Hi, someone could help me?
I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d).
After protocol handshake I get this error:
SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption
failed or bad record mac problem
Stunnel is configured in this way:
==========================
client = yes
debug=7
cert=clcert.pem
[telnet]
accept = 23
connect = 10.36.3.144:4433
==========================
My router's configuration is:
==========================
-Verify 4
-cert cert.pem
==========================
The exchange of packets:
==========================
client sends=======> Client Hello
server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done
client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message
server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data.
After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection.
Having debug on stunnel client I can see:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX
2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd
2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd
2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG
2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully
2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem
2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem
2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients
2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode
2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket
2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23
2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589
2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode
2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread
2005.03.15 11:13:54 LOG7[2040:2376]: New thread created
2005.03.15 11:13:54 LOG7[2040:3588]: telnet started
2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589
2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode
2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433
2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds
2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected
2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized
2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data
2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A
2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache
2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect())
2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished
2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept())
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts
2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated
2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac
2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac
2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket
2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left)
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the
problem (after searching on Internet I deduce that).
Not having solution to the problem, I know that my conclusion is not right. This morning I tryed with new library available in your home page (New
compiled Windows DLL libraries for 0.9.7d)
but I get the same error.
So if someone knows how to procede, please help me.
Thanks&Regards
Maddalena Pulcini
3
2
I have a personal webserver running on Win2K Pro SP4 that listens on port
17875. This server is accessible through my NAT and software firewall
(ZoneAlarm Pro). I then installed STunnel with the following conf:
[https]
accept=4430
connect=17875
TIMEOUTclose=0
Now, when I access https://<server>:4430, I get a HTTP 400 (Bad Request)
error message, with both Internet Explorer 6 and FireFox 1.01. However, if I
change the accept port from 4430 to 443 (and make the appropriate changes on
the NAT for port forwarding), and use https://<server>, it works. I don't
want to use the standard port. What am I doing wrong?
Here's the log that STunnel generated:
2005.03.16 08:33:26 LOG5[1044:288]: stunnel 4.08 on x86-pc-mingw32-gnu
WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004
2005.03.16 08:33:26 LOG7[1044:1096]: RAND_status claims sufficient entropy
for the PRNG
2005.03.16 08:33:26 LOG6[1044:1096]: PRNG seeded successfully
2005.03.16 08:33:26 LOG7[1044:1096]: Certificate: stunnel.pem
2005.03.16 08:33:26 LOG7[1044:1096]: Key file: stunnel.pem
2005.03.16 08:33:26 LOG5[1044:1096]: No limit detected for the number of
clients
2005.03.16 08:33:26 LOG7[1044:1096]: FD 168 in non-blocking mode
2005.03.16 08:33:26 LOG7[1044:1096]: SO_REUSEADDR option set on accept
socket
2005.03.16 08:33:26 LOG7[1044:1096]: https bound to 0.0.0.0:4430
2005.03.16 08:34:08 LOG7[1044:1096]: https accepted FD=180 from
192.168.0.2:4864
2005.03.16 08:34:08 LOG7[1044:1096]: FD 180 in non-blocking mode
2005.03.16 08:34:08 LOG7[1044:1096]: Creating a new thread
2005.03.16 08:34:08 LOG7[1044:1096]: New thread created
2005.03.16 08:34:08 LOG7[1044:896]: https started
2005.03.16 08:34:08 LOG5[1044:896]: https connected from 192.168.0.2:4864
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): before/accept
initialization
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read client
hello A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write server
hello A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write
