Re: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11
by Jose Alf. 04 May '11
04 May '11
Laurent,
We need to present a client certificate to the server. That's the important part
missing. Do that by adding -cert your_cert_filename to the command, like:
openssl s_client -ssl3 -state -cert your_client_cert_filename -connect
your-stunnel-ip:10443
See http://www.openssl.org/docs/apps/s_client.html
Regards,
Jose
________________________________
From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com>
To: josealf(a)rocketmail.com
Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org
Sent: Wed, May 4, 2011 6:55:19 AM
Subject: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error
:SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
Jose, thanks you for your response, i use the openssl s_client command but i
have the following error :
1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared
library:dso_dlfcn.c:162:filename(libz.so): Could not load module .
System error: No such file or directory
1499296:error:25070067:DSO support routines:DSO_load:could not load the shared
library:dso_lib.c:244:
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP
PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP
PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP
PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com
verify error:num=21:unable to verify the first certificate
verify return:1
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server certificate request A
SSL_connect:SSLv3 read server done A
SSL3 alert write:warning:no certificate
SSL_connect:SSLv3 write client certificate A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL3 alert read:fatal:handshake failure
SSL_connect:failed in SSLv3 read finished A
1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake
failure:s3_pkt.c:1060:SSL alert number 40
1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
failure:s3_pkt.c:530:
is it normal?
Thanks.
Regards.
Laurent UK
Internet
josealf(a)rocketmail.com
04/05/2011 13:38 Pour Laurent UK
cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org
Objet Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error
:SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
Laurent,
Ideally, you should terminate the SSL connection on your final server. But
that's not the problem here. It should work as is.
Mosty likely the problem is on the client SSL software you are using to connect
to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and
TLSv1. Can you force your client to use those protocols? Maybe it is trying to
negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text?
You can test your connection to stunnel server with openssl s_client command.
Example
openssl s_client -ssl3 -state -connect your-stunnel-ip:10443
openssl s_client -tls1 -state -connect your-stunnel-ip:10443
if this works, we found the culprit.
Regards
Jose
________________________________
From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com>
To: josealf(a)rocketmail.com
Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org
Sent: Wed, May 4, 2011 2:05:07 AM
Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error
:SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
Jose,
I use 2 servers in my configuration:
the first one who listenning on the port 10443 (where we receive encrypted
traffic from software using ssl)
and the second one who listenning the port 10016 (where we receive decrypted
traffic).
The first one receive the encrypted traffic, it decrypted it and send it to the
second server that's why i only use the server mode on my fist server.
Do you think that i also need to change this configuration?
Cordialement,
Laurent UK
Internet
josealf(a)rocketmail.com
03/05/2011 19:18
Pour Laurent UK
cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org
Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong
versionnumber with cipher DES-CBC-SHA
Laurent,
I'm not sure you are connecting the dots right.
I see an stunnel server configuration. In this case, your stunnel is a front-end
to a service you run on host XXXX port 10016. What is that service? Is stunnel
running on the same host? Note that If stunnel is not running on the same host
with IP XXXX, then you may have some traffic in clear text in your network (from
the device running stunnel to the device hosting the service on port 10016).
You need a client to connect to the stunnel server. Unless your client support
SSL natively, you also should have an stunnel running on your client device with
entries like these:
client=yes
[pestip]
accept = 10443
connect = Your-Stunnel-server-IP:10443
In this case your client apps connects locally to port 10443, traffic is
encrypted and sent to your server listening on port 10443, where it is decripted
and send to IP XXXX port 10016.
