- stunnel-users - stunnel.org

Using CAStore on Android (stunnel.conf)
by smf.forum1＠ntlworld.com 31 Jul '25

31 Jul '25

I have build stunnel with a few changes to run in a QThread (Qt 6.9.1) for Android. My Qt App starts stunnel at the start of execution and stops it when my Qt application exits. This all works fine (I need to review and clean up my stunnel changes before I use my solution for real) but I cannot get certification to work, here are two test runs one with verify set to 0 (works) and verify set to 2 (fails). What needs to change in my stunnel.conf file ? Thanks. (obfuscated details) stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 0 Works: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b640 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] needs authentication to prevent MITM attacks I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=117) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:36802 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:58660 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate not required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: OCSP: Certificate chain verification disabled I/stunnel : LOG6[0]: TLS connected: new session negotiated I/stunnel : LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) I/stunnel : LOG6[0]: Peer temporary key: X25519, 253 bits I/stunnel : LOG6[0]: Session id: 90DD6325CCBC47C3F8F560C36F76755B4959E6A8421DD97B751E37FDD1DCCAC7 I/stunnel : LOG6[0]: Session id: 24345E21753FE3B254CA089FB7621C1481B523E72EB9571DDF7A366B5E89E834 stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 2 Fails: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b0a0 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] uses "verifyChain" without subject checks W/stunnel : LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=114) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:39238 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:59154 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[0]: CERT: Pre-verification error: certificate not found in local repository: self-signed certificate W/stunnel : LOG4[0]: Rejected by CERT at depth=0: C=PL, ST=Mazovia Province, L=Warsaw, O=Stunnel Developers, OU=Provisional CA, CN=localhost E/stunnel : LOG3[0]: SSL_connect: tls_post_process_server_certificate@ssl/statem/statem_clnt.c:1890: error:0A000086:SSL routines::certificate verify failed I/stunnel : LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket I/stunnel : LOG6[ui]: Child process 17669 finished with code 0

1 0

Android Stunnel 64bit version
by emxacademy＠gmail.com 18 Jul '25

18 Jul '25

Hello everyone, I've been searching online but still haven’t found a clear or working method to build a 64-bit version of the Android stunnel executable. Since most Android devices now run on 64-bit architecture, the 32-bit version available on the official website no longer works on many phones. If anyone has experience with this or can guide me through the proper way to compile a 64-bit version, I’d really appreciate your help. Thanks in advance!

1 0

Error message when trying to set Stunnel as a start up app
by Edward Smithson 18 Jul '25

18 Jul '25

Hello Stunnel mailing list, We are trying to set Stunnel (5.75) to automatically open as a start up app on Windows 11. When the PC powers up, it gives this error message: stunnel.exe - System Error The code execution cannot proceed because libcrypto-3-x64.dll was not found. Reinstalling the program may fix this problem. We have tried reinstalling, but to no avail. NB, Stunnel works fine if opened manually. This was not an issue with Windows 10. Has anyone else had this problem (and solved it)? Many thanks, Ed Smithson Ed Smithson Reader Services Librarian Nuffield College, Oxford, OX1 1NF +44(0) 1865 278551 [cid:[email protected]]<https://bsky.app/profile/nuffieldlibrary.bsky.social>[cid:[email protected]]<https://www.facebook.com/NuffieldCollegeLibrary>[cid:[email protected]]<https://www.instagram.com/nuffieldlibrary/> [cid:[email protected]]<https://www.nuffield.ox.ac.uk/>

5 6

stunnel with aurora postgreSQL
by Grube, Rolf | Oberender AG 25 Jun '25

25 Jun '25

Hi everybody, Does anybody has already established a connection to AWS aurora postgreSQL with stunnel? I cant establish a connection and it may be an issue with channel binding. My config looks like this: ; Sample stunnel configuration file for Win64 by Michal Trojnara 1998-2025 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance fips = yes ; The CNG engine allows to integrate stunnel with the Windows Cryptography API: ; Next Generation (CNG) for authentication with private keys stored in the ; Windows certificate store. It serves as a drop-in replacement for the legacy ; OpenSSL Cryptography API (CAPI) engine. ; https://www.stunnel.org/cng-engine.html ; Each section using this feature also needs the "engineId = cng" option engine = cng ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** [postgreSQL_TLS] client = yes ;engineId = cng accept = 5433 connect = xxx.rds.amazonaws.com:5432 protocol = pgsql CAfile = C:\cert\xxx-bundle.pem verifyChain = yes checkHost = xxx.rds.amazonaws.com Thanks for any recommendations. Best regards Rolf Grube, MBA Senior Manager <https://www.credly.com/badges/443267d6-0d25-4fc3-9eee-f9654f6f3ee1/public_u rl> Oberender AG Elsenheimerstraße 59 | 80687 München t: +49 89 8207516-0 | m: +49 173 2035 133 <mailto:[email protected]> rolf.grube(a)oberender.com <http://www.oberender.com/> www.oberender.com Vorsitzender des Aufsichtsrats: Dipl.-Volkswirtin Irmtraut Gürkan Vorstand: Jan Hacker (Vorsitzender), Jochen Baierlein Handelsregister: Amtsgericht Bayreuth, HRB 4267 Sitz der Gesellschaft: Bayreuth Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren, sowie die unbefugte Weitergabe dieser Mail sind nicht gestattet.

1 0

Duplicate Received trusted client CA messages
by Sean Burford 18 Jun '25

18 Jun '25

Hi, While configuring stunnel to connect as a client to a TLS server that requires client certificate auth (known as mutual TLS auth), I noticed that each new connection generates lots (up to hundreds) of duplicate logs like: 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA I expect one log per trusted client CA provided by the server. Openssl s_client -msg shows that the server only sends a small CertificateRequest. Stunnel logs show that only one connection is made. This only happens if the server offers exactly one trusted client CA. If multiple client CA options are offered by the server then a single log entry is recorded for each. What appears to be happening is that OpenSSL’s state machine generates lots of info callbacks (the number depends on latency). This appears to be harmless except for the excessive logging. I’m running stunnel 5.75 against OpenSSL 3.5.0 (compiled with enable-weak-ssl-ciphers, enable-ssl3 and enable-ssl3-method): $ stunnel [ ] Initializing inetd mode configuration [ ] Clients allowed=125 [.] stunnel 5.75 on sparc-sun-solaris2.10 platform [.] Compiled/running with OpenSSL 3.5.0 8 Apr 2025 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*(___errno())) … $ openssl version OpenSSL 3.5.0 8 Apr 2025 (Library: OpenSSL 3.5.0 8 Apr 2025) This is probably NOT caused by an OpenSSL 3.5.0 behaviour change, I also see duplicate messages from the public stunnel build running on Windows: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.74 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.3.2 3 Sep 2024 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) To diagnose this further, I modified stunnel src/ctx.c info_callback() to log the TLS state in callbacks: //#if 0 // s_log(LOG_DEBUG, "state = %x", state); state_string=SSL_state_string_long(ssl); s_log(LOG_DEBUG, "TLS state (where %08X state %08X): %s", where, state, state_string); //#endif This shows that there are many callbacks from where SSL_CB_ACCEPT_EXIT and one final callback from SSL_CB_ACCEPT_LOOP: 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001001 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate request Modifying info_callback to look for SSL_CB_LOOP in where suppresses the excess messages: /* log the client certificate request (if received) */ #ifndef SSL3_ST_CR_CERT_REQ_A if(state==TLS_ST_CR_CERT_REQ && *where & SSL_CB_LOOP*) #else if(state==SSL3_ST_CR_CERT_REQ_A && *where & SSL_CB_LOOP*) #endif print_CA_list("Received trusted client CA", SSL_get_client_CA_list(ssl)); Here’s my config: debug=info [outbound-http-to-https-mtls] accept = 127.0.0.1:8447 connect = 127.0.0.1:8445 client = yes ; verify 2 - verify peer certificate chain verify = 2 sni = www.example.com checkHost = www.example.com verifyChain = yes CAfile = /export/home/user/stunnel/trusted-ca-certs.pem ; Authenticate ourselves to peer using a client certificate. cert = /export/home/user/stunnel/user.ecdsa-p256.pem key = /export/home/user/stunnel/user.ecdsa-p256.key -- Thanks, Sean Burford

1 0

[PATCH 0/3] Improve stunnel performance by ~17%
by Edwin Torok 12 Jun '25

12 Jun '25

Hello, Flamegraph profiling on stunnel has shown that most time is NOT spent in encryption/decryption, but in sending/receiving data. Experimental setup: ``` CPU: 2x 18-core Intel Xeon Gold 6354 NIC: Intel E810-XXV, 100 Gbit/s Kernel: 6.14.8-300.fc42.x86_64 x86_64 Mem: 251.32 GiB OS: Fedora Linux 42 openssl version: OpenSSL 3.2.4 11 Feb 2025 (Library: OpenSSL 3.2.4 11 Feb 2025) stunnel: 5.75 from git ``` Network, encryption and memory copy speeds converted into Gbit/s on the above HW: ``` iperf3: 40Gbit/s openssl speed -evp aes-256-gcm: 72Gbit/s perf bench memcpy: 100Gbit/s ``` Under ideal conditions we should be able to achieve at most ~20.5Gbit/s, however I only measured ~7.6Gbit/s. The scripts that I used to perform measurements are included in the attached patch 3. See also related discussion on curl: https://github.com/curl/curl/pull/17548 Enabling readahead, avoiding excessive alloc/free of buffers, increasing buffer sizes, and improving buffer handling can all improve performance. For now I'm sending just the first small patches as proofs of concept, each of them one-liners. I hope you can include these in some form in the next release. Eventually these should probably be exposed as configuration flags in stunnel.conf, I can help implementing that, or I can leave implementing that to you if you prefer. In fact readahead was enabled in previous versions of stunnel, and then disabled again, so I assume you ran into some bugs with it on certain protocols? Increasing the buffer size is not a clear win (as with curl), due to the excessive use of memmove/memset, and that SSL_read/SSL_write only still processes 1 TLS record at a time. I have some further changes that can improve that, but the patches are larger and I haven't finished testing them for correctness yet. Please let me know if you'd want these as patches, or if you'd rather implement them yourself. Edwin Török (3): openssl: enable readahead openssl: disable SSL_MODE_RELEASE_BUFFERS Benchmark scripts src/ctx.c | 5 +- tests/benchmark/benchmark.sh | 120 +++++++++++++++++++++++ tests/benchmark/launch.sh | 185 +++++++++++++++++++++++++++++++++++ 3 files changed, 309 insertions(+), 1 deletion(-) create mode 100644 tests/benchmark/benchmark.sh create mode 100755 tests/benchmark/launch.sh -- 2.43.5

4 6

Is TLS 1.2 supported with stunnel 5.01
by joverton＠vital-soft.com 01 Jun '25

01 Jun '25

I have searched online, but was unable to fine any definitive answer on the minimum version of stunnel required for TLS 1.2. I have a client using stunnel 5.01 with our solution and they want to activate TLS 1.2. Their setup looks like this: 2014.05.15 13:38:22 LOG5[10132]: stunnel 5.01 on x86-pc-msvc-1500 platform 2014.05.15 13:38:22 LOG5[10132]: Compiled/running with OpenSSL 1.0.1g-fips 7 Apr 2014 2014.05.15 13:38:22 LOG5[10132]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2014.05.15 13:38:22 LOG5[10132]: Reading configuration from file stunnel.conf 2014.05.15 13:38:22 LOG5[10132]: FIPS mode disabled 2014.05.15 13:38:22 LOG5[10132]: Configuration successful Everything works fine without requiring TLS 1.2, but when that is required, we get the following error: 2025.05.14 07:04:45 LOG7[3796]: SSL state (connect): before/connect initialization 2025.05.14 07:04:45 LOG7[3796]: SSL state (connect): SSLv3 write client hello A 2025.05.14 07:04:45 LOG7[3796]: SSL alert (read): fatal: protocol version 2025.05.14 07:04:45 LOG3[3796]: SSL_connect: 1409442E: error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version 2025.05.14 07:04:45 LOG5[3796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2025.05.14 07:04:45 LOG7[3796]: Remote socket (FD=840) closed 2025.05.14 07:04:45 LOG7[3796]: Local socket (FD=832) closed - Do we need to change anything in stunnel.conf? - Do we need to upgrade stunnel? Many Thanks, John

4 5

Re: stunnel 5.75 released
by Christian Ullrich 28 May '25

28 May '25

* Michal Trojnara wrote: > I have released version 5.75 of stunnel. > > ### Version 5.75, 2025.05.26, urgency: MEDIUM Hello, why does the Windows release include "libgcc_s_seh-1.dll"? I cannot find anything that uses it, and a basic configuration works without any attempts to load it. I went to some lengths to find indications it might be loaded dynamically, but found nothing. Thanks, -- Christian

2 1

stunnel 5.75 released
by Michał Trojnara 26 May '25

26 May '25

Dear Users, I have released version 5.75 of stunnel. ### Version 5.75, 2025.05.26, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.4.1. - OpenSSL FIPS Provider updated to version 3.1.2. * Bugfixes - Fixed infinite loop triggered by OCSP URL parsing errors (thx to Richard Könning for reporting). - Fixed OPENSSL_NO_OCSP build issues (thx to Dmitry Mostovoy for reporting). - Fixed default curve selection in FIPS mode with OpenSSL 3.4+. - Fixed tests with modern Python versions. - Fixed tests with multiple OpenSSL versions installed. * Features - Added provider URI support for "cert" and "key" options. - Added new "CAstore" service-level option (OpenSSL 3.0+). - Added "provider" (OpenSSL 3.0+), "providerParameter" (OpenSSL 3.5+), and "setEnv" global options. - Key file/URI path added to passphrase prompt on Unix. - PKCS#11 provider installed on Windows. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0c1ef0ed85240974dccb94fe74fb92d6383474c7c0d10e8796d1f781a3ba5683 stunnel-5.75.tar.gz 18ec3b83bda9143c79479ecdc1e3ecf515eeb8a8b11e6ea3a6856cd77399317d stunnel-5.75-win64-installer.exe d1a04ec51840d8cbf5fb6d897d2eb999af573b5b66268fdec109cddaff2acfb7 stunnel-5.75-android.zip Best regards, Mike

1 0

Preserving Client IP Address
by atritium＠hushmail.com 21 May '25

21 May '25

Has anyone followed the stunnel man page instructions and been able to successfully pass/preserve the connecting client's original IP address? Checking history on this issue back to 2010, it looks people with problems, no reports of success. Though it seems so fundamental, you would hope it was smooth as the man page indicates For example, I set up an iptables 'mangle' table for DIVERT routing, ip rule, ip route, etc, for the server as given in the stunnel man page for a Red Hat 8 system. When the stunnel server is then also configured with "transparent = source" and restarted, the remote-initiated connection -hangs- without connecting for a few seconds before closing. Take out "transparent = source" from the server config, and the connection works successfully (though the client IP address is not available to applications). Logs are the same up until the point (shown below), which shows the "hanging/failed" case timing out after reporting "Cannot assign an AF=2 address an AF=10 socket". Don't know what the "Cannot assign AF ..." refers to, or how to address it, but the process goes downhill and hangs after that. 7111 is the open port stunnel is monitoring. 2025.05.21 10:07:16 LOG7[0]: Cannot assign an AF=2 address an AF=10 socket 2025.05.21 10:07:16 LOG6[0]: IP_TRANSPARENT socket option set 2025.05.21 10:07:16 LOG6[0]: bind succeeded on the original port 2025.05.21 10:07:16 LOG6[0]: s_connect: connecting 127.0.0.1:7111 2025.05.21 10:07:16 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:7111: waiting 10 seconds 2025.05.21 10:07:16 LOG7[0]: FD=6 events=0x2001 revents=0x0 2025.05.21 10:07:16 LOG7[0]: FD=11 events=0x2005 revents=0x1 2025.05.21 10:07:26 LOG3[0]: s_connect: s_poll_wait 127.0.0.1:7111: TIMEOUTconnect exceeded 2025.05.21 10:07:26 LOG3[0]: No more addresses to connect 2025.05.21 10:07:26 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.05.21 10:07:26 LOG7[0]: local_rfd/local_wfd reset (FD=3) 2025.05.21 10:07:26 LOG7[0]: Local descriptor (FD=3) closed 2025.05.21 10:07:26 LOG7[0]: Service [TLS SERVER] finished (0 left) The log for the successful case when "transparent = source is NOT specified in server config) instead says: 2025.05.21 09:59:58 LOG6[0]: s_connect: connecting ::1:7111 2025.05.21 09:59:58 LOG7[0]: s_connect: s_poll_wait ::1:7111: waiting 10 seconds 2025.05.21 09:59:58 LOG7[0]: FD=6 events=0x2001 revents=0x0 2025.05.21 09:59:58 LOG7[0]: FD=11 events=0x2005 revents=0x1 2025.05.21 09:59:58 LOG5[0]: s_connect: connected ::1:7111 2025.05.21 09:59:58 LOG6[0]: persistence: ::1:7111 cached 2025.05.21 09:59:58 LOG5[0]: Service [TLS SERVER] connected remote server from ::1:49806 2025.05.21 09:59:58 LOG7[0]: Setting remote socket options (FD=11) Any insight on what "Cannot assign an AF=2 address an AF=10 socket" is and how to fix it to preserve client IP address? stunnel is running as root, setuid is not used. I might not correctly understand the man page comment "This option is currently available in: Remote mode (connect option) on Linux >=2.6.28", but think it means a normal external connection request. Hopefully not a special configuration on the client side.

1 0

SSL_CTX_load_verify_locations: Peer suddenly disconnected
by lynn9a＠yahoo.com 13 May '25

13 May '25

Hi, All When we try to start stunnel(stunnel 5.67, wolfSSL5.6.4 on linux), there is an error randomly happened like following, anybody knows why this happen and how to fix this? Thanks May 9 09:09:01 [ ] Initializing inetd mode configuration May 9 09:09:01 [ ] Clients allowed=500 May 9 09:09:01 [.] stunnel 5.67 on arm-oe-linux-gnueabi platform May 9 09:09:01 [.] Compiled/running with wolfSSL 5.6.4 May 9 09:09:01 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:OCSP,PSK,SNI May 9 09:09:01 [ ] errno: (*__errno_location ()) May 9 09:09:01 [ ] Initializing inetd mode configuration May 9 09:09:01 [.] Reading configuration from file /opt/config/stunnel.conf May 9 09:09:01 [.] UTF-8 byte order mark not detected May 9 09:09:01 [ ] No PRNG seeding was required May 9 09:09:01 [ ] Initializing service [xxxHost] May 9 09:09:01 [ ] stunnel default security level set: 2 May 9 09:09:01 [ ] Ciphers: TLS_AES_256_GCM_SHA384 May 9 09:09:01 [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 May 9 09:09:01 [ ] TLS options: 0x4D474C4C003000 (+0x0, -0x0) May 9 09:09:01 [ ] Session resumption enabled May 9 09:09:01 [ ] Loading certificate from file: ./config/client.pem May 9 09:09:01 [ ] Certificate loaded from file: ./config/client.pem May 9 09:09:01 [ ] Loading private key from file: ./config/client.key May 9 09:09:01 [:] Insecure file permissions on ./config/client.key May 9 09:09:01 [ ] Private key loaded from file: ./config/client.key May 9 09:09:01 [ ] Private key check succeeded May 9 09:09:01 [!] SSL_CTX_load_verify_locations: Peer suddenly disconnected May 9 09:09:01 [!] Service [xxxHost]: Failed to initialize TLS context May 9 09:09:01 [!] Configuration failed May 9 09:09:01 [ ] Deallocating temporary section defaults May 9 09:09:01 [ ] Deallocating section [xxxHost]

3 2

Using intermediate CA as a trust anchor in stunnel
by Vít Holásek 30 Mar '25

30 Mar '25

Hi, I'm trying to setup stunnel to trust only certificates issued by intermediate CA and not other CAs issues by the same root CA. I came across this discussion about the same topic: https://www.stunnel.org/ mailman3/hyperkitty/list/stunnel-users(a)stunnel.org/thread/DUF6C6 BRNFVAWVCDIGXPUDTAPZR5KV5W/. I tested described options but it always authenticates also other sub CAs, because the whole chain must be always supplied in configured CAfile or CApath. In my opinion, the proper solution would be to add "partial chain" OpenSSL configuration option to stunnel config. This would allow admin to decide how intermediate CA will be verified. What do you think about that? See corresponding OpenSSL issue: https://github.com/openssl/openssl/issues/ 7871. Thanks Vit

1 0

stunnel - client conexion close by TLS alert (write) fatal decode error
by Rodigo Alvarez 07 Mar '25

07 Mar '25

Hi All! I would appreciate any clue to solve the problem we are having with a client mode service that stopped working this week (we verified that the service works directly without stunnel). The error I identify in the trace is the following: "TLS alert (write): fatal: decode error" Stunnel Config (windows version): [afip-prod-fce] client = yes accept = ARSASSRV4DMS06:1031 connect = serviciosjava.afip.gob.ar:443 debug = 7 ws: https://serviciosjava.afip.gob.ar/wsfecred/FECredService Complete trace: 2024.01.24 09:28:46 LOG5[main]: stunnel 5.71 on x64-pc-mingw32-gnu platform 2024.01.24 09:28:46 LOG5[main]: Compiled/running with OpenSSL 3.1.3 19 Sep 2023 2024.01.24 09:28:46 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2024.01.24 09:28:46 LOG5[main]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2024.01.24 09:28:46 LOG5[main]: UTF-8 byte order mark detected 2024.01.24 09:28:46 LOG5[main]: FIPS mode disabled 2024.01.24 09:28:46 LOG4[main]: Service [afip-prod-fce] needs authentication to prevent MITM attacks 2024.01.24 09:28:46 LOG5[main]: Configuration successful 2024.01.24 09:29:23 LOG7[0]: Service [afip-prod-fce] started 2024.01.24 09:29:23 LOG7[0]: Setting local socket options (FD=892) 2024.01.24 09:29:23 LOG7[0]: Option TCP_NODELAY set on local socket 2024.01.24 09:29:23 LOG5[0]: Service [afip-prod-fce] accepted connection from 10.70.162.24:57723 2024.01.24 09:29:23 LOG6[0]: s_connect: connecting 200.1.116.19:443 2024.01.24 09:29:23 LOG7[0]: s_connect: s_poll_wait 200.1.116.19:443: waiting 10 seconds 2024.01.24 09:29:23 LOG7[0]: FD=896 ifds=rwx ofds=--- 2024.01.24 09:29:24 LOG5[0]: s_connect: connected 200.1.116.19:443 2024.01.24 09:29:24 LOG5[0]: Service [afip-prod-fce] connected remote server from 10.72.0.69:64788 2024.01.24 09:29:24 LOG7[0]: Setting remote socket options (FD=896) 2024.01.24 09:29:24 LOG7[0]: Option TCP_NODELAY set on remote socket 2024.01.24 09:29:24 LOG7[0]: Remote descriptor (FD=896) initialized 2024.01.24 09:29:24 LOG6[0]: SNI: sending servername: serviciosjava.afip.gob.ar 2024.01.24 09:29:24 LOG6[0]: Peer certificate not required 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): before SSL initialization 2024.01.24 09:29:24 LOG7[0]: Initializing application specific data for session authenticated 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2024.01.24 09:29:24 LOG6[0]: CERT: Certificate verification disabled 2024.01.24 09:29:24 LOG6[0]: CERT: Certificate verification disabled 2024.01.24 09:29:24 LOG6[0]: CERT: Certificate verification disabled 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2024.01.24 09:29:24 LOG7[0]: OCSP stapling: Client callback called 2024.01.24 09:29:24 LOG6[0]: OCSP: Certificate chain verification disabled 2024.01.24 09:29:24 LOG6[0]: Client certificate not requested 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2024.01.24 09:29:24 LOG7[0]: New session callback 2024.01.24 09:29:24 LOG7[0]: Peer certificate was cached (6643 bytes) 2024.01.24 09:29:24 LOG6[0]: Session id: D63C79766AC02C9A3E8494AD528954A183E9F7C250856695BA05C16A2219A4B3 2024.01.24 09:29:24 LOG7[0]: 1 client connect(s) requested 2024.01.24 09:29:24 LOG7[0]: 1 client connect(s) succeeded 2024.01.24 09:29:24 LOG7[0]: 0 client renegotiation(s) requested 2024.01.24 09:29:24 LOG7[0]: 0 session reuse(s) 2024.01.24 09:29:24 LOG6[0]: TLS connected: new session negotiated 2024.01.24 09:29:24 LOG6[0]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2024.01.24 09:29:24 LOG6[0]: Peer temporary key: ECDH, P-256, 256 bits 2024.01.24 09:29:24 LOG7[0]: Compression: null, expansion: null 2024.01.24 09:29:24 LOG7[0]: Remove session callback 2024.01.24 09:29:24 LOG7[0]: TLS alert (write): fatal: decode error 2024.01.24 09:29:24 LOG6[0]: TLS socket closed (SSL_read) 2024.01.24 09:29:24 LOG7[0]: Sent socket write shutdown 2024.01.24 09:29:24 LOG5[0]: Connection closed: 1755 byte(s) sent to TLS, 634 byte(s) sent to socket 2024.01.24 09:29:24 LOG7[0]: Remote descriptor (FD=896) closed 2024.01.24 09:29:24 LOG7[0]: Local descriptor (FD=892) closed 2024.01.24 09:29:24 LOG7[0]: Service [afip-prod-fce] finished (0 left) Thank you! Kind regards, Rodrigo.

3 3

stunnel warning: SSL_accept: ../ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number
by Marcel de Rooy 23 Jan '25

23 Jan '25

Hi, Taking this opportunity to ask a question on the mentioned warning. In our stunnel setup (stunnel server in a Docker container on Linux, version 5.68 and windows clients on version 5.73, no certificate verification) I am seeing every minute the following lines in stunnel.log on the server side: 2025.01.20 04:12:27 LOG5[0]: Service [siptest] accepted connection from 172.20.23.1:46658 2025.01.20 04:12:27 LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number 2025.01.20 04:12:27 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is every minute, so 04:13:27 again, etc. The warning is there already shortly after container restart without active connections to our SIP devices. I only see it recently. And changing the server/client config with sslVersionMin = TLSv1.2 and sslVersionMax = TLSv1.3 did not resolve it. Since it comes back every minute, I was thinking in the direction of keepalive settings. But do keep alives need encryption? Probably not. Is this just an innocent bug in the stunnel code or could I still do something in my configuration to clear the warn? Thank you for your attention. Marcel de Rooy Rijksmuseum Netherlands xxx

3 4

How do I setup stunnel + openvpn for android (I already have the server running, I just need a android client, Sslsocks isn't working for some reason for me.)
by sharifkashif224＠gmail.com 23 Jan '25

23 Jan '25

I've tried using Sslsocks but it keeps giving me an error called unexpected eof while reading. This occurs when I try to initiate a connection via OpenVPN in android.

1 0

How do I use the android zip file provided in the download section in the stunnel website for android
by sharifkashif224＠gmail.com 22 Jan '25

22 Jan '25

I want to try connecting my openvpn server thats wrapped around stunnel onto my phone, any help will be appreciated!