certificate A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write server
done A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 flush data
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read client
key exchange A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read finished
A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write change
cipher spec A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write finished
A
2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 flush data
2005.03.16 08:34:08 LOG7[1044:896]: 1 items in the session cache
2005.03.16 08:34:08 LOG7[1044:896]: 0 client connects (SSL_connect())
2005.03.16 08:34:08 LOG7[1044:896]: 0 client connects that finished
2005.03.16 08:34:08 LOG7[1044:896]: 0 client renegotiatations requested
2005.03.16 08:34:08 LOG7[1044:896]: 1 server connects (SSL_accept())
2005.03.16 08:34:08 LOG7[1044:896]: 1 server connects that finished
2005.03.16 08:34:08 LOG7[1044:896]: 0 server renegotiatiations requested
2005.03.16 08:34:08 LOG7[1044:896]: 0 session cache hits
2005.03.16 08:34:08 LOG7[1044:896]: 1 session cache misses
2005.03.16 08:34:08 LOG7[1044:896]: 0 session cache timeouts
2005.03.16 08:34:08 LOG6[1044:896]: SSL accepted: new session negotiated
2005.03.16 08:34:08 LOG6[1044:896]: Negotiated ciphers: RC4-MD5
SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
2005.03.16 08:34:08 LOG7[1044:896]: FD 200 in non-blocking mode
2005.03.16 08:34:08 LOG7[1044:896]: https connecting 127.0.0.1:17875
2005.03.16 08:34:08 LOG7[1044:896]: connect_wait: waiting 10 seconds
2005.03.16 08:34:08 LOG7[1044:896]: connect_wait: connected
2005.03.16 08:34:08 LOG7[1044:896]: Remote FD=200 initialized
2005.03.16 08:34:08 LOG7[1044:896]: Socket closed on read
2005.03.16 08:34:08 LOG7[1044:896]: SSL write shutdown
2005.03.16 08:34:08 LOG7[1044:896]: SSL alert (write): warning: close notify
2005.03.16 08:34:08 LOG7[1044:896]: SSL_shutdown retrying
2005.03.16 08:34:08 LOG7[1044:896]: s_poll_wait timeout waiting for SSL
close_notify
2005.03.16 08:34:08 LOG5[1044:896]: Connection closed: 208 bytes sent to
SSL, 389 bytes sent to socket
2005.03.16 08:34:08 LOG7[1044:896]: https finished (0 left)
Any help much appreciated.
Thanks.
2
6
Hi all,
I have a working setup of stunnel listening on port 443 and connect to the
server on the same host on port 80.
It is done via xinetd.
Alltough everything is working just fine, clients on webbrowsers get the
"you have choosen not to trust this CA" error when connecting to this server.
In apache the certificate chain (bundle.ca) is used and clients connecting to
the apache server wont get this error.
Is there a way to make stunnel behave like apache, so the clients don't have
to manually install the CA certificates?
(the certificate is a vallid certificate obtained from globaslsign.be)
i do have the CAfile in my options file, but this does not help.
All help is greatly appreciated!
Kind regards,
@
1
0
Hi all,
I have take over a stunnel install and all the clients certs have expired.
I have been trying for the past 2 days to get the new step up to work but
no such luck.
Here is the error I get on the sever side, Linux Fedora Core 3, Stunnel 4.05:
2005.03.17 11:36:15 LOG7[12746:3086949296]: school4 started
2005.03.17 11:36:15 LOG5[12746:3086949296]: school4 connected from
XXX.XXX.XXX.XX:1414
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept):
before/accept initialization
2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read
2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: ok
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 read
client hello A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
write server hello A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
write certificate A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
write certificate request A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
flush data
2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read
2005.03.17 11:36:18 LOG7[12746:3086949296]: waitforsocket: ok
2005.03.17 11:36:18 LOG7[12746:3086949296]: SSL alert (read): fatal:
certificate unknown
2005.03.17 11:36:18 LOG3[12746:3086949296]: SSL_accept: 14094416:
error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate
unknown
2005.03.17 11:36:18 LOG7[12746:3086949296]: school4 finished (0 left)
And here is the output on the client side:
005.03.17 11:21:02 LOG5[952:1264]: stunnel 4.04 on x86-pc-mingw32-gnu
WIN32 with OpenSSL 0.9.7 31 Dec2002
2005.03.17 11:21:03 LOG5[952:896]: Peer certificate location (null)
2005.03.17 11:21:03 LOG5[952:896]: WIN32 platform: 30000 clients allowed
2005.03.17 11:21:03 LOG5[952:1152]: schools connected from 127.0.0.1:1413
2005.03.17 11:21:07 LOG5[952:1152]: VERIFY OK: depth=1,
/C=CA/ST=XXX/L=XXX/O=XXX/OU=XXX
CACERT/CN=sd.traf.mb.ca/emailAddress=sysadmin@XXXX
2005.03.17 11:21:07 LOG4[952:1152]: VERIFY ERROR ONLY MY: no cert for
/C=CA/ST=XXX/O=XXXX/OU=STUNNEL SERVER
CERT/CN=XXXXX/emailAddress=sysadmin@XXXX
2005.03.17 11:21:07 LOG3[952:1152]: SSL_connect: 14090086:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
failed
I have created the certs on both server and client according to the
documents at
http://www.stunnel.org/faq/openssl_stunnel_ServerClientAuth.txt.