Regards,
Jose
________________________________
From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com>
To: josealf(a)rocketmail.com
Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org
Sent: Tue, May 3, 2011 10:48:11 AM
Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong
versionnumber with cipher DES-CBC-SHA
Dear Jose,
here is the configuration file of my stunnel :
; Sample stunnel configuration file by Michal Trojnara 2002-2006
; Some options used here may not be adequate for your particular configuration
; Please make sure you understand them (especially the effect of chroot jail)
; Certificate/key is needed in server mode and optional in client mode
cert = /opt/freeware/etc/stunnel/ca_nopass.pem
foreground = yes
syslog = yes
; Protocol version (all, SSLv2, SSLv3, TLSv1)
;sslVersion = SSLv2
sslVersion = all
;ciphers = DES-CBC-SHA
;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5
; Some security enhancements for UNIX systems - comment them out on Win32
;chroot = /usr/local/stunnel/var/lib/stunnel
;chroot = /tmp/
;setuid = root
;setgid = other
; PID is created inside chroot jail
pid = /var/adm/stunnel_server_level1.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = rle
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
;options = Options_SSL
; Authentication stuff
verify = 3
; Don't forget to c_rehash CApath
; CApath is located inside chroot jail
CApath = /opt/freeware/etc/stunnel/CA_files/
; It's often easier to use CAfile
;CAfile = /opt/freeware/etc/stunnel/ca.pem
; Don't forget to c_rehash CRLpath
; CRLpath is located inside chroot jail
;CRLpath = /crls
; Alternatively you can use CRLfile
;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
; Use it for client mode
client = no
; Service-level configuration
[pesitip]
accept = 10443
connect = XXXXXXX:10016
Thanks for your help.
Regards.
Laurent UK
Internet
josealf(a)rocketmail.com
03/05/2011 14:52
Veuillez répondre à
josealf(a)rocketmail.com
Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org
cc
Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber
with cipher DES-CBC-SHA
Laurent,
Can you post your configuration? For security, You should change the real IPs
(but not the ports) before posting.
You can check:
1. Does your stunnel client config has client=yes?
2. Does your stunnel server config has client=no
3. Check your packet flow, that is: your accept/connect settings.
Regards
Jose
-----Original Message-----
From: laurent.uk(a)bnpparibas.com
Sender: stunnel-users-bounces(a)stunnel.org
Date: Tue, 3 May 2011 14:16:09
To: <stunnel-users(a)stunnel.org>
Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version
number with cipher DES-CBC-SHA
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
This message and any attachments (the "message") is
intended solely for the addressees and is confidential.
If you receive this message in error, please delete it and
immediately notify the sender. Any use not in accord with
its purpose, any dissemination or disclosure, either whole
or partial, is prohibited except formal approval. The internet
can not guarantee the integrity of this message.
BNP PARIBAS (and its subsidiaries) shall (will) not
therefore be liable for the message if modified.
Do not print this message unless it is necessary,
consider the environment.
---------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le
"message") sont etablis a l'intention exclusive de ses
destinataires et sont confidentiels. Si vous recevez ce
message par erreur, merci de le detruire et d'en avertir
immediatement l'expediteur. Toute utilisation de ce
message non conforme a sa destination, toute diffusion
ou toute publication, totale ou partielle, est interdite, sauf
autorisation expresse. L'internet ne permettant pas
d'assurer l'integrite de ce message, BNP PARIBAS (et ses
filiales) decline(nt) toute responsabilite au titre de ce
message, dans l'hypothese ou il aurait ete modifie.
N'imprimez ce message que si necessaire,
pensez a l'environnement.
1
0
Re: [stunnel-users] Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11
by Jose Alf. 04 May '11
04 May '11
Laurent,
Ideally, you should terminate the SSL connection on your final server. But
that's not the problem here. It should work as is.
Mosty likely the problem is on the client SSL software you are using to connect
to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and
TLSv1. Can you force your client to use those protocols? Maybe it is trying to
negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text?
You can test your connection to stunnel server with openssl s_client command.
Example
openssl s_client -ssl3 -state -connect your-stunnel-ip:10443
openssl s_client -tls1 -state -connect your-stunnel-ip:10443
if this works, we found the culprit.