1 0

Re: stunnel log file fills up with errors very fast
by Alan M Varghese (Nokia) 22 Jan '25

22 Jan '25

After digging into this a bit further, I was able to confirm that these "retries" are not created by stunnel itself. Rather, stunnel is simply trying to forward the connection attempts from NFS. Changing the NFS mount's "timeo" and "retrans" parameters affects duration for which NFS attempts to connect to the server. Thanks, Alan M Varghese

1 0

stunnel log file fills up with errors very fast
by Alan M Varghese (Nokia) 19 Jan '25

19 Jan '25

Hello stunnel users, With stunnel (version: 5.71) setup and running (used to secure NFSv4 mounts), when the network interface is brought down, a huge number of messages are written to the log file (configured with the "output" option) in a very short amount of time. Below are some sample logs: 2025.01.19 14:19:58 LOG5[1044766]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.01.19 14:19:58 LOG5[1044767]: Service [xxxxx] accepted connection from 127.0.0.1:994 2025.01.19 14:19:58 LOG3[1044767]: s_connect: connect 192.168.x.xx:xxxx: Network is unreachable (101) 2025.01.19 14:19:58 LOG3[1044767]: No more addresses to connect 2025.01.19 14:19:58 LOG5[1044767]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.01.19 14:19:58 LOG5[1044768]: Service [xxxxx] accepted connection from 127.0.0.1:994 2025.01.19 14:19:58 LOG3[1044768]: s_connect: connect 192.168.x.xx:xxxx: Network is unreachable (101) 2025.01.19 14:19:58 LOG3[1044768]: No more addresses to connect ... This causes the log size to grow very quickly, sometimes overwhelming the filesystem. Log rotation alleviates this issue to some extent. But still, the archived logs would be filled with duplicate logs. This issue has been discussed by another user in the following thread: https://www.stunnel.org/mailman3/hyperkitty/list/[email protected]/… (Note, while the user in the thread above received "Connection refused" messages, here the error is "Network is unreachable". Otherwise, the behaviour with respect to logs is the same.) We would like to know if there is a way to control this connection behaviour from stunnel when "Network is unreachable" in such a manner. If not, is there a way to control/limit the log output from stunnel (without reducing the log level from default)? Steps to reproduce the issue: 1. Mount an NFSv4 filesystem using stunnel (configured to output logs to a file) 2. Bring down the network interfaces such that stunnel is not able to reach the configured server. (Please make sure to not lose access to the server while doing this.) 3. Wait ~300 seconds 4. Bring the interface(s) back up. 5. Examine the log size and contents. Thanks, Alan M Varghese

1 0

Issue with OCSP messages in stunnel 5.73 and above
by Alexander Moisseev 02 Jan '25

02 Jan '25

Hello, I am experiencing an issue with stunnel versions 5.73 and above where the server logs are continuously filled with the following message: "OCSP: SSL_get_certificate" This issue does not occur in version 5.72. I am using PSK for encryption and have not configured OCSP. Here are the details of my setup: [.] stunnel 5.74 on amd64-portbld-freebsd14.1 platform [.] Compiled with OpenSSL 3.0.13 30 Jan 2024 [.] Running with OpenSSL 3.0.15 3 Sep 2024 - Server configuration file: ``` setuid = stunnel setgid = nogroup pid = /var/run/stunnel/stunnel.pid [bayes] accept = 6478 connect = 6378 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt cert = /usr/local/etc/stunnel/cert.pem key = /usr/local/etc/stunnel/private.key [fuzzy] accept = 6477 connect = 6377 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt cert = /usr/local/etc/stunnel/cert.pem key = /usr/local/etc/stunnel/private.key ``` - Client configuration file: ``` setuid = stunnel setgid = nogroup pid = /var/run/stunnel/stunnel.pid [bayes] client = yes accept = localhost:6478 connect = host.example.org:6478 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt [fuzzy] client = yes accept = localhost:6477 connect = host.example.org:6477 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt ``` - Relevant log entries: ``` Dec 27 09:00:10 mx stunnel[22113]: LOG3[per-minute]: OCSP: SSL_get_certificate ``` As a temporary workaround, I generated a self-signed certificate and configured stunnel to use it. This has resolved the issue with OCSP messages. However, I believe this is not the intended behavior when using PSK without configuring OCSP. I would appreciate any help or guidance on how to properly configure stunnel to avoid this issue without requiring a self-signed certificate. Thank you, Alexander

3 4

STUNNEL Installation to Windows Failover Cluster
by John Pipolo 19 Dec '24

19 Dec '24

Hi Is there any documentation or how to on installing STUNNEL to a 2 node Windows failover cluster? thx

1 0

[Bug][5.73] stunnel segfault and coredump due to OCSP handling
by stunnel＠benary.org 15 Dec '24

15 Dec '24

Hi everyone, I've recently upgraded from NixOS 24.05 to 24.11 which went from stunnel 5.72 to 5.73 and have since had stunnel crash on me multiple times on different servers (pretty much identical setup however) due to what looks like a memory allocation race? Since 5.73 moved OCSP fetches to a thread, and the problem hasn't ever happened with 5.72 it sounds like an issue specific to that. Someone familiar with the codebase probably has a better idea of what's going on. Given that my updates happened somewhen mid last month and there have been no certificate renewals since (except for one that wouldn't affect the systems that were affected, thanks so much to crt.sh and CT existing) the error message of "OCSP routines::status expired" also seems out of place at least for the certificate itself (the staple may be expired, but stunnel should probably get a new one in that case which may have to do with the error in question). ``` Dec 06 04:43:02 shell stunnel[1124111]: LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: 2024.12.06 04:43:02 LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: 2024.12.06 04:43:02 LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: 2024.12.06 04:43:02 LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:56 shell stunnel[1124111]: LOG5[ui]: Log file reopened Dec 06 04:43:56 shell stunnel[1124111]: 2024.12.06 04:43:56 LOG5[ui]: Log file reopened Dec 06 04:44:02 shell stunnel[1124111]: LOG3[per-minute]: OCSP: OCSP_check_validity: crypto/ocsp/ocsp_cl.c:351: error:1380007D:OCSP routines::status expired Dec 06 04:44:02 shell stunnel[1124111]: 2024.12.06 04:44:02 LOG3[per-minute]: OCSP: OCSP_check_validity: crypto/ocsp/ocsp_cl.c:351: error:1380007D:OCSP routines::status expired Dec 06 04:44:02 shell stunnel[1124111]: 2024.12.06 04:44:02 LOG4[per-minute]: OCSP: Unknown verification status Dec 06 04:44:02 shell stunnel[1124111]: INTERNAL ERROR: Memory allocated in a different thread at ocsp.c, line 412 Dec 06 04:44:02 shell stunnel[1124111]: LOG4[per-minute]: OCSP: Unknown verification status Dec 06 04:44:02 shell stunnel[1124111]: INTERNAL ERROR: Memory allocated in a different thread at ocsp.c, line 412 Dec 06 04:44:02 shell systemd-coredump[282485]: Process 1124111 (stunnel) of user 988 terminated abnormally with signal 6/ABRT, processing... Dec 06 04:44:02 shell systemd[1]: Started Process Core Dump (PID 282485/UID 0). Dec 06 04:44:02 shell systemd-coredump[282486]: [🡕] Process 1124111 (stunnel) of user 988 dumped core. Module libgcc_s.so.1 without build-id. Module libcap.so.2 without build-id. Module stunnel without build-id. Stack trace of thread 1124120: #0 0x00007f9191c99a9c __pthread_kill_implementation (libc.so.6 + 0x92a9c) #1 0x00007f9191c47576 raise (libc.so.6 + 0x40576) #2 0x00007f9191c2f935 abort (libc.so.6 + 0x28935) #3 0x000056142e23e435 fatal_debug.cold (stunnel + 0xc435) #4 0x000056142e23eebc get_alloc_list_ptr (stunnel + 0xcebc) #5 0x000056142e23f0b9 str_detach_debug.part.0 (stunnel + 0xd0b9) #6 0x000056142e23f856 str_free_debug (stunnel + 0xd856) #7 0x000056142e259635 ocsp_stapling (stunnel + 0x27635) #8 0x000056142e25a18f per_minute_thread (stunnel + 0x2818f) #9 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #10 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676245: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 1124111: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e25b5f6 daemon_loop (stunnel + 0x295f6) #3 0x000056142e23e680 main (stunnel + 0xc680) #4 0x00007f9191c3127e __libc_start_call_main (libc.so.6 + 0x2a27e) #5 0x00007f9191c31339 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x2a339) #6 0x000056142e23e875 _start (stunnel + 0xc875) Stack trace of thread 1124119: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e250acd s_poll_sleep (stunnel + 0x1eacd) #3 0x000056142e25a21c per_second_thread (stunnel + 0x2821c) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676190: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 1124121: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e250acd s_poll_sleep (stunnel + 0x1eacd) #3 0x000056142e259fab per_day_thread (stunnel + 0x27fab) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676445: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676300: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676491: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) ELF object binary architecture: AMD x86-64 Dec 06 04:44:02 shell systemd[1]: stunnel.service: Main process exited, code=dumped, status=6/ABRT Dec 06 04:44:02 shell systemd[1]: stunnel.service: Failed with result 'core-dump'. Dec 06 04:44:02 shell systemd[1]: stunnel.service: Consumed 2min 11.812s CPU time, 21.6M memory peak, 19.6M memory swap peak, 50.9M read from disk, 47.1M written to disk, 587.2M incoming IP traffic, 588.8M outgoing IP traffic. ``` Note that stunnel is handling mTLS for my prometheus, which means that it is indeed getting hammered by one scrape per exporter at a time, which in this case would make exactly five scrapes per minute but all of them happening at the same time, which, if this is a race, does make me a lot more likely to hit this issue. Also a huge Thank You for building what has been an integral part of my infrastructure for almost a decade now.

3 4

stunnel 5.74 released
by Michał Trojnara 13 Dec '24

13 Dec '24

Dear Users, I have released version 5.74 of stunnel. ### Version 5.74, 2024.12.13, urgency: HIGH * Bugfixes - Fixed a stapling cache deallocation crash. - Fixed "redirect" with protocol negotiation. * Features - "protocolHost" support for "socks" protocol clients. - More detailed logs in OpenSSL 3.0 or later. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9bef235ab5d24a2a8dff6485dfd782ed235f4407e9bc8716deb383fc80cd6230 stunnel-5.74.tar.gz 8ce19cc782a64b0cacf32356249265ed16b3888e3578454853f5497726778d76 stunnel-5.74-win64-installer.exe 68c3395c1bebcc8b4eee2c7f58190aa2fe39b835dd7a4cce5ad37d5dfc1c5542 stunnel-5.74-android.zip Best regards, Mike

1 0

Stunnel on a windwos 11 pro installation not working
by ron.reijgwart＠gmail.com 09 Dec '24

09 Dec '24

I'm trying to use Stunnel on a windwos 11 pro installation. I tried version 5.56, 5.73 and 5.74b1. On my old pc all was working fine but now I get the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.73 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.3.2 3 Sep 2024 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [ssmtp] [ ] Initializing context [ssmtp] [ ] OpenSSL security level is used: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: C:\Program Files (x64)\stunnel\config\stunnel.pem [!] error queue: ssl/ssl_rsa.c:472: error:0A080002:SSL routines::system lib [!] error queue: crypto/bio/bss_file.c:300: error:10080002:BIO routines::system lib [!] SSL_CTX_use_certificate_chain_file: crypto/bio/bss_file.c:297: error:80000003:system library::No such process [!] Service [ssmtp]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Cleaning up context [(null)] [ ] Deallocating section [ssmtp] [ ] Cleaning up context [ssmtp] On a windows 10 Education installation it works fine with this logging: 2024.12.05 13:38:58 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2024.12.05 13:38:58 LOG5[service]: UTF-8 byte order mark detected 2024.12.05 13:38:58 LOG5[service]: FIPS mode disabled 2024.12.05 13:38:58 LOG4[service]: Service [ssmtp] needs authentication to prevent MITM attacks 2024.12.05 13:38:58 LOG5[service]: Configuration successful My conf-file looks like this: ;use it for client mode client = yes [ssmtp] accept = 1925 cert = C:\Program Files (x64)\stunnel\config\stunnel.pem connect = smtp.bhosted.nl:465 Can you please give me some advice?

2 2

Is it possible for stunnel to reject client connections if the server end cannot connect?
by mohmmad170720＠gmail.com 05 Dec '24

05 Dec '24

Hi all Say we have two machines set up, ClientPC and ServerPC. On ClientPC I run stunnel accepting a connection on a local port and connecting to an stunnel port on ServerPC. On ServerPC I run stunnel accepting a connection on the local stunnel port and connecting to the 'encryption unaware' server on another port on the same ServerPC machine. OK, pretty simple stuff so far. The problem is, when I connect to ClientPC with the 'encryption unaware' client app. then I always get a successful connection, even if there is no server running on ServerPC. Of course once the client has a successful connection, it then performs a write(), and that fails with 'Connection reset by peer'. Really, since there is no server running on ServerPC, I want the connect() to stunnel on ClientPC to fail. Is there a way to do this?

1 0

Router + Cudy mesh system
by trashrap22＠gmail.com 26 Nov '24

26 Nov '24

Hi, My stunnel setup was working. I since moved and had to add a Cudy mesh system / extension to the router to extend the internet through the building. Now I can't get stunnel to work again - I have done port forwarding on the Cudy system too. Has anyone done this extentions of router setup and got stunnel to work?

1 0

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Is it possible to hide "Acceptable client certificate CA names" during SSL handshaking?
by hshh 12 Nov '24

12 Nov '24

Since version 5.68, when stunnel is configured with verifyPeer=yes, CApath=/path and CAfile=/path/file, the 'Acceptable client certificate CA names' and required certificates are displayed during SSL handshaking. Is it possible to hide this information?

3 4

s_ssl_read_eof: SSL_ERROR_WANT_READ: Retrying
by stavultras＠gmail.com 07 Nov '24

07 Nov '24

Hello, i've encountered a very strange issue when you use stunnel 7.53 (doesn't matter actually, happens in 5.68 as well) like this: [server] accept = 443 protocol = socks [client] accept = 1080 protocol = socks connect = server:443 with iptables -A OUTPUT -p tcp -d 10.8.0.1 -j REDIRECT --to-ports 1080, I see in 95% cases in logs for every request from curl: curl http://10.8.0.1 (server's internal IP), however, it never happens if you use client like this: [client] accept = 1080 connect = server:443 and curl -x socks5://127.0.0.1:1080 http://10.8.0.1 (internal server's IP). Technically it affects nothing, but I still guess there's a small time overhead due to retry. Maybe i'm wrong. Please advise. Thanks.

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

socks mode doesn't verify peer
by stavultras＠gmail.com 05 Nov '24

05 Nov '24

Hello. I'm trying to configure "protocol = socks" with "redirect = 127.0.0.1:80" and "verifyPeer = yes", but accordingly to the debug logs stunnel doesn't verify peer when I'm trying to connect without client's certificate, for an example, from browser: https://192.168.200.131:9013/, where 192.168.200.131 is stunnel server. Config file: [socks] cert = /usr/local/etc/stunnel/server.pem CAfile = /usr/local/etc/stunnel/client.crt verifyPeer = yes redirect = 127.0.0.1:80 accept = 0.0.0.0:9013 protocol = socks Debug log: 2024.10.02 07:24:19 LOG6[9]: No peer certificate received 2024.10.02 07:24:19 LOG6[9]: Session id: AFA5F9CE2997328612F76E3B3572FE00C71C53ED31A98567E56DCC084EF580AD 2024.10.02 07:24:19 LOG7[9]: TLS state (accept): SSLv3/TLS write session ticket 2024.10.02 07:24:19 LOG6[9]: TLS accepted: new session negotiated 2024.10.02 07:24:19 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_128_GCM_SHA256 (128-bit encryption) 2024.10.02 07:24:19 LOG6[9]: Peer temporary key: X25519, 253 bits 2024.10.02 07:24:19 LOG7[9]: Compression: null, expansion: null 2024.10.02 07:24:19 LOG7[9]: Waiting for the SOCKS request 2024.10.02 07:24:19 LOG3[9]: Unsupported SOCKS version 0x47 2024.10.02 07:24:19 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket It tries to accept SOCKS info even without certificate and doesn't redirect to 127.0.0.1:80. In browser, I'm getting: Secure Connection Failed An error occurred during a connection to 192.168.200.131:9013. PR_CONNECT_RESET_ERROR Error code: PR_CONNECT_RESET_ERROR Can you check why it happens? Thank you.

1 9

"direct" protocol support
by stavultras＠gmail.com 05 Nov '24

05 Nov '24

Hello, is it possible to implement "direct" protocol support? For an example: You have OpenVPN TCP on a server and let's say SSH (or any other TCP software) and you want to use stunnel on the same port or under the same SNI. Configs would like: [server] accept = 443 protocol = direct [client_openvpn_tcp] sni=test.com protocolHost = 127.0.0.1:2000 connect = server:443 accept = 127.0.0.1:2000 [client_ssh] sni=test.com protocolHost = 127.0.0.1:22 connect = server:443 accept = 127.0.0.1:222 I know, you can use "protocol = socks", but in this case you can't use this thing directly with your software that doesn't support socks5 (OpenVPN isn't a fully good example, because it supports socks5 proxy). SSH is a good example if you want to use it under TLS on the same port with OpenVPN TCP and other TCP applications. It will be useful for many other applications without socks5 support and if you won't occupy more than 1 port or SNI. P.S.: I'm still trying to use socks5 code from stunnel to implement "direct" protocol, but i'm not very good at C. Thanks.

1 2

Smpp with stunnel
by Andrew Z 16 Oct '24

16 Oct '24

Hello, I'm trying to leverage stunnel with smpp to communicate over by smppS protocol. I saw an older message from Pierre Delaage (2019) outlining the process ( https://www.stunnel.org/pipermail/stunnel-users/2010-September/002752.html) Unfortunately, that is not working for me. What may I be overlooking? Data: Fedora 39, stunnel 5.72 on x86_64-redhat-linux-gnu platform stunnel config from /etc/stunnel: cat ./stunnel.conf output = /var/log/stunnel.log foreground = yes [smpps] client = yes accept = 3775 connect = <vendor dnsname>:3550 cert = /tmp/nginx-selfsigned.crt key=/tmp/nginx-selfsigned.key sslVersion=all [root@dell5000 stunnel]# stunnel ./stunnel.conf 2024.10.16 13:52:44 LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform 2024.10.16 13:52:44 LOG5[ui]: Compiled with OpenSSL 3.1.1 30 May 2023 2024.10.16 13:52:44 LOG5[ui]: Running with OpenSSL 3.1.4 24 Oct 2023 2024.10.16 13:52:44 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.10.16 13:52:44 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2024.10.16 13:52:44 LOG5[ui]: UTF-8 byte order mark not detected 2024.10.16 13:52:44 LOG5[ui]: FIPS mode disabled 2024.10.16 13:52:44 LOG4[ui]: Service [smpps] needs authentication to prevent MITM attacks 2024.10.16 13:52:44 LOG5[ui]: Configuration successful 2024.10.16 13:53:02 LOG5[0]: Service [smpps] accepted connection from 192.168.1.114:11270 2024.10.16 13:53:02 LOG5[0]: s_connect: connected <vendor IP>:3550 2024.10.16 13:53:02 LOG5[0]: Service [smpps] connected remote server from 192.168.1.114:55508 2024.10.16 13:53:07 LOG5[0]: Connection closed: 293 byte(s) sent to TLS, 0 byte(s) sent to socket the smpp client is pointed to localhost:3775 and I running in the container. As such the "localhost" is "host.containers.internal". Here is the smpp log: 2024-10-16 17:53:02 INFO 1 Establishing SSL connection to host.containers.internal:3775 2024-10-16 17:53:02 INFO 1 Connecting to IPv4Address(type='TCP', host='host.containers.internal', port=3775) ... 2024-10-16 17:53:02 WARNING 1 SMPP connection established from 192.168.1.114 to port 40554 2024-10-16 17:53:02 INFO 1 Connection made to host.containers.internal:3775 2024-10-16 17:53:02 WARNING 1 Requesting bind as transceiver 2024-10-16 17:53:07 WARNING 1 SMPP 192.168.1.114 disconnected from port 40554: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionLost'>: Connection to the other side was lost in a non-clean fashion: Connection lost. ] 2024-10-16 17:53:07 ERROR 1 Connection lost. Reason: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly. ] 2024-10-16 17:53:07 INFO 1 Reconnecting after 10 seconds ... 2024-10-16 17:53:17 INFO 1 Connecting to IPv4Address(type='TCP', host='host.containers.internal', port=3775) ... 2024-10-16 17:53:17 WARNING 1 SMPP connection established from 192.168.1.114 to port 54806 2024-10-16 17:53:17 INFO 1 Connection made to host.containers.internal:3775 2024-10-16 17:53:17 WARNING 1 Requesting bind as transceiver 2024-10-16 17:53:22 WARNING 1 SMPP 192.168.1.114 disconnected from port 54806: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionLost'>: Connection to the other side was lost in a non-clean fashion: Connection lost. ] 2024-10-16 17:53:22 ERROR 1 Connection lost. Reason: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly. ] 2024-10-16 17:53:22 INFO 1 Reconnecting after 10 seconds ... 2024-10-16 17:53:32 ERROR 1 Request timed out after 30 secs: PDU [command: CommandId.bind_transceiver, sequence_number: 1, command_status: CommandStatus.ESME_ROK system_id: b'XXXXX' password: b'XXXXX' system_type: b'' interface_version: 52 addr_ton: <AddrTon.UNKNOWN: 1> addr_npi: <AddrNpi.UNKNOWN: 1> address_range: None ] 2024-10-16 17:53:32 ERROR 1 Bind failed [[Failure instance: Traceback (failure with no frames): <class 'smpp.pdu.error.SMPPRequestTimoutError'>: Request timed out after 30 secs: PDU [command: CommandId.bind_transceiver, sequence_number: 1, command_status: CommandStatus.ESME_ROK system_id: b'XXXX' password: b'XXXXX' system_type: b'' interface_version: 52 addr_ton: <AddrTon.UNKNOWN: 1> addr_npi: <AddrNpi.UNKNOWN: 1> address_range: None ] ]]. Disconnecting...

1 0

stunnel overhead: Tunneling over stunnel - How does this affect MTU?
by Marek Küthe 15 Oct '24

15 Oct '24

Hello, I am tunneling packets via stunnel using OpenVPN. I would now like to have an MTU in my tunnel where no fragmentation occurs. Hence my question: What overhead does stunnel introduce? Is the plaintext with a length one-to-one translated into the ciphertext? How large is the stunnel / TLS header? I look forward to any answer! Regards Marek Küthe -- Marek Küthe m.k(a)mk16.de er/ihm he/him

1 0

Newbie: installation and config
by ajbguinto＠yahoo.com 30 Sep '24

30 Sep '24

Hi, I am tasked to make stunnel work in our organization but a newbie I seem not to be able to follow the instructions for installation. can you help me out? plan to install this on our servers that will cater to oracle / mssql in transit data encryption. how do I know if im installing on a client or a server? will this work standalone (server will act as server and client too). how will this be configured.

2 5

External PSK and TLS 1.3
by mike ads 18 Sep '24

18 Sep '24

Hello, I'm looking for a solution to connect to a server using TLS 1.3 and an external PSK. Does stunnel support this? I see that there are configuration options to set TLS 1.3, and configuration options to specify a PSK; if those were used together, would that result in TLS 1.3 with the PSK? If so, how would I choose between ephemeral vs non-ephemeral DH? This doesn't seem to be an option. Ephemeral is an important choice for forward secrecy. Would it default to ephemeral? Thank you.

1 0

stunnel 5.73 released
by Michał Trojnara 09 Sep '24

09 Sep '24

Dear Users, I have released version 5.73 of stunnel. ### Version 5.73, 2024.09.09, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.3.2. - OpenSSL FIPS Provider updated to version 3.0.9. * Bugfixes - Fixed a memory leak while reloading stunnel.conf sections with "client=yes" and "delay=no". - Fixed TIMEOUTocsp with values greater than 4. - Fix the IPv6 test on a non-IPv6 machine. * Features - HELO replaced with EHLO in the post-STARTTLS SMTP protocol negotiation (thx to Peter Pentchev). - OCSP stapling fetches moved away from server threads. - Improved client-side session resumption. - Added support for the mimalloc allocator. - Check for protocolHost moved to configuration file processing for the client-side CONNECT protocol. - Clarified some confusing OpenSSL's certificate verification error messages. - stunnel.nsi updated for Debian 13 and Fedora. - Improved NetBSD compatibility. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: bc917c3bcd943a4d632360c067977a31e85e385f5f4845f69749bce88183cb38 stunnel-5.73.tar.gz d686b1a4135947718e7a8157a8cb6694ed50e2267713de1972941148a8859789 stunnel-5.73-win64-installer.exe 9d6065ea1e7fa59405b5a152eeeaed9296bd5a0d2b11964800e95867e7391f16 stunnel-5.73-android.zip Best regards, Mike

1 0

Re: GMail and OAuth 2.0
by meirman＠fastmail.com 02 Sep '24

02 Sep '24

I would prefer to use stunnel, which I used for 10 or 20 years until recently, but this proxy is supposed to work for the new problem: SIMON ROB'S EMAIL-OAUTH2-PROXY Go to https://github.com/simonrob/email-oauth2-proxy/releases Download emailproxy-YYYY-MM-DD_pyinstaller-Windows.zip from the most recent release. Unzip the emailproxy-YYYY-MM-DD_pyinstaller-Windows.zip file, extracting the contents to the desired location; avoid the protected system folders such as "Program Files", "Program Files (x86)", etc. Right-click each extracted file, go to Properties, and enable "Unblock"..... Write me at traveler(a)mm.st if you want me to post the rest of the instructions. Maybe experienced people don't need them. I havent' tried to install either this or stunnel yet.

1 0

No key from stunnel TLS handshake ?
by atritium＠hushmail.com 31 Aug '24

31 Aug '24

In a TLS handshake, the server presents the signed public key (certificate from a CA) to the client to use so that it doesn't have to be pre-existing in a file on the arbitrary systems making connections. Am I correct that stunnel does NOT do this? It appears stunnel clients MUST have a pre-existing -file- containing the server's signed public key and pointed at in the config file's CAfile setting. Sort of like "authorized_keys" file for ssh, except the certificates have short lifespans before going invalid. This makes authentication unworkable for services that could have thousands of semi-random people connecting, especially with certificate lifespans creeping down to 1 year and probably months. Even if the certificate was bundled in the initial stunnel set-up, remote clients would have to constantly be updating the file. If this is correct, I wonder why stunnel doesn't handle the TLS handshake like a browser and supply the current server public certificate for the client to authenticate. It seems like stunnel is presupposing a handful of clients in close contact who can be constantly fed current certificates to place in files on their machine. Really limits usability of the tool. Or maybe I am missing something (?)

4 3

Peer suddenly disconnected
by noel.melvin＠tcs.com 20 Aug '24

20 Aug '24

We are seeing these messages after the stunnel application was closed and opened. LOG3[81]: SSL_accept: Peer suddenly disconnected Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket What could be the issue.

