seem to get it to work. I have enabled the outlook account to accept pop and enabled the client to send them. I'm not sure if I'm missing something or what, any help would be greatly appreciated. Here is my config: debug = info output = stunnel.log [outlook-pop3] client = yes accept = 110 connect = pop-mail.outlook.com:995 [outlook-imap] client = yes accept = 143 connect = imap-mail.outlook.com:993 [outlook-smtp] protocol = smtp client = yes accept = 25 connect = smtp-mail.outlook.com:587 Here is the log as well: 2018.05.08 15:15:03 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.05.08 15:15:03 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.05.08 15:15:03 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.05.08 15:15:03 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.08 15:15:03 LOG5[main]: UTF-8 byte order mark detected 2018.05.08 15:15:03 LOG5[main]: FIPS mode disabled 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-pop3] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-pop3] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-imap] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-imap] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-smtp] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-smtp] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG5[main]: Configuration successful 2018.05.08 15:15:03 LOG5[main]: Logging to C:\Users\dps_engineer\AppData\Local\stunnel.log 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] accepted connection from 126.10.230.254:52629 2018.05.08 15:15:53 LOG6[0]: failover: round-robin, starting at entry #1 2018.05.08 15:15:53 LOG6[0]: s_connect: connecting 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: s_connect: connected 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] connected remote server from 126.10.218.222:60145 2018.05.08 15:15:53 LOG6[0]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:15:53 LOG6[0]: Peer certificate not required 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Client certificate not requested 2018.05.08 15:15:54 LOG6[0]: TLS connected: new session negotiated 2018.05.08 15:15:54 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:15:55 LOG6[0]: Read socket closed (readsocket) 2018.05.08 15:15:55 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:15:55 LOG6[0]: TLS socket closed (SSL_read) 2018.05.08 15:15:55 LOG5[0]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] accepted connection from 126.10.230.254:52639 2018.05.08 15:15:55 LOG6[1]: failover: round-robin, starting at entry #2 2018.05.08 15:15:55 LOG6[1]: s_connect: connecting 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: s_connect: connected 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] connected remote server from 126.10.218.222:60147 2018.05.08 15:15:55 LOG6[1]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:15:55 LOG6[1]: Peer certificate not required 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Empty client CA list 2018.05.08 15:15:55 LOG6[1]: TLS connected: new session negotiated 2018.05.08 15:15:55 LOG6[1]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:00 LOG6[1]: TLS socket closed (SSL_read) 2018.05.08 15:16:00 LOG5[1]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] accepted connection from 126.10.230.254:52644 2018.05.08 15:16:00 LOG6[2]: failover: round-robin, starting at entry #2 2018.05.08 15:16:00 LOG6[2]: s_connect: connecting 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: s_connect: connected 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] connected remote server from 126.10.218.222:60149 2018.05.08 15:16:00 LOG6[2]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:00 LOG6[2]: Peer certificate not required 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Client certificate not requested 2018.05.08 15:16:00 LOG6[2]: TLS connected: new session negotiated 2018.05.08 15:16:00 LOG6[2]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:01 LOG6[2]: TLS socket closed (SSL_read) 2018.05.08 15:16:01 LOG5[2]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] accepted connection from 126.10.230.254:52647 2018.05.08 15:16:01 LOG6[3]: failover: round-robin, starting at entry #3 2018.05.08 15:16:01 LOG6[3]: s_connect: connecting 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: s_connect: connected 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] connected remote server from 126.10.218.222:60150 2018.05.08 15:16:01 LOG6[3]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:01 LOG6[3]: Peer certificate not required 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Empty client CA list 2018.05.08 15:16:01 LOG6[3]: TLS connected: new session negotiated 2018.05.08 15:16:01 LOG6[3]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:03 LOG6[cron]: Executing cron jobs 2018.05.08 15:16:03 LOG6[cron]: Cron jobs completed in 0 seconds 2018.05.08 15:16:06 LOG6[3]: TLS socket closed (SSL_read) 2018.05.08 15:16:06 LOG5[3]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] accepted connection from 126.10.230.254:52653 2018.05.08 15:16:06 LOG6[4]: failover: round-robin, starting at entry #3 2018.05.08 15:16:06 LOG6[4]: s_connect: connecting 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: s_connect: connected 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] connected remote server from 126.10.218.222:60153 2018.05.08 15:16:06 LOG6[4]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:06 LOG6[4]: Peer certificate not required 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Client certificate not requested 2018.05.08 15:16:06 LOG6[4]: TLS connected: new session negotiated 2018.05.08 15:16:06 LOG6[4]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:07 LOG6[4]: Read socket closed (readsocket) 2018.05.08 15:16:07 LOG6[4]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:16:07 LOG6[4]: TLS socket closed (SSL_read) 2018.05.08 15:16:07 LOG5[4]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:07 LOG5[5]: Service [outlook-smtp] accepted connection from 126.10.230.254:52656 2018.05.08 15:16:07 LOG6[5]: failover: round-robin, starting at entry #4 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:101::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:101::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:108::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:108::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:cc::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:cc::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:8f::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:8f::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: s_connect: connected 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: Service [outlook-smtp] connected remote server from 126.10.218.222:60158 2018.05.08 15:16:08 LOG6[5]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:08 LOG6[5]: Peer certificate not required 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Empty client CA list 2018.05.08 15:16:08 LOG6[5]: TLS connected: new session negotiated 2018.05.08 15:16:08 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:13 LOG6[5]: TLS socket closed (SSL_read) 2018.05.08 15:16:13 LOG5[5]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket Sent from Outlook<http://aka.ms/weboutlook>