Regards
Jose
________________________________
From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com>
To: josealf(a)rocketmail.com
Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org
Sent: Wed, May 4, 2011 2:05:07 AM
Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error
:SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
Jose,
I use 2 servers in my configuration:
the first one who listenning on the port 10443 (where we receive encrypted
traffic from software using ssl)
and the second one who listenning the port 10016 (where we receive decrypted
traffic).
The first one receive the encrypted traffic, it decrypted it and send it to the
second server that's why i only use the server mode on my fist server.
Do you think that i also need to change this configuration?
Cordialement,
Laurent UK
Internet
josealf(a)rocketmail.com
03/05/2011 19:18 Pour Laurent UK
cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org
Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong
versionnumber with cipher DES-CBC-SHA
Laurent,
I'm not sure you are connecting the dots right.
I see an stunnel server configuration. In this case, your stunnel is a front-end
to a service you run on host XXXX port 10016. What is that service? Is stunnel
running on the same host? Note that If stunnel is not running on the same host
with IP XXXX, then you may have some traffic in clear text in your network (from
the device running stunnel to the device hosting the service on port 10016).
You need a client to connect to the stunnel server. Unless your client support
SSL natively, you also should have an stunnel running on your client device with
entries like these:
client=yes
[pestip]
accept = 10443
connect = Your-Stunnel-server-IP:10443
In this case your client apps connects locally to port 10443, traffic is
encrypted and sent to your server listening on port 10443, where it is decripted
and send to IP XXXX port 10016.
Regards,
Jose
________________________________
From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com>
To: josealf(a)rocketmail.com
Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org
Sent: Tue, May 3, 2011 10:48:11 AM
Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong
versionnumber with cipher DES-CBC-SHA
Dear Jose,
here is the configuration file of my stunnel :
; Sample stunnel configuration file by Michal Trojnara 2002-2006
; Some options used here may not be adequate for your particular configuration
; Please make sure you understand them (especially the effect of chroot jail)
; Certificate/key is needed in server mode and optional in client mode
cert = /opt/freeware/etc/stunnel/ca_nopass.pem
foreground = yes
syslog = yes
; Protocol version (all, SSLv2, SSLv3, TLSv1)
;sslVersion = SSLv2
sslVersion = all
;ciphers = DES-CBC-SHA
;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5
; Some security enhancements for UNIX systems - comment them out on Win32
;chroot = /usr/local/stunnel/var/lib/stunnel
;chroot = /tmp/
;setuid = root
;setgid = other
; PID is created inside chroot jail
pid = /var/adm/stunnel_server_level1.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = rle
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
;options = Options_SSL
; Authentication stuff
verify = 3
; Don't forget to c_rehash CApath
; CApath is located inside chroot jail
CApath = /opt/freeware/etc/stunnel/CA_files/
; It's often easier to use CAfile
;CAfile = /opt/freeware/etc/stunnel/ca.pem
; Don't forget to c_rehash CRLpath
; CRLpath is located inside chroot jail
;CRLpath = /crls
; Alternatively you can use CRLfile
;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
; Use it for client mode
client = no
; Service-level configuration
[pesitip]
accept = 10443
connect = XXXXXXX:10016
Thanks for your help.
Regards.
Laurent UK
Internet
josealf(a)rocketmail.com
03/05/2011 14:52
Veuillez répondre à
josealf(a)rocketmail.com
Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org
cc
Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber
with cipher DES-CBC-SHA
Laurent,
Can you post your configuration? For security, You should change the real IPs
(but not the ports) before posting.
You can check:
1. Does your stunnel client config has client=yes?
2. Does your stunnel server config has client=no
3. Check your packet flow, that is: your accept/connect settings.
Regards
Jose
-----Original Message-----
From: laurent.uk(a)bnpparibas.com
Sender: stunnel-users-bounces(a)stunnel.org
Date: Tue, 3 May 2011 14:16:09
To: <stunnel-users(a)stunnel.org>
Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version
number with cipher DES-CBC-SHA
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
This message and any attachments (the "message") is
intended solely for the addressees and is confidential.