1 0

Re: stunnel 5.71 released
by Daniel Moerker 14 Aug '24

14 Aug '24

Dear Michal We are running Stunnel version 5.72 as TLS proxy for internal API in server mode on Windows. The server has no direct internet access. [my_tls_proxy] sslVersionMin = TLSv1.2 accept = 8443 connect = 1234 cert = mycert.pem OCSPaia = no OCSPrequire = no Is there a way to disable the OCSP connection attempts? The log is full of: 2024.08.14 16:20:26 LOG5[32]: OCSP: Connecting the AIA responder " http://ocsp.globalsign.com/gsrsaovsslca2018" 2024.08.14 16:20:27 LOG3[28]: s_connect: connect 104.18.21.226:80: Connection refused (WSAECONNREFUSED) (10061) Many thanks in advance for your reply. BR, Daniel

1 0

stunnel reload - existing connections
by Stewart Anderson 13 Aug '24

13 Aug '24

> >Hi All, I have seen this question asked a few times, but no replies that I could see. I have my stunnel services set in different service (.conf ) files and when I reload the config they all load fine. What does stunnel do with the existing connections? i.e. when I add a new service config and then do a reload, are the existing connections explicitly dropped and reloaded or can they by dynamically updated without interrupting the connection? For me, this specifically is when I add a new service on a new port, no changes to existing services. cheers Stu >

1 1

Problems with stunnel segfaulting on every connection
by jml＠bigjar.com 12 Aug '24

12 Aug '24

Hello, I’m running into a problem with stunnel segfaulting on me. I’m not sure if it’s a NetBSD problem or an stunnel problem. The following combinations work: NetBSD-10.0/stunnel 5.57 Debian/stunnel 5.50 Fedora/stunnel 5.72 Unfortunately, what doesn’t work for me is: NetBSD-10.0/stunnel 5.71 (or 5.7.2) NetBSD-9.x/stunnel 5.71 It looks like stunnel is doing something related to OCSP and the response causes it to crash. The certificate is a wildcard for my domain, bigjar.com. Here’s a snippet of the output right before the segfault: 2024.08.04 13:47:35 LOG7[0]: SNI: no virtual services defined 2024.08.04 13:47:35 LOG7[0]: OCSP stapling: Server callback called 2024.08.04 13:47:35 LOG6[0]: OCSP: The root CA certificate was not found 2024.08.04 13:47:35 LOG5[0]: OCSP: Connecting the AIA responder "http://e5.o.lencr.org" Segmentation fault (core dumped) I rolled back to an earlier certificate issued by sectigo and got the same result: 2024.08.05 15:11:01 LOG7[0]: OCSP stapling: Server callback called 2024.08.05 15:11:01 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.sectigo.com" There were some issues getting stunnel to run with the correct version of OpenSSL (the “pkgsrc” version), but those have been fixed. Any suggestions are greatly appreciated! Thanks, Jason M. Full /usr/pkg/etc/stunnel/stunnel.conf —————————————————— foreground = yes debug = 7 CAPath = /etc/openssl/certs [imaps] accept = 993 connect = 10.100.0.75:143 cert = /path/wildcard.bigjar.com.pem OCSPaia = no Full stunnel output: 2024.08.05 15:22:13 LOG6[ui]: Initializing inetd mode configuration 2024.08.05 15:22:13 LOG7[ui]: Clients allowed=500 2024.08.05 15:22:13 LOG5[ui]: stunnel 5.71 on x86_64--netbsd platform 2024.08.05 15:22:13 LOG5[ui]: Compiled/running with OpenSSL 3.3.1 4 Jun 2024 2024.08.05 15:22:13 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2024.08.05 15:22:13 LOG7[ui]: errno: (*__errno()) 2024.08.05 15:22:13 LOG6[ui]: Initializing inetd mode configuration 2024.08.05 15:22:13 LOG5[ui]: Reading configuration from file /usr/pkg/etc/stunnel/stunnel.conf 2024.08.05 15:22:13 LOG5[ui]: UTF-8 byte order mark not detected 2024.08.05 15:22:13 LOG6[ui]: Compression disabled 2024.08.05 15:22:13 LOG7[ui]: No PRNG seeding was required 2024.08.05 15:22:13 LOG6[ui]: Initializing service [imaps] 2024.08.05 15:22:13 LOG7[ui]: Initializing context [imaps] 2024.08.05 15:22:13 LOG6[ui]: OpenSSL security level is used: 2 2024.08.05 15:22:13 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2024.08.05 15:22:13 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2024.08.05 15:22:13 LOG7[ui]: TLS options: 0x2100000 (+0x0, -0x0) 2024.08.05 15:22:13 LOG6[ui]: Session resumption enabled 2024.08.05 15:22:13 LOG6[ui]: Loading certificate from file: /usr/local/certs/wildcard.bigjar.com.20210406.pem 2024.08.05 15:22:13 LOG6[ui]: Certificate loaded from file: /usr/local/certs/wildcard.bigjar.com.20210406.pem 2024.08.05 15:22:13 LOG6[ui]: Loading private key from file: /usr/local/certs/wildcard.bigjar.com.20210406.pem 2024.08.05 15:22:13 LOG6[ui]: Private key loaded from file: /usr/local/certs/wildcard.bigjar.com.20210406.pem 2024.08.05 15:22:13 LOG7[ui]: Private key check succeeded 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=ES, O=FNMT-RCM, OU=Ceres, organizationIdentifier=VATES-Q2826004J, CN=AC RAIZ FNMT-RCM SERVIDORES SEGUROS 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: serialNumber=G63287510, C=ES, O=ANF Autoridad de Certificacion, OU=ANF CA Raiz, CN=ANF Secure Server Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=AffirmTrust, CN=AffirmTrust Commercial 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=AffirmTrust, CN=AffirmTrust Networking 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Amazon, CN=Amazon Root CA 1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Amazon, CN=Amazon Root CA 2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Amazon, CN=Amazon Root CA 3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Amazon, CN=Amazon Root CA 4 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: CN=Atos TrustedRoot 2011, O=Atos, C=DE 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: CN=Atos TrustedRoot Root CA ECC TLS 2021, O=Atos, C=DE 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: CN=Atos TrustedRoot Root CA RSA TLS 2021, O=Atos, C=DE 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O=BEIJING CERTIFICATE AUTHORITY, CN=BJCA Global Root CA1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O=BEIJING CERTIFICATE AUTHORITY, CN=BJCA Global Root CA2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Certainly, CN=Certainly Root E1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Certainly, CN=Certainly Root R1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=FR, O=Dhimyotis, CN=Certigna 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=FR, O=Dhimyotis, OU=0002 48146308100036, CN=Certigna Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=PL, O=Asseco Data Systems S.A., OU=Certum Certification Authority, CN=Certum EC-384 CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=PL, O=Asseco Data Systems S.A., OU=Certum Certification Authority, CN=Certum Trusted Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=CommScope, CN=CommScope Public Trust ECC Root-01 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=CommScope, CN=CommScope Public Trust ECC Root-02 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=CommScope, CN=CommScope Public Trust RSA Root-01 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=CommScope, CN=CommScope Public Trust RSA Root-02 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST BR Root CA 1 2020 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST EV Root CA 1 2020 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Google Trust Services LLC, CN=GTS Root R1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="DigiCert, Inc.", CN=DigiCert TLS ECC P384 Root G5 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="DigiCert, Inc.", CN=DigiCert TLS RSA4096 Root G5 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="Entrust, Inc.", OU=www.entrust.net/CPS is incorporated by reference, OU="(c) 2006 Entrust, Inc.", CN=Entrust Root Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2012 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - EC1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2015 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G4 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O="GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.", CN=GDCA TrustAUTH R5 ROOT 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Google Trust Services LLC, CN=GTS Root R2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=AT, O=e-commerce monitoring GmbH, CN=GLOBALTRUST 2020 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Google Trust Services LLC, CN=GTS Root R3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Google Trust Services LLC, CN=GTS Root R4 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: OU=GlobalSign ECC Root CA - R5, O=GlobalSign, CN=GlobalSign 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: OU=GlobalSign Root CA - R6, O=GlobalSign, CN=GlobalSign 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Root E46 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Root R46 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="The Go Daddy Group, Inc.", OU=Go Daddy Class 2 Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Arizona, L=Scottsdale, O="GoDaddy.com, Inc.", CN=Go Daddy Root Certificate Authority - G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA TLS ECC Root CA 2021 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA TLS RSA Root CA 2021 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions ECC RootCA 2015 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2015 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=TW, O="Chunghwa Telecom Co., Ltd.", CN=HiPKI Root CA - G1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=HK, ST=Hong Kong, L=Hong Kong, O=Hongkong Post, CN=Hongkong Post Root CA 3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Internet Security Research Group, CN=ISRG Root X1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Internet Security Research Group, CN=ISRG Root X2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=ES, O=IZENPE S.A., CN=Izenpe.com 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, emailAddress=info(a)e-szigno.hu 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Microsoft Corporation, CN=Microsoft ECC Root Certificate Authority 2017 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR ROOT CA2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=Microsoft Corporation, CN=Microsoft RSA Root Certificate Authority 2017 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=KR, O=NAVER BUSINESS PLATFORM Corp., CN=NAVER Global Root Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=HU, L=Budapest, O=NetLock Kft., OU=Tanúsítványkiadók (Certification Services), CN=NetLock Arany (Class Gold) Főtanúsítvány 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CH, O=WISeKey, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GB CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CH, O=WISeKey, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GC CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Texas, L=Houston, O=SSL Corporation, CN=SSL.com EV Root Certification Authority ECC 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=JP, O="Japan Certification Services, Inc.", CN=SecureSign RootCA11 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Texas, L=Houston, O=SSL Corporation, CN=SSL.com EV Root Certification Authority RSA R2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Texas, L=Houston, O=SSL Corporation, CN=SSL.com Root Certification Authority ECC 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Texas, L=Houston, O=SSL Corporation, CN=SSL.com Root Certification Authority RSA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=SSL Corporation, CN=SSL.com TLS RSA Root CA 2022 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=SecureTrust Corporation, CN=SecureTrust CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O=SecureTrust Corporation, CN=Secure Global CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", CN=Security Communication ECC RootCA1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security Communication RootCA2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", CN=Security Communication RootCA3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, O="Starfield Technologies, Inc.", OU=Starfield Class 2 Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Root Certificate Authority - G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Services Root Certificate Authority - G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=Deutsche Telekom Security GmbH, CN=Telekom Security TLS ECC Root 2020 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=DE, O=Deutsche Telekom Security GmbH, CN=Telekom Security TLS RSA Root 2023 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: O=TeliaSonera, CN=TeliaSonera Root CA v1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=FI, O=Telia Finland Oyj, CN=Telia Root CA v2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O="TrustAsia Technologies, Inc.", CN=TrustAsia Global Root CA G3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O="TrustAsia Technologies, Inc.", CN=TrustAsia Global Root CA G4 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Illinois, L=Chicago, O="Trustwave Holdings, Inc.", CN=Trustwave Global Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Illinois, L=Chicago, O="Trustwave Holdings, Inc.", CN=Trustwave Global ECC P256 Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=Illinois, L=Chicago, O="Trustwave Holdings, Inc.", CN=Trustwave Global ECC P384 Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=TN, O=Agence Nationale de Certification Electronique, CN=TunTrust Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O=UniTrust, CN=UCA Extended Validation Root 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O=UniTrust, CN=UCA Global G2 Root 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=RO, O=certSIGN, OU=certSIGN ROOT CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=RO, O=CERTSIGN SA, OU=certSIGN ROOT CA G2 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=HU, L=Budapest, O=Microsec Ltd., organizationIdentifier=VATHU-23584497, CN=e-Szigno Root CA 2017 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=TW, O="Chunghwa Telecom Co., Ltd.", OU=ePKI Root Certification Authority 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, OU=emSign PKI, O=eMudhra Inc, CN=emSign ECC Root CA - C3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=US, OU=emSign PKI, O=eMudhra Inc, CN=emSign Root CA - C1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign Root CA - G1 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O="iTrusChina Co.,Ltd.", CN=vTrus ECC Root CA 2024.08.05 15:22:13 LOG6[ui]: Configured trusted client CA: C=CN, O="iTrusChina Co.,Ltd.", CN=vTrus Root CA 2024.08.05 15:22:13 LOG7[ui]: OCSP: Server OCSP stapling enabled 2024.08.05 15:22:13 LOG6[ui]: DH initialization skipped: no DH ciphersuites 2024.08.05 15:22:13 LOG7[ui]: ECDH initialization 2024.08.05 15:22:13 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2024.08.05 15:22:13 LOG5[ui]: Configuration successful 2024.08.05 15:22:13 LOG7[ui]: Deallocating deployed section defaults 2024.08.05 15:22:13 LOG7[ui]: Cleaning up context [stunnel] 2024.08.05 15:22:13 LOG7[ui]: Binding service [imaps] 2024.08.05 15:22:13 LOG7[ui]: Listening file descriptor created (FD=9) 2024.08.05 15:22:13 LOG7[ui]: Setting accept socket options (FD=9) 2024.08.05 15:22:13 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2024.08.05 15:22:13 LOG6[ui]: Service [imaps] (FD=9) bound to :::993 2024.08.05 15:22:13 LOG7[ui]: Listening file descriptor created (FD=10) 2024.08.05 15:22:13 LOG7[ui]: Setting accept socket options (FD=10) 2024.08.05 15:22:13 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2024.08.05 15:22:13 LOG6[ui]: Service [imaps] (FD=10) bound to 0.0.0.0:993 2024.08.05 15:22:13 LOG7[ui]: No pid file being created 2024.08.05 15:22:13 LOG6[ui]: Accepting new connections 2024.08.05 15:22:13 LOG7[per-second]: Per-second thread initialized 2024.08.05 15:22:13 LOG7[per-day]: Per-day thread initialized 2024.08.05 15:22:13 LOG6[per-day]: Executing per-day jobs 2024.08.05 15:22:13 LOG6[per-day]: Per-day jobs completed in 0 seconds 2024.08.05 15:22:13 LOG7[per-day]: Waiting 86400 seconds 2024.08.05 15:22:34 LOG7[ui]: Found 1 ready file descriptor(s) 2024.08.05 15:22:34 LOG7[ui]: FD=4 events=0x1 revents=0x0 2024.08.05 15:22:34 LOG7[ui]: FD=9 events=0x1 revents=0x0 2024.08.05 15:22:34 LOG7[ui]: FD=10 events=0x1 revents=0x1 2024.08.05 15:22:34 LOG7[ui]: Service [imaps] accepted (FD=3) from 192.168.10.127:50130 2024.08.05 15:22:34 LOG7[0]: Service [imaps] started 2024.08.05 15:22:34 LOG7[0]: Setting local socket options (FD=3) 2024.08.05 15:22:34 LOG7[0]: Option TCP_NODELAY set on local socket 2024.08.05 15:22:34 LOG5[0]: Service [imaps] accepted connection from 192.168.10.127:50130 2024.08.05 15:22:34 LOG6[0]: Peer certificate not required 2024.08.05 15:22:34 LOG7[0]: TLS state (accept): before SSL initialization 2024.08.05 15:22:34 LOG7[0]: TLS state (accept): before SSL initialization 2024.08.05 15:22:34 LOG7[0]: Initializing application specific data for session authenticated 2024.08.05 15:22:34 LOG7[0]: SNI: no virtual services defined 2024.08.05 15:22:34 LOG7[0]: OCSP stapling: Server callback called 2024.08.05 15:22:34 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.sectigo.com" Segmentation fault (core dumped) uname -a from the clean NetBSD 10.0 install ——————————————————————— NetBSD Thundercats.virtual.bigjar.com 10.0 NetBSD 10.0 (GENERIC) #0: Thu Mar 28 08:33:33 UTC 2024 [email protected]:/usr/src/sys/arch/amd64/compile/GENERIC amd64 dmesg from the same system ——————————— [ 1.000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, [ 1.000000] 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, [ 1.000000] 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, [ 1.000000] 2024 [ 1.000000] The NetBSD Foundation, Inc. All rights reserved. [ 1.000000] Copyright (c) 1982, 1986, 1989, 1991, 1993 [ 1.000000] The Regents of the University of California. All rights reserved. [ 1.000000] NetBSD 10.0 (GENERIC) #0: Thu Mar 28 08:33:33 UTC 2024 [ 1.000000] [email protected]:/usr/src/sys/arch/amd64/compile/GENERIC [ 1.000000] total memory = 2047 MB [ 1.000000] avail memory = 1953 MB [ 1.000000] timecounter: Timecounters tick every 10.000 msec [ 1.000000] Kernelized RAIDframe activated [ 1.000000] timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100 [ 1.000004] mainbus0 (root) [ 1.000004] ACPI: RSDP 0x00000000000F5220 000014 (v00 BOCHS ) [ 1.000004] ACPI: RSDT 0x000000007FFE3036 000038 (v01 BOCHS BXPC 00000001 BXPC 00 [ 1.000004] ACPI: FACP 0x000000007FFE2E08 000074 (v01 BOCHS BXPC 00000001 BXPC 00 [ 1.000004] ACPI: DSDT 0x000000007FFDF040 003DC8 (v01 BOCHS BXPC 00000001 BXPC 0 [ 1.000004] ACPI: FACS 0x000000007FFDF000 000040 [ 1.000004] ACPI: APIC 0x000000007FFE2E7C 000090 (v03 BOCHS BXPC 00000001 BXPC 00 [ 1.000004] ACPI: SSDT 0x000000007FFE2F0C 0000CA (v01 BOCHS VMGENID 00000001 BXPC [ 1.000004] ACPI: HPET 0x000000007FFE2FD6 000038 (v01 BOCHS BXPC 00000001 BXPC 00 [ 1.000004] ACPI: WAET 0x000000007FFE300E 000028 (v01 BOCHS BXPC 00000001 BXPC 00 [ 1.000004] ACPI: 2 ACPI AML tables successfully acquired and loaded [ 1.000004] ioapic0 at mainbus0 apid 0: pa 0xfec00000, version 0x11, 24 pins [ 1.000004] cpu0 at mainbus0 apid 0 [ 1.000004] cpu0: Use lfence to serialize rdtsc [ 1.000004] cpu0: Intel(R) Xeon(R) CPU L5420 @ 2.50GHz, id 0x1067a [ 1.000004] cpu0: node 0, package 0, core 0, smt 0 [ 1.000004] cpu1 at mainbus0 apid 1 [ 1.000004] cpu1: Intel(R) Xeon(R) CPU L5420 @ 2.50GHz, id 0x1067a [ 1.000004] cpu1: node 0, package 0, core 1, smt 0 [ 1.000004] cpu2 at mainbus0 apid 2 [ 1.000004] cpu2: Intel(R) Xeon(R) CPU L5420 @ 2.50GHz, id 0x1067a [ 1.000004] cpu2: node 0, package 1, core 0, smt 0 [ 1.000004] cpu3 at mainbus0 apid 3 [ 1.000004] cpu3: Intel(R) Xeon(R) CPU L5420 @ 2.50GHz, id 0x1067a [ 1.000004] cpu3: node 0, package 1, core 1, smt 0 [ 1.000004] acpi0 at mainbus0: Intel ACPICA 20221020 [ 1.000004] acpi0: X/RSDT: OemId <BOCHS ,BXPC ,00000001>, AslId <BXPC,00000001> [ 1.000004] LNKS: ACPI: Found matching pin for 0.1.INTA at func 3: 9 [ 1.000004] LNKD: ACPI: Found matching pin for 0.1.INTD at func 2: 11 [ 1.000004] LNKC: ACPI: Found matching pin for 0.3.INTA at func 0: 11 [ 1.000004] LNKA: ACPI: Found matching pin for 0.5.INTA at func 0: 10 [ 1.000004] LNKB: ACPI: Found matching pin for 0.18.INTA at func 0: 10 [ 1.000004] LNKB: ACPI: Found matching pin for 0.30.INTA at func 0: 10 [ 1.000004] LNKC: ACPI: Found matching pin for 0.31.INTA at func 0: 11 [ 1.000004] acpi0: SCI interrupting at int 9 [ 1.000004] acpi0: fixed power button present [ 1.000004] timecounter: Timecounter "ACPI-Fast" frequency 3579545 Hz quality 1000 [ 1.026231] hpet0 at acpi0: high precision event timer (mem 0xfed00000-0xfed00400) [ 1.026231] timecounter: Timecounter "hpet0" frequency 100000000 Hz quality 2000 [ 1.029336] qemufwcfg0 at acpi0 (FWCF, QEMU0002): io 0x510-0x51b [ 1.029336] qemufwcfg0: <QEMU> [ 1.029336] pckbc1 at acpi0 (KBD, PNP0303) (kbd port): io 0x60,0x64 irq 1 [ 1.029336] pckbc2 at acpi0 (MOU, PNP0F13) (aux port): irq 12 [ 1.029336] fdc0 at acpi0 (FDC0, PNP0700): io 0x3f2-0x3f5,0x3f7 irq 6 drq 2 [ 1.029336] VGEN (QEMUVGID) at acpi0 not configured [ 1.029336] ACPI: Enabled 3 GPEs in block 00 to 0F [ 1.029336] pckbd0 at pckbc1 (kbd slot) [ 1.029336] pckbc1: using irq 1 for kbd slot [ 1.029336] wskbd0 at pckbd0: console keyboard [ 1.029336] pms0 at pckbc1 (aux slot) [ 1.029336] pckbc1: using irq 12 for aux slot [ 1.029336] wsmouse0 at pms0 mux 0 [ 1.029336] pci0 at mainbus0 bus 0: configuration mode 1 [ 1.029336] pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok [ 1.029336] pchb0 at pci0 dev 0 function 0: Intel 82441FX (PMC) PCI and Memory Controller (rev. 0x0 [ 1.029336] pcib0 at pci0 dev 1 function 0: Intel 82371SB (PIIX3) PCI-ISA Bridge (rev. 0x00) [ 1.029336] piixide0 at pci0 dev 1 function 1: Intel 82371SB IDE Interface (PIIX3) (rev. 0x00) [ 1.029336] piixide0: bus-master DMA support present [ 1.029336] piixide0: primary channel wired to compatibility mode [ 1.029336] piixide0: primary channel interrupting at ioapic0 pin 14 [ 1.029336] atabus0 at piixide0 channel 0 [ 1.029336] piixide0: secondary channel wired to compatibility mode [ 1.029336] piixide0: secondary channel interrupting at ioapic0 pin 15 [ 1.029336] atabus1 at piixide0 channel 1 [ 1.029336] uhci0 at pci0 dev 1 function 2: Intel 82371SB (PIIX3) USB Host Controller (rev. 0x01) [ 1.029336] uhci0: interrupting at ioapic0 pin 11 [ 1.029336] usb0 at uhci0: USB revision 1.0 [ 1.029336] piixpm0 at pci0 dev 1 function 3: Intel 82371AB (PIIX4) Power Management Controller (rev [ 1.029336] timecounter: Timecounter "piixpm0" frequency 3579545 Hz quality 1000 [ 1.029336] piixpm0: 24-bit timer [ 1.029336] piixpm0: interrupting at ioapic0 pin 9 [ 1.029336] iic0 at piixpm0 port 0: I2C bus [ 1.029336] vga0 at pci0 dev 2 function 0: vendor 1234 product 1111 (rev. 0x02) [ 1.029336] wsdisplay0 at vga0 kbdmux 1: console (80x25, vt100 emulation), using wskbd0 [ 1.029336] wsmux1: connecting to wsdisplay0 [ 1.029336] drm at vga0 not configured [ 1.029336] virtio0 at pci0 dev 3 function 0 [ 1.029336] virtio0: memory balloon device (id 5, rev. 0x00) [ 1.029336] viomb0 at virtio0: features: 0x10000000<INDIRECT_DESC> [ 1.029336] virtio0: allocated 8192 byte for virtqueue 0 for inflate, size 128 [ 1.029336] virtio0: allocated 8192 byte for virtqueue 1 for deflate, size 128 [ 1.029336] virtio0: interrupting at ioapic0 pin 11 [ 1.029336] ppb0 at pci0 dev 5 function 0: Red Hat Qemu PCI-PCI (rev. 0x00) [ 1.029336] pci1 at ppb0 bus 1 [ 1.029336] pci1: i/o space, memory space enabled [ 1.029336] wm0 at pci0 dev 18 function 0, 64-bit DMA: Intel i82540EM 1000BASE-T Ethernet (rev. 0x [ 1.029336] wm0: interrupting at ioapic0 pin 10 [ 1.029336] wm0: 32-bit 33MHz PCI bus [ 1.029336] wm0: 64 words (6 address bits) MicroWire EEPROM [ 1.029336] wm0: RX packet buffer size: 48KB [ 1.029336] wm0: Ethernet address bc:24:11:28:4e:0d [ 1.029336] wm0: 0x200002<LOCK_EECD,WOL> [ 1.029336] makphy0 at wm0 phy 1: Marvell 88E1011 Gigabit PHY, rev. 0 [ 1.029336] makphy0: Failed to access EADR. Are you an emulator? [ 1.029336] makphy0: Failed to read EXTSR. Are you an emulator?. Regard as 1000BASE-T. [ 1.029336] makphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-F [ 1.029336] ppb1 at pci0 dev 30 function 0: Red Hat Qemu PCI-PCI (rev. 0x00) [ 1.029336] pci2 at ppb1 bus 2 [ 1.029336] pci2: i/o space, memory space enabled [ 1.029336] ppb2 at pci0 dev 31 function 0: Red Hat Qemu PCI-PCI (rev. 0x00) [ 1.029336] pci3 at ppb2 bus 3 [ 1.029336] pci3: i/o space, memory space enabled [ 1.029336] isa0 at pcib0 [ 1.029336] attimer0 at isa0 port 0x40-0x43 [ 1.029336] pcppi0 at isa0 port 0x61 [ 1.029336] spkr0 at pcppi0: PC Speaker [ 1.029336] wsbell at spkr0 not configured [ 1.029336] midi0 at pcppi0: PC speaker [ 1.029336] sysbeep0 at pcppi0 [ 1.029336] attimer0: attached to pcppi0 [ 1.029336] acpicpu0 at cpu0: ACPI CPU [ 1.029336] acpicpu0: C1: HLT, lat 0 us, pow 0 mW [ 1.029336] vmt0 at cpu0 [ 1.029336] vmt0: UUID: 744f4106-92e9-4346-8075-d18275f8edfd [ 1.029336] vmware: open failed, eax=0xffffffff, ecx=0x1e, edx=0x5658 [ 1.029336] vmt0: autoconfiguration error: failed to open backdoor RPC channel (TCLO protocol) [ 1.029336] acpicpu1 at cpu1: ACPI CPU [ 1.029336] acpicpu2 at cpu2: ACPI CPU [ 1.029336] acpicpu3 at cpu3: ACPI CPU [ 1.029336] timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0 [ 2.044826] IPsec: Initialized Security Association Processing. [ 2.054842] uhub0 at usb0: NetBSD (0x0000) UHCI root hub (0x0000), class 9/0, rev 1.00/1.00, addr [ 2.054842] uhub0: 2 ports with 2 removable, self powered [ 3.744874] uhidev0 at uhub0 port 1 configuration 1 interface 0 [ 3.744874] uhidev0: QEMU (0x0627) QEMU USB Tablet (0x0001), rev 2.00/0.00, addr 2, iclass 3/0 [ 3.754781] ums0 at uhidev0: 3 buttons and Z dir [ 3.754781] wsmouse1 at ums0 mux 0 [ 5.034767] wd0 at atabus0 drive 0 [ 5.034767] wd0: <QEMU HARDDISK> [ 5.044755] wd0: drive supports 16-sector PIO transfers, LBA48 addressing [ 5.044755] wd0: 256 GB, 532610 cyl, 16 head, 63 sec, 512 bytes/sect x 536870912 sectors [ 5.054776] wd0: GPT GUID: 42a7e333-2c05-4cbd-8664-1555d1755017 [ 5.054776] dk0 at wd0: "f0a8b571-d30a-43a6-a0ef-191b9afe08e7", 16777216 blocks at 2048, typ [ 5.054776] dk1 at wd0: "926b4afc-b71b-4615-9fd2-a2a845a4d129", 4194304 blocks at 1677926 [ 5.067931] dk2 at wd0: "da56269b-1ddb-4cb8-a470-e689f1e1dbe5", 515897311 blocks at 20973 [ 5.067931] wd0: 32-bit data port [ 5.067931] wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 5 (Ultra/100) [ 5.067931] wd0(piixide0:0:0): using PIO mode 4, DMA mode 2 (using DMA) [ 5.067931] atapibus0 at atabus1: 2 targets [ 5.074732] cd0 at atapibus0 drive 0: <QEMU DVD-ROM, QM00003, 2.5+> cdrom removable [ 5.074732] cd0: 32-bit data port [ 5.074732] cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 5 (Ultra/100) [ 5.074732] cd0(piixide0:1:0): using PIO mode 4, DMA mode 2 (using DMA) [ 5.084749] swwdog0: software watchdog initialized [ 5.104732] WARNING: 1 error while detecting hardware; check system log. [ 5.104732] boot device: wd0 [ 5.104732] root on dk0 dumps on dk1 [ 5.104732] root file system type: ffs [ 5.114878] kern.module.path=/stand/amd64/10.0/modules [ 20.034308] wsdisplay0: screen 1 added (80x25, vt100 emulation) [ 20.044324] wsdisplay0: screen 2 added (80x25, vt100 emulation) [ 20.054309] wsdisplay0: screen 3 added (80x25, vt100 emulation) [ 20.054309] wsdisplay0: screen 4 added (80x25, vt100 emulation)

3 2

Response not received
by hiren.bhatt＠westernunion.com 11 Aug '24

11 Aug '24

Here is current setup. Linux Server - Application ==> Stunnel in Client mode ==> Network ==> F5 havingTLS cert to decrypt traffic. We are runnign Stunnel in client mode to encrypt traffic with detination F5. F5 is equipped with TLS cert which decrypts traffic. Setup is working fine but we see some 0.2% traffic is impacted where Stunnel calling app in client side does not receive response. We are not running Stunnel on Server mode on destination. Packet capture does not show any abnormalities. Stunnel used by use is 4.62 coming out of Redhat distribution. We are clueless on traffic drop. Anyone with similar experiences can help?