2 1

Stunnel Time out Error
by Sedick Cloete 07 May '18

07 May '18

HI All, We recently moved our email server from an in-house server to Office 365. We are now in the process of replacing all our XP boxes with Windows 10. One of the boxes are running the email service which collects emails from Office 365, that we have just recently upgraded. This process works on the XP but times out on windows 10. Attached, is the time out the log file. Below is the code I am using: Basic program code * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ---------------------------------------------------------------------------- ------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Your assistance in this regard will be highly appreciated. Thank you. Kind Regards, Logicore SEDICK CLOETE IT Business Consultant Cell: 083 228 7058 Fax: 086 515 9695 email: sedick(a)logicore.co.za If you are not the intended recipient of this communication, please notify the sender immediately. The information and/or attachment contained in this email is confidential and may contain proprietary and/or personal information. It is meant solely for the intended recipient. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any processing of the email or the information contained therein (including disclosure, copying, distribution, storage) or any action taken or omitted in reliance on this, is prohibited and may be unlawful.

2 1

How to configure stunnel client on Mac
by Mark Foley 04 May '18

04 May '18

I've successfully set up stunnel for Windows and Linux clients. Now to set up for Mac. I've gone to the website http://macappstore.org/stunnel/ and followed the instructions there which are: 1. Press Command+Space and type Terminal and press enter/return key. 2. Run in Terminal app: ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null and press enter/return key. 3. Run: brew install stunnel And then it says, "Done! You can now use stunnel." Well, not exactly. Where do I put my stunnel.conf and certificate.pem? How do I make stunnel run automatically at boot time? The web instructions aren't very complete. Need additional assistance. THX --Mark

1 1

Stunnel in Windows Failover cluster
by Tobias Gillstöm 27 Apr '18

27 Apr '18

Hi, I'm currently using stunnel in a windows fail over cluster: My problem is that when a fail over occurs stunnel switches too the other node and says that stunnel is running and everything is fine. But when I check the logs for stunnel and the program that uses stunnel, it does not appear to be running or sending any data. In the screenshot you can see my stunnel configuration, in the startup parameters section it says "-service -install" my question is if it shouldn't say "-service -start" instead, has anyone else encountered this problem? And if this is the problem why does the stunnel service install with these parameters?

1 0

Ubuntu 16.04.4 LTS SSLv3 and SSlv2 running stunnel 5.44
by Joe Phillips 25 Apr '18

25 Apr '18

I am running stunnel 5.44 on Ubuntu 16.04.4 LTS with all updates. I cannot get devices to connect using sslv2 or 3. My conf file Options line as seen below : ;Enable support for inecure SSLv3 protocol Options = -NO_SSLv3 Options = -NO_SSLv2 I continuously get error 1408A10B SSL routines: ssl3_get_client_hello:wrong version number Do I not have SSL3 and 2 correctly defined in my conf file? I realize 2 and 3 are no longer secure, but I need to support them while I transition to TLS 1.2 thanks [cid:[email protected]]

2 1

stunnel as a Windows Service
by Paul Muller 20 Apr '18

20 Apr '18

Does anyone have any documentation on how to setup stunnel as a Windows Service? I currently have it installed on a Windows Server 2012 R2 Standard. I noticed that stunnel stops running as soon as I log off of my RDP session on the server. [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 1

Rapid subsequent DNS resolution fails within stunnel
by Vincent Deschenes 20 Apr '18

20 Apr '18

Hi, We have had this weird problem for a long time where sometime DNS resolution will fail with this error: Error resolving 'domain name printed here': Neither nodename nor servname known (EAI_NONAME) Today I found out that this will happen when stunnel get 2 calls for the same outgoing endpoint very fast one after the other. One call will work no problem. But if you do 2 one after the other then the second one and all other subsequent will fail. Wait a bit and try again, the first one will pass and then others will fail. DNS resolution on the server (linux) itself work without problem, nslookup in loops no problem. But with stunnel we always have the problem. The only working solution is to add a record to the server host file. Any idea ? Could this be a bug in stunnel ? Thanks, Vincent

1 1

Authentication
by Paul Muller 20 Apr '18

20 Apr '18

When I first setup stunnel, I changed my software to reflect the [gmail-smtp] entries in my configuration file. When I tried to send an email from my application I received the following message: "No Email sent, Error 535-5.7.8 Username and Password not accepted." Then I remarked out the authentication credentials in my software. When I tried to send an email I received the following message: "No Email sent, Error-5.5.1 Authentication Required." My question is, can place my authentication credentials in the "stunnel.conf" file? And if so, where? Thanks, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:[email protected]> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 2