If you receive this message in error, please delete it and
immediately notify the sender. Any use not in accord with
its purpose, any dissemination or disclosure, either whole
or partial, is prohibited except formal approval. The internet
can not guarantee the integrity of this message.
BNP PARIBAS (and its subsidiaries) shall (will) not
therefore be liable for the message if modified.
Do not print this message unless it is necessary,
consider the environment.
---------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le
"message") sont etablis a l'intention exclusive de ses
destinataires et sont confidentiels. Si vous recevez ce
message par erreur, merci de le detruire et d'en avertir
immediatement l'expediteur. Toute utilisation de ce
message non conforme a sa destination, toute diffusion
ou toute publication, totale ou partielle, est interdite, sauf
autorisation expresse. L'internet ne permettant pas
d'assurer l'integrite de ce message, BNP PARIBAS (et ses
filiales) decline(nt) toute responsabilite au titre de ce
message, dans l'hypothese ou il aurait ete modifie.
N'imprimez ce message que si necessaire,
pensez a l'environnement.
1
0
Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 03 May '11
by Jose Alf. 03 May '11
03 May '11
Laurent,
I'm not sure you are connecting the dots right.
I see an stunnel server configuration. In this case, your stunnel is a front-end
to a service you run on host XXXX port 10016. What is that service? Is stunnel
running on the same host? Note that If stunnel is not running on the same host
with IP XXXX, then you may have some traffic in clear text in your network (from
the device running stunnel to the device hosting the service on port 10016).
You need a client to connect to the stunnel server. Unless your client support
SSL natively, you also should have an stunnel running on your client device with
entries like these:
client=yes
[pestip]
accept = 10443
connect = Your-Stunnel-server-IP:10443
In this case your client apps connects locally to port 10443, traffic is
encrypted and sent to your server listening on port 10443, where it is decripted
and send to IP XXXX port 10016.
Regards,
Jose
________________________________
From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com>
To: josealf(a)rocketmail.com
Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org
Sent: Tue, May 3, 2011 10:48:11 AM
Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong
versionnumber with cipher DES-CBC-SHA
Dear Jose,
here is the configuration file of my stunnel :
; Sample stunnel configuration file by Michal Trojnara 2002-2006
; Some options used here may not be adequate for your particular configuration
; Please make sure you understand them (especially the effect of chroot jail)
; Certificate/key is needed in server mode and optional in client mode
cert = /opt/freeware/etc/stunnel/ca_nopass.pem
foreground = yes
syslog = yes
; Protocol version (all, SSLv2, SSLv3, TLSv1)
;sslVersion = SSLv2
sslVersion = all
;ciphers = DES-CBC-SHA
;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5
; Some security enhancements for UNIX systems - comment them out on Win32
;chroot = /usr/local/stunnel/var/lib/stunnel
;chroot = /tmp/
;setuid = root
;setgid = other
; PID is created inside chroot jail
pid = /var/adm/stunnel_server_level1.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = rle
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
;options = Options_SSL
; Authentication stuff
verify = 3
; Don't forget to c_rehash CApath
; CApath is located inside chroot jail
CApath = /opt/freeware/etc/stunnel/CA_files/
; It's often easier to use CAfile
;CAfile = /opt/freeware/etc/stunnel/ca.pem
; Don't forget to c_rehash CRLpath
; CRLpath is located inside chroot jail
;CRLpath = /crls
; Alternatively you can use CRLfile
;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
; Use it for client mode
client = no
; Service-level configuration
[pesitip]
accept = 10443
connect = XXXXXXX:10016
Thanks for your help.
Regards.
Laurent UK
Internet
josealf(a)rocketmail.com
03/05/2011 14:52
Veuillez répondre à
josealf(a)rocketmail.com
Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org
cc
Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber
with cipher DES-CBC-SHA
Laurent,
Can you post your configuration? For security, You should change the real IPs
(but not the ports) before posting.