1 0

stunnel for postgres
by Casey & Gina 10 Aug '24

10 Aug '24

Hi! I'm trying to set up stunnel for postgres, and cannot get it working. For the moment, I'm just trying to test locally on a Mac. I have set up postgres SSL correctly and confirmed that direct connections to the db with psql work with SSL. Here's the most promising config I've come up with: foreground = yes client = yes [postgresql] protocol = pgsql accept = 127.0.0.1:5433 connect = 127.0.0.1:5432 verify = 0 cert = /opt/homebrew/var/postgresql(a)16/server.crt key = /opt/homebrew/var/postgresql(a)16/server.key CAfile = /opt/homebrew/var/postgresql(a)16/ca.crt Here's what I'm getting: $ PGSSLMODE=disable psql -h 127.0.0.1 -p 5432 -U casey -d postgres -c 'select 1' -At 1 $ PGSSLMODE=require psql -h 127.0.0.1 -p 5432 -U casey -d postgres -c 'select 1' -At 1 $ PGSSLMODE=disable psql -h 127.0.0.1 -p 5433 -U casey -d postgres -c 'select 1' -At psql: error: connection to server at "127.0.0.1", port 5433 failed: server offered SCRAM-SHA-256-PLUS authentication over a non-SSL connection $ PGSSLMODE=require psql -h 127.0.0.1 -p 5433 -U casey -d postgres -c 'select 1' -At psql: error: connection to server at "127.0.0.1", port 5433 failed: FATAL: unsupported frontend protocol 1234.5679: server supports 3.0 to 3.0 Also, is it possible to connect to stunnel via UNIX socket instead of TCP? Thanks, -- Casey

3 2

Help
by Hugo Sarkissian 10 Aug '24

10 Aug '24

Hello, Tried to configure stunnel linked to pdm (solidworks) When I try I have an error : Service [ssmtp] started 2024.07.30 15:01:27 LOG7[1]: Setting local socket options (FD=1184) 2024.07.30 15:01:27 LOG7[1]: Option TCP_NODELAY set on local socket 2024.07.30 15:01:27 LOG5[1]: Service [ssmtp] accepted connection from 127.0.0.1:60652 2024.07.30 15:01:27 LOG6[1]: Peer certificate not required 2024.07.30 15:01:27 LOG7[1]: TLS state (accept): before SSL initialization 2024.07.30 15:01:37 LOG7[1]: TLS alert (write): fatal: record overflow 2024.07.30 15:01:37 LOG3[1]: error queue: ssl/record/rec_layer_s3.c:645: error:0A000139:SSL routines::record layer failure 2024.07.30 15:01:37 LOG3[1]: SSL_accept: ssl/record/methods/tls_common.c:654: error:0A0000C6:SSL routines::packet length too long 2024.07.30 15:01:37 LOG5[1]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2024.07.30 15:01:37 LOG7[1]: Local descriptor (FD=1184) closed 2024.07.30 15:01:37 LOG7[1]: Service [ssmtp] finished (0 left) My config : ; Configuration de Stunnel ; Niveau de journalisation debug = 7 output = stunnel.log ; Service SMTP sécurisé [ssmtp] accept = 127.0.0.1:25 connect = 127.0.0.1:587 cert = C:\Program Files (x86)\stunnel\config\stunnel.pem key = C:\Program Files (x86)\stunnel\config\stunnel.pem ; Protocoles et suites de chiffrement sslVersion = all ciphers = ALL:!aNULL:!MD5 renegotiation = no options = NO_SSLv2 TIMEOUTclose = 0 Can you help me please [cid:logopiabgroup_89c2c8d4-09f6-4cf6-87f9-3682b4094f7c.jpg] Hugo Sarkissian IT Operation Support Technician Piab Group Montelier FR (+33) 7 88 06 22 31 Hugo.Sarkissian(a)piabgroup.com<mailto:[email protected]> Please consider your environmental responsibility. Before printing this email message, ask yourself whether you really need a hard copy.

2 1

421 mismatched
by d.arlo.421642＠gmail.com 07 Aug '24

07 Aug '24

Hi I am running stunnel on my local pc win10. Trying to stunnel to https://api.interactsms.com/HTTP_API/V1/sendmessage.aspx?user=User1&passwor… Password1&api_id=9876&to=353879999999&text=HelloWorld&from=YourCompany which gives me wrong user name and password which is fine. if I Stunnel this http://localhost:8083/HTTP_API/V1/sendmessage.aspx?user=User1&password=Pass… I get Misdirected Request The client needs a new connection for this request as the requested host name does not match the Server Name Indication (SNI) in use for this connection. Is this a problem with the site or my Stunnel config? when I installed Stunnel, I used localhost for the CN. I have tried downloading the client, intermediate and CA cert with the below config... ;cert = D:\Program Files (x86)\stunnel\config\sms\interactsms-com.pem ;CAfile= D:\Program Files (x86)\stunnel\config\sms\godaddyca.pem this is current config... [sms] client = yes accept = 8083 connect = api.interactsms.com:443 cert = D:\Program Files (x86)\stunnel\config\stunnel.pem

3 3

OCSP: The root CA certificate was not found
by akos.schneemaier＠gmail.com 06 Aug '24

06 Aug '24

Hi, this is my first post on this mailing list. I did extensive search and tried to resolve the issue I have in pfsense with stunnel. Pfsense CE 2.7.2 uses stunnel 5.71. In my config I created certificate using the acme package with Let's ecrypt. The created certificate works fine in pfsense wenb consol and also with stunnel 5.68 on Debian, but it does not work with stunnel 5.71 on Pfsense. All connections going through stunnel get are timing out and the stunnel log has the following in it: ``` Jul 19 00:53:08 router1 stunnel[2933]: LOG5[6]: Service [XXXX] accepted connection from xxxxxx:46415 Jul 19 00:53:08 router1 stunnel[2933]: LOG6[6]: Peer certificate not required Jul 19 00:53:08 router1 stunnel[2933]: LOG6[6]: OCSP: The root CA certificate was not found Jul 19 00:53:08 router1 stunnel[2933]: LOG5[6]: OCSP: Connecting the AIA responder "http://r10.o.lencr.org" Jul 19 00:56:05 router1 stunnel[2933]: LOG3[6]: Error resolving "r10.o.lencr.org": Address family for nodename not supported (EAI_ADDRFAMILY) Jul 19 00:56:05 router1 stunnel[2933]: LOG3[6]: OCSP: Failed to resolve the OCSP responder address Jul 19 00:56:05 router1 stunnel[2933]: LOG6[6]: OCSP: No OCSP stapling response to send Jul 19 00:56:05 router1 stunnel[2933]: LOG3[6]: SSL_accept: /var/jenkins/workspace/pfSense-CE-snapshots-2_7_2-main/sources/FreeBSD-src-RELENG_2_7_2/crypto/openssl/ssl/record/rec_layer_s3.c:304: error:0A000126:SSL routines::unexpected eof while reading Jul 19 00:56:05 router1 stunnel[2933]: LOG5[6]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket ``` So far i tried: 1. Creating new certificate with acme 2. Unisntall and reinstall both acme and stunnel 3. Tried new cetrificate provider (zerossl) 4. tried adding "OCSPrequire = no" to stunnel.conf based on https://www.stunnel.org/mailman3/hyperkitty/list/[email protected]/… None of the above fixed the issue and not I am not sure how to resolve it. I have another Pfsense installation where all these things work fine. I compaired the stunnel.conf files, but there are identical (except the certificate ofcourse). I looked into the source code and found that the error message is comming from ocsp_params_append_root_ca function in opcs.c, but I ma not a C programer and neither familiar with the stunnel code to figure out more. I hope someone from the stunnel list has some ideas how to proceed based on the logs above. Thank you!

3 2

Error stnnul linked to PDM (solidwork)
by hugo.sarkissian＠coval.com 30 Jul '24

30 Jul '24

Hello, I have this error : 2024.07.30 15:01:37 LOG7[1]: TLS alert (write): fatal: record overflow 2024.07.30 15:01:37 LOG3[1]: error queue: ssl/record/rec_layer_s3.c:645: error:0A000139:SSL routines::record layer failure 2024.07.30 15:01:37 LOG3[1]: SSL_accept: ssl/record/methods/tls_common.c:654: error:0A0000C6:SSL routines::packet length too long 2024.07.30 15:01:37 LOG5[1]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2024.07.30 15:01:37 LOG7[1]: Local descriptor (FD=1184) closed 2024.07.30 15:01:37 LOG7[1]: Service [ssmtp] finished (0 left) my conf is: ; Configuration de Stunnel ; Niveau de journalisation debug = 7 output = stunnel.log ; Service SMTP sécurisé [ssmtp] accept = 127.0.0.1:25 connect = 127.0.0.1:587 cert = C:\Program Files (x86)\stunnel\config\stunnel.pem key = C:\Program Files (x86)\stunnel\config\stunnel.pem ; Protocoles et suites de chiffrement sslVersion = all ciphers = ALL:!aNULL:!MD5 renegotiation = no options = NO_SSLv2 TIMEOUTclose = 0 can you help me please i don't understant

1 0

stunnel not able to daisy-chain transparent connections
by ftsanetamot 29 Jul '24

29 Jul '24

Hello, I struggled recently, with combining sslh and nginx daisy-chaining ip-transparent connections, and realised the same problem, other users reported, when using stunnel. Now that I have found a fix, which solves my problem with sslh, I checked into the stunnel code, and adapted my proposed fix for stunnel: diff client.c_original client.c 1721a1722,1723 > if (setsockopt(c->fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof on)) > sockerror("setsockopt SO_REUSEADD"); 1769a1772,1776 > int on = 1; > #ifdef IP_TRANSPARENT > if (setsockopt(c->fd, SOL_IP, IP_TRANSPARENT, &on, sizeof on)) > sockerror("setsockopt SO_IP_TRANSPARENT");> #endif I described my findings here in Detail: https://github.com/ftasnetamot/sslh/blob/2024-07-28--documentation/doc/Dais… This article helped me to figure out, what is wrong: https://blog.cloudflare.com/how-to-stop-running-out-of-ephemeral-ports-and-… I wrote as well some weeks earlier two documents, describing how to configure ip-transparent connections only with routing and no firewall rules involved. The same works 1:1 with stunnel. https://github.com/yrutschle/sslh/blob/master/doc/simple_transparent_proxy.… https://github.com/yrutschle/sslh/blob/master/doc/scenarios-for-simple-tran… Happy tunneling .f Sicher versendet mit [Proton Mail](https://proton.me/).

1 0

How to verify a certificate
by William Wood 24 Jul '24

24 Jul '24

I have tried everything I can think of, and even though I have certificates that are marked as "valid" when I look at the lock icon for an https: site, I get a verification "fail": CERT: Pre-verification error: self-signed certificate in certificate chain From everything I have read, my understanding is that every chain of certificates starts with a self-signed certificate I have even queried my Windows certificate management, and the issuer of the certificate is Entrust, which is on the list of trusted issuers. Within openssl, I get the same error: error 18 at 0 depth lookup: self signed certificate There is talk of a CApath, as well as lists of trusted issuers, but I do not understand anything within the documentation for stunnel which suggests how to access this information and incorporate it in the functioning of the program. Any help would be much appreciated! Thanks in advance -William Wood

2 1

Almost there - openssl verifies remote certificate, but stunnel still fails
by William Wood 24 Jul '24

24 Jul '24

In Windows 10 I have done the following: 1. Created a directory C:\Certificates\ 2. From the Microsoft Management Concole (MMC) I have exported all the "Trusted Root Certificate Authorities\Certificates" as Personal Information exchange .PFX with a passcode 3. Using a Powershell environment, I change directories to C:\Certificates\ and run openssl From the openssl prompt convert the above .PFX file to a .pem file openssl pkcs12 -in All_Trusted.pfx -out All_Trusted.pem -nodes 4. Next I run the following openssl command OpenSSL s_client -CApath c:\Certificates\ -connect api.gainfutures.com:9400 -CAfile All_Trusted.pem After a bunch of output, I get the notification Verification: OK This tells me that the verification has passed the remote certificate. Using this to inform my stunnel configuration, I configure: [GainFuturesConnect] client = yes accept = 127.0.0.1:8080 connect = 192.111.85.171:9400 CAfile = C:\Certificates\All_Trusted.pem CApath = C:\Certificates\ securityLevel = 1 verifyChain = yes checkHost = api.gainfutures.com:9400 sslVersion = TLSv1.2 sslVersionMax = TLSv1.2 ciphers = DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256 Although the preverification succeeds at each "depth", the verification fails at the end: CERT: Pre-verification succeeded (**Note, this is a change from before I added the above CAfile and CApath values**) CERT: Subject checks failed Rejected by CERT at depth=0: C=GB, L=London, O=Gain Capital UK Limited, CN=*.gainfutures.com Remove session callback TLS alert (write): fatal: internal error SSL_connect: ssl/statem/statem_clnt.c:2091: error:0A000086:SSL routines::certificate verify failed So my question becomes two parts: 1. How do I get the Subject checks to pass for CERT; 2. How do I get rid of the TLS "write" alert which is an internal error? Thank you -William Wood

1 0

Re: Trying to get stunnel to verify remote server certificate
by William Wood 18 Jul '24

18 Jul '24

Thank you Mike for your reply. I apologize for my lack of experience with networks. One thing that I personally did not understand in using stunnel is that my SSL traffic that I want to "wrap" needs to be directed at the "accept" port, and that the stunnel wrap THEN sends it out over the connect port with the SSL "magic" applied. With that in mind, I have amended my configuration, and I have a new problem (s?): client = yes accept = 127.0.0.1:8080 connect = 192.111.85.171:9400 cert = C:\Certificates\WMW_trade_csr.pem CAfile = C:\Certificates\ca-cert1.pem securityLevel = 0 verifyPeer = yes checkHost = api.gainfutures.com sslVersion = TLSv1.2 sslVersionMax = TLSv1.2 This binds the service to 127.0.0.1:8080 So far so good. When I start my program, which directs its output stream to the "accept" port, the stunnel log now responds as I send messages: (I have pulled out just the last part before the error) 2024.07.18 12:19:45 LOG6[1150]: Peer certificate required 2024.07.18 12:19:45 LOG7[1150]: TLS state (connect): before SSL initialization 2024.07.18 12:19:45 LOG7[1150]: Initializing application specific data for session authenticated 2024.07.18 12:19:45 LOG7[1150]: TLS state (connect): SSLv3/TLS write client hello 2024.07.18 12:19:45 LOG7[1150]: TLS state (connect): SSLv3/TLS write client hello 2024.07.18 12:19:45 LOG7[1150]: TLS state (connect): SSLv3/TLS read server hello This looks okay to me so far 2024.07.18 12:19:45 LOG7[1150]: Verification started at depth=2: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2024.07.18 12:19:45 LOG6[1150]: CERT: Pre-verification error ignored: self-signed certificate in certificate chain 2024.07.18 12:19:45 LOG6[1150]: OCSP: Certificate chain verification disabled 2024.07.18 12:19:45 LOG6[1150]: Certificate accepted at depth=2: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2024.07.18 12:19:45 LOG7[1150]: Verification started at depth=2: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2024.07.18 12:19:45 LOG7[1150]: CERT: Pre-verification succeeded 2024.07.18 12:19:45 LOG6[1150]: OCSP: Certificate chain verification disabled 2024.07.18 12:19:45 LOG6[1150]: Certificate accepted at depth=2: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2024.07.18 12:19:45 LOG7[1150]: Verification started at depth=1: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2012 Entrust, Inc. - for authorized use only", CN=Entrust Certification Authority - L1K 2024.07.18 12:19:45 LOG7[1150]: CERT: Pre-verification succeeded 2024.07.18 12:19:45 LOG6[1150]: OCSP: Certificate chain verification disabled 2024.07.18 12:19:45 LOG6[1150]: Certificate accepted at depth=1: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2012 Entrust, Inc. - for authorized use only", CN=Entrust Certification Authority - L1K 2024.07.18 12:19:45 LOG7[1150]: Verification started at depth=0: C=GB, L=London, O=Gain Capital UK Limited, CN=*.gainfutures.com 2024.07.18 12:19:45 LOG7[1150]: CERT: Pre-verification succeeded 2024.07.18 12:19:45 LOG6[1150]: CERT: Host name "api.gainfutures.com" matched with "*.gainfutures.com" 2024.07.18 12:19:45 LOG4[1150]: CERT: Certificate not found in local repository not sure what this indicates (not found in local repository) 2024.07.18 12:19:45 LOG4[1150]: Rejected by CERT at depth=0: C=GB, L=London, O=Gain Capital UK Limited, CN=*.gainfutures.com 2024.07.18 12:19:45 LOG7[1150]: Remove session callback 2024.07.18 12:19:45 LOG7[1150]: TLS alert (write): fatal: bad certificate 2024.07.18 12:19:45 LOG3[1150]: SSL_connect: ssl/statem/statem_clnt.c:2091: error:0A000086:SSL routines::certificate verify failed After looking on the internet, I think that the [TLS alert (write): fatal: bad certificate] may refer to the cert = (file.pem), which in this case is a certificate I had made and verified by a trusted authority. The rejected by CERT is clearly referring to the certificate which comes from the server located at the other end of the "connect" port. I have looked specifically at this certificate, and the chain is comprised of two authenticated certificates, with a self-authenticated third certificate. As an example, when I change the "checkHost =" to an IP address, the error message changes: 2024.07.18 12:40:45 LOG7[1157]: CERT: Pre-verification succeeded *2024.07.18 12:40:45 LOG4[1157]: CERT: Subject checks failed *2024.07.18 12:40:45 LOG4[1157]: Rejected by CERT at depth=0: C=GB, L=London, O=Gain Capital UK Limited, CN=*.gainfutures.com 2024.07.18 12:40:45 LOG7[1157]: Remove session callback *2024.07.18 12:40:45 LOG7[1157]: TLS alert (write): fatal: unknown CA What seems to be consistent is that the remote certificate is being rejected because there is a self-authenticated certificate as the third part of the chain. I have tried the following: CAfile = C:\Certificates\ca-cert.pem (CA file which comes with openssl, I believe) which gives the same results. CAfile = C:\Certificates\ca-cert1.pem (Here I have added the chain certificates from file gain-futures-chain.pem) same results CAfile = C:\Certificates\ca-cert2.pem (Here I have added the chain certificates from file gain-futures-chainpumpbut removed the self-signed part) same results CAfile =C:\Certificates\ca-cert3.pem (ca-cert3.pem contains ONLY the certificates from gain-futures-chain.pem) same results CAfile =C:\Certificates\gain-futures-chain.pem This causes the service NOT to be bound, and throws what look like a bunch of openssl errors So it appears that I am actually probing the certificate that the remote server is sending me. I am still not clear on the role of CAfile, because of the behavior I have outlined. Do I need somehow to find a CAfile which recognizes and validates the certificate from the remote server? Thank you again! -William Wood

1 0

Trying to get stunnel to verify remote server certificate
by William Wood 15 Jul '24

15 Jul '24

I have downloaded the remote certificates, and configured stunnel: client = no accept = 127.0.0.1:9400 connect = 192.111.85.171:9400 cert = C:\Certificates\gain-futures-chain.pem verifyChain = yes verifyPeer = yes checkHost = 192.111.85.171 checkIP = api.gainfutures.com sslVersion = TLSv1.1 options = NO_SSLv2 options = NO_SSLv3 OCSPaia = yes This results in the failure to initialize the tLS context: 2024.07.15 08:40:50 LOG7[service]: Found 1 ready file descriptor(s) 2024.07.15 08:40:50 LOG7[service]: FD=580 ifds=r-x ofds=r-- 2024.07.15 08:40:50 LOG7[service]: FD=640 ifds=r-x ofds=--- 2024.07.15 08:40:50 LOG7[service]: Dispatching a signal from the signal pipe 2024.07.15 08:40:50 LOG7[service]: Processing SIGNAL_RELOAD_CONFIG 2024.07.15 08:40:50 LOG6[service]: Initializing inetd mode configuration 2024.07.15 08:40:50 LOG7[service]: Running on Windows 6.2 2024.07.15 08:40:50 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2024.07.15 08:40:50 LOG5[service]: UTF-8 byte order mark not detected 2024.07.15 08:40:50 LOG5[service]: FIPS mode disabled 2024.07.15 08:40:50 LOG6[service]: Compression disabled 2024.07.15 08:40:50 LOG7[service]: No PRNG seeding was required 2024.07.15 08:40:50 LOG6[service]: Initializing service [GainFuturesConnect] 2024.07.15 08:40:50 LOG7[service]: Initializing context [GainFuturesConnect] 2024.07.15 08:40:50 LOG6[service]: OpenSSL security level is used: 2 2024.07.15 08:40:50 LOG7[service]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2024.07.15 08:40:50 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2024.07.15 08:40:50 LOG7[service]: TLS options: 0x2100000 (+0x2000000, -0x0) 2024.07.15 08:40:50 LOG6[service]: Session resumption enabled 2024.07.15 08:40:50 LOG6[service]: Loading certificate from file: C:\Certificates\gain-futures-chain.pem 2024.07.15 08:40:50 LOG3[service]: error queue: ssl/ssl_rsa.c:472: error:0A080002:SSL routines::system lib 2024.07.15 08:40:50 LOG3[service]: error queue: crypto/bio/bss_file.c:300: error:10080002:BIO routines::system lib 2024.07.15 08:40:50 LOG3[service]: SSL_CTX_use_certificate_chain_file: crypto/bio/bss_file.c:297: error:80000002:system library::No such file or directory 2024.07.15 08:40:50 LOG3[service]: Service [GainFuturesConnect]: Failed to initialize TLS context 2024.07.15 08:40:50 LOG3[service]: Configuration failed 2024.07.15 08:40:50 LOG7[service]: Deallocating temporary section defaults 2024.07.15 08:40:50 LOG7[service]: Cleaning up context [(null)] 2024.07.15 08:40:50 LOG7[service]: Deallocating section [GainFuturesConnect] 2024.07.15 08:40:50 LOG7[service]: Cleaning up context [GainFuturesConnect] 2024.07.15 08:40:50 LOG3[service]: Failed to reload the configuration file This is the best I can gather regarding getting verification of the REMOTE certificate. The problem is that I am unable to connect if I cannot verify their certificate - they are not looking at my certificate. Any help would be appreciated. Thank you! -William Wood

2 1

Help installing stunnel 5.72 as service in windows 10
by William Wood 04 Jul '24

04 Jul '24

Apparently to get stunnel to work, I have to install it as a service in Windows. In order to do this, I fire up a powershell, change directories to the stunnel\bin\, and run the command: .\stunnel -install This results in the error message: OpenSCManager: error 5: Access is denied Not sure what to do, as I am running as an administrator Any help would be appreciated Thanks -William Wood

2 2

How to connect to a website through a port
by William Wood 02 Jul '24

02 Jul '24

Hi - I am trying to connect securely to a website from a Windows 10 machine: gainfutures.com through the port: 9400 I am told I need to do this using SSL. I have a python script which successfully connects through their non-secure ports. I am given no other information about what is needed for the connection, so I am asking how to do this. I have added to the configuration file: accept=gainfutures.com:9400 connect=gainfutures:9400 The "accept" line results in the error: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) the "connect" line has no effect in the messages. Any suggestions would be much appreciated. Thank you -WW

2 1

help connecting to a website through a port from Windows 10
by William Wood 02 Jul '24

02 Jul '24

Hi - I am trying to connect securely to a website from a Windows 10 machine: gainfutures.com through the port: 9400 I am told I need to do this using SSL. I have a python script which successfully connects through their non-secure ports. I am given no other information about what is needed for the connection, so I am asking how to do this. I have added to the configuration file: accept=gainfutures.com:9400 connect=gainfutures:9400 The "accept" line results in the error: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) the "connect" line has no effect in the messages. Any suggestions would be much appreciated. Thank you -WW

1 0

How to specify OCSP responder URL in "server" mode?
by sbworkde＠gmail.com 02 Jul '24

02 Jul '24

I want to specify OCSP responder URL while stunnel in "server" mode. I tried to use the option "OCSP" in configuration file, but it only works in "client" mode. The OCSP responder URL is always read form AIA while stunnel is in "server" mode, even when I set "OCSPaia = no". Is there a way to specify OCSP resonder URL for "server" mode?

2 1

Stunnel with tinyproxy seem failed to forward
by jensen＠fixes.hk 29 Jun '24

29 Jun '24

Stunnel config client = no cert = /path/to/fullchain.pem key = /path/to/privkey.pem pid = /var/run/stunnel4/stunnel.pid debug = 7 output = /var/log/stunnel4/stunnel.log [tinyproxy] accept = 0.0.0.0:8443 connect = 127.0.0.1:7777 here's the log 2024.06.28 11:08:26 LOG7[main]: Found 1 ready file descriptor(s) 2024.06.28 11:08:26 LOG7[main]: FD=4 events=0x2001 revents=0x0 2024.06.28 11:08:26 LOG7[main]: FD=9 events=0x2001 revents=0x1 2024.06.28 11:08:26 LOG7[main]: Service [tinyproxy] accepted (FD=3) from X.X.X.X:42086 2024.06.28 11:08:26 LOG7[3]: Service [tinyproxy] started 2024.06.28 11:08:26 LOG7[3]: Setting local socket options (FD=3) 2024.06.28 11:08:26 LOG7[3]: Option TCP_NODELAY set on local socket 2024.06.28 11:08:26 LOG5[3]: Service [tinyproxy] accepted connection from X.X.X.X:42086 2024.06.28 11:08:26 LOG6[3]: Peer certificate not required 2024.06.28 11:08:26 LOG7[3]: TLS state (accept): before SSL initialization 2024.06.28 11:08:26 LOG3[3]: SSL_accept: ../ssl/record/ssl3_record.c:348: error:0A00009B:SSL routines::https proxy request 2024.06.28 11:08:26 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2024.06.28 11:08:26 LOG7[3]: local_rfd/local_wfd reset (FD=3) 2024.06.28 11:08:26 LOG7[3]: Local descriptor (FD=3) closed 2024.06.28 11:08:26 LOG7[3]: Service [tinyproxy] finished (0 left) on connect, I'm using server with OS Ubuntu16.04 with OpenSSL 1.1.1n 15 Mar 2022 (Library: OpenSSL 1.1.1 11 Sep 2018). using my other server (OS ubuntu 2X.) and my local (Mac OS), I'm able to connect to stunnel + tinyproxy successfully. it seems the issue within the server with Ubuntu16.04 or did I miss other config ?

