stunnel-users November 2022

8 participants
9 discussions

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Setup and Installing stunnel on windows wsl2 Ubuntu
by adamsaltlake＠hotmail.com 25 Nov '22

25 Nov '22

I am new to stunnel and have been struggling for weeks to get it to work on windows wsl2 ubuntu; it keep failing with pid error "You should check that you have specified the pid= in you configuration file" any idea is welcome

1 0

Self signed certificate check
by Bob Bob 20 Nov '22

20 Nov '22

Hi, I have two Windows based stations with one hosting a specific service. Stunnel is used to create a secure connection. As stated on the auth page, I have implemented PSK to prevent MITM Attack but also as a way to authenticate connections and limit who can connect to the server. I would like to add an extra layer of security by having the Server only accept connections when the client submits a pre-agreed self cert. verifyPeer does not seem to work with self certificate. I would like to end up with PSK + certificate check. Is there a way to achieve that with self certificate on Stunnel? Thanks.

1 0

Windows 10 Pro - StartService: error 1053
by jason99si＠gmail.com 11 Nov '22

11 Nov '22

I'm installing stunnel for a second time. I'm using it for Blue Iris on a Windows 10 Pro machine. I'm using stunnel 5.67 on Win64. GUI shows "Configuration successful". I've tried uninstalling and reinstalling numerous times. When I run stunnel Service Start I receive a dialog box that says: stunnel 5.67 on Win64 (not configured) StartService: error 1053: The service did not respond to the start or control request in a timely fashion Can anyone help?

2 2

Two certificates on same connection
by perisnagini＠gmail.com 07 Nov '22

07 Nov '22

hi, I am into implementations and generally use stunnel with a certification provided by our third party connections in stunnel for encryption/ decryption both ways. Recently we had a query from one of our vendors stating we must use one cert to encrypt which they will decrypt using the key provided by us and they will encrypt which must be decrypted using the key provided. Keeping it simple we have below: Client Key - clt.pem Client cert - clt.cer Vendor key - vndr.pem our ca certs - ca-cert.pem Could anyone help me in understanding how do I leverage vendor key for decrypting and clt key for encrypting in stunnel.conf using the above certs. Many Thanks.

1 0

error:0A000126:SSL routines::unexpected eof while reading
by sburke＠unitedelectric.com 07 Nov '22

07 Nov '22

Hello, I am trying to get a system notification email back up and running after google disabled the "use less secure apps" functionality in the Gmail platform. I have set up the Gmail account to use an app password which I assigned to the system that was sending emails before this change. It appears the system is now connecting to Stunnel running on a windows 10 machine and Stunnel is making the connection with the Gmail server again, but no email actually gets sent out. I am running Stunnel 5.66 Here is the configuration currently: [gmail-smtp] client = yes accept = 25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.Gmail.com OCSPaia = yes Here is a copy of the log file: 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] accepted connection from 192.168.100.200:56399 2022.09.20 07:40:49 LOG5[0]: s_connect: connected 74.125.138.109:465 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] connected remote server from 172.16.4.220:60367 2022.09.20 07:40:49 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gtsr1" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gts1c3" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: Certificate accepted at depth=0: CN=smtp.gmail.com 2022.09.20 07:40:51 LOG3[0]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.09.20 07:40:51 LOG5[0]: Connection reset: 92 byte(s) sent to TLS, 620 byte(s) sent to socket Is this something I can remedy from the configuration, or is this something that requires modification on the email server side? Thank you sean

3 2

Re: stunnel 5.67 released
by Rok Berlec 07 Nov '22

07 Nov '22

Hi, When we install version 5.67 we sometimes get the message: "The procedure entry point OPENSSL_strcasecmp could not be located" After start of service everything looks fine. We upgrade by uninstalling the previous version and installing the latest one. Best regards, Rok Berlec

1 0

stunnel 5.67 released
by Michał Trojnara 01 Nov '22

01 Nov '22

Dear Users, I have released version 5.67 of stunnel. ### Version 5.67, 2022.11.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.7. * New features - Provided a logging callback to custom engines. * Bugfixes - Fixed "make cert" with OpenSSL older than 3.0. - Fixed the code and the documentation to use conscious language for SNI servers (thx to Clemens Lang). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3086939ee6407516c59b0ba3fbf555338f9d52f459bcab6337c0f00e91ea8456 stunnel-5.67.tar.gz a6bdc2a735eb34465d10e3c7e61f32d679ba29a68de8ea8034db79c0c8b328a3 stunnel-5.67-win64-installer.exe 893f53d6647900eb34041be8f21a21c052a31de3fb393a97627021a1ef2752f5 stunnel-5.67-android.zip Best regards, Mike

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users November 2022