/etc/hosts setting
by White Little 17 Apr '18

17 Apr '18

Hi All I found a interesting issue with /etc/hosts setting in different Linux system. My stunnel.conf setting like below [HOST] cert = client.crt key = client.key CAfile = server.crt client = yes accept = 10.160.160.88:57853 connect = 10.136.160.21:3520 I would like to connect server 10.136.160.21:3520 via stunnel 10.160.160.88:57853 Part A If my hostname and /etc/hosts setting in different System as followings all will works well 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost 10.136.160.88 virtual-machine Part B. If the "127.0.0.1" include the hostname in /etc/hosts, both CentOS and Fedora will fail, but Ubuntu still work 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost* localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.253 localhost.localdomain 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost *localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost *virtual-machine* 10.136.160.88 virtual-machine I think it maybe not a stunnel issue, but I'd like to know why it has different behavior Thanks Jay

2 2

make_test failing
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, Our CI has been failing since Friday with the same errors seen at https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/stunnel4…. make_test fails on 012_verify_chain and 013_CRL_file. Anyone else seeing the same thing? We run Ubuntu 14.04, stunnel v5.44, automatically applying apt security patches to the OS. My initial assumption is that some dependency of stunnel has been updated, but I've not had chance to find out. We have been using the same version of stunnel since the day it was released without any other problems. Ian

2 2

Invalid certificate in tests, prevents make_test from running
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, I posted earlier about `make_test` failing, apologies for not replying to that thread but I didn't receive the email myself. I've tracked this down to `tests/certs/CACert.pem` containing an expired certificate - see below output: openssl x509 -in tests/certs/CACert.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Validity Not Before: Apr 26 18:41:00 2017 GMT Not After : Apr 13 15:45:00 2018 GMT Subject: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:af:cc:61:f5:73:2b:49:3c:62:c0:b0:d6:1b:0f: 5e:32:d1:49:48:01:b2:35:36:a8:04:a3:e0:7e:e4: 1d:f9:cb:fe:11:0a:c3:2e:b1:3e:87:4c:b0:72:d7: 73:04:ba:28:c7:2b:b4:67:13:0e:5d:05:7f:67:bd: ba:7f:c5:89:b0:48:d6:21:4b:e8:3a:70:ac:dc:e4: f5:43:c3:c9:57:7f:73:f1:3b:b0:e5:a5:90:44:9f: 6e:c3:2a:f5:ab:e6:15:f3:de:cd:44:23:5e:4f:c2: eb:44:59:6c:f5:76:46:b0:7c:fc:59:df:20:97:0c: 0f:43:ae:df:47:f6:d2:78:fd:c6:be:11:cf:26:a1: 8d:87:74:2f:c9:b5:1b:2b:9d:a4:95:44:0c:54:de: 0c:12:d4:8d:14:57:31:a7:a8:70:11:68:6e:20:3d: 76:c9:c8:45:50:d5:4e:2f:f1:6e:78:25:23:05:45: 6e:7d:11:2a:b3:e8:88:6e:68:29:2c:a2:c2:3d:cf: 41:50:b5:e1:51:8f:8e:f4:36:0f:f5:a8:63:5e:29: 1d:b4:fe:71:43:d0:2a:be:2a:2c:b1:62:c6:b9:bc: 4d:95:80:4e:60:ec:e9:79:92:19:31:9c:b2:00:74: 3b:a1:80:57:b4:22:45:c8:d3:1a:a7:4f:f6:00:12: 35:b7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption 97:03:b2:c1:a2:44:8a:2a:9c:1d:3c:cb:61:a6:f9:bc:7f:4f: 21:fc:69:d8:f3:31:7b:4b:e5:2b:34:42:19:03:1a:40:af:fa: 7e:18:93:99:a8:78:cb:32:15:23:75:6e:49:6d:ac:ee:ca:5e: d6:d2:69:5a:b5:4a:13:cd:7c:77:e4:f2:6d:a0:2d:63:2f:62: b5:be:24:ee:12:d7:22:3e:dd:d2:56:07:81:ca:c4:cf:4c:2c: 36:64:32:52:b1:76:76:5f:c7:45:86:b9:34:1a:c7:37:0c:38: ce:8b:20:8b:70:a1:33:a0:e1:3d:ed:9a:26:c0:04:e7:35:c5: 41:ab:bd:f9:cc:10:8d:12:3f:7a:ee:b3:a3:98:35:09:b2:e5: 5f:aa:22:16:7e:18:df:61:ac:3d:30:48:f7:77:41:5c:25:bd: 6f:dc:53:d0:f3:d7:cc:33:f6:77:36:99:0b:e4:8f:3e:83:e4: ca:3a:58:6f:73:55:83:6e:a7:01:b2:21:bf:09:54:28:e3:e0: a5:4f:bd:d7:66:a2:f8:c2:81:6f:0d:aa:ba:6f:7d:a9:cf:6f: 06:a8:a2:b1:5b:3b:f9:7b:89:bf:f5:c4:ed:f0:5e:cf:64:87: 39:84:90:6c:c9:e0:5d:b4:54:ae:a7:6c:e7:b4:2a:29:fe:ab: 62:4f:91:d0 As a (horrible) workaround I've had to skip "make_test" in my CI - if there are any better ideas please let me know! Ian