3 5

Devo Relay(Stunnel) -> Palo Alto Log Ingestion Configuration
by jeykipamca＠hotmail.com 14 Jun '24

14 Jun '24

Hi!, I am trying to ingest Palo Alto Firewall syslogs from Devo SIEM, to do that, I had to implement Stunnel on my relay server but in the installation part, I got this error message (I couldn't start stunnel service and I set all the configs as mentioned below links); devo-relay-server:/etc/stunnel# systemctl status stunnel4.service × stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons) Loaded: loaded (/etc/init.d/stunnel4; generated) Active: failed (Result: exit-code) since Fri 2024-06-14 13:42:04 UTC; 58min ago Docs: man:systemd-sysv-generator(8) CPU: 27ms Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [.] Reading configuration from file /etc/stunnel/stunnel.conf Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [.] UTF-8 byte order mark not detected Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [!] /etc/stunnel/stunnel.conf:6: "setuid = test": Illegal UID Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [!] Configuration failed Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [ ] Deallocating temporary section defaults Jun 14 13:42:04 -devo-relay-server stunnel4[4018]: failed Jun 14 13:42:04 -devo-relay-server stunnel4[4018]: You should check that you have specified the pid= in you configuration file Jun 14 13:42:04 -devo-relay-server systemd[1]: stunnel4.service: Control process exited, code=exited, status=1/FAILURE Jun 14 13:42:04 -devo-relay-server systemd[1]: stunnel4.service: Failed with result 'exit-code'. Jun 14 13:42:04 -devo-relay-server systemd[1]: Failed to start LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). root@-devo-relay-server:/etc/stunnel# -------------------------------------------------------------- My conf file; /etc/stunnel/stunnel.conf ; ************************************************************************** ; * Global options * ; ************************************************************************** ; It is recommended to drop root privileges if stunnel is started by root setuid = test setgid = test ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes ;debug = debug output = /var/log/stunnel4/stunnel.log [firewall_tunnel] client = no accept = 6515 connect = 127.0.0.1:13005 cert = /etc/pki/stunnel/cert_SyslogCert-Devo.pem verifyChain = yes verifyPeer = yes CAfile = /etc/pki/stunnel/cert_RootCA-Devo.crt -------------------------------------------------------------- /etc/default/stunnel4 file; # /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0 # Change to enable the setting of limits on the stunnel instances # For example, to set a large limit on file descriptors (to enable # more simultaneous client connections), set RLIMITS="-n 4096" # More than one resource limit may be modified at the same time, # e.g. RLIMITS="-n 4096 -d unlimited" RLIMITS="" -------------------------------------------------------------- Does anyone have knowledge about the issue? The links which I got support. https://docs.devo.com/space/latest/94663679/Sending+Palo+Alto+events+to+Dev… https://docs.devo.com/space/latest/96469881/Sending+SSL%2FTLS+encrypted+eve…

1 0

Can I use stunnel to create a proxy chain?
by Eugene Bos 11 Jun '24

11 Jun '24

Hello. I have a proxy with http/socks5 support but this configuration doesnt work: client = yes [my-proxy] accept = 127.0.0.1:9666 connect = proxy.com:10000 protocol = connect protocolHost = username__cr.ua:[email protected]:10000 I wanted to proxy requests sent to 127.0.0.1:9666 to username__cr.ua:p [email protected]:10000

1 0

help required with stunnel cipher set up
by Glick, Daniel 11 Jun '24

11 Jun '24

Classification: Restricted Dear All, Objective : We have been informed by Euroclear that we must use the following ciphers below with our stunnel connection to them TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 Server details : [cid:[email protected]] The required cipher has been defined as being the first in the list. [cid:[email protected]] Information security has confirmed that the cipher has been enabled [cid:[email protected]] However after rebooting the server and starting stunnel – the old ciphers are still being used [cid:[email protected]] Please can anyone point us in the right direction as to what we are doing wrong. Thank you Daniel Glick Application Specialist, Investment Management & Finance Platform Arbuthnot Latham & Co., Limited ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender and delete it from your system. Internet communications are not secure and therefore Arbuthnot Latham & Co., Limited does not accept legal responsibility for the contents of this message or any damage sustained as a result of this email or its attachments. Any views or opinions presented are solely those of the author and do not necessarily represent those of Arbuthnot Latham & Co., Limited or any of its affiliates. Please take some time to read our Privacy Notice, which provides information on what personal data we collect from you, what we do with it and who it might be shared with. *********************************************************************** Arbuthnot Latham & Co., Limited Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Arbuthnot Latham & Co., Limited, DIFC Branch, is regulated by the Dubai Financial Services Authority ("DFSA"). Registered in England and Wales 819519. Registered office: Arbuthnot House 7 Wilson Street London EC2M 2SN Tel : 020 7012 2500 Fax : 020 7012 2501 ************************************************************************

4 4

GRE over Stunnel
by marslogout＠gmail.com 17 May '24

17 May '24

Hello, is it possible to use GRE with Stunnel? I know that GRE is a protocol different from TCP, but I would like to hear your opinion on this matter. If GRE is not supported, would it be correct to replace it with PPTP without encryption?

1 0

Stunnel with no encryption
by Castro, Flavio 16 May '24

16 May '24

Hello, I am trying to configure Stunnel to use the insecure cipher PSK-NULL-SHA@SECLEVEL=0 but am encountering issues where a different cipher appears to be negotiated instead. My goal is to authenticate endpoints without encryption. Here are the details of my setup: Stunnel Version: 5.63 Operating System: Ubuntu Stunnel Configuration: ; Stunnel Configuration ; Global Options fips = no output = /var/log/stunnel.log ; Specify the pre-shared key file PSKsecrets = /etc/stunnel/psk.txt sslVersion = TLSv1.2 ; PSK Server Configuration [PSK server] accept = 192.168.20.11:5074 connect = 192.168.30.11:5074 ciphers = PSK-NULL-SHA ; In OpenSSL, I can achieve my goal using the following command, which works as expected: openssl s_client -port 5074 -cipher "PSK-NULL-SHA@SECLEVEL=0" -psk 4f8583bca4d311ee9fd6034d1fcbd7c3 -tls1 However, with Stunnel, it appears a different cipher is negotiated, and I do not see any error messages in the logs. I tcpdumped the connection and observed the traffic is being encrypt which was not the case when using openssl. In my usecase I need to authenticate endpoints without encryption, hence the use of PSK-NULL-SHA@SECLEVEL=0. Could you please advise on how to properly configure Stunnel to use the PSK-NULL-SHA@SECLEVEL=0 cipher, or if this is supported? Thank you for your assistance. Flavio Castro

1 0

use openvpn service through socks
by Alberto P 27 Apr '24

27 Apr '24

Hi, I have a paying vpn service that offers a few connection modes but no socks or http proxy Is it possible to use stunnel to 1) connect to the vpn service via openvpn (I have server_name, user, pass, config file) 2) make this vpn available through a socks5 proxy on my local network or localhost ? Any help with config files would be greatly appreciated

1 0

Next release of stunnel
by Heyes, Chad (Coral Springs) 25 Apr '24

25 Apr '24

Hello, We have a number of clients currently using stunnel to communicate securely from emulator software to our Unisys host. We have been coordinating with them when stunnel need to be updated. Is there a plan to update stunnel version anytime soon? I understand that it may be a 'last minute' decision based on security vulnerabilities. However, any advance notice would be helpful. Thanks, Chad Heyes Software Architect, Advisory Product Development, Bank Solutions Fiserv www.fiserv.com<http://www.fiserv.com/> Fiserv<http://links.mkt030.com/ctt?kn=3&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Join Our Team<http://links.mkt030.com/ctt?kn=7&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Twitter<http://links.mkt030.com/ctt?kn=1&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | LinkedIn<http://links.mkt030.com/ctt?kn=5&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Facebook<http://links.mkt030.com/ctt?kn=9&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> FORTUNE Magazine World's Most Admired Companies(r) 2014 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 (c) 2018 Fiserv Inc. or its affiliates. Fiserv is a registered trademark of Fiserv Inc. Privacy Policy

2 1

Re: TLSv1.0 and TLSv1.1 - unable to disable
by Josealf.rm 24 Apr '24

24 Apr '24

1 0

TLSv1.0 and TLSv1.1 - unable to disable
by Alan Flores 23 Apr '24

23 Apr '24

Hello: I have not been able to get STunnel to disable these protocols. In the STunnel.conf file I put in the line sslVersionMin = TLSv1.2 I have disabled these in windows 2019 via reg keys But this has not stopped scans from seeing TLSv1.0 and 1.1 Any help would be appreciated stunnel 5.72 on x64-pc-mingw32-gnu platform Windows server 2019 Compiled/running with OpenSSL 3.2.1 30 Jan 2024 Alan Flores Enterprise Support Specialist Enterprise Application Systems E: Alan.Flores(a)Valpo.edu <http://www.valpo.edu> 1700 Chapel Drive, Valparaiso, IN 46383

1 0

using a socks5 with user/name authentication
by Alberto P 21 Apr '24

21 Apr '24

Hello, I have a vpn service that provides a socks5 proxy using user/pass authentication. Using stunnel would allow me to use the service with other clients that allow for a socks5 proxy but normally no authentication. Could anybody tell me 1) is what I'd like feasible ? 2)How do I provide user/pass to the configuration file ? Your help would be very appreciated ! alberto

1 0

Wondering if process to create the g2.pem file is available?
by Michael D. Setzer II 19 Apr '24

19 Apr '24

Was wondering if the process to create the g2.pem file you shared is available. It does work with changes to the stunnel.conf file for both the smtp1.guam.net and mail.guam.net [guampop] client=yes accept = 127.0.0.1:20996 connect = mail.guam.net:995 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = mail.guam.net OCSPaia = yes [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = smtp1.guam.net OCSPaia = yes Not sure the the g2.pem would work for all time, or has an expiration date. Thanks. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:[email protected] mailto:[email protected] mailto:[email protected] Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 19 Apr '24

19 Apr '24

3 2

unknow TCP service 11702
by tomoyalin＠yahoo.co.jp 18 Apr '24

18 Apr '24

how to solve problem from stunnel config file when using port is not 80 or 443. ( our config tcp service port is 11702)

2 1

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 18 Apr '24

18 Apr '24

Having issues with stunnel not working with this settings that have work with previous kernels? [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs checkHost = mail.guam.net OCSPaia = yes But now changing to [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 Seems to work. systemctl status stunnel. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:48:15 ChST; 5s ago Process: 15349 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15352 (stunnel) Tasks: 3 (limit: 18938) Memory: 3.6M CPU: 1.618s CGroup: /system.slice/stunnel.service └─15352 /usr/bin/stunnel Apr 18 14:48:14 setzconote.dyndns.org systemd[1]: Starting stunnel.service - TLS tunnel for network daemons... Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.co> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: UTF-8 byte order mark not detected Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: FIPS mode disabled Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Configuration successful Apr 18 14:48:15 setzconote.dyndns.org systemd[1]: Started stunnel.service - TLS tunnel for network daemons. Using the longer one gives this after attempting to sent smtp. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:57:22 ChST; 1min 15s ago Process: 15616 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15619 (stunnel) Tasks: 3 (limit: 18938) Memory: 4.0M CPU: 1.639s CGroup: /system.slice/stunnel.service └─15619 /usr/bin/stunnel Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: CERT: Pre-verification error: unable to get local issuer> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: Rejected by CERT at depth=0: CN=*.guam.net Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: TLS alert (write): fatal: unknown CA Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG3[3]: SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A0000> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG5[3]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Deallocating application specific data for session conne> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Remote descriptor (FD=16) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: local_rfd/local_wfd reset (FD=3) Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Local descriptor (FD=3) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Service [guamsmtp] finished (0 left) lines 1-23/23 (END) Was using the Fedora stunnel the is 5.71, but downloaded the latest 5.72, but seem to get same results. Had some issues with nvidia drives that work fine with 6.7.11 kernels, but fail with the 6.8.x drivers, so not sure if it is linked to that? +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:[email protected] mailto:[email protected] mailto:[email protected] Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

stunnel doesn't allow two client certificates with the same Subject DN?
by Christopher Schultz 16 Apr '24

16 Apr '24

Hello, I was recently rotating a certificate for a service and I went through my usual procedure: 1. Generate a new client key+cert; don't place them into service, yet 2. Distribute the new certificate to all my stunnel servers that need to trust it by placing it at the end of each of my servers' CAFile files 3. Restart all stunnel services 4. Swap the old key+cert for the client with the new key+cert 5. Test that all is well I've found that if the Distinguished Name of both the old and new certificate are the same, stunnel will only trust the one that is mentioned /first/ in the CAFile. For example, if the CAFile contains: -----BEGIN CERTIFICATE----- certificate A Serial Number: 12345678 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE----- certificate B Serial Number: 87654321 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- Certificate A will be trusted but Certificate B will not be trusted. The error shown in the logs is: CERT: Pre-verification error: self signed certificate Apr 15 21:33:06 mirth-pcc.chadis.com stunnel[23421]: Certificate check failed: depth=0, /C=US/OU=Testing/O=Example.com/CN=test While the certificates are both self-signed, that should not cause an error. Removing the old certificate from the CAFile or moving it to the bottom of the file resolves the problem. (But of course then Certificate A is no longer trusted despite it appearing in the CAFile.) Is this expected behavior? It would be very helpful if stunnel could support two different certificates with the same Subject DN for these kinds of cert-rotation processes. The alternatives are to always use a new DN each time or to add/remove at the same time which makes rolling-back more difficult. Note that everything else about these certificates is different: serial number, fingerprint, generating-key, etc. It's only the Subject DN that is the same. This is stunnel 4.56 on x86_64-koji-linux-gnu platform, on Amazon Linux 2. Thanks! -chris

2 1

HELO handshake problem (?)
by Ducale Ducale 10 Apr '24

10 Apr '24

In a Windows 10 machine I'm using a tool (Netwrix Service Monitor) with a SMTP notification feature that doesn't support authentication, so I'm using Stunnel 5.72 as a local relay for SMTP2GO (smtp2go.com) with this configuration: [smtp2go] client = yes accept = 127.0.0.1:25 connect = mail.smtp2go.com:2525 protocol = smtp protocolAuthentication = plain protocolHost = cloud.mydomain.com protocolUsername = smtp2go(a)mydomain.com protocolPassword = P@ssw0rd debug = 7 I try both PLAIN and LOGIN as authentication mode, with this is error: LOGIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH LOGIN <- 503 AUTH command used when not advertised Remote server does not support LOGIN authentication ... " PLAIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH PLAIN ******************************************** <- 503 AUTH command used when not advertised PLAIN Authentication Failed Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Deallocating application specific data for session connect address ... " Can anyone help me solve this problem? Thanks!

3 3

help configuration for socks5 nordvpn requiring authentication
by Alberto P 10 Apr '24

10 Apr '24

Hello, I would like to use stunnel to use a socks5 server requiring user/pass authentication (nordvpn) with different clients that allow for a socks5 proxy but no authentication. Could someone help me with the configuration (linux or windows is good). In detail, I don't know how to provide user/pass to the configuration, and if it is actually feasible. Any help will be very appreciated !

1 1

Stunnel - Silent switch to change the install directory
by Meena Prabhakaran 27 Mar '24

27 Mar '24

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. For more details, please have a look at Autonomous Patching for Every Third-Party Windows App (adaptiva.com) (https://adaptiva.com/products/autonomous-patch) We are willing to add the latest stable version of Stunnel product to our catalogue. Downloaded https://www.stunnel.org/downloads/stunnel-5.72-win64-installer.exe We are testing this app on Windows 10 64Bit VM. Please help us on below points: 1. Is there any switch/parameter which can be passed along with "stunnel-5.72-win64-installer.exe" for changing the "Install directory" silently? Tried these switches - /D, /DIR, /APPDIR, /INSTALLDIR, /TARGETDIR, /INSTALLLOCATION Thanks & Regards, Meena Prabhakaran Application Packager, Adaptiva M +91 9080759487 meena.prabhakaran(a)adaptiva.com<mailto:[email protected]> www.adaptiva.com<http://www.adaptiva.com/> Data Protection and Privacy: Your privacy is important to us. We are committed to protecting your personal information and handling it responsibly. For more information on how we process and protect your data, please review our Privacy Policy (https://adaptiva.com/privacy) Confidentiality Notice: Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Adaptiva. The recipient should check for the presence of viruses, as Adaptiva accepts no liability for any virus transmitted by this email.

3 3

Received trusted client CA list not found
by allmail 16 Mar '24

16 Mar '24

I see this message in the Stunnel (client) logs during SSL handshake with the server The server requires a client certificate which has been configured in the stunnel configuration. The handshake is working fine but I was wondering what exactly does this line mean. From what I found so far, seems like there is a way for the server to specify which CA's it will accept for the client certificate and it can specify them in the ClientCertificate request that it sends This server doesnt send anything like that, so I am guessing that is the reason for this log line? Can someone please confirm? Btw, I see this line only when using TLSv1.3. When I restrict the client to TLSv1.2, I dont see this line. thanks LOG Peer certificate required TLS state (connect): before SSL initialization Initializing application specific data for session authenticated TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS read server hello TLS state (connect): TLSv1.3 read encrypted extensions Received trusted client CA list not found TLS state (connect): SSLv3/TLS read server certificate request

1 0

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by docfxit＠theoffice.la 12 Mar '24

12 Mar '24

This is my log: [code] stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.03.10 10:19:49 LOG5[main]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.03.10 10:19:49 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.03.10 10:19:49 LOG7[main]: errno: (*_errno()) 2024.03.10 10:19:49 LOG6[main]: Initializing inetd mode configuration 2024.03.10 10:19:49 LOG7[main]: Running on Windows 6.2 Windows 10 2024.03.10 10:19:49 LOG5[main]: Reading configuration from file C:\Programs\stunnel\config\stunnel.conf 2024.03.10 10:19:49 LOG5[main]: UTF-8 byte order mark not detected 2024.03.10 10:19:49 LOG5[main]: FIPS mode disabled 2024.03.10 10:19:49 LOG6[main]: Compression disabled 2024.03.10 10:19:49 LOG7[main]: No PRNG seeding was required 2024.03.10 10:19:49 LOG6[main]: Initializing service [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG7[main]: Initializing context [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG6[main]: OpenSSL security level is used: 2 2024.03.10 10:19:49 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2024.03.10 10:19:49 LOG7[main]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2024.03.10 10:19:49 LOG7[main]: TLS options: 0x2100000 (+0x0, -0x0) 2024.03.10 10:19:49 LOG6[main]: Session resumption enabled 2024.03.10 10:19:49 LOG7[main]: No certificate or private key specified 2024.03.10 10:19:49 LOG6[main]: No trusted certificates found [/code] I copied a working config from Windows 7 64bit. Running stunnel 5.50

2 1

A conclusive Manual for Web Nursing Classes
by silir10174＠mcuma.com 07 Mar '24

07 Mar '24

[b]A conclusive Manual for Web Nursing Classes[/b] Show (150 words): In the rapidly creating circumstance of preparing, electronic learning has changed into an establishment for overwhelmingly most certain clinical directors searching for flexibility and responsiveness. This wide aide, "Rx for Progress: An unequivocal [url=https://tutorsacademy.co/nurs-fpx-4050-assessment-2-ethical-and-policy-factors-in-care-coordination/]4050 assessment 2[/url] Manual for Electronic Nursing Classes," bounces into the universe of web nursing bearing, offering boundless encounters and strong signs to explore this imperative learning environment. From picking the right program to winning in virtual study corridors, this guide means to empower specific specialists with the data and resources expected to prosper in the online nursing preparing space. I. The Move of Web Nursing Coaching The key piece investigates the making obviousness of electronic nursing programs, uncovering data into the parts that have added to their standing. Look at the flexibility these undertakings offer, the rising interest for remote learning, and such progress in movement that [url=https://tutorsacademy.co/nurs-fpx-4040-assessment-1-nursing-informatics-in-health-care/]nurs 4040 assessment 1[/url] make electronic arranging more open than later in consistent memory. II. Picking the Right Web Nursing Undertaking This part gives an every little push toward turn guide on picking the ideal electronic nursing program. It covers fundamental evaluations like declaration, program reputation, labor force endorsements, and the availability of clinical approaches. Furthermore, it offers tips on researching and standing separated different undertakings from ensure a remarkably arranged fit for individual necessities and goals. III. Investigating Virtual Homerooms Truly analyzing the virtual homeroom is genuine for web nursing students. This part offers significant empowering on utilizing time, as a matter of fact, convincing correspondence with instructors and mates, and utilizing on the web resources. It also addresses typical challenges looked by online students and gives systems to beat them. IV. Controlling Clinical Experiences Clinical experiences are a crucial piece of nursing tutoring. This part examines how web nursing programs coordinate clinical circumstances, orchestrating the meaning of dynamic experience and offering heading on finding fitting entryways locally. It likewise discusses the control of reenactment movement in beating any hindrance among speculation and practice. V. Instruments and Movements for Online Accomplishment To win in electronic nursing classes, students ought to be have a lot of involvement in various contraptions and levels of progress. This part approaches basic programming, stages, and resources that can moreover cultivate the shocking an open door for development. From virtual labs to crafty outline materials, this guide ensures students are outstanding for progress. VI. Vanquishing Challenges and Remaining Invigorated Web learning goes with its own course of action of troubles. This part pays special attention to normal blocks like detachment, time use difficulties, and movement issues. It gives essential clues on extra moved, searching for help, and saving solid areas for an among fun and serious exercises. End Considering everything, "Rx for Progress: A persuading Manual for Electronic Nursing Classes" fills in as a total partner without a doubt clinical managers leaving on their online training experience. By resolving focal issues of view from program decision to overwhelming virtual homerooms, this guide partners with students to thrive in the dynamic and repaying field of electronic nursing training. Outfitted with data and sensible designs, perusers are all set to embrace the doorways and burdens of electronic getting, making game plans for a valuable nursing business.

1 0

Stunnel HA Options
by caspernetherlands＠gmail.com 07 Mar '24

07 Mar '24

Hello folks, I have seen a couple of other posts concerning this question but I am still unclear and wanted to see if there are any new options for 2024. What would the recommended setup for Stunnel look like for HA (high-availability)? All I need is basically to have two servers, one active and another one stand by and be able to fail over to the standby server when the active one becomes unavailable due to hardware failure, bad vmotion etc. Extra point if this setup offers automatic failover to DR as well, meaning failover to a third server that's also on standby in case of catastrophic failures on the first two. This almost looks like a load-balancing solution but not really. I say this because I tried to leverage F5 to accomplish this HA scenario and wasn't successful at it because of the way that the F5 performs active checks so often and how noisy that can be for network perimeter security setups. My main request is the local HA though, I can come up with a solution for DR later on. Any recommendation is appreciated. Thank you in advance!

4 5

possible typo in manpage imap example
by alisonatwork＠outlook.com 05 Mar '24

05 Mar '24

Hi, It's possible that I am missing something obvious, but I was reading the manpage today and it seems like the example suggesting how to configure an email client for tunneled imap is incorrect. It suggests that the user configure their client to connect to port 119, but then the example stunnel config shows accept = 143. If this is indeed incorrect, I think the following files need to be modified to change 119 to 143: doc/stunnel.8.in doc/stunnel.html.in doc/stunnel.pl.8.in doc/stunnel.pl.html.in doc/stunnel.pl.pod.in doc/stunnel.pod.in Regards, Alison

1 0

Succeeding in Nursing Academia: The Critical Impact of Online Course Assistance on Academic Triumph
by towim42830＠artgulin.com 04 Mar '24

04 Mar '24

Introduction: In the dynamic landscape of education, the demand for online courses has witnessed an unprecedented surge, especially in fields like nursing. The flexibility and accessibility offered by online learning platforms have made education more attainable for individuals balancing work, family, and other commitments nurs fpx 4050 assessment 2. However, the rigorous nature of nursing programs can pose challenges for students, leading many to seek assistance with their coursework. In this blog, we will explore the growing trend of students turning to online course help and paying someone to do their online classes, particularly in the realm of nursing paper writing services. The Rise of Online Nursing Education: The allure of online nursing education lies in its flexibility, allowing aspiring nurses to pursue their dreams without sacrificing their current commitments. With the increasing popularity of online nursing programs, students are presented with a unique set of challenges. Balancing clinical experiences, theoretical coursework, and other responsibilities can be overwhelming, prompting students to explore options for additional support. The Need for Academic Assistance: Nursing programs often require students to delve into complex topics, complete extensive research, and submit well-crafted papers. The pressure to excel in both practical and theoretical aspects of nursing education can be daunting, leading some students to seek online course help. The question then arises – is it ethical to pay someone to do my online class or assist with nursing paper writing services? Understanding the Ethical Dilemma: The ethical considerations surrounding seeking academic assistance are complex. On one hand, students argue that external support enables them to focus on practical experiences and hands-on learning. On the other hand, critics argue that outsourcing coursework undermines the integrity of education and the development of essential skills nurs-fpx 4060 assessment 1. Navigating the Online Course Help Landscape: For those considering online course help, it is crucial to approach the situation with caution and a clear understanding of the ethical implications. Many online platforms and services claim to provide assistance with nursing paper writing services, but it is essential to discern between legitimate support and services that may compromise academic integrity. Choosing Reputable Services: When seeking online course help for nursing paper writing services, it is imperative to choose reputable and ethical service providers. These services should prioritize academic honesty, transparency, and the development of students' critical thinking skills. Thoroughly researching and vetting potential service providers can help students make informed decisions. The Role of Academic Support Services: Rather than viewing online course help as a shortcut, students should consider these services as valuable supplements to their learning journey. Academic support services can offer guidance, feedback, and assistance in understanding complex nursing concepts. This collaborative approach allows students to enhance their skills while meeting the demands of their coursework chamberlain nurse executive track. Developing Essential Skills: While online course help can provide support, it is essential for students to actively engage with the material and develop the critical skills necessary for a successful nursing career. Ethical academic support services aim to empower students, encouraging them to take an active role in their education and fostering a sense of responsibility for their learning outcomes. Balancing Priorities: The decision to seek online course help should be accompanied by a realistic assessment of one's priorities and capabilities. Nursing students juggling multiple responsibilities may find that strategic use of academic support services can help them maintain a healthy work-life balance while excelling in their coursework. The Impact on Future Nursing Practice: Aspiring nurses must recognize that the skills and knowledge acquired during their education directly impact their ability to provide quality patient care in the future. While online course help can provide temporary relief, it is crucial for students to actively engage with the material and strive for a deep understanding of nursing concepts. Conclusion: The landscape of nursing education is evolving, with online courses offering unprecedented flexibility for students. As the demand for nursing professionals continues to grow, the need for academic support services, including nursing paper writing services, is likely to persist online class help. However, students must approach online course help with a balanced perspective, understanding the ethical considerations and prioritizing the development of essential skills. By navigating the online course help landscape responsibly, nursing students can enhance their learning experience and prepare for a successful and fulfilling career in healthcare.