I have the cacert.pem file on the cleint side, I have c_hashed the cert
file on the server side. Do I need to out the c_hash of the server side
cert on the client as well?
Is there something I have missed? Any ideas as to what I can check to see
where the issue is?
I am desperate, any help would be greatly appreciated.
Regards,
+------------------------------------------+
| Richard Houston .^. |
| R.L.H. Consulting /V\ |
| E-Mail <rhouston(a)rlhc.net> /( )\ |
| WWW <www.rlhc.net> ^^-^^ |
+------------------------------------------+
3
8
Hi all,
I have take over a stunnel install and all the clients certs have expired.
I have been trying for the past 2 days to get the new step up to work but
no such luck.
Here is the error I get on the sever side, Linux Fedora Core 3, Stunnel 4.05:
2005.03.17 11:36:15 LOG7[12746:3086949296]: school4 started
2005.03.17 11:36:15 LOG5[12746:3086949296]: school4 connected from
XXX.XXX.XXX.XX:1414
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept):
before/accept initialization
2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read
2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: ok
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 read
client hello A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
write server hello A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
write certificate A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
write certificate request A
2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3
flush data
2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read
2005.03.17 11:36:18 LOG7[12746:3086949296]: waitforsocket: ok
2005.03.17 11:36:18 LOG7[12746:3086949296]: SSL alert (read): fatal:
certificate unknown
2005.03.17 11:36:18 LOG3[12746:3086949296]: SSL_accept: 14094416:
error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown
2005.03.17 11:36:18 LOG7[12746:3086949296]: school4 finished (0 left)
And here is the output on the client side:
005.03.17 11:21:02 LOG5[952:1264]: stunnel 4.04 on x86-pc-mingw32-gnu
WIN32 with OpenSSL 0.9.7 31 Dec2002
2005.03.17 11:21:03 LOG5[952:896]: Peer certificate location (null)
2005.03.17 11:21:03 LOG5[952:896]: WIN32 platform: 30000 clients allowed
2005.03.17 11:21:03 LOG5[952:1152]: schools connected from 127.0.0.1:1413
2005.03.17 11:21:07 LOG5[952:1152]: VERIFY OK: depth=1,
/C=CA/ST=XXX/L=XXX/O=XXX/OU=XXX
CACERT/CN=sd.traf.mb.ca/emailAddress=sysadmin@XXXX
2005.03.17 11:21:07 LOG4[952:1152]: VERIFY ERROR ONLY MY: no cert for
/C=CA/ST=XXX/O=XXXX/OU=STUNNEL SERVER
CERT/CN=XXXXX/emailAddress=sysadmin@XXXX
2005.03.17 11:21:07 LOG3[952:1152]: SSL_connect: 14090086:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
failed
I have created the certs on both server and client according to the
documents at
http://www.stunnel.org/faq/openssl_stunnel_ServerClientAuth.txt.
I have the cacert.pem file on the cleint side, I have c_hashed the cert
file on the server side. Do I need to out the c_hash of the server side
cert on the client as well?
Is there something I have missed? Any ideas as to what I can check to see
where the issue is?
I am desperate, any help would be greatly appreciated.
Regards,
+------------------------------------------+
| Richard Houston .^. |
| R.L.H. Consulting /V\ |
| E-Mail <rhouston(a)rlhc.net> /( )\ |
| WWW <www.rlhc.net> ^^-^^ |
+------------------------------------------+
1
0
So I don't normally start off on a list by immediately asking a question
but I've got a weird one here that's a critical thing
tonight, plus, this might just be entertaining!