You can check:
1. Does your stunnel client config has client=yes?
2. Does your stunnel server config has client=no
3. Check your packet flow, that is: your accept/connect settings.
Regards
Jose
-----Original Message-----
From: laurent.uk(a)bnpparibas.com
Sender: stunnel-users-bounces(a)stunnel.org
Date: Tue, 3 May 2011 14:16:09
To: <stunnel-users(a)stunnel.org>
Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version
number with cipher DES-CBC-SHA
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
This message and any attachments (the "message") is
intended solely for the addressees and is confidential.
If you receive this message in error, please delete it and
immediately notify the sender. Any use not in accord with
its purpose, any dissemination or disclosure, either whole
or partial, is prohibited except formal approval. The internet
can not guarantee the integrity of this message.
BNP PARIBAS (and its subsidiaries) shall (will) not
therefore be liable for the message if modified.
Do not print this message unless it is necessary,
consider the environment.
---------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le
"message") sont etablis a l'intention exclusive de ses
destinataires et sont confidentiels. Si vous recevez ce
message par erreur, merci de le detruire et d'en avertir
immediatement l'expediteur. Toute utilisation de ce
message non conforme a sa destination, toute diffusion
ou toute publication, totale ou partielle, est interdite, sauf
autorisation expresse. L'internet ne permettant pas
d'assurer l'integrite de ce message, BNP PARIBAS (et ses
filiales) decline(nt) toute responsabilite au titre de ce
message, dans l'hypothese ou il aurait ete modifie.
N'imprimez ce message que si necessaire,
pensez a l'environnement.
1
0
Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Leandro Avila 03 May '11
by Leandro Avila 03 May '11
03 May '11
Hi,
If you have control of both ends of the connection make sure your SSL version is consistent on
both sides.
I would not recomend using sslVersion = all
Either set it to SSLv3 or TLSv1
DES-CBC-SHA is supported under those
However, judging for the cipher you are choosing I assume you might be dealing with a legacy
application and you might not have access to both ends of the connection.
I would try setting only one version at the time and moving down from TLSv1, SSLv3 and SSLv2
sslVersion =
ciphers = DES-CBC-SHA
Cheers
-----------------
Leandro Avila
________________________________
From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com>
To: josealf(a)rocketmail.com
Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org
Sent: Tuesday, May 3, 2011 10:48 AM
Subject: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
Dear Jose,
here is the configuration file of my
stunnel :
; Sample stunnel configuration
file by Michal Trojnara 2002-2006
; Some options used here may not be
adequate for your particular configuration
; Please make sure you understand them
(especially the effect of chroot jail)
; Certificate/key is needed in server
mode and optional in client mode
cert = /opt/freeware/etc/stunnel/ca_nopass.pem
foreground = yes
syslog = yes
; Protocol version (all, SSLv2, SSLv3,
TLSv1)
;sslVersion = SSLv2
sslVersion = all
;ciphers = DES-CBC-SHA
;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5
; Some security enhancements for UNIX
systems - comment them out on Win32
;chroot = /usr/local/stunnel/var/lib/stunnel
;chroot = /tmp/
;setuid = root
;setgid = other
; PID is created inside chroot jail
pid = /var/adm/stunnel_server_level1.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = rle
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
;options = Options_SSL
; Authentication stuff
verify = 3
; Don't forget to c_rehash CApath
; CApath is located inside chroot jail
CApath = /opt/freeware/etc/stunnel/CA_files/
; It's often easier to use CAfile
;CAfile = /opt/freeware/etc/stunnel/ca.pem
; Don't forget to c_rehash CRLpath
; CRLpath is located inside chroot jail
;CRLpath = /crls
; Alternatively you can use CRLfile
;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
; Use it for client mode
client = no
; Service-level configuration
[pesitip]
accept = 10443
connect = XXXXXXX:10016
Thanks for your help.
Regards.