1 0

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

How to use best config to secure stunnel?
by sephrrr＠gmail.com 27 Feb '24

27 Feb '24

Irans goverment start to detect stunnel with openvpn tunnel. how to avoid this? is there any updates for stunnel for this problem?

1 0

Windows 2022 tunnel client issues
by Mark Weishaar 23 Feb '24

23 Feb '24

Hello, I’m working on replacing an older Windows server that uses stunnel 5.71 to connect to an Oracle database running on a Linux box. I can communicate just fine with the older Windows machine and another Linux box; however, when I try to connect with the stunnel 5.72 on the Windows 2022 server, I keep running into issues and the connection is forcibly closed. Old Windows server: stunnel 5.71 New Windows 2022 server: stunnel 5.72 (I also tried 5.71 and 5.62 just to rule things out Oracle db server: stunnel 5.72 Other Linux server: stunnel 5.72 My stunnel.conf file is very basic, but this is what is working from my other Windows server (running stunnel 5.71): debug = 7 [oracle15211] client = yes accept = 127.0.0.1:15211 connect = 172.28.125.52:15211 Below is the log with debug level 7… the only issue that I’m seeing is the “transfer() loop executes not transferring any data” message that baffles me but I’m not sure if that’s the cause of my issues or not: 2024.02.23 11:10:21 LOG7[0]: Service [oracle15211] started 2024.02.23 11:10:21 LOG7[0]: Setting local socket options (FD=768) 2024.02.23 11:10:21 LOG7[0]: Option TCP_NODELAY set on local socket 2024.02.23 11:10:21 LOG5[0]: Service [oracle15211] accepted connection from 127.0.0.1:49750 2024.02.23 11:10:21 LOG6[0]: s_connect: connecting 172.28.125.52:15211 2024.02.23 11:10:21 LOG7[0]: s_connect: s_poll_wait 172.28.125.52:15211: waiting 10 seconds 2024.02.23 11:10:21 LOG7[0]: FD=780 ifds=rwx ofds=--- 2024.02.23 11:10:21 LOG5[0]: s_connect: connected 172.28.125.52:15211 2024.02.23 11:10:21 LOG5[0]: Service [oracle15211] connected remote server from 172.28.112.245:49751 2024.02.23 11:10:21 LOG7[0]: Setting remote socket options (FD=780) 2024.02.23 11:10:21 LOG7[0]: Option TCP_NODELAY set on remote socket 2024.02.23 11:10:21 LOG7[0]: Remote descriptor (FD=780) initialized 2024.02.23 11:10:21 LOG6[0]: SNI: sending servername: 172.28.125.52 2024.02.23 11:10:21 LOG6[0]: Peer certificate not required 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): before SSL initialization 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): TLSv1.3 read encrypted extensions 2024.02.23 11:10:21 LOG6[0]: CERT: Certificate verification disabled 2024.02.23 11:10:21 LOG6[0]: CERT: Certificate verification disabled 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): TLSv1.3 read server certificate verify 2024.02.23 11:10:21 LOG7[0]: OCSP stapling: Client callback called 2024.02.23 11:10:21 LOG6[0]: OCSP: Certificate chain verification disabled 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2024.02.23 11:10:21 LOG7[0]: 1 client connect(s) requested 2024.02.23 11:10:21 LOG7[0]: 1 client connect(s) succeeded 2024.02.23 11:10:21 LOG7[0]: 0 client renegotiation(s) requested 2024.02.23 11:10:21 LOG7[0]: 0 session reuse(s) 2024.02.23 11:10:21 LOG6[0]: TLS connected: new session negotiated 2024.02.23 11:10:21 LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2024.02.23 11:10:21 LOG6[0]: Peer temporary key: X25519, 253 bits 2024.02.23 11:10:21 LOG7[0]: Compression: null, expansion: null 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: Deallocating application specific data for session connect address 2024.02.23 11:10:21 LOG7[0]: New session callback 2024.02.23 11:10:21 LOG7[0]: Peer certificate was cached (1375 bytes) 2024.02.23 11:10:21 LOG6[0]: Session id: B36502A30B16F61EFE3A13B7BAA73BBCD57C2C6DB838FFC7CDFDE9BF7D8607A0 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSL negotiation finished successfully 2024.02.23 11:10:21 LOG7[0]: Initializing application specific data for session authenticated 2024.02.23 11:10:21 LOG7[0]: New session callback 2024.02.23 11:10:21 LOG7[0]: Deallocating application specific data for session connect address 2024.02.23 11:10:21 LOG6[0]: Session id: 7FC6ABDCD70443FE70736F725F90792FAC2692FD9AD8F54A3F0443C2403C9A0C 2024.02.23 11:10:21 LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket 2024.02.23 11:10:21 LOG3[0]: transfer() loop executes not transferring any data 2024.02.23 11:10:21 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org<mailto:[email protected]> 2024.02.23 11:10:21 LOG3[0]: stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.02.23 11:10:21 LOG3[0]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.02.23 11:10:21 LOG3[0]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2024.02.23 11:10:21 LOG7[0]: errno: (*_errno()) 2024.02.23 11:10:21 LOG3[0]: protocol=TLSv1.3, SSL_pending=0, SSL_has_pending=0 2024.02.23 11:10:21 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y 2024.02.23 11:10:21 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2024.02.23 11:10:21 LOG3[0]: sock_can_rd=n, sock_can_wr=n 2024.02.23 11:10:21 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n 2024.02.23 11:10:21 LOG3[0]: read_wants_read=Y, read_wants_write=n 2024.02.23 11:10:21 LOG3[0]: write_wants_read=n, write_wants_write=n 2024.02.23 11:10:21 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n 2024.02.23 11:10:21 LOG3[0]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2024.02.23 11:10:21 LOG5[0]: Connection reset: 685 byte(s) sent to TLS, 381 byte(s) sent to socket 2024.02.23 11:10:21 LOG7[0]: remote_fd reset (FD=780) 2024.02.23 11:10:21 LOG7[0]: Remote descriptor (FD=780) closed 2024.02.23 11:10:21 LOG7[0]: local_rfd/local_wfd reset (FD=768) 2024.02.23 11:10:21 LOG7[0]: Local descriptor (FD=768) closed 2024.02.23 11:10:21 LOG7[0]: Service [oracle15211] finished (0 left) Any help is greatly appreciated! Thank you, Mark

1 0

Dynamic DNS
by alstar＠maybenot.work 20 Feb '24

20 Feb '24

Hi, I'm running Stunnel on Linux. It needs to connect to a dynamic IP address (by domain name). The DNS is updated automatically. I noticed that the last time the address changed, Stunnel stopped working. A ping from the machine produced the correct address but Stunnel was using the old one. Will a reload work?

4 6

stunnel 5.72 released
by Michał Trojnara 05 Feb '24

05 Feb '24

Dear Users, I have released version 5.72 of stunnel. ### Version 5.72, 2024.02.04, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.2.1. * Bugfixes - Fixed SSL_CTX_new() errors handling. - Fixed OPENSSL_NO_PSK builds. - Android build updated for NDK r23c. - stunnel.nsi updated for Debian 12. - Fixed tests with OpenSSL older than 1.0.2. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d532941281ae353319735144e4adb9ae489a10b7e309c58a48157f08f42e949 stunnel-5.72.tar.gz 1037c53f8ab590c2f3001e54cf381c3ea4225e9670b03870191383060e6851e7 stunnel-5.72-win64-installer.exe 668161b90034820198c456b4137ed3680d6fd49d4de920d51e499b84538f63d3 stunnel-5.72-android.zip Best regards, Mike

1 0

error:0A00010B:SSL routines::wrong version number
by Graham Lang 18 Dec '23

18 Dec '23

Hi, I've been using Stunnel for many years without a problem but I just changed my email provider and now my mail client can't send emails. Receiving via POP is still fine, but sending via SMTP is giving the error "SSL_connect: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number" The old SMTP server was on port 465 whereas the new server (hotmail) is on port 587 so that may be the source of the problem. My config file is quite simple: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [pop] accept = 110 connect = outlook.office365.com:995 [smtp] accept = 25 connect = smtp-mail.outlook.com:587 I just changed the POP and SMTP server details to the new ones. POP is still on port 995 as it was before but SMTP has changed from 465 to 587. I was running an older version of Stunnel but updating to latest version hasn't helped. Does anyone have any ideas? I'd hate to have to lose my old Email client which has so many messages stored so it would be great to get it working fully with hotmail. Thanks! Graham.

4 3

stunnel - slowness
by Luciano Bonifácio 15 Dec '23

15 Dec '23

Good morning guys! I started using stunnel very recently with GLPI to authenticate to Google LDAP, and it is working, but with extreme slowness at Login. Something around 35 seconds. I believe there may be some parameters, adjustments to make. I'm sending the stunnel.conf configuration below, as well as the attached log file(txt). Could you give me a suggestion. Thanks, Luciano # stunnel.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - debug = 7 output = /var/log/stunnel4/stunnel.log [ldap] client = yes accept = 127.0.0.1:1636 connect = ldap.google.com:636 cert = /etc/certificates/glpi_ldap.crt key = /etc/certificates/glpi_ldap.key - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 0

Paho connection to stunnel
by jesramsing＠hotmail.com 15 Dec '23

15 Dec '23

I have a strange problem connecting from a C++ application using the Paho framework to the stunnel. The certificates are self signed, and MQTT Explorerr hooks up nicely and validates the certificate when fed with the appropriate ca certificate. So, stunnel seems to behave nicely on some cases, others not. The stunnel log shows a SSL_accept: ssl/record/ssl3_record_c:354: errror: 0A00010B:SSL wrong version. I have tried version 1.1 and 1.2 in the Paho library, both failing with the same error code. Any ideas or suggestions?

1 0

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Michael, On 12/13/23 15:43, Michael D. Setzer II wrote: > /var/log/secure Thank you for your reply, but /var/log is basically empty (meaning very few files located there). journald has absorbed everything and files are no longer the way to get logs from systemd-based environments. The only thing which contains non-trivial information is /var/log/journal/* which is a bunch of binary files. My reply below shows how you can get the stunnel-related log messages. I don't believe they are available through any traditional text-based log file. -chris > On 13 Dec 2023 at 15:37, Christopher Schultz wrote: > > Date sent: Wed, 13 Dec 2023 15:37:04 -0500 > To: "'stunnel-users(a)stunnel.org'" > <stunnel-users(a)stunnel.org> > From: Christopher Schultz > <chris(a)christopherschultz.net> > Subject: [stunnel-users] Re: Getting logs in systemd > environment > patches" <stunnel-users.stunnel.org> > >> Carter, >> >> On 12/13/23 14:53, cbrowne wrote: >>> Have you tried doing "find / -name stunnel.log -print" as root. I have >>> found that the log file can be in a number of different locations >>> depending on the system. >> >> There are no files named stunnel.log on my system. >> >> I do not have a specific setting for "output". I was expecting syslog to >> be used for that purpose without a specific setting. syslog=yes appears >> to be the default given the man page for stunnel. >> >> But your comment got me more interested in exactly what was happening, >> so I tried /not/ limiting journalctl --follow to a specific service and >> I can see all kinds of things coming from stunnel: >> >> >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local >> socket options (FD=3) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service >> [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready >> file descriptor(s) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 >> events=0x2001 revents=0x1 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 >> events=0x2001 revents=0x0 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service >> [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service >> [ORU-outbound] started >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local >> socket options (FD=15) >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option >> TCP_NODELAY set on local socket >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service >> [ORU-outbound] accepted connection from ::ffff:client.ip:44905 >> Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer >> certificate required >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): before SSL initialization >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing >> application specific data for session authenticated >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no >> virtual services defined >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS read client hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server hello >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write key exchange >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write certificate request >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state >> (accept): SSLv3/TLS write server done >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert >> (read): fatal: certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove >> session callback >> Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: >> ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert >> certificate unknown >> Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection >> reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket >> >> So this probably just comes down to either systemd/journalctl or me >> being stupid. >> >> Instead of asking for the journal/log for the "unit" stunnel (i.e. >> journalctl -u stunnel), you need instead to ask for the "systelog >> identifier" called stunnel like this: >> >> $ journalctl -t stunnel >> >> If you use --follow you get tail -f behavior, which is nice to see >> what's happening in real-time. >> >> -chris >> >>> On 12/13/2023 2:39 PM, Christopher Schultz wrote: >>>> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >>>> the case that I should be able to view the journals using this command: >>>> >>>> sudo journalctl --follow -u stunnel.service >>>> >>>> But nothing is ever printed there. >>> >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > > > +------------------------------------------------------------+ > Michael D. Setzer II - Computer Science Instructor > (Retired) > mailto:[email protected] > mailto:[email protected] > mailto:[email protected] > Guam - Where America's Day Begins > G4L Disk Imaging Project maintainer > http://sourceforge.net/projects/g4l/ > +------------------------------------------------------------+ > > >

2 2

Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

All, I recently built a server from scratch in Amazon EC2 using Amazon Linux 2023 which is systemd-based. When having trouble with a client failing to connect to our stunnel-based service, I tried raising the log level: debug=7 and restarted the service. I can't find any indication that the logs are available. There is no /var/log/stunnel directory. There are none of the usual files I might expect these logs to be in on other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears the case that I should be able to view the journals using this command: sudo journalctl --follow -u stunnel.service But nothing is ever printed there. Does anyone know how to get logging from stunnel in this kind of environment? (BTW, *I* am able to connect to this service, so I know it's running, etc. This is only a logging-problem, not an stunnel-isnt-working problem.) Thanks, -chris

2 1

Re: Getting logs in systemd environment
by Christopher Schultz 13 Dec '23

13 Dec '23

Carter, On 12/13/23 14:53, cbrowne wrote: > Have you tried doing "find / -name stunnel.log -print" as root. I have > found that the log file can be in a number of different locations > depending on the system. There are no files named stunnel.log on my system. I do not have a specific setting for "output". I was expecting syslog to be used for that purpose without a specific setting. syslog=yes appears to be the default given the man page for stunnel. But your comment got me more interested in exactly what was happening, so I tried /not/ limiting journalctl --follow to a specific service and I can see all kinds of things coming from stunnel: Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=3) from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Setting local socket options (FD=3) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Service [ORU-outbound] accepted connection from ::ffff:20.204.213.204:55455 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174806]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Found 1 ready file descriptor(s) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=4 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=11 events=0x2001 revents=0x1 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=12 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=13 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: FD=14 events=0x2001 revents=0x0 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[main]: Service [ORU-outbound] accepted (FD=15) from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Service [ORU-outbound] started Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Setting local socket options (FD=15) Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Option TCP_NODELAY set on local socket Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174807]: Service [ORU-outbound] accepted connection from ::ffff:client.ip:44905 Dec 13 20:31:00 example.com stunnel[300695]: LOG6[174807]: Peer certificate required Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): before SSL initialization Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: Initializing application specific data for session authenticated Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: SNI: no virtual services defined Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS read client hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server hello Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write key exchange Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write certificate request Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174807]: TLS state (accept): SSLv3/TLS write server done Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: TLS alert (read): fatal: certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG7[174806]: Remove session callback Dec 13 20:31:00 example.com stunnel[300695]: LOG3[174806]: SSL_accept: ssl/record/rec_layer_s3.c:1605: error:0A000416:SSL routines::sslv3 alert certificate unknown Dec 13 20:31:00 example.com stunnel[300695]: LOG5[174806]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket So this probably just comes down to either systemd/journalctl or me being stupid. Instead of asking for the journal/log for the "unit" stunnel (i.e. journalctl -u stunnel), you need instead to ask for the "systelog identifier" called stunnel like this: $ journalctl -t stunnel If you use --follow you get tail -f behavior, which is nice to see what's happening in real-time. -chris > On 12/13/2023 2:39 PM, Christopher Schultz wrote: >> other systems (e.g. /var/log/seure, /var/log/auth, etc.). It appears >> the case that I should be able to view the journals using this command: >> >> sudo journalctl --follow -u stunnel.service >> >> But nothing is ever printed there. >

1 0

Connect multiple clients to one server port
by egig＠gmv.com 12 Dec '23

12 Dec '23

Hi all I was wondering if there is a way to connect multiple stunnel clients running on different machines to the same stunnel server service, also running on a different machine. All the clients must connect to the same server port. I have tried it with my current config but I haven't been able to make it work, is this even possible?? Thanks, Esteban.

3 4

Accepted connection and then TIMEOUTconnection exceeded:
by trashrap22＠gmail.com 07 Dec '23

07 Dec '23

Hi All, I can ssh to my VM with terminal etc. However my stunnel has something stopping the packet flow? What could be the problem and what should I check / troubleshoot: client log file: 2023.12.07 07:21:05 LOG7[0]: Service [Sql_Silicon] started 2023.12.07 07:21:05 LOG7[0]: Setting local socket options (FD=636) 2023.12.07 07:21:05 LOG7[0]: Option TCP_NODELAY set on local socket 2023.12.07 07:21:05 LOG5[0]: Service [Sql_Silicon] accepted connection from 127.0.0.1:50474 2023.12.07 07:21:05 LOG6[0]: s_connect: connecting <IP>:<Port> 2023.12.07 07:21:05 LOG7[0]: s_connect: s_poll_wait <IP>:<Port>: waiting 10 seconds 2023.12.07 07:21:05 LOG7[0]: FD=676 ifds=rwx ofds=--- 2023.12.07 07:21:15 LOG3[0]: s_connect: s_poll_wait <IP>:<Port>: TIMEOUTconnect exceeded 2023.12.07 07:21:15 LOG3[0]: No more addresses to connect 2023.12.07 07:21:15 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.12.07 07:21:15 LOG7[0]: local_rfd/local_wfd reset (FD=636) 2023.12.07 07:21:15 LOG7[0]: Local descriptor (FD=636) closed 2023.12.07 07:21:15 LOG7[0]: Service [Sql_Silicon] finished (0 left) My VM is a linux server, on startup of stunnel I get this concerning message which might be the cause? However, I checked and stunnel4:stunnel4 has permissions on the folder and psk file. 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt server log file on start service: 2023.12.07 07:40:45 LOG7[ui]: Clients allowed=500 2023.12.07 07:40:45 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform 2023.12.07 07:40:45 LOG5[ui]: Compiled with OpenSSL 1.1.1k 25 Mar 2021 2023.12.07 07:40:45 LOG5[ui]: Running with OpenSSL 1.1.1w 11 Sep 2023 2023.12.07 07:40:45 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2023.12.07 07:40:45 LOG7[ui]: errno: (*__errno_location ()) 2023.12.07 07:40:45 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2023.12.07 07:40:45 LOG5[ui]: UTF-8 byte order mark not detected 2023.12.07 07:40:45 LOG5[ui]: FIPS mode disabled 2023.12.07 07:40:45 LOG7[ui]: Compression disabled 2023.12.07 07:40:45 LOG7[ui]: No PRNG seeding was required 2023.12.07 07:40:45 LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/pskSQL_.txt 2023.12.07 07:40:45 LOG6[ui]: PSKsecrets line 1: 64-byte hexadecimal key configured for identity "siliconServer" 2023.12.07 07:40:45 LOG6[ui]: Initializing service [SQL-<port>] 2023.12.07 07:40:45 LOG6[ui]: PSK identities: 1 retrieved 2023.12.07 07:40:45 LOG7[ui]: Ciphers: PSK 2023.12.07 07:40:45 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.12.07 07:40:45 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2023.12.07 07:40:45 LOG7[ui]: No certificate or private key specified 2023.12.07 07:40:45 LOG6[ui]: DH initialization needed for DHE-PSK-AES256-GCM-SHA384 2023.12.07 07:40:45 LOG7[ui]: DH initialization 2023.12.07 07:40:45 LOG7[ui]: No certificate available to load DH parameters 2023.12.07 07:40:45 LOG6[ui]: Using dynamic DH parameters 2023.12.07 07:40:45 LOG7[ui]: ECDH initialization 2023.12.07 07:40:45 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.12.07 07:40:45 LOG5[ui]: Configuration successful 2023.12.07 07:40:45 LOG7[ui]: Binding service [SQL-<port>] 2023.12.07 07:40:45 LOG7[ui]: Listening file descriptor created (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Setting accept socket options (FD=9) 2023.12.07 07:40:45 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2023.12.07 07:40:45 LOG6[ui]: Service [SQL-<port>] (FD=9) bound to <IP>:<port> 2023.12.07 07:40:45 LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/ 2023.12.07 07:40:45 LOG7[main]: Created pid file /stunnel.pid 2023.12.07 07:40:45 LOG7[cron]: Cron thread initialized 2023.12.07 07:40:45 LOG6[cron]: Executing cron jobs 2023.12.07 07:40:45 LOG5[cron]: Updating DH parameters

2 1

Stunnel load balancing through F5
by caspernetherlands＠gmail.com 05 Dec '23

05 Dec '23

Hello, Was wondering if anyone has tried to setup an HA like setup, specifically active/passive through two Stunnel servers and F5 load balancers. The problem I have is that TCP health checks (active checks) from the F5 are causing session initiation all the way to the 3rd party on the other side and this is causing a lot of unnecessary TCP traffic at the transport layer. The good thing is that the F5 closes these TCP sessions, but the problem is the 3rd party thinks someone is trying to brute force or something. Does anyone know how to maintain the TCP active health checks that the F5 does, but at the same time not cause a session initiation all the way to the 3rd party? Or if it’s not possible to stop the session initiation, would there be any option where something can be adjusted in the stunnel side so that the other side sees only one TCP health check as opposed to multiple every few seconds?

3 3

Connection failed: no suitable signature algorithm
by Martin K. 01 Dec '23

01 Dec '23

I'm trying to understand this error: SSL_accept: ssl/t1_lib.c:2827: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm How can I fix that? Is it because of the openssl version? I'm using Stunnel 5.71 on both sides. The server-side stunnel is built from source.

1 0

WG: stunnel core dumps, "SSL3_GET_RECORD:decryption failed or bad record mac"
by Sacha Hottinger 27 Nov '23

27 Nov '23

Hello, We are using stunnel 5.71 on Solaris 10 to tunnel NFS on more than 50 systems. In the past we saw stunnel dumping cores without any errors or hints in the stunnel log file. It was believed to be an OpenSSL 1.x problem. We got an stunnel version with SSL 2.x and 3.x but we had to go back to 1.x because of other problems. We noticed the dumps to happen at regular times and found a script that made NFS requests every 10 Min. After changing the script so there are less NFS requests it was stable. It looked like the problem accumulated over time and a counter or something alike reached its limit which then resulted in the core dump. Then the core dumps started again. It still seems to be related to the amount of requests because the problem occurs on the two NFS Servers with the highest number of connections. This time, we see errors in the stunnel log. The error slightly varies: 2023.10.12 22:05:43 LOG3[10745]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac // There were also a few cases with an additional "internal error". I.e: 2023.10.16 00:23:53 LOG5[2968]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:38270 2023.10.16 00:40:19 LOG3[2968]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG3[2967]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.16 00:40:19 LOG5[2968]: Connection reset: 2476 byte(s) sent to TLS, 3324 byte(s) sent to socket 2023.10.16 00:40:19 LOG5[2967]: Connection reset: 2500 byte(s) sent to TLS, 3100 byte(s) sent to socket INTERNAL ERROR: Bad magic at ssl.c, line 192 2023.10.16 00:40:20 LOG6[ui]: Initializing inetd mode configuration // or 2023.10.23 07:33:53 LOG5[62]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:50626 2023.10.23 07:38:37 LOG3[62]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.23 07:38:37 LOG5[62]: Connection reset: 364 byte(s) sent to TLS, 336 byte(s) sent to socket ... 2023.10.23 07:44:37 LOG5[61]: Connection reset: 1704 byte(s) sent to TLS, 2360 byte(s) sent to socket INTERNAL ERROR: Bad magic at OpenSSL, line 0 // or 2023.10.24 08:20:59 LOG5[52]: Service [tls-nfs-srv] connected remote server from 127.0.0.1:43966 2023.10.24 08:56:13 LOG6[52]: Read socket closed (readsocket) ... 2023.10.24 09:00:01 LOG5[53]: Service [tls-nfs-srv] accepted connection from 1.2.3.4:59973 2023.10.24 09:00:01 LOG6[53]: Peer certificate not required 2023.10.24 09:00:01 LOG3[49]: SSL_read: s3_pkt.c:534: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2023.10.24 09:00:01 LOG5[49]: Connection reset: 7112 byte(s) sent to TLS, 9188 byte(s) sent to socket INTERNAL ERROR: Dead canary at OpenSSL, line 0 I have attached a file with more details. Although this looks like an OpenSSL problem at first glance, we think it still could be a problem with stunnel. Can you make more out of this data? Do you know a way to log more information about the connections? i.e. not all requests were accepted. What happened here? 2023.11.24 02:50:13 LOG7[359]: 354 server accept(s) requested 2023.11.24 02:50:13 LOG7[359]: 351 server accept(s) succeeded Thank you in advance. Best regards Sasha This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

1 0

Proxy an unencrypted Oracle client
by Randall Smith 15 Nov '23

15 Nov '23

I'm trying to determine if it is possible to connect an Oracle client that is not configured for encrypted connections to a TLS or mTLS connected Oracle Autonomous database using an stunnel client connection. First I tested a TLS capable client to verify connectivity. Next I set up stunnel to make the same TLS connection. I have configured stunnel as follows: foreground = yes debug = info [oracle] accept = 127.0.0.1:1521 connect = adb.us-ashburn-1.oraclecloud.com:1521 client = yes Next, I attempted a non-encrypted Oracle database connection to 127.0.0.1:1521, but got the following errors from stunnel: 2023.11.14 10:58:50 LOG6[0]: TLS connected: new session negotiated 2023.11.14 10:58:50 LOG6[0]: TLSv1.2 ciphersuite: AES256-GCM-SHA384 (256-bit encryption) 2023.11.14 10:58:50 LOG3[0]: SSL_read: ../ssl/record/ssl3_record.c:1065: error:14191044:SSL routines:tls1_enc:internal error 2023.11.14 10:58:50 LOG5[0]: Connection reset: 752 byte(s) sent to TLS, 8 byte(s) sent to socket ^C2023.11.14 10:58:57 LOG3[ui]: Received SIGINT; terminating Could this be a configuration issue in stunnel or might there be something in the Oracle database protocol itself that is different for TLS connections that would prevent tunneling?