1 0

Possible memory leak with stunnel reload
by Mark Brookes 06 Apr '18

06 Apr '18

Hi all, we have noticed that when reloading (note reloading not restarting) stunnel it appears to be leaking between 12 and 32 bytes of memory (ish) per reload. There does not need to be any traffic passing through it at the time to view this problem. If its reloaded enough times the system will eventually run out of memory. Unless an stunnel restart if performed inbetween. We are running 5.41 tried with the latest 5.44 and have the same result. We are using openssl 1.0.2j-fips ive tried with 1.0.2n and 1.1.0e (to try and rule out openssl) We are reloading by running: kill -s HUP <pid> The stunnel configuration is - pid = /var/run/stunnel/stunnel.pid debug = 7 syslog = no output = /var/log/stunnel.log socket = a:IP_FREEBIND=yes fips = no sslVersion = all [VIP_Name] cert = /etc/loadbalancer.org/certs/server.pem ciphers = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES accept = 192.168.80.16:443 connect = 127.0.0.5:80 delay = yes options = NO_SSLv3 options = NO_TLSv1 options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no local = 192.168.80.16 TIMEOUTclose = 0 The stunnel log file is as follows - 2018.04.03 11:09:59 LOG7[ui]: Clients allowed=62937 2018.04.03 11:09:59 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2018.04.03 11:09:59 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 2018.04.03 11:09:59 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.04.03 11:09:59 LOG7[ui]: errno: (*__errno_location ()) 2018.04.03 11:09:59 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:09:59 LOG5[ui]: UTF-8 byte order mark not detected 2018.04.03 11:09:59 LOG5[ui]: FIPS mode disabled 2018.04.03 11:09:59 LOG7[ui]: Compression disabled 2018.04.03 11:09:59 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:09:59 LOG7[ui]: PRNG seeded successfully 2018.04.03 11:09:59 LOG6[ui]: Initializing service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:09:59 LOG7[ui]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:09:59 LOG6[ui]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG7[ui]: Private key check succeeded 2018.04.03 11:09:59 LOG7[ui]: ECDH initialization 2018.04.03 11:09:59 LOG7[ui]: ECDH initialized with curve prime256v1 2018.04.03 11:09:59 LOG5[ui]: Configuration successful 2018.04.03 11:09:59 LOG7[ui]: Binding service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Listening file descriptor created (FD=6) 2018.04.03 11:09:59 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Option IP_FREEBIND set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:09:59 LOG7[main]: Created pid file /var/run/stunnel/stunnel.pid 2018.04.03 11:09:59 LOG7[cron]: Cron thread initialized 2018.04.03 11:10:59 LOG6[cron]: Executing cron jobs 2018.04.03 11:10:59 LOG6[cron]: Cron jobs completed in 0 seconds 2018.04.03 11:10:59 LOG7[cron]: Waiting 86400 seconds 2018.04.03 11:11:08 LOG7[main]: Found 1 ready file descriptor(s) 2018.04.03 11:11:08 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.04.03 11:11:08 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.04.03 11:11:08 LOG7[main]: Dispatching signals from the signal pipe 2018.04.03 11:11:08 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.04.03 11:11:08 LOG5[main]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:11:08 LOG5[main]: UTF-8 byte order mark not detected 2018.04.03 11:11:08 LOG5[main]: FIPS mode disabled 2018.04.03 11:11:08 LOG7[main]: Compression disabled 2018.04.03 11:11:08 LOG7[main]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:11:08 LOG7[main]: PRNG seeded successfully 2018.04.03 11:11:08 LOG6[main]: Initializing service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:11:08 LOG7[main]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:11:08 LOG6[main]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG7[main]: Private key check succeeded 2018.04.03 11:11:08 LOG7[main]: ECDH initialization 2018.04.03 11:11:08 LOG7[main]: ECDH initialized with curve prime256v1 2018.04.03 11:11:08 LOG5[main]: Configuration successful 2018.04.03 11:11:08 LOG7[main]: Unbinding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed (FD=6) 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed 2018.04.03 11:11:08 LOG7[main]: Binding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Listening file descriptor created (FD=6) 2018.04.03 11:11:08 LOG7[main]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:11:08 LOG7[main]: Option IP_FREEBIND set on accept socket 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:11:08 LOG7[main]: Signal pipe is empty Any help would be appreciated. Thanks -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

2 2

Motion and Stunnel Query
by Vidya Govindan 04 Apr '18

04 Apr '18

Hi Everyone, I am trying to work on a video streaming project which uses the motion software to stream images from a usb camera. By default the streaming is done in a non-secure manner. So I installed Stunnel , generated a self signed certificate and I am not using it on top of the motion software to securely stream images. Now, I want to know exactly how Stunnel encrypts/decrypts image data that is generated by motion? I know that motion sends the data on port 8081 and Stunnel tunnels it to another port 8443. I can not understand where exactly the Openssl library functions are used to add the security feature in this scenario. Can anyone with a better understanding throw some light on the same? Thanks & Regards, Vidya

