stunnel-users September 2022

10 participants
9 discussions

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

error:0A000126:SSL routines::unexpected eof while reading
by sburke＠unitedelectric.com 07 Nov '22

07 Nov '22

Hello, I am trying to get a system notification email back up and running after google disabled the "use less secure apps" functionality in the Gmail platform. I have set up the Gmail account to use an app password which I assigned to the system that was sending emails before this change. It appears the system is now connecting to Stunnel running on a windows 10 machine and Stunnel is making the connection with the Gmail server again, but no email actually gets sent out. I am running Stunnel 5.66 Here is the configuration currently: [gmail-smtp] client = yes accept = 25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.Gmail.com OCSPaia = yes Here is a copy of the log file: 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] accepted connection from 192.168.100.200:56399 2022.09.20 07:40:49 LOG5[0]: s_connect: connected 74.125.138.109:465 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] connected remote server from 172.16.4.220:60367 2022.09.20 07:40:49 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gtsr1" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gts1c3" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: Certificate accepted at depth=0: CN=smtp.gmail.com 2022.09.20 07:40:51 LOG3[0]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.09.20 07:40:51 LOG5[0]: Connection reset: 92 byte(s) sent to TLS, 620 byte(s) sent to socket Is this something I can remedy from the configuration, or is this something that requires modification on the email server side? Thank you sean

3 2

32-bit windows download
by Ágnes Kakasi 27 Sep '22

27 Sep '22

Hi, I'm looking for help to download and install Stunnel on a laptop with 32-bit Windows 7. I have downloaded the available download file from the website (stunnel-5.66-win64-installer.exe) but the computer indicates it cannot open the file. I tried to find info on this and in the platform sections I found Stunnel can run on 32-bit, as well, but I don't know how to make it work. Can you please advise me on what the correct download file is and how to install it so that it works on this computer? Thank you in advance. Agnes

2 1

error:0A000438:SSL routines::tlsv1 alert internal error
by johannwang＠ami.com 21 Sep '22

21 Sep '22

Hello, I am trying to use the xvncviewer on Ubuntu by VNC over stunnel, it will connect failed and print "xvncviewer: read: Connection reset by peer". The LOG on VNC server is here: 2012.01.01 00:21:58 LOG7[1]: Initializing application specific data for session authenticated 2012.01.01 00:21:58 LOG7[1]: SNI: no virtual services defined 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS read client hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write key exchange 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate request 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server done 2012.01.01 00:21:58 LOG7[1]: TLS alert (read): fatal: internal error 2012.01.01 00:21:58 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1584: error:0A000438:SSL routines::tlsv1 alert internal error 2012.01.01 00:21:58 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2012.01.01 00:21:58 LOG7[1]: Deallocating application specific data for session connect address 2012.01.01 00:21:58 LOG7[1]: Local descriptor (FD=3) closed 2012.01.01 00:21:58 LOG7[1]: Service [vnc] finished (0 left) I am running Stunnel 5.63 Here is the configuration currently: stunnel.conf on VNC client: cert = /home/server.pem key = /home/privkey.pem [VNC] client = yes accept = 127.0.0.1:5901 connect = 172.31.100.121:5901 sslVersion = all verifyChain = yes CAfile = /home/server.pem checkIP = 172.31.100.121 stunnel.conf on VNC server: cert = /conf/server.pem ;key = /conf/certs/privkey.pem setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:TCP_NODELAY=1 debug = 7 foreground = yes client = no ciphers=AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM sslVersion = TLSv1.2 [vnc] accept = :::5901 connect = 5900 verify = 3 CAfile = /conf/server.pem Is this something I can remedy from the configuration, or is this something that requires modification? Thank you Johan

1 0

v5.66: failing test 081
by Andreas Vetter 20 Sep '22

20 Sep '22

Hi, in open build system I get the following failing test, when building and testing stunnel 5.66: [ 45s] 081. Test IPv6 support [ 45s] [client] Read '2022.09.15 21:17:15 LOG6[0]: TLS fd: Connection reset by peer (104)' [ 45s] ...................................................................... failed Is this a stunnel problem or a problem with logging inside the build system? What can I do to get more verbose information during build? The test is working for a similar target OS (openSUSE_Tumbleweed) and not for this one (openSUSE:Factory). The difference is small, but sometimes not neglectible: openSUSE:Factory is the to be tested submissions, always in the flow. openSUSE_Tumbleweed is a tested working snapshot of Factory. Best regards, Andreas

1 1

stunnel 5.66 released
by Michał Trojnara 11 Sep '22

11 Sep '22

Dear Users, I have released version 5.66 of stunnel. ### Version 5.66, 2022.09.11, urgency: MEDIUM * New features - OpenSSL 3.0 FIPS Provider support for Windows. * Bugfixes - Fixed building on machines without pkg-config. - Added the missing "environ" declaration for BSD-based operating systems. - Fixed the passphrase dialog with OpenSSL 3.0. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 558178704d1aa5f6883aac6cc5d6bbf2a5714c8a0d2e91da0392468cee9f579c stunnel-5.66.tar.gz 5fccb2e4db0d2e3c1adb26c3906585ac545baf88226f4f539b2dc43fe418a3ef stunnel-5.66-win64-installer.exe 3b1e30e060e16f6aa9a8ad1b1a6ba1210c165bf76bd01e4734cb4537e0717c09 stunnel-5.66-android.zip Best regards, Mike

1 0

Stunnel Consulting
by Gary Jackson 10 Sep '22

10 Sep '22

I am looking for someone to assist with an stunnel configuration on windows that will accept TLS1.2 connections and then send them unencrypted to an IP and port. I would need to get it working within the next week or so and am available most times if scheduled. Thank you. Gary Jackson Sent from my mobile

2 1

TLS 1.2 traffic on STunnel
by Gary Jackson 08 Sep '22

08 Sep '22

Good afternoon, I am trying to use Stunnel to accept traffic from a custom application using TLS 1.2 and a self signed cert and then send it to a back end application unencrypted. I want the configuration to only affect one listener on Stunnel and not all incoming ports. I am using Stunnel v.5.6 I am confused with all the documentation and what needs to be set in the config file for this use case. The config file currently has connections where it accepts traffic on one port and then directs it to another port internally but not with TLS 1.2. Thank you for all your knowledge and insight! _________________________________ Gary Jackson | Senior Systems Engineer

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users September 2022