1 0

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 10 Nov '23

10 Nov '23

Hi Pavan, AFAIK, there is no option to customise the components when you do a silent install. You get all components. If someone knows better, let me know. Regards Jose > On 9/11/2023, at 1:09 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Jose, > > Gentle Reminder !! > > Can we get an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Tuesday, November 7, 2023 10:17 AM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Jose, > > I have re-attached the snapshots for your reference. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Thursday, November 2, 2023 4:49 PM > To: Pavan Reddy <pavan.reddy(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Pavan, > > Sorry, I don’t see the snapshots/customizations you talk about. > > Regards > Jose > >> On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: >> >> Hi Team, >> >> Could you please provide an update on this. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Pavan Reddy >> Sent: Wednesday, October 25, 2023 3:08 PM >> To: Josealf.rm <josealf(a)rocketmail.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: RE: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. >> For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. >> >> Application is installing silently by using /S. >> >> While installing the application we found these customizations. And I am attaching the snapshots. >> >> Could you please have a look and help us to handle these customizations with silent properties. >> >> Regards, >> PavanReddy. >> >> -----Original Message----- >> From: Josealf.rm <josealf(a)rocketmail.com> >> Sent: Monday, October 23, 2023 4:50 PM >> To: Meta Email <meta(a)adaptiva.com> >> Cc: stunnel-users(a)stunnel.org >> Subject: Re: [stunnel-users] Silent installation is not working for >> Stunnel v5.71 >> >> [Some people who received this message don't often get email from >> josealf(a)rocketmail.com. Learn why this is important at >> https://aka.ms/LearnAboutSenderIdentification ] >> >> Stunnel uses an NSIS based installer. Try using /S instead of -quiet. >> >> -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. >> >> >> Regards >> Jose >> >>>> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >>> >>> Hi Team, >>> >>> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >>> https://ada/ >>> p%2F&data=05%7C01%7Cpavan.reddy%40adaptiva.com%7C1d6b0f9facd740f536d4 >>> 08dbdb959b24%7C1264bc823da147f88a41e4c19cdc7499%7C0%7C0%7C63834520784 >>> 7265891%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiL >>> CJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hWcJe3nMjxuwIPz9M >>> ee9qKT5xCAi6ubmK3l%2FIu45e94%3D&reserved=0 >>> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40a >>> d >>> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e >>> 4 >>> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWI >>> j >>> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7 >>> C >>> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&res >>> e >>> rved=0 >>> >>> We have downloaded the binary from below URL – >>> https://www/. >>> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.co >>> m >>> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc749 >>> 9 >>> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjA >>> w >>> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sd >>> a >>> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >>> >>> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >>> Could you please help us to install the application silently. >>> _______________________________________________ >>> stunnel-users mailing list -- stunnel-users(a)stunnel.org To >>> unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> >> Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email. > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Re: Silent installation is not working for Stunnel v5.71
by Josealf.rm 02 Nov '23

02 Nov '23

Hi Pavan, Sorry, I don’t see the snapshots/customizations you talk about. Regards Jose > On 30/10/2023, at 7:19 AM, Pavan Reddy <pavan.reddy(a)adaptiva.com> wrote: > > Hi Team, > > Could you please provide an update on this. > > Regards, > PavanReddy. > > -----Original Message----- > From: Pavan Reddy > Sent: Wednesday, October 25, 2023 3:08 PM > To: Josealf.rm <josealf(a)rocketmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: RE: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. > For more details you may refer https://adaptiva.com/products/autonomous-patch. We are willing to add Stunnel 5.71 product to our catalogue. > > Application is installing silently by using /S. > > While installing the application we found these customizations. And I am attaching the snapshots. > > Could you please have a look and help us to handle these customizations with silent properties. > > Regards, > PavanReddy. > > -----Original Message----- > From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Monday, October 23, 2023 4:50 PM > To: Meta Email <meta(a)adaptiva.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Silent installation is not working for Stunnel v5.71 > > [Some people who received this message don't often get email from josealf(a)rocketmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > Stunnel uses an NSIS based installer. Try using /S instead of -quiet. > > -quiet is a switch for stunnel.exe, not for the installer and is used to configure stunnel as a service. > > > Regards > Jose > >> On 23/10/2023, at 3:30 AM, Meta Adaptiva via stunnel-users <stunnel-users(a)stunnel.org> wrote: >> >> Hi Team, >> >> We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fadap >> tiva.com%2Fproducts%2Fautonomous-patch&data=05%7C01%7Cpavan.reddy%40ad >> aptiva.com%7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4 >> c19cdc7499%7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIj >> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C >> %7C%7C&sdata=Vp%2FDHnulu3OEo%2BBnEnt5EY4GQfThzGQ5SC75YK%2Bb3V0%3D&rese >> rved=0 >> >> We have downloaded the binary from below URL – >> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww. >> stunnel.org%2Fdownloads.html&data=05%7C01%7Cpavan.reddy%40adaptiva.com >> %7C1082867908d64478920608dbd3ba192e%7C1264bc823da147f88a41e4c19cdc7499 >> %7C0%7C0%7C638336568481075204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAw >> MDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sda >> ta=kIsTmj%2Bx3fIiPWKL85BDKJ8yN2K%2FKk077dWHsb82Q9M%3D&reserved=0 >> >> We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. >> Could you please help us to install the application silently. >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe >> send an email to stunnel-users-leave(a)stunnel.org > > Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed or otherwise directed. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Adaptiva. Finally, the recipient should check this email and any attachments for the presence of viruses. Adaptiva accepts no liability for any damage caused by any virus transmitted by this email.

1 0

two stunnels in the local network
by alessandro.deliperi＠ichnobyte.it 02 Nov '23

02 Nov '23

Hi everyone, this is my first question. I have successfully configured a stunnel (A) that does the job of it. I need to configure a second stunnel (B) that works in a more hidden network. When B connects to A, which connects to public mail server X I get a time out error. I bring you the logs, I think it is related to the fact that both stunnel servers are trying to establish a TLS session. Is there a way to solve? 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on local socket 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] accepted connection from 192.168.0.109:46078 2023.11.02 08:42:10 LOG6[0]: s_connect: connecting 192.168.180.10:25 2023.11.02 08:42:10 LOG7[0]: s_connect: s_poll_wait 192.168.180.10:25: waiting 10 seconds 2023.11.02 08:42:10 LOG7[0]: FD=6 events=0x2001 revents=0x0 2023.11.02 08:42:10 LOG7[0]: FD=11 events=0x2005 revents=0x0 2023.11.02 08:42:10 LOG5[0]: s_connect: connected 192.168.180.10:25 2023.11.02 08:42:10 LOG5[0]: Service [smtp-tls] connected remote server from 192.168.0.23:41156 2023.11.02 08:42:10 LOG7[0]: Setting remote socket options (FD=11) 2023.11.02 08:42:10 LOG7[0]: Option TCP_NODELAY set on remote socket 2023.11.02 08:42:10 LOG7[0]: Remote descriptor (FD=11) initialized 2023.11.02 08:42:10 LOG7[0]: <- 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> 220 mailservers 2023.11.02 08:42:10 LOG7[0]: -> EHLO localhost 2023.11.02 08:42:11 LOG7[0]: <- 250-email-smtp.posta 2023.11.02 08:42:11 LOG7[0]: <- 250-8BITMIME 2023.11.02 08:42:11 LOG7[0]: <- 250-STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 250-AUTH PLAIN LOGIN 2023.11.02 08:42:11 LOG7[0]: <- 250 Ok 2023.11.02 08:42:11 LOG7[0]: -> STARTTLS 2023.11.02 08:42:11 LOG7[0]: <- 503 TLS not available due to temporary reason: TLS already active 2023.11.02 08:42:11 LOG3[0]: Remote server is not RFC 2487 compliant 2023.11.02 08:42:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Suppressing warnings
by Ian Pilcher 31 Oct '23

31 Oct '23

I am using stunnel (along with an Apache reverse proxy) to enable my browser to connect to my old managed switches. An example configuration looks like this: debug = warning syslog = yes [switch1] client = yes accept = 127.0.0.1:8081 connect = 192.168.4.1:443 verifyChain = yes checkHost = switch1.example.com CAfile = /etc/pki/ca-trust/source/anchors/example-com-ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 1 OCSPrequire = no Everything is working, but I'm seeing a lot of warnings in my system log: OCSP: No OCSP stapling response received transfer: s_poll_wait: TIMEOUTclose exceeded: closing Are there any settings that I can use to suppress these warnings? Thanks! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

1 0

TLSV1.0
by Stefano Pelli 27 Oct '23

27 Oct '23

Dear all, as my first post, I am asking a confirmation: is TLS ver 1.0 still supported by stunnel (unfortunately, I need that deprecated version to access a server)? It all worked fine, then I upgraded to Kubuntu 22.04 and for some reason that broke the support of this protocol. I get the connection closed right after trying to open it. Before upgrading all was working without a hitch. Since then (1 year ago), I have been looking for solutions and trying all sorts of fixes by changing stunnel.conf, but with no success. Can you be so kind to give me some info about this and if possible a remedy until the server gets updated (not under my control)? Thank you in advance, Stefano

3 3

Re: TLSV1.0
by Stefano Pelli 26 Oct '23

26 Oct '23

At 04:26 AM 10/26/2023, Thomas Ward via stunnel-users wrote: >This is not an STunnel issue but an OpenSSL libraries/defaults issue. Thank you Thomas. After your input I made some more tests. Following advice founf in the net, I had already included: >[system_default_sect] >CipherString = DEFAULT@SECLEVEL=1 in openssl.cnf But still it would not work through stunnel. Today I tried a connection directly from openssl and I managed to succesfully initiate and conclude a proper POP3 dialog with the culprit server. Then, looking at the messages from openssl, I saw that the connection was established, as expected, by TLSV1 and AES256-SHA protocol. Therefore, I tried to force this in the relevant section of stunnel.conf: >ciphers = AES256-SHA But with the same result when trying to open the connection through stunnel (5.71) >telnet 127.0.1.1 110 >Trying 127.0.1.1... >Connected to 127.0.1.1. >Escape character is '^]'. >Connection closed by foreign host. With the other servers I can this way estblish a POP3 dialog, as I managed directly through openssl. What am I missing here? Thank you for any addition insights! Stefano

1 0

Silent installation is not working for Stunnel v5.71
by meta＠adaptiva.com 23 Oct '23

23 Oct '23

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. https://adaptiva.com/products/autonomous-patch We have downloaded the binary from below URL – https://www.stunnel.org/downloads.html We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. Could you please help us to install the application silently.

2 1

Re: Silent installation is not working for, Stunnel v5.71
by Miroslav Geisselreiter 23 Oct '23

23 Oct '23

Hi, we use /S switch which works for us for a long time. Miroslav Geisselreiter > Message: 1 > Date: Mon, 23 Oct 2023 08:30:30 -0000 > From: meta(a)adaptiva.com > Subject: [stunnel-users] Silent installation is not working for > Stunnel v5.71 > To: stunnel-users(a)stunnel.org > Message-ID: <169804983049.1982.1603425052292506533(a)stunnel.org> > Content-Type: text/plain; charset="utf-8" > > Hi Team, > > We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers and willing to add Stunnel to our catalogue. > https://adaptiva.com/products/autonomous-patch > > We have downloaded the binary from below URL – > https://www.stunnel.org/downloads.html > > We are trying to install the application silently, we found -quiet as silent switch for this application. But that is not installing the application silently. > Could you please help us to install the application silently. >

1 0

Re: How do I hide my browsing?
by Eberhard 21 Oct '23

21 Oct '23

Exactly! If people could get around the Forti products that easily they would not have the reputation they have! Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: Thomas Ward via stunnel-users <stunnel-users(a)stunnel.org> Sent: Friday, October 20, 2023 6:11 AM To: Jason Long <hack3rcon(a)yahoo.com>; Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: How do I hide my browsing? Stunnel is not a VPN, so no it can't "hide your browsing". Hiding your browsing needs more than just stunnel because of how DNS and other components for browsing work. Question 2 is beyond the scope of stunnel's list to answer. This said: If you have to ask how to hide your browsing that means you're violating your network's use policies, and with Fortinet and Fortigate in line it sounds like you're on a workplace network. Just don't use your workplace network for whatever shady stuff you're concerned about them finding you doing. Sent from my Galaxy -------- Original message -------- From: Jason Long via stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Date: 10/20/23 09:05 (GMT-05:00) To: Stewart Anderson via Stunnel-users <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: [stunnel-users] How do I hide my browsing? Hello, In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 4

How do I hide my browsing?
by Jason Long 20 Oct '23

20 Oct '23

Hello,In an internal network, they monitor web browsing through firewalls (Fortinet and FortiGate). I have two questions: 1- Can I use Stunnel to hide my browsing? 2- Can they capture usernames and passwords for email and other websites? Thank you.

3 2

stunnel cmvp number
by Seray Tokadli 09 Oct '23

09 Oct '23

Hi, for our company i need to find the cvmp number for stunnel however I am not able to find it. Is there anyone who can help me with that? https://csrc.nist.gov/projects/cryptographic-module-validation-program/vali… I could not find stunnel here. -- Seray TOKADLI KILIÇ +420778116052

2 1

Re: stunnel smtp tls frontend server/proxy for remote backend postfix
by James Thornton 09 Oct '23

09 Oct '23

The direction is mail sent from an external email address to stunnel (running on google cloud) for delivery to a postfix mailbox running on a local network. I posted this question on serverfault ( https://serverfault.com/questions/1145279/stunnel-smtp-tls-frontend-server-…) and someone said the problem may be either stunnel strips the ip and/or the the sender is trying to switch to TLS on postfix, not realizing the TLS connection has already been made by stunnel. On Sat, Oct 7, 2023 at 9:22 AM Stewart Anderson <stuson_2000(a)yahoo.co.uk> wrote: > Client and server will both negotiate SSL. Your server mode is presenting > a certificate. > > It's not clear from your config /text which direction your traffic is > going !! > > If it's incoming from Google to your postfix server then server mode is > correct. Stunnel will negotiate the SSL and then forward to postfix in > clear. If the handshake isn't happening, have you put Google's cert in > your CA certs somewhere? > > What confuses it for me is the Google internal IP reference. If you are > getting traffic from Google then stunnel would need to be accepting on the > host where stunnel is, so only a port is required in the accept. This can > be on a machine in your DMZ or behind a firewall, e.g. on or close to your > postfix server. > > Hope that helps. > > > > > Stewart > stuson_2000(a)yahoo.co.uk > > On 6 October 2023 05:51:14 "james(a)jamesthornton.com" < > james(a)jamesthornton.com> wrote: > > I'm running stunnel in server mode and listening on port 587 and trying to >> connect to a remote postfix server running on port 25. >> >> NB: the two servers are connected via zerortier, which may or may no be >> relevant to the issue. >> >> DEBUG = 7 >> >> [ssmtp] >> protocol = smtp >> accept = google_cloud_internal_ip:587 >> connect = remote_zerotier_postfix_ip:25 >> cert = /etc/stunnel/domain.pem >> >> I thought this would set up stunnel to handle the TLS handshake and >> terminate the TLS connection, while proxing to the backend postfix server >> without requiring postfix to worry about TLS. But I'm getting LOG3[0]: >> STARTTLS expected when stunnel tries to connect to postfix. If I put >> stunnel in client mode, then it doesn't negotiate the incoming TLS >> (right?). >> >> What am I missing? >> _______________________________________________ >> stunnel-users mailing list -- stunnel-users(a)stunnel.org >> To unsubscribe send an email to stunnel-users-leave(a)stunnel.org >> > > -- James Thornton, *http://electricspeed.com <http://electricspeed.com>*

2 1

stunnel smtp tls frontend server/proxy for remote backend postfix
by james＠jamesthornton.com 06 Oct '23

06 Oct '23

I'm running stunnel in server mode and listening on port 587 and trying to connect to a remote postfix server running on port 25. NB: the two servers are connected via zerortier, which may or may no be relevant to the issue. DEBUG = 7 [ssmtp] protocol = smtp accept = google_cloud_internal_ip:587 connect = remote_zerotier_postfix_ip:25 cert = /etc/stunnel/domain.pem I thought this would set up stunnel to handle the TLS handshake and terminate the TLS connection, while proxing to the backend postfix server without requiring postfix to worry about TLS. But I'm getting LOG3[0]: STARTTLS expected when stunnel tries to connect to postfix. If I put stunnel in client mode, then it doesn't negotiate the incoming TLS (right?). What am I missing?

1 0

stunnel events
by noel_melvin＠neimanmarcus.com 02 Oct '23

02 Oct '23

Whats the difference between Connection closed: : 2505 byte(s) sent to TLS, 59 byte(s) sent to socket and Connection closed: : 0 byte(s) sent to TLS, 0 byte(s) sent to socket we can see these kind of variations in the stunnel logs. if its 0 bytes doest it mean that client didnt send any data/packet to stunnel server? Need help

1 1

Java jdk.disabled.NamedCurves
by Randy Curry 27 Sep '23

27 Sep '23

Hello, We are making a Rest API to an endpoint that uses stunnel for their proxy. We recently upgraded our integration engine and it's running Java AdoptOpenJDK 11.0.15. Since we've upgraded we can only successfully make one or two POST API calls then we get an error: Caused by: java.io.IOException: Error writing to server I did some research and found this version of Java has disabled named curves, part of it's Elliptic-curve cryptography. Is there any known issues with stunnel and the version of Java that's being used or the disabled named curves? Thank you, Randy Curry Senior Integration Services Architect [cid:[email protected]] [cid:[email protected]][email protected]<mailto:[email protected]> [cid:[email protected]] 919.588.1036 [cid:[email protected]] www.mihin.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.mihin.org&d=DwQGaQ&…> [cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_MiHIN&d=Dw…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_user_M…>[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by returning the e-mail and destroying all copies of the original message.

1 0

stunnel 5.71 released
by Michał Trojnara 19 Sep '23

19 Sep '23

Dear Users, I have released version 5.71 of stunnel. ### Version 5.71, 2023.09.19, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.1.3. * Bugfixes - Fixed the console output of tstunnel.exe. * Features sponsored by SAE IT-systems - OCSP stapling is requested and verified in the client mode. - Using "verifyChain" automatically enables OCSP stapling in the client mode. - OCSP stapling is always available in the server mode. - An inconclusive OCSP verification breaks TLS negotiation. This can be disabled with "OCSPrequire = no". - Added the "TIMEOUTocsp" option to control the maximum time allowed for connecting an OCSP responder. * Features - Added support for Red Hat OpenSSL 3.x patches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: f023aae837c2d32deb920831a5ee1081e11c78a5d57340f8e6f0829f031017f5 stunnel-5.71.tar.gz 945df5118473bcbf1ecdc5561fd6f26743c5dd1fd82e1a25199d0fd5c39a9373 stunnel-5.71-win64-installer.exe d511df533bb89464a324b2439e7e04b24b6ce26ecc0e03b67ada307725343d40 stunnel-5.71-android.zip Best regards, Mike

2 1

New machine
by stunnel＠paapnet.nl 16 Sep '23

16 Sep '23

Hello All, Who can help me? Just setup a new Ubuntu 22.04 (server) machine gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04) grabbed stunnel (git) However running into issues (an old linux box runs well with compile) configure runs well: config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tests/Makefile config.status: creating tests/certs/Makefile config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success Make bails out: root@dns:/Downloads/stunnel# make CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' aclocal-1.16 -I m4 cd . && /bin/bash /Downloads/stunnel/auto/missing automake-1.16 --foreign CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash '/Downloads/stunnel/auto/missing' autoconf configure.ac:53: warning: back quotes and double quotes must not be escaped in: Unknown thread model \"${withval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1553: AC_ARG_WITH is expanded from... configure.ac:53: the top level configure.ac:285: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:285: the top level configure.ac:309: warning: back quotes and double quotes must not be escaped in: bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:309: the top level configure.ac:334: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:334: the top level configure.ac:369: warning: back quotes and double quotes must not be escaped in: Bad value \"${enableval}\" lib/m4sugar/m4sh.m4:699: AS_IF is expanded from... ./lib/autoconf/general.m4:1534: AC_ARG_ENABLE is expanded from... configure.ac:369: the top level configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:22: error: possibly undefined macro: AC_DEFINE make: *** [Makefile:409: configure] Error 1 aclocal (GNU automake) 1.16.5 autoconf (GNU Autoconf) 2.71 Is active What do I mis here ? Chrs....

1 0

Use of dante socks proxy with Stunnel
by vinesh＠techvinesh.com 15 Sep '23

15 Sep '23

I am deploying connection between on premise database with BI application on cloud. Currently the on premise database connecting via jdbc driver and it not supporting encryption. As per my understanding Stunnel opens port listening on http:127.0.0.1 ( as local) and forward traffic to destination over https using TLSv1.2. I have few question on this , to protect on network level, 1- can I use dante socks proxy along with Stunnel to provide 2 layer of protection? On-prem --- cloud ( 2 layer of protection) -- dante socks ( unencrypted tunnel) -- Stunnel ( e2e Encryption) 2- will it supporting CA other than openSsl

1 0

The stunnel process running on an AWS EC2 instance frequently enters a zombie state.
by sharukh.khan+stunnel＠seclore.com 12 Sep '23

12 Sep '23

We're facing an issue where the stunnel process running on our AWS Ec2 enters a zombie state. This results in the nfs server timeout (We're using EFS). We're running Amazon Linux 2 (Kernel version 4.14.318-241.531) with stunnel version 5.6.4. The configuration for stunnel is stated below: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini

2 4

stunnel events
by noel_melvin＠neimanmarcus.com 11 Sep '23

11 Sep '23

We have stunnel running on Windows machine. Just would like to know whether the below events is anything abnormal/critical to be addressed. 2023.09.07 10:10:16 LOG5[7]: Service [Application1] accepted connection from x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: Peer certificate not required 2023.09.07 10:10:16 LOG6[7]: No peer certificate received 2023.09.07 10:10:16 LOG6[7]: Session id: (Alphanumeric) 2023.09.07 10:10:16 LOG6[7]: TLS accepted: new session negotiated 2023.09.07 10:10:16 LOG6[7]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2023.09.07 10:10:16 LOG6[7]: s_connect: connecting x.x.x.x:1234 2023.09.07 10:10:16 LOG5[7]: s_connect: connected x.x.x.x:1234 2023.09.07 10:10:16 LOG6[7]: persistence: x.x.x.x:1234 cached

1 1

Stunnel hangs with static build with openssl 1.1.1c
by eklein＠triple-eye.nl 07 Sep '23

07 Sep '23

I successfully cross compiled and built a static version of stunnel for ARM. It works with stunnel 5.70 and openssl 1.1.1b If however, I try to use openssl 1.1.1c, stunnel hangs. I narrowed the problem down to the following call in compression_init in ssl.c: comp_methods[COMP_NONE]=sk_SSL_COMP_new_null(); The program does not get past this point. I also tried to build with openssl 1.1.1v and 3.0.0, to no avail. I am using the following commands: To build openssl: ./Configure linux-armv4 --prefix=/home/erik/Documents/openssl-1.1.1b/install --openssldir=/home/erik/Documents/openssl-1.1.1b/install threads shared make CC=arm-linux-gnueabi-gcc make install To build stunnel: sed -i 's/^stunnel_LDFLAGS = /&-all-static /' src/Makefile.in export CFLAGS='-Os -fomit-frame-pointer -pipe' ./configure --with-ssl=/home/erik/Documents/openssl-1.1.1b/install --disable-fips --disable-shared --enable-static --disable-silent-rules --build x86_64-pc-linux-gnu --host arm-linux-gnueabi make What is the difference between openssl1.1.1b and 1.1.1c which causes this problem?

1 1

Failover configuration using a proxy
by Daphne Shaw 06 Sep '23

06 Sep '23

Hello! I have a configuration question around failover with stunnel as a https client (that is, "client=yes"). The end goal here is a "Try to connect to host A, if that fails, connect to host B, etc." type of setup. I can do that with multiple connect= options, one per host, and it works as expected: connect=x.x.x.x connect=y.y.y.y connect=z.z.z.z The question I have is around doing the same thing with a proxy. In a proxy configuration, connect= specifies the proxy (https in my case, so "protocol=connect"), and protocolHost= specifies the host that I want to connect to via that proxy. Unfortunately, it seems that protocolHost only allows a single host and cannot be used multiple times, so I can't specify the hosts to failover to. connect=my.proxy.ip protocol=connect protocolhost=x.x.x.x protocolhost=y.y.y.y protocolhost=z.z.z.z That always attempts to connect to z.z.z.z (the last specified host) via the proxy. I am using stunnel 4.56 (stock stunnel from Centos 7), but happy to upgrade if a newer version makes this possible (the manual suggests the latest version works the same way). Any suggestions? I'm sure I could accomplish this by wrapping stunnel in a script that generates a new config file for each failover, but well, I'm hoping to not have to do that. Thanks, Daphne

2 2

Connection abend between Stunnel and multiple clients
by arunprasanna_dhayalavel＠neimanmarcus.com 06 Sep '23

06 Sep '23

Hello All!! We are experiencing multiple transactions initiated from the different clients towards the Stunnel getting reset. We are trying to identify if the below events relate to the issue. If yes, kindly suggest how we can rectify the below. 2023.09.05 09:10:43 LOG6[210]: transfer: s_poll_wait: TIMEOUTidle exceeded: sending reset 2023.09.05 09:10:43 LOG5[210]: Connection reset: 2505 byte(s) sent to TLS, 59 byte(s) sent to socket

1 0

error:0A000126 on windows 10
by Stewart Anderson 02 Sep '23

02 Sep '23

Hi, First apologies I posted this question on a google stunnel group, but I realise that does not have much activity, so posting here also. I am trying to get stunnel up and running and getting the error in the subject. The full error text is: "SSL_accept: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number" I have a simple service which seems to load fine. I have stunnel up at the "server side" on a VM in azure and if I telnet to the VM public address I can see the activity in the stunnel logs on the VM, so I know at least a pipe is open. I can hit the port server side and see the log activity in stunnel also. If I try a telnet to the local stunnel accept port. I see the error above. This is the full log. 2023.08.23 11:01:04 LOG7[service]: Found 1 ready file descriptor(s) 2023.08.23 11:01:04 LOG7[service]: FD=604 ifds=r-x ofds=--- 2023.08.23 11:01:04 LOG7[service]: FD=664 ifds=r-x ofds=r-- 2023.08.23 11:01:04 LOG7[service]: Service [dev-dev-testHarness] accepted (FD=708) from 127.0.0.1:10756 2023.08.23 11:01:04 LOG7[service]: Creating a new thread 2023.08.23 11:01:04 LOG7[service]: New thread created 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] started 2023.08.23 11:01:04 LOG7[4]: Setting local socket options (FD=708) 2023.08.23 11:01:04 LOG7[4]: Option TCP_NODELAY set on local socket 2023.08.23 11:01:04 LOG5[4]: Service [dev-dev-testHarness] accepted connection from 127.0.0.1:10756 2023.08.23 11:01:04 LOG6[4]: Peer certificate not required 2023.08.23 11:01:04 LOG7[4]: TLS state (accept): before SSL initialization 2023.08.23 11:01:04 LOG7[4]: TLS alert (write): fatal: decode error 2023.08.23 11:01:04 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:303: error:0A000126:SSL routines::unexpected eof while reading 2023.08.23 11:01:04 LOG5[4]: Connection reset/closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.08.23 11:01:04 LOG7[4]: Local descriptor (FD=708) closed 2023.08.23 11:01:04 LOG7[4]: Service [dev-dev-testHarness] finished (0 left) What am I missing, I haven't used stunnel for quite a while and previous effort were on linux and I did not see this problem then. Using telnet/TNC as the local test tools and stunnel was installed with bare default installation. The only thing I have done different is to set a config fragment folder to separate services on the sever side and they report as loading fine. any help greatly appreciated. Stu

1 1

Re: Need help setting up new stunnel config
by Mark Foley 01 Sep '23

01 Sep '23

I think I'm confused here. My objective is for requests sent to port 3389 on the Windows 10 machine to be "validated" by stunnel, then passed on to the service listening on that port. Am I mistaken about what stunnel is supposed to do? If not, what would my config look like to accomplish this? I don't see how changing the RDC port would help. Regardless of what port RDC listens on, it's still going to be used by RDC and therefore I don't see why the 'accept' wouldn't continue to fail. Sorry to be so obtuse on this. I just don't get it and haven't found any examples for stunneling to RDC. --Mark -----Original Message----- From: Michael Curran <mike_curran(a)hotmail.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Re: Need help setting up new stunnel config Date: Fri, 1 Sep 2023 17:39:25 +0000 Mark -- Your full stanza should look like this [dbserver] accept = <some port> connect = 3389 CAfile = stunnel.pem The IP:PORT was a suggestion for the RDC connection string. If you cannot start RDC with an IP:PORT, then you can change the internal RDC port from 3389 to something else. I have not done this, you will have to review Microsofts site to find out how. If RDC can be changed , but not the RDC connection string then your stanza might look like [dbserver] accept = 3389 connect = <new rdc port> CAfile = stunnel.pem Mike ________________________________ From: Mark Foley <mfoley(a)novatec-inc.com> Sent: Friday, September 1, 2023 1:28 PM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: Need help setting up new stunnel config Michael - thanks for your response. I did not see the "ip:port" syntax you suggested in the stunnel doc, so I just use 'port'. Below is the config I tried: [DBSERVER] connect = 3389 CAfile = stunnel.pem When running I got the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.70 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.9 30 May 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [DBSERVER] [!] Service [DBSERVER]: TLS server needs a certificate [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [DBSERVER] Notice "TLS server needs a certificate". The installation dialog steps me through creating a certificate which it puts in stunnel.pem. So why this message? I also tried the full pathname to stunnel.pem. --Mark -----Original Message----- From: Michael Curran <michael.curran(a)cosocloud.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Need help setting up new stunnel config Date: Fri, 1 Sep 2023 13:12:30 +0000 accept is the port you want them to connect on remotely – which would have to be other than 3389 since it is open already connect would be 3389 I think in the connection string for RDC you can just specify ip:port to connect If you cannot , you can also redesignate the port remote desktop answers on -- Michael Curran Systems Architect| CoSo Cloud D 614.568.2285 | C 614.403.6320 | michael.curran(a)cosocloud.com From: Mark Foley <mfoley(a)novatec-inc.com> Date: Thursday, August 31, 2023 at 11:33 AM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Need help setting up new stunnel config I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org This is an external email and may have suspicious content. Please take care when clicking links or opening attachments. When in doubt, contact your IT Department. _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

2 1

Re: Need help setting up new stunnel config
by Mark Foley 01 Sep '23

01 Sep '23

Michael - thanks for your response. I did not see the "ip:port" syntax you suggested in the stunnel doc, so I just use 'port'. Below is the config I tried: [DBSERVER] connect = 3389 CAfile = stunnel.pem When running I got the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.70 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.9 30 May 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [DBSERVER] [!] Service [DBSERVER]: TLS server needs a certificate [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [DBSERVER] Notice "TLS server needs a certificate". The installation dialog steps me through creating a certificate which it puts in stunnel.pem. So why this message? I also tried the full pathname to stunnel.pem. --Mark -----Original Message----- From: Michael Curran <michael.curran(a)cosocloud.com> To: Mark Foley <mfoley(a)novatec-inc.com>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Need help setting up new stunnel config Date: Fri, 1 Sep 2023 13:12:30 +0000 accept is the port you want them to connect on remotely – which would have to be other than 3389 since it is open already connect would be 3389 I think in the connection string for RDC you can just specify ip:port to connect If you cannot , you can also redesignate the port remote desktop answers on -- Michael Curran Systems Architect| CoSo Cloud D 614.568.2285 | C 614.403.6320 | michael.curran(a)cosocloud.com From: Mark Foley <mfoley(a)novatec-inc.com> Date: Thursday, August 31, 2023 at 11:33 AM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Need help setting up new stunnel config I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org This is an external email and may have suspicious content. Please take care when clicking links or opening attachments. When in doubt, contact your IT Department.