1 0

proxy with authentication
by Andreas Meier 03 Apr '18

03 Apr '18

3 3

First Time Troubles.
by me＠kilosierracharlie.me 22 Mar '18

22 Mar '18

Hello All, I'm trying to configure STunnel4 on Windows to connect to my VPS installed with STunnel, so I can use SSH through a DPI laden network. The configuration works if I try at home, or on a mobile data hotspot, but if I attempt within the DPI network, it does not work, and provides this console output: 2018.03.22 09:30:15 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.03.22 09:30:15 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.03.22 09:30:15 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.03.22 09:30:15 LOG5[main]: Reading configuration from file stunnel.conf 2018.03.22 09:30:15 LOG5[main]: UTF-8 byte order mark detected 2018.03.22 09:30:15 LOG5[main]: FIPS mode disabled 2018.03.22 09:30:15 LOG5[main]: Configuration successful 2018.03.22 09:30:24 LOG5[0]: Service [ssh] accepted connection from 127.0.0.1:65086 2018.03.22 09:30:24 LOG5[0]: s_connect: connected 130.185.251.28:443 2018.03.22 09:30:24 LOG5[0]: Service [ssh] connected remote server from 172.28.1.25:65087 2018.03.22 09:30:25 LOG4[0]: CERT: Certificate not found in local repository 2018.03.22 09:30:25 LOG4[0]: Rejected by CERT at depth=0: CN=130.185.251.28 2018.03.22 09:30:25 LOG3[0]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.03.22 09:30:25 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is the configuration I'm using: [ssh] client = yes accept = 443 connect = 130.185.251.28:443 CAfile = peer-ssh.pem verifyPeer = yes The odd thing, is that if I connect using my mobile data, and then switch over to filtered internet and try again, it works fine, and adds the following lines to the log: 2018.03.22 09:36:46 LOG5[1]: Service [ssh] accepted connection from 127.0.0.1:65237 2018.03.22 09:36:46 LOG5[1]: s_connect: connected 130.185.251.28:443 2018.03.22 09:36:46 LOG5[1]: Service [ssh] connected remote server from 192.168.43.115:65238 2018.03.22 09:36:46 LOG5[1]: Certificate accepted at depth=0: C=GB, ST=Lincolnshire, L=Horncastle, O=N/A, OU=N/A, CN=personal.kilosierracharlie.me, emailAddress=webmaster(a)kilosierracharlie.me Has anyone got any ideas regarding this issue? It's not mission critical, but it's quite annoyingly repetitive! Cheers, Kieran.

1 0

sTunnel client connecting to load balanced URL - stunnel 5.02 on x86-pc-msvc-1500 platform
by Tony 19 Mar '18

19 Mar '18

Hi all, I have a situation where I'm trying to use sTunnel as the client to connect to a service on a secure URL, but the hiccup is that the secure URL is load balanced. If a do an nslookup on the URL, the response comes back as it being an alias. Non-authoritative answer: Name: eu1571393051174.ssl.ondemand.com Address: 155.56.210.164 Aliases: l4884-iflmap.hcisbp.eu1.hana.ondemand.com Looking at the sTunnel log, it resolves to the IP of the server. But the IP itself does not host the service so I'm getting http:503 errors. 2018.03.16 14:44:44 LOG7[18796]: Service [ssl-OSRdev] (FD=564) bound to 0.0.0.0:8085 2018.03.16 14:44:55 LOG7[18796]: Service [ssl-OSRdev] accepted (FD=572) from 192.168.0.22:61093 2018.03.16 14:44:55 LOG7[18796]: Creating a new thread 2018.03.16 14:44:55 LOG7[18796]: New thread created 2018.03.16 14:44:55 LOG7[30864]: Service [ssl-OSRdev] started 2018.03.16 14:44:55 LOG5[30864]: Service [ssl-OSRdev] accepted connection from 192.168.0.22:61093 2018.03.16 14:44:55 LOG6[30864]: s_connect: connecting 155.56.210.164:443 2018.03.16 14:44:55 LOG7[30864]: s_connect: s_poll_wait 155.56.210.164:443: waiting 10 seconds 2018.03.16 14:44:56 LOG5[30864]: s_connect: connected 155.56.210.164:443 2018.03.16 14:44:56 LOG5[30864]: Service [ssl-OSRdev] connected remote server from 192.168.0.32:30269 2018.03.16 14:44:56 LOG7[30864]: Remote socket (FD=588) initialized 2018.03.16 14:44:56 LOG7[30864]: SNI: sending servername: l4884-iflmap.hcisbp.eu1.hana.ondemand.com 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): before/connect initialization 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv2/v3 write client hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate request A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server done A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write certificate verify A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write change cipher spec A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write finished A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 flush data 2018.03.16 14:44:57 LOG7[30864]: SSL state (connect): SSLv3 read finished A 2018.03.16 14:44:57 LOG7[30864]: 1 items in the session cache 2018.03.16 14:44:57 LOG7[30864]: 1 client connects (SSL_connect()) 2018.03.16 14:44:57 LOG7[30864]: 1 client connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 client renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 server connects (SSL_accept()) 2018.03.16 14:44:57 LOG7[30864]: 0 server connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 server renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 external session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 session cache misses 2018.03.16 14:44:57 LOG7[30864]: 0 session cache timeouts 2018.03.16 14:44:57 LOG7[30864]: Peer certificate was cached (3826 bytes) 2018.03.16 14:44:57 LOG6[30864]: SSL connected: new session negotiated 2018.03.16 14:44:57 LOG6[30864]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.03.16 14:44:57 LOG6[30864]: Compression: null, expansion: null 2018.03.16 14:44:58 LOG6[30864]: SSL socket closed (SSL_read) 2018.03.16 14:44:58 LOG7[30864]: Sent socket write shutdown 2018.03.16 14:44:58 LOG5[30864]: Connection closed: 1730 byte(s) sent to SSL, 274 byte(s) sent to socket 2018.03.16 14:44:58 LOG7[30864]: Remote socket (FD=588) closed 2018.03.16 14:44:58 LOG7[30864]: Local socket (FD=572) closed 2018.03.16 14:44:58 LOG7[30864]: Service [ssl-OSRdev] finished (0 left) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 3 block(s), 4294962489 data byte(s), 150 control byte(s) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:413 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:412 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:411 I have tested the service using SoapUI and it works. Is it possible to have sTunnel follow the URL redirection? Regards, Tony