Problem : MacOS Panther has horrible performance problems with large
https web apps.
So I setup Stunnel to take port 80 and run it through the web app on
443. Provides http from an https server.
On a MacOS client machine I set /etc/hosts to say that
system.netsuite.com, the web app, is 192.168.0.4, a handy
FreeBSD 5.3 box running stunnel 4.05
It works. Sort of.
Problems - the web app keeps rewriting the url from http to https,
anytime I click on anything, hmmm.. so I can't make stunnel answer
on 443 because then I'm back to square one. Also, I can't login, the web
app is giving me a login page as http, but I get a session timeout,please
login again, just repeats, unsure if something in the stunnel config
should be done to fix that. Other than that, this is working.
Config is currently this.
client=yes
accept=80
connect=system.netsuite.com:443
Anyway, so is this maybe one of the stranger uses of stunnel, possibly a
wrong headed and broken way of using it, but oh well.
There goes my plea for some ideas on this one,
Thanks,
Todd
1
0
SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05
15 Mar '05
Hi, someone could help me?
I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d).
Stunnel is configured in this way:
==========================
client = yes
debug=7
cert=clcert.pem
[telnet]
accept = 23
connect = 10.36.3.144:4433
==========================
My router's configuration is:
==========================
-Verify 4
-cert cert.pem
==========================
The exchange of packets:
==========================
client sends=======> Client Hello
server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done
client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message
server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data.
After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection.
Having debug on stunnel client I can see:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX
2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd
2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd
2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG
2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully
2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem
2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem
2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients
2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode
2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket
2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23
2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589
2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode
2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread
2005.03.15 11:13:54 LOG7[2040:2376]: New thread created
2005.03.15 11:13:54 LOG7[2040:3588]: telnet started
2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589
2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode
2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433
2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds
2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected
2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized
2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data
2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A
2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache
2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect())
2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished
2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept())
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts
2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated
2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac
2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac
2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket
2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left)
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the
problem (after searching on Internet I deduce that).
Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me.
Thanks&Regards
Maddalena Pulcini
1
0
SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05
15 Mar '05
Hi, someone could help me?
I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d).
Stunnel is configured in this way:
==========================
client = yes
debug=7
cert=clcert.pem
[telnet]
accept = 23
connect = 10.36.3.144:4433
==========================
My router's configuration is:
==========================
-Verify 4
-cert cert.pem
==========================
The exchange of packets:
==========================
client sends=======> Client Hello
server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done
client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message
server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data.
After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection.
Having debug on stunnel client I can see:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX
2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd
2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd
2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG
2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully
2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem
2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem
2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients
2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode
2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket
2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23
2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589
2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode
2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread
2005.03.15 11:13:54 LOG7[2040:2376]: New thread created
2005.03.15 11:13:54 LOG7[2040:3588]: telnet started
2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589
2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode
2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433
2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds
2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected
2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized
2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A
2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data
2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A
2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache
2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect())
2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished
2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept())
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished
2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses
2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts
2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated
2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac
2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac
2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket
2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left)
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the
problem (after searching on Internet I deduce that).
Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me.
Thanks&Regards
Maddalena Pulcini
1
0
14 Mar '05
Hi My name is Miguel from Brazil I need to know if anyone has ever
configured Stunnel with Macromedia Flash Communication Server.
If anyone has can you tell me something about it I’m new to Stunnel so
if anyone can please help me it would be great.
Thanks
Miguel
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/3/2005
1
0
Hello all..
I would like to pass radius over stunnel, but I'm not sure if this will
work... I have a lot of 'client's that are using RADIUS for
authentication, but i want to pass the data over the internet, and
radius is relatively insecure. My client machines also run a web
server, which stunnel sits in front of, to provide ssl encrypted web
services.
My radius servers can easily run stunnel, without any issue.
Could someone suggest a configuration for this??
3
2