Laurent UK
Internet
josealf(a)rocketmail.com
03/05/2011 14:52
Veuillez répondre à
josealf(a)rocketmail.com
Pour Laurent UK, stunnel-users-bounces(a)stunnel.org,
stunnel-users(a)stunnel.org
cc
Objet Re: [stunnel-users] need help error
:SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
Laurent,
Can you post your configuration? For security, You should change the real
IPs (but not the ports) before posting.
You can check:
1. Does your stunnel client config has client=yes?
2. Does your stunnel server config has client=no
3. Check your packet flow, that is: your accept/connect settings.
Regards
Jose
-----Original Message-----
From: laurent.uk(a)bnpparibas.com
Sender: stunnel-users-bounces(a)stunnel.org
Date: Tue, 3 May 2011 14:16:09
To: <stunnel-users(a)stunnel.org>
Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version
number with cipher DES-CBC-SHA
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
This message and any attachments (the "message") is
intended solely for the addressees and is confidential.
If you receive this message in error, please delete it and
immediately notify the sender. Any use not in accord with
its purpose, any dissemination or disclosure, either whole
or partial, is prohibited except formal approval. The internet
can not guarantee the integrity of this message.
BNP PARIBAS (and its subsidiaries) shall (will) not
therefore be liable for the message if modified.
Do not print this message unless it is necessary,
consider the environment.
---------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le
"message") sont etablis a l'intention exclusive de ses
destinataires et sont confidentiels. Si vous recevez ce
message par erreur, merci de le detruire et d'en avertir
immediatement l'expediteur. Toute utilisation de ce
message non conforme a sa destination, toute diffusion
ou toute publication, totale ou partielle, est interdite, sauf
autorisation expresse. L'internet ne permettant pas
d'assurer l'integrite de ce message, BNP PARIBAS (et ses
filiales) decline(nt) toute responsabilite au titre de ce
message, dans l'hypothese ou il aurait ete modifie.
N'imprimez ce message que si necessaire,
pensez a l'environnement.
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
1
0
Dear Users,
Version 4.36 of stunnel was released.
The ChangeLog entry:
Version 4.36, 2011.05.03, urgency: LOW:
* New features
- Updated Win32 DLLs for OpenSSL 1.0.0d.
- Dynamic memory management for strings manipulation:
no more static STRLEN limit, lower stack footprint.
- Strict public key comparison added for "verify = 3" certificate
checking mode (thx to Philipp Hartwig).
- Backlog parameter of listen(2) changed from 5 to SOMAXCONN:
improved behavior on heavy load.
- Example tools/stunnel.service file added for systemd service
manager.
* Bugfixes
- Missing pthread_attr_destroy() added to fix memory leak (thx to
Paul Allex and Peter Pentchev).
- Fixed the incorrect way of setting FD_CLOEXEC flag.
- Fixed --enable-libwrap option of ./configure script.
- /opt/local added to OpenSSL search path for MacPorts compatibility.
- Workaround implemented for signal handling on MacOS X.
- A trivial bug fixed in the stunnel.init script.
- Retry implemented on EAI_AGAIN error returned by resolver calls.
Home page: http://www.stunnel.org/
Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.36.tar.gz:
3483fc2011e8a9d2614a93a9dbf7eabf405044df3566f29144fe2d1dd37a35f5
Best regards,
Mike
3
2
Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by josealf＠rocketmail.com 03 May '11
by josealf＠rocketmail.com 03 May '11
03 May '11
Laurent,
Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting.
You can check:
1. Does your stunnel client config has client=yes?
2. Does your stunnel server config has client=no
3. Check your packet flow, that is: your accept/connect settings.
Regards
Jose
-----Original Message-----
From: laurent.uk(a)bnpparibas.com
Sender: stunnel-users-bounces(a)stunnel.org
Date: Tue, 3 May 2011 14:16:09
To: <stunnel-users(a)stunnel.org>
Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version
number with cipher DES-CBC-SHA
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
1
0