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 19 Mar '18

19 Mar '18

Solved! I've fixed up the various ports and now I am able to connect. For the edification of other list readers I'll summarize. I have a local Linux host acting as firewall/router. It routes requests on port 1234 to port 3389 on a local Linux workstation which is running x11vnc server listening on its local port 5900. I want to connect to this VNC server from a remote vnc viewer. (Why does the router forward to port 3389? Because the workstaion can dual-boot Windows, so the forward works regardless of booted OS.) Remote vnc viewer, stunnel client stunnel.conf: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = router.obfuscate.org:1234 Local workstation vnc server, stunnel server stunnel.conf: pid = /var/run/stunnel.pid debug = 7 [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 The certificate is self-signed and created on the stunnel/vnc server host using the following commands: openssl genrsa -out privatekey.pem 2048 openssl req -new -x509 -days 365 -key privatekey.pem -out certificate.pem The certificate.pem is copied to the stunnel client host. With x11vnc listening on 5900 on the local workstation and with 'stunnel stunnel.conf' running on both stunnel client (as the normal user) and server hosts, I use the remote vnc viewer, logged in as a normal user, with the connection 127.0.0.1:5900 I'm guessing I could configure my vnc viewers to connect to multiple clients with difference [service] sections, for example: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [remoteHost1] accept = 5900 connect = router.obfuscate.org:1234 [remoteHost2] accept = 5901 connect = router.obfuscate.org:4321 I haven't tried that, but I will. I futher guess that I could have different CAfiles per server if I moved that directive to the respective service defintions (can someone confirm?), but I haven't tried that either. Thanks especially to Flo Rance for helping me work through this. Now, I have to figure out how to do this from a Windows client! --Mark

2 1

Creating CSR for GoDaddy
by John McClymont 15 Mar '18

15 Mar '18

Good Morning, As a novice user of stunnel. I use stunnel to make and encrypted video connection to home security system. I wish to create an SSL certificate request to obtain an SSL from GoDaddy I use the following command openssl req -new -newkey rsa:2048 -nodes -keyout c:\key\private_key.key -out c:\key\request.csr Is this correct? thanks in advance for suggestions

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 15 Mar '18

15 Mar '18

Nitin - sorry, I didn't realize this was a response to my message and I sent a followup message before reading this one. I have your patch in a previous message. I'm not familiar with "patching". Can you give me quickie instructions on doing that, or refer me to a link that explains it? I assume I need to patch the source code, right? If so, I have stunnel version 5.35. Do I need to apply this patch to a more recent version? Are there any other sslVersions stunnel supports? Thanks --Mark -----Original Message----- On Tue, 13 Mar 2018 22:21:24 +0400 Nitin Mutkawoa <jmutkawoa(a)hackers.mu> wrote: > > hello > > Sorry, I was not clear enough in my previous mail. > The patch allows you to specify TLS 1.3 in the configuration file and do a > TLS 1.3 only. > > regards > > Nitin J Mutkawoa > > https://tunnelix.com > https://hackers.mu > > Twitter: @TheTunnelix > > On Tue, Mar 13, 2018 at 3:13 PM, Ma??gorzata Olszówka < > Malgorzata.Olszowka(a)stunnel.org> wrote: > > > I'm also working on TLS 1.3 compatibility with Stunnel. I will reach the > >> mailing list as soon as possible with a tested patch. > >> > > > > Hello Nitin, > > Could you specify what problem do you have with TLS 1.3. > > It works for me: > > > > 2018.03.13 11:39:06 LOG5[ui]: stunnel 5.44 on x86_64-unknown-linux-gnu > > platform > > 2018.03.13 11:39:06 LOG5[ui]: Compiled/running with OpenSSL > > 1.1.1-pre2-dev xx XXX xxxx > > ??? > > 2018.03.13 11:39:23 LOG6[0]: Negotiated TLSv1.3 ciphersuite > > TLS13-AES-256-GCM-SHA384 (256-bit encryption) > > > > > > Regards, > > Ma??gorzata > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > >

