- stunnel-users - stunnel.org

Init script
by Alan Chester 29 Aug '13

29 Aug '13

Hello, I am currently working on using stunnel. I was wondering what everyones thoughts were on the creation of an init script for stunnel. This would help insure that the connections are brought up after a reboot. Or what is the best way to go about handling this? Thanks, Alan

2 1

no certificate available safari browser
by Scott McKeown 28 Aug '13

28 Aug '13

Hi Libin, If possible can you send over your STunnel config file but my guess would be that you would need to include your Root CA and Intermediate CA certificates into your PEM file. I would check to see what https://www.ssllabs.com/ssltest/analyze.html says about your certificates another quick test would be to have a look at http://www.digicert.com/help/ to see what they also say about the certificate chains. ~Scott Hi all, > > Sever OS: Linux/Centos 5.9 > SSLServer: Stunnel > ErrorMessage: no certificate available > CertType: SSL Web Server Certificate > Client Browser: Safari 5.1. > Client OS: OS X Lion > > When i am trying to hit the URL on safari browser it shows me the messages > "no certificate available" > No certificate meet the application . However, the same link is working > for all other browsers. Moreover, we have checked the stunnel logs, but > couldn't able to get any thing from the logs. > > Apache HTTPS config we have option *SSLVerifyClient none *in Stunnel I > have tried all option non of thing working. > * > * > Please help me.* * > > Thanks > Libin -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

3 2

stunnel 4.56 and 4.55 are not working on Android 4.3.1
by Mohsin Mirza 28 Aug '13

28 Aug '13

I tried both version of stunnel for android on Nexus 4 Build JWR66Y, Is it have to anything to do with SELinux or MAC secuirty model introduce by 4.3 It was working in initial 4.3 build OTA. root@mako:/system/bin # ./sh -c /system/xbin/stunnel root@mako:/system/bin # ________________________________________Disclaimer: This email and any attachments may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately by email and destroy this email. Any unauthorized copying, dissemination, disclosure or distribution of the material in this email is strictly forbidden. Unless expressly stated to the contrary, the sender of this email is not authorized by MBC to make any representations, negotiations or enter into any agreement on behalf of MBC. This e-mail message and any attached files have been scanned for the presence of computer viruses. However, it is the responsibility of the recipient to ensure that it is virus free; we accept no responsibility for any loss or damage arising in any way from its use.________________________________________

1 0

no certificate available safari browser
by Libindas 27 Aug '13

27 Aug '13

Hi Michal, Sever OS: Linux/Centos 5.9 SSLServer: Stunnel ErrorMessage: no certificate available CertType: SSL Web Server Certificate Client Browser: Safari 5.1. Client OS: OS X Lion When i am trying to hit the URL on safari browser it shows me the messages "no certificate available" No certificate meet the application . However, the same link is working for all other browsers. Moreover, we have checked the stunnel logs, but couldn't able to get any thing from the logs. Apache HTTPS config we have option *SSLVerifyClient none *in Stunnel I have tried all option non of thing working. * * Please help me.* * Thanks Libin

1 1

Re: [stunnel-users] Build failure for ARM32 with Yocto
by Ludolf Holzheid 23 Aug '13

23 Aug '13

On Thu, 2013-08-22 15:44:43 +0100, Laszlo Papp wrote: > On Thu, Aug 22, 2013 at 3:34 PM, Ludolf Holzheid < > lholzheid(a)bihl-wiedemann.de> wrote: > > > On Thu, 2013-08-22 14:43:55 +0100, Laszlo Papp wrote: > > > Here you can find the log file in question for details: > > > > > > [..] > > > > > > In file included from /usr//include/features.h:324:0, > > > from /usr//include/pthread.h:23, > > > from common.h:158, > > > from str.c:38: > > > > > /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/sysroots/foo/usr/include/bits/predefs.h:23:3: > > > error: #error "Never use <bits/predefs.h> directly; include > > <stdc-predef.h> > > > > Laszlo, > > > > Are you sure /usr//include is the right include directory for cross- > > compiling? I must confess, I'm not familiar with cross-compiling, but > > this looks fishy. > > > > Most certainly not, but other softwares get it right. I will assume that it > has something to do with how the Makefile is generated for stunnel. Got a > clue in that area? I would try to remove -I/usr//include (and -pedantic) from the compiler flags, but again, I'm no expert in autoconf and cross-compiling. Ludolf -- Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

3 3

REMOVE
by Bruce Edwards 22 Aug '13

22 Aug '13

Please remove me from your list server R. Bruce Edwards Communications Manager 1018 Pretlow St Franklin, VA 23851 bedwards(a)franklinpolice.org Office: 757-562-8696 Cell: 757-621-5295

1 0

Build failure for ARM32 with Yocto
by Laszlo Papp 22 Aug '13

22 Aug '13

Hi, if I build stunnel manually on my desktop machine (Archlinux), it works fine. However, when I am trying to use a Yocto/OE recipe for building it for my arm32 target, I am facing the issue below. Anyone any hint? Cheers, L. | /usr//include/linux/sysctl.h:836:20: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:849:12: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:892:31: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:897:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:912:26: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:917:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:928:20: warning: comma at end of enumerator list [-pedantic] | In file included from /usr//include/linux/netfilter_ipv4.h:8:0, | from common.h:383, | from network.c:38: | /usr//include/linux/netfilter.h:58:18: warning: comma at end of enumerator list [-pedantic] | In file included from common.h:383:0, | from network.c:38: | /usr//include/linux/netfilter_ipv4.h:68:26: warning: comma at end of enumerator list [-pedantic] | make[2]: *** [stunnel-str.o] Error 1 | make[2]: *** Waiting for unfinished jobs.... | make[2]: *** [stunnel-network.o] Error 1 | make[2]: *** [stunnel-resolver.o] Error 1 | make[2]: *** [stunnel-protocol.o] Error 1 | make[2]: *** [stunnel-log.o] Error 1 | make[2]: *** [stunnel-file.o] Error 1 | make[2]: *** [stunnel-options.o] Error 1 | make[2]: *** [stunnel-client.o] Error 1 | make[2]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make[1]: *** [all] Error 2 | make[1]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make: *** [all-recursive] Error 1 | ERROR: oe_runmake failed | ERROR: Function failed: do_compile (see /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/temp/log.do_compile.10590 for further information) ERROR: Task 6 (/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile) failed with exit code '1' NOTE: Tasks Summary: Attempted 561 tasks of which 559 didn't need to be rerun and 1 failed. No currently running tasks (561 of 568) Summary: 1 task failed: /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile Summary: There was 1 ERROR message shown, returning a non-zero exit code.

2 3

Problem Selecting Only Ecliptic Curve Ciphers
by Carter Browne 07 Aug '13

07 Aug '13

I'm using stunnel 4.56 on Windows 7. When I use the following cipher list: ciphers = ECDHE-ECDSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-ECDSA-AES128-SHA to establish a connection, I get a "no shared cipher" response. The following set of ciphers does work: ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA Other relevant settings: options = NO_SSLv2 sslVersion = all fips = no verify = 2 If I take out the first ECDHE-RSA-ASE256-SHA cipher from the list, the ECDHE-RSA-AES128-SHA cipher is selected. What am I doing wrong? Thanks. -- Carter Browne cbrowne(a)cbcs-usa.com

2 1

Unable to make SSL connexion work
by OLIVER Patrice 07 Aug '13

07 Aug '13

Hi, Since our company had to migrate to Orange Office365 platform, we cannot send simple SMTP message using smtp.office365.com We have to use SMTP over TLS. While I have to use some applications which cannot use SMTP, I installed and setup STunnel. When I try to send a simple mail like this : telnet myserver 25 ehlo ch-lepuy.fr mail from: toto(a)ch-lepuy.fr I cannot continue with rcpt to syntax and I have the following message : rcpt to:530 5.7.1 Client was not authenticated In the STunnel log file, I can see that : 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): before/connect initialization 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): SSLv3 write client hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate request A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server done A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write certificate verify A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write change cipher spec A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write finished A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 flush data 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read finished A 2013.08.06 19:20:50 LOG7[1352:2832]: 1 items in the session cache 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects (SSL_connect()) 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 client renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects (SSL_accept()) 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 external session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache misses 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache timeouts 2013.08.06 19:20:50 LOG7[1352:2832]: Peer certificate was cached (6184 bytes) 2013.08.06 19:20:50 LOG6[1352:2832]: SSL connected: new session negotiated 2013.08.06 19:20:50 LOG6[1352:2832]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-SHA (256-bit encryption) 2013.08.06 19:20:50 LOG6[1352:2832]: Compression: null, expansion: null 2013.08.06 19:21:13 LOG3[1352:2832]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2013.08.06 19:21:13 LOG5[1352:2832]: Connection reset: 65 byte(s) sent to SSL, 231 byte(s) sent to socket 2013.08.06 19:21:13 LOG7[1352:2832]: Remote socket (FD=316) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Local socket (FD=244) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Service [SMTP Outgoing] finished (0 left) Here is my STunnel setup : client = yes output = stunnel-log.txt debug = 7 taskbar = yes ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 Does anyone have an idea ? Regards? Patrice Oliver | Centre Hospitalier Emile Roux Responsable Informatique T. 04 71 04 38 30 12 Bd Andr? Chantemesse - 43012 LE PUY EN VELAY Cedex http://www.ch-lepuy.fr

3 3

Disable SSL session ticket
by dansmith 06 Aug '13

06 Aug '13

Hi, when connecting a stunnel client to a stunnel server, is it possible to disable the use of SSL session tickets? I need to be able to decrypt the stunnel traffic in wireshark. Unfortunately, wireshark still doesn't support SSL session tickets.

2 1