1 1

Re: [stunnel-users] basic usage question
by Mark Foley 14 Mar '18

14 Mar '18

Thanks to help from Nitin, I've made a tiny bit of progress with stunnel. I've created the certificates per Nitin's instructions at https://tunnelix.com/securing-mysql-traffic-with-stunnel-in-a-jail-environm… Certificates have permissions 0600. I want to use a VNC client on Linux to connect to a VNC Server also on Linux. In between these two computers I have a Linux router which routes all request to port 1914 to port 3389 on the VNC Server. stunnel on the server is run at the command line by root: 'stunnel /root/stunnel.conf'. Here is my VNC Server computer's stunnel.conf: foreground = yes pid = /var/run/stunnel.pid debug = 7 ; output = /root/stunnel.log output = /dev/stdout [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 stunnel on the client is run by a normal user, stunnel $HOME/.stunnel/stunnel.conf. Below is my client stunnel.conf: foreground = yes verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = mail.ohprs.org:1914 When I run stunnel on the client I get: 2018.03.13 13:21:17 LOG5[ui]: stunnel 5.35 on x86_64-slackware-linux-gnu platform 2018.03.13 13:21:17 LOG5[ui]: Compiled with OpenSSL 1.0.2h 3 May 2016 2018.03.13 13:21:17 LOG5[ui]: Running with OpenSSL 1.0.2n 7 Dec 2017 2018.03.13 13:21:17 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2018.03.13 13:21:17 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2018.03.13 13:21:17 LOG5[ui]: Reading configuration from file /home/mfoley/.stunnel/stunnel.conf 2018.03.13 13:21:17 LOG5[ui]: UTF-8 byte order mark not detected 2018.03.13 13:21:17 LOG5[ui]: FIPS mode disabled 2018.03.13 13:21:17 LOG4[ui]: Service [x11vnc] uses "verify = 2" without subject checks 2018.03.13 13:21:17 LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates 2018.03.13 13:21:17 LOG5[ui]: Configuration successful On the client, I then run tigerVNCViewer connecting to 127.0.0.1::5900. I get the following messages on the client: 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] accepted connection from 127.0.0.1:35034 2018.03.13 13:22:03 LOG5[0]: s_connect: connected 98.102.63.107:1914 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] connected remote server from 192.168.0.17:40512 2018.03.13 13:22:03 LOG3[0]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2018.03.13 13:22:03 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Just guessing, but is it failing with the SSLVersion? Help appreciated. Thanks, Mark

1 1

[PATCH] TLS 1.3 Compatibility
by Nitin Mutkawoa 13 Mar '18

13 Mar '18

Hello, To add TLS 1.3 compatibility on Stunnel, the following patch was applied and tested. --- options.c.orig 2018-03-13 04:06:01.410477727 +0000 +++ options.c 2018-03-13 05:42:51.883782519 +0000 @@ -2675,6 +2675,18 @@ NOEXPORT char *parse_service_option(CMD #else /* defined(OPENSSL_NO_TLS1_2) */ return "TLSv1.2 not supported"; #endif /* !defined(OPENSSL_NO_TLS1_2) */ + } else if(!strcasecmp(arg, "TLSv1.3")) { +#ifndef OPENSSL_NO_TLS1_3 + section->client_method=(SSL_METHOD *)TLS_client_method(); + section->server_method=(SSL_METHOD *)TLS_server_method(); + section->ssl_options_set|= SSL_OP_NO_SSLv2; + section->ssl_options_set|= SSL_OP_NO_SSLv3; + section->ssl_options_set|= SSL_OP_NO_TLSv1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_2; +#else /* defined(OPENSSL_NO_TLS1_3) */ + return "TLSv1.3 not supported"; +#endif #endif /* OPENSSL_API_COMPAT<0x10100000L */ } else return "Incorrect version of TLS protocol"; Please see this link for more info about the test for TLS 1.3 https://gist.github.com/jmutkawoa/c97f5d67ded592f6ad04389a3ade623e Regards Nitin J Mutkawoa https://tunnelix.com https://hackers.mu Twitter: @TheTunnelix

1 0

basic usage question
by Mark Foley 10 Mar '18

10 Mar '18

I'm trying to set up an ssl tunnel for VNC per the instructions at https://www.ibm.com/developerworks/library/l-sslvnc/index.html. I've not gotten very far into the steps. I tried: # stunnel -d 5905 -r 5900 -p /root/combined.pem [ ] Clients allowed=500 [.] stunnel 5.35 on x86_64-slackware-linux-gnu platform [.] Compiled with OpenSSL 1.0.2h 3 May 2016 [.] Running with OpenSSL 1.0.2n 7 Dec 2017 [.] Update OpenSSL shared libraries or rebuild stunnel [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-d" [!] realpath: No such file or directory (2) [ ] Cron thread initialized I find nothing on the -d, -r or -p options in the manpage. This is my 1st posting to this list. I have very rudimentary skills with ssl, ssh, and certificates, mainly limited to getting certificates from a provider and installing for web and email; and creating public keys for ssh login using ssh-keygen. That's about it, so I'm pretty much a certified newbie. Help getting past the starting gate would be greatly appreciated. THX --Mark

1 0

[PATCH] Spectre v2 Vulnerability Mitigations
by Nitin Mutkawoa 07 Mar '18

07 Mar '18

Hello To prevent any leakage (Spectre v2) from a compromised VM on same physical host, this patch would mitigate the impact. --- configure.ac.orig 2018-03-04 01:46:55.877067173 +0400 +++ configure.ac 2018-03-04 01:49:26.422625147 +0400 @@ -101,6 +101,11 @@ if test "$GCC" = yes; then fi AX_APPEND_COMPILE_FLAGS([-D_FORTIFY_SOURCE=2]) +# Spectre v2 mitigations +AX_APPEND_COMPILE_FLAGS([-mfunction-return=thunk]) +AX_APPEND_COMPILE_FLAGS([-mindirect-branch=thunk]) + AC_MSG_NOTICE([**************************************** libtool]) LT_INIT([disable-static]) AC_SUBST([LIBTOOL_DEPS]) Kind regards, Nitin J Mutkawoa https://tunnelix.com https://hackers.mu

1 0

Re: [stunnel-users] Connect using TLS with public Web Server
by peter＠easthope.ca 06 Mar '18

06 Mar '18

From: Carlos Castro <carlos.castro.guerrero(a)gmail.com> Date: Fri, 2 Feb 2018 12:04:08 +0100 > I have older application and now I need connect with external server HTTPS > using TLS . My application doesn't support with TLS and I think use Stunnel > to connect with this Server HTTPS. Same requirement here. Have you tried this configuration? ; yourhost:/etc/stunnel4/stunnel.conf ... [https] client = yes accept = 443 transparent = destination Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

3 6

Stunnel in server mode with certificate from the Windows Certificate Store
by merlin＠mp3merlin.net 06 Mar '18

06 Mar '18

Hello, I'm trying to use stunnel in server mode with certificates from the Windows Certificate Store. I have a basic configuration which is working with a PEM certificate file and I'm trying to get it to use a cert via the CAPI engine. Here is my basic (working) config: debug = debug output = C:\stunnel\stunnel.log options = -NO_SSLv3 [https] accept = 443 connect = 80 cert = stunnel.pem Here is my config using the CAPI engine: debug = debug output = C:\stunnel\stunnel.log engine = capi engineCtrl = debug_level:2 engineCtrl = debug_file:c:\stunnel\capi.log engineCtrl = store_flags:1 engineCtrl = list_certs options = -NO_SSLv3 [https] accept = 443 connect = 80 engineId = capi However stunnel does not seem to find a certificate to use: [...] 2018.03.06 10:22:05 LOG7[main]: Enabling support for engine "capi" 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_level:2 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_file:c:\stunnel\capi.log 2018.03.06 10:22:05 LOG7[main]: Executing engine control command store_flags:1 2018.03.06 10:22:05 LOG7[main]: Executing engine control command list_certs 2018.03.06 10:22:05 LOG7[main]: Initializing engine #1 (capi) 2018.03.06 10:22:05 LOG6[main]: Engine #1 (capi) initialized [...] 2018.03.06 10:22:05 LOG6[main]: Initializing service [https] 2018.03.06 10:22:05 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.03.06 10:22:05 LOG7[main]: TLS options: 0x01004004 (+0x03004000, -0x02000000) 2018.03.06 10:22:05 LOG7[main]: No certificate or private key specified [...] And I have no certificates listed in the CAPI debug log: Setting debug level to 2 Setting debug file to c:\stunnel\capi.log Setting flags to 1 Listing certs for store MY Opening certificate store MY capi_cert_get_fname When I load the engine via OpenSSL, I can see that a certificate is present in the store: C:\stunnel\bin>openssl.exe engine -t dynamic -pre "SO_PATH:C:\stunnel\engines\capi.dll" -pre LOAD -post store_flags:1 -post store_name:MY -post list_certs WARNING: can't open config file: /devel/win32/openssl/openssl.cnf (dynamic) Dynamic engine loading support [Success]: SO_PATH:C:\stunnel\engines\capi.dll [Success]: LOAD Loaded: (capi) CryptoAPI ENGINE [ available ] [Success]: store_flags:1 Certificate 0 Friendly Name "test" Subject: CN = test Issuer: CN = test [Success]: list_certs This certificate (and the associated private key) has been generated via the IIS Manager console and I have imported it in the Local Computer Store (with the private key). Does anybody have any idea what I am missing to get this to work ? I can provide more logs and run more tests if necessary. I'm using Stunnel 5.44 on Windows 2008 R2. I tried with an older version (5.40) but same problem. Thanks. Kevin

1 0