1 0

Problem TLS connection Outlook 365
by adebelew＠gmail.com 01 Sep '23

01 Sep '23

Hi, I'm trying to connect to Outlook 365 with this setup [office365] client = yes accept = 127.0.0.1:993 connect = outlook.office365.com:993 unfortunately, when from my penthao software, I try to connect with email and password stunnel responds like this: 2023.09.01 09:57:33 LOG5[2]: Service [office365] accepted connection from 127.0.0.1:63027 2023.09.01 09:57:33 LOG5[2]: s_connect: connected 52.98.206.242:993 2023.09.01 09:57:33 LOG5[2]: Service [office365] connected remote server from 192.168.1.228:63028 2023.09.01 09:57:33 LOG5[2]: Connection closed: 258 byte(s) sent to TLS, 160 byte(s) sent to socket could you help me? is it necessary to configure the certificates? How should it be done? Thank you!

1 0

Need help setting up new stunnel config
by Mark Foley 31 Aug '23

31 Aug '23

I used stunnel about 5 years ago and now I want to use it again, but my notes are terrible and I'm having trouble getting started. I want to create a connection between Windows computer on port 3389. The "client" will be some remote Windows computer, perhaps at someone's home office. The "server" will be a Windows workstation at the office. I've installed stunnel 5.70 on a Windows 10 workstation at the office, hostname COMMONW10. I'm at a loss creating the config file on this machine. I have: [COMMONW10] ;client = yes accept = 3389 ;connect = ???:xxxx CAfile = stunnel.pem The stunnel.pem was create when I installed stunnel. I have no idea what the 'connect' line should have. When I run stunnel (clicking on desktop icon) I get: [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [COMMONW10] [ ] Listening file descriptor created (FD=724) [ ] Setting accept socket options (FD=724) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [COMMONW10] to 127.0.0.1:3389: Permission denied (WSAEACCES) (10013) [!] Binding service [COMMONW10] failed [ ] Unbinding service [COMMONW10] [ ] Service [COMMONW10] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [COMMONW10] [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 Server is down I'm assuming the "Permission denied" is because Remote Desktop is already listening on 3389. So, I'm stuck and feeling quite ignorant! Help appreciated. --Mark

1 0

Fail to build stunnel 5.70 for windows using xmingw64
by roierachamim＠gmail.com 30 Aug '23

30 Aug '23

Hi, Trying to build stunnel the following warning showed up: network.c: In function 's_read': network.c:737:44: warning: unknown conversion type character 'l' in format [-Wformat=] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^ network.c:737:66: warning: unknown conversion type character 'l' in format [-Wformat=] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^ network.c:737:24: warning: too many arguments for format [-Wformat-extra-args] s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ And one more of the same kind. I wonder how it didn't happen in the official binaries. Are they being built using the instructions in INSTALL.W32 ? Using xmingw-64 ? Roie

2 1

Config stunnel for outgoing mails to Ionos
by a.franken＠management-kommunikation.de 22 Aug '23

22 Aug '23

In these days, our provider Ionos/1&1 starts to accept only encrypted access to its mail server and at least TLS 1.2. There are no problems with incoming mails. In order to be on the safe side with our Win SBS Server 2008 (no comments please!) with outgoing mails, I now have interposed stunnel as recommended many times on the web. This works in principle. Unfortunate exception: In some cases - expecially if the mail recipient has a Microsoft address like @hotmail.de, @live.de, @outlook.com -, sending aborts with error 503 5.5.2 ("Need mail command"). Unfortunately, I'm quite innocent with SMTP, SSL and certificates, but worked hard to create the following stunnel configuration file: socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 client = yes output = C:\Program Files (x86)\stunnel\stunnel.log [smtpionos] accept = localhost:465 connect = smtp.ionos.de:465 verifyChain = yes verifyPeer = yes CAfile = C:\Program Files (x86)\stunnel\config\amakor2022.pem checkHost = remote.management-kommunikation.de protocolHost = smtp.ionos.de protocolAuthentication = login protocolUsername = OUR_USERNAME protocolPassword = OUR_PASSWORD sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 delay = yes protocol = smtp amakor2022.pem is the "PositiveSSL" certificate that we acquired for our subdomain remote.management-kommunikation.de. "Our_Username" and "Our_Password" are of course our correct access data. After spending hours searching the web for a solution, does anyone have a tip what's wrong and what to do?

1 2

error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40
by kgpunix＠gmail.com 16 Aug '23

16 Aug '23

error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40

1 0

Passing client IP via stunned to HAProxy
by Ashok Kumar Agrawal 07 Aug '23

07 Aug '23

Hi, Our setup has stunnel and HAproxy running on same server. Our clients (postgresql clients) connect to port where stunnel is listening. Clients are sending encrypted data (setting sslmode=require in pgsql connection options). Stunnel listens to encrypted traffic and writes unencrypted traffic to another port on same host where HAproxy is listening. Then, HAProxy passes this request to one of many postgresql servers. These servers are custom written to implement postgresql protocol. We want IP of the postgresql clients to be captured at the server. HAProxy documentation says that proxy protocol is only way to pass original client IP for non-http traffic. Can you please suggest how we can configure Stunnel to listen to encrypted postgresql client traffic (pgsql protocol) and write unencrypted data to HAProxy instance in proxy protocol. Following are our current configurations for stunnel and HAProxy: Stunnel: foreground = yes debug = 5 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = l:TCP_KEEPIDLE=120 socket = l:TCP_KEEPINTVL=30 socket = l:TCP_KEEPCNT=3 ciphers = HIGH:MEDIUM [postgres-serverB] protocol = pgsql accept = 0.0.0.0:3255 connect = localhost:5433 retry = yes cert = /etc/stunnel/stunnel.crt delay = no sslVersion = TLSv1.2 HAProxy: listen pgsql mode tcp option tcplog bind *:5433 balance leastconn timeout server 1d timeout client 1d option tcp-check option clitcpka server qspgsqlsvr1 host.docker.internal:5432 check Thanks, Ashok

1 0

Oqsprovider support with Openssl 3,x
by mukesh.kochu＠yahoo.com 01 Aug '23

01 Aug '23

hello Team, Anybody knows how to plugin the provider included in the openssl 3.x , to be supported with stunnel , by doing any configuration change or so . To give you guys a background , I compiled a openssl 3.x version and and then compiled liboqs , and build the ops provider support in the openssl 3.x .following the below link. https://github.com/open-quantum-safe/oqs-provider I was under the impression tunnel might support all algorithm which is supported in the openssl version which is used to build the stunnel So I rebuild the same using the pqc supported openssl , but unfortunately not sure how to consume the provider there and or what to be tweaked in he tunnel source code that multiple providers or algorithms will be supported or not . or is it not possible to achieve this without doing a massive source code change ? Appreciate any help on this Regards Mukesh

1 0

can not send
by wizardm＠gmx.de 21 Jul '23

21 Jul '23

hello, I have accounts with gmx, aol and 1&1 (ionos). with gmx and aol I can receive and send. but with 1&1 I can only receive. the stunnel log says "SSL_connect: ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number". in the log of the mail program there is an "error - Unexpected connection termination. Connection lost." what can I do? here is my configuration. [gmx-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmx.net:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmx.net OCSPaia = yes [gmx-smtp] client = yes accept = 127.0.0.1:25 connect = mail.gmx.net:465 verifyChain = yes CAfile = ca-certs.pem checkHost = mail.gmx.net OCSPaia = yes [aol-pop3] client = yes accept = 127.0.0.1:10110 ; protocol = pop3 connect = pop.aol.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.aol.com OCSPaia = yes [aol-smtp] client = yes accept = 127.0.0.1:10025 ; protocol = smtp connect = smtp.aol.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.aol.com OCSPaia = yes [1und1-pop3] client = yes accept = 127.0.0.1:1110 connect = pop.ionos.de:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.ionos.de OCSPaia = yes [1und1-smtp] client = yes accept = 127.0.0.1:1111 connect = smtp.ionos.de:587 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.ionos.de OCSPaia = yes thank you very much

1 0

“latest” alias
by David Richard (CajunD) 16 Jul '23

16 Jul '23

Hi Folks, I have found some older discussions about keeping archives and such, but wanted to ask if you could create an alias that always pointed to the latest version. We were hard-linking to a version in /downloads/ and when version 5.69 was removed a few days ago, some automation on our end broke and (as a result of circumstance) caused an outage while we were trying to fix another problem with a remote dependency. We have altered our script to point to the archive version and added checking to ensure any future problems are handled properly. That being said, we will always want the latest version of your software when we build our machine images. And while you do send an announcement, we have to take additional action on our end to get that new version. A “latest” link would allow us to get the latest version automatically when we perform security updates. Thanks for considering this request. David. --- David Richard cajund(a)gmail.com

4 3

securityLevel doesn't work with OpenSSL 3.0
by Yasuhiro Kimura 14 Jul '23

14 Jul '23

Hello, I'd like to use stunnel to acccess SMTP server that has following configuration parameters. Host: smtp.example.org Port number: smtps (465) Encryption method: SMTP over TLS At first I created following configuration file and run stunnel 5.70 with it on FreeBSD 13.2-RELEASE. ---------------------------------------------------------------------- CApath=/home/yasu/.certs client=yes foreground=yes syslog=no verify=2 [12345] accept=localhost:12345 checkHost=smtp.examle.org connect=smtp.examle.org:465 ---------------------------------------------------------------------- But unfortunately stunnel emits following messages and local-side connection.is closed when I connect to 12345 port of localhost. ---------------------------------------------------------------------- 2023.07.14 12:29:12 LOG5[0]: Service [12345] accepted connection from ::1:14632 2023.07.14 12:29:12 LOG5[0]: s_connect: connected 10.0.0.1:465 2023.07.14 12:29:12 LOG5[0]: Service [12345] connected remote server from 192.168.0.1:14633 2023.07.14 12:29:12 LOG5[0]: Certificate accepted at depth=0: C=JP, ST=Tokyo, L=Ohta-Ku, O=EXAMLE.INC, CN=smtp.examle.org 2023.07.14 12:29:12 LOG3[0]: SSL_connect: /usr/src/crypto/openssl/ssl/t1_lib.c:1146: error:1414D172:SSL routines:tls12_check_peer_sigalg:wrong signature type 2023.07.14 12:29:12 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket ---------------------------------------------------------------------- So I added setting of securityLevel as following. ---------------------------------------------------------------------- CApath=/home/yasu/.certs client=yes foreground=yes securityLevel=1 syslog=no verify=2 [12345] accept=localhost:12345 checkHost=smtp.examle.org connect=smtp.examle.org:465 ---------------------------------------------------------------------- And now I can successfully access to STMP server through stunnel. Next, I also tried it on FreeBSD 14-CURRENT and surprisingly stunnel 5.70 emits following messages even if 'securityLevel=1' is specified in configuration file. ---------------------------------------------------------------------- 2023.07.14 12:31:12 LOG5[0]: Service [12345] accepted connection from ::1:10838 2023.07.14 12:31:12 LOG5[0]: s_connect: connected 10.0.0.1:465 2023.07.14 12:31:12 LOG5[0]: Service [12345] connected remote server from 192.168.0.11:41449 2023.07.14 12:31:12 LOG3[0]: SSL_connect: /usr/src/crypto/openssl/ssl/statem/extensions.c:894: error:0A000152:SSL routines::unsafe legacy renegotiation disabled 2023.07.14 12:31:12 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket ---------------------------------------------------------------------- So I also tried on 2 other platforms. a. Cygwin's stunnel.exe (version 5.69) b. tstunnel.exe installed by useing stunnel-5.69-win64-installer.exe And result is that the former works fine and the latter emits same message as FreeBSD 14-CURRENT. According to these result it seems the failure is related to the version of OpenSSL. That is, while FreeBSD 13.2-RELEASE and Cygwin use OpenSSL 1.1.1, FreeBSD 14-CURRENT and stunnel-5.69-win64-installer.exe use OpenSSL 3.0. So does this mean securityLevel option doesn't work with OpenSSL 3.0? Regards. --- Yasuhiro Kimura

2 1

Stunnel is not accepting TLS1.1 anymore?
by Bohnig＠gmx.de 13 Jul '23

13 Jul '23

Hi there, i have a problem (maybe with understanding) with stunnel. I'm using the newest version 5.70 but had this also with 5.66 and 5.69. My goal was to access an Exchange server IIS (on port 443, which understands only TLS1.1 and below) with TLS1.2 and upper. I was able to achieve this with the following config --------------------------- debug = 7 output = stunnel.log [Exserver] accept = 441 connect = 442 cert = stunneldd.pem TIMEOUTclose = 0 [Exclient] client = yes accept = 442 connect = 443 --------------------------- stunneldd.pem i made with openssl req -new -x509 -days 365 -nodes -config openssl.cnf -out stunneldd.pem -keyout stunneldd.pem This is working so far. My problem is, stunnel is no longer accepting TLS1.0 and TLS1.1. I need this for some clients which couldn't talk TLS1.2. But why? All infos i could find (and this was days, not hours) are showing that it should work. Even with the added line sllVerison = all or sslVersionMin = TLSv1 sslVersionMax = TLSv1.3 it ws not accepting TLS1 queries. My steps to confirm this: ------------------------- - install stunnel 5.70 - take the config shown above - make a cert with openssl req -new -x509 -days 365 -nodes -config openssl.cnf -out stunneldd.pem -keyout stunneldd.pem - start stunnel - test it with openssl s_client -connect localhost:441 -tls1_1 -debug stunnel log: ------------ 2023.07.13 09:53:04 LOG7[25]: TLS alert (write): fatal: internal error 2023.07.13 09:53:04 LOG3[25]: SSL_accept: ssl/t1_lib.c:3342: error:0A000076:SSL routines::no suitable signature algorithm I'm thinking, that the bind OpenSSL doesn't support TLS1.1 anymore but the [Exclient] which is talking to Port 443 uses TLS1.1. Or has the cert anything to do with it. I think no, because the andshake failed and that is befor the cert is used? What I'm missing? I want stunnel to accept TLs1.0, TLS1.1. TLS1.2 and upwards on the same port. Would be nice if anybody could help me with this? Many thanks.

1 0

Default destination folder of stunnel-*-win64-installer.exe
by Yasuhiro Kimura 13 Jul '23

13 Jul '23

Hello, If you install stunnel on Windows with stunnel-*-win64-installer.exe, it installs everything under "C:\Program Files (x86)\stunnel" by default. But since it installs 64bit binaries, should default destination folder be "C:\Program Files\stunnel"? Regards.

1 0

`tstunnel -(help|options|version)` outputs garbase with 5.70
by Yasuhiro Kimura 13 Jul '23

13 Jul '23

Hello, With tstunnel.exe installed with stunnel-5.70-win64-installer.exe, `tstunnel -help', `tstunnel -options` and `tstunnel -version` output gabases. The issue doesn't happen with either stunnel 5.70 on Unix or tstunnel.exe installed with stunnel-5.69-win64-installer.exe. Regards. --- Yasuhiro Kimura

1 0

stunnel 5.70 released
by Michal Trojnara 12 Jul '23

12 Jul '23

Dear Users, I have released version 5.70 of stunnel. ### Version 5.70, 2023.07.12, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.9. - OpenSSL FIPS Provider updated to version 3.0.8. * Bugfixes - Fixed TLS socket EOF handling with OpenSSL 3.x. This bug caused major interoperability issues between stunnel built with OpenSSL 3.x and Microsoft's Schannel Security Support Provider (SSP). - Fixed reading certificate chains from PKCS#12 files. * Features - Added configurable delay for the "retry" option. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7bbc7b9e9a988d76301325db4c110ec360a98ffb8a221c7accbff9c0a8bae2f3 stunnel-5.70.tar.gz c50fb79329ddbf095e65ba8817a0249188aa5b25f15557f8504d8f65876034d9 stunnel-5.70-win64-installer.exe df87f71596ddd8730a5394fd3795b32689664816c0aa87e206e94fdab540f672 stunnel-5.70-android.zip Best regards, Mike

1 0

Cannot open PSKsecrets file
by trashrap22＠gmail.com 11 Jul '23

11 Jul '23

Hi, I am setting up stunnel on my Windows 10 PC, but must be missing something small with the error I am getting: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.69 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.8 7 Feb 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [Sql_Secure_Trek-<port>] [!] Cannot open PSKsecrets file [!] C:\Program Files (x86)\stunnel\config\stunnel.conf:68: "PSKsecrets = "C:\Program Files (x86)\stunnel\config\pskSql.txt"": Failed to read PSK secrets [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [Sql_Secure_Trek-<port>] Server is down Here is my .conf file: ;Global settings: debug = 7 output = stunnel.log sslVersion = all sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 [Sql_Secure_Trek-<port>] client = yes accept = 0.0.0.0:<port> connect = <IP>:<port> ciphers = PSK PSKsecrets = "C:\Program Files (x86)\stunnel\config\pskSql.txt" Any ideas?

1 1

stunnel 5.57 crashed while trying to write logs
by phananh.nguyen＠dxc.com 06 Jul '23

06 Jul '23

it crashed at the function log_raw. here is the backtrace == Backtrace #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49 #1 0x0000007f82ed54b4 in __GI_abort () at abort.c:79 #2 0x0000007f82f1f984 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f82fdc660 "%s\n") at ../sysdeps/posix/libc_fatal.c:155 #3 0x0000007f82f273dc in malloc_printerr (str=str@entry=0x7f82fd7bc8 "corrupted double-linked list") at malloc.c:5389 #4 0x0000007f82f27cc8 in unlink_chunk (p=p@entry=0x7f64012260, av=0x7f64000020) at malloc.c:1472 #5 0x0000007f82f27e48 in malloc_consolidate (av=av@entry=0x7f64000020) at malloc.c:4539 #6 0x0000007f82f29df0 in _int_malloc (av=av@entry=0x7f64000020, bytes=bytes@entry=8192) at malloc.c:3727 #7 0x0000007f82f2c5b0 in __libc_calloc (n=<optimized out>, elem_size=<optimized out>) at malloc.c:3448 #8 0x0000007f82f1e41c in __GI___open_memstream (bufloc=bufloc@entry=0x7f72ffc3f8, sizeloc=sizeloc@entry=0x7f72ffc400) at memstream.c:83 #9 0x0000007f82f7d274 in __vsyslog_internal (pri=31, pri@entry=7, fmt=fmt@entry=0x5584b5f930 "%s: %s", ap=..., mode_flags=mode_flags@entry=2) at ../misc/syslog.c:181 #10 0x0000007f82f7d810 in __syslog_chk (pri=pri@entry=7, flag=flag@entry=1, fmt=fmt@entry=0x5584b5f930 "%s: %s") at ../misc/syslog.c:136 #11 0x0000005584b45884 in syslog (__fmt=0x5584b5f930 "%s: %s", __pri=7) at /usr/include/bits/syslog.h:31 #12 log_raw (level=level@entry=7, stamp=stamp@entry=0x7f64003420 "2023.06.16 01:36:58", id=id@entry=0x7f64001120 "LOG7[19]", text=text@entry=0x7f6401b060 "Service [proxy-r] started", opt=<optimized out>, opt=<optimized out>) at ../../stunnel-5.57/src/log.c:263 #13 0x0000005584b45b88 in s_log (level=level@entry=7, format=format@entry=0x5584b5a780 "Service [%s] started") at ../../stunnel-5.57/src/log.c:192 #14 0x0000005584b454e8 in client_main (c=c@entry=0x7f82e30060) at ../../stunnel-5.57/src/client.c:178 #15 0x0000005584b45658 in client_thread (arg=0x7f82e30060) at ../../stunnel-5.57/src/client.c:130 #16 0x0000007f83026e64 in start_thread (arg=0x7fc21e457f) at pthread_create.c:463 #17 0x0000007f82f815dc in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:78 == Thread apply all backtrace full

2 4

Using URL Subfolders to redirect traffic to a different service?
by hellmanandrew＠comcast.net 02 Jul '23

02 Jul '23

I want to be able to actually use stunnel as a reverse proxy by running everything through one port. How I want to do that is by using subfolders in a URL like: webpage.net/service1 webpage.net/service2 Basically, every subfolder will redirect to a different IP address or port offered by a server. Just not sure how I should configure this.

1 0

help
by Seray Tokadli 26 Jun '23

26 Jun '23

Hello, I am trying to configure stunnel on windows (version 5.69) I am using the capi engine with below conf. I am sending the logs to logstash and not sure if it is working or not. My questions are: 1) I dont see anything in the log after initializing the service. When it sends the logs through stunnel, should i see an entry in the logs? 2) When using capi engine, should i limit the ssl version still ? in your website i see that the tls version supposed to be limited but is it an old info? 3) in your website again it mentions that i should specify the security level to zero for capi engine, is it also a valid info? if yes, do i need to set it in global section or service level? https://www.stunnel.org/config_windows.html fips = yes taskbar = yes engine = capi output = C:\Logs\stunnel\stunnel.log debug = debug [logging_service_for_filebeat] engineId = capi client = yes accept = {{ stunnel_logging_port_filebeat }} delay = yes connect = {{ logstash_vip }}:{{ stunnel_logging_port_filebeat }} ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 sessionCacheSize = 5000 sessionCacheTimeout = 300 socket = l:TCP_NODELAY=1 # the only FIPS 140-2 compliant protocol sslVersion = TLSv1.2 CApath = <ca path> verifyChain = yes checkHost = <ca host> verify = 2 Log: 023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG7[service]: No limit detected for the number of clients 2023.06.26 14:37:39 LOG5[service]: stunnel 5.69 on x64-pc-mingw32-gnu platform 2023.06.26 14:37:39 LOG5[service]: Compiled/running with OpenSSL 3.0.8 7 Feb 2023 2023.06.26 14:37:39 LOG5[service]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.06.26 14:37:39 LOG7[service]: errno: (*_errno()) 2023.06.26 14:37:39 LOG6[service]: Initializing inetd mode configuration 2023.06.26 14:37:39 LOG7[service]: Running on Windows 6.2 2023.06.26 14:37:39 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2023.06.26 14:37:39 LOG5[service]: UTF-8 byte order mark not detected 2023.06.26 14:37:39 LOG7[service]: Enabling support for engine "capi" 2023.06.26 14:37:39 LOG6[service]: Logging not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: UI not supported by engine #1 (capi) 2023.06.26 14:37:39 LOG7[service]: Initializing engine #1 (capi) 2023.06.26 14:37:39 LOG6[service]: Engine #1 (capi) initialized 2023.06.26 14:37:39 LOG5[service]: FIPS provider enabled 2023.06.26 14:37:39 LOG5[service]: FIPS mode enabled 2023.06.26 14:37:39 LOG6[service]: Compression disabled 2023.06.26 14:37:39 LOG7[service]: No PRNG seeding was required 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA:xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG6[service]: Initializing service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG6[service]: stunnel default security level set: 2 2023.06.26 14:37:39 LOG7[service]: Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256 2023.06.26 14:37:39 LOG7[service]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.06.26 14:37:39 LOG7[service]: TLS options: 0x2100000 (+0x0, -0x0) 2023.06.26 14:37:39 LOG6[service]: Session resumption enabled 2023.06.26 14:37:39 LOG6[service]: Client certificate engine (capi) enabled 2023.06.26 14:37:39 LOG7[service]: No certificate or private key specified 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: Configured trusted server CA: xxx 2023.06.26 14:37:39 LOG6[service]: DH initialization skipped: client section 2023.06.26 14:37:39 LOG7[service]: ECDH initialization 2023.06.26 14:37:39 LOG7[service]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.06.26 14:37:39 LOG5[service]: Configuration successful 2023.06.26 14:37:39 LOG7[service]: Deallocating deployed section defaults 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_filebeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=632) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=632) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_filebeat] (FD=632) bound to 0.0.0.0:10300 2023.06.26 14:37:39 LOG7[service]: Binding service [logging_service_for_winlogbeat] 2023.06.26 14:37:39 LOG7[service]: Listening file descriptor created (FD=648) 2023.06.26 14:37:39 LOG7[service]: Setting accept socket options (FD=648) 2023.06.26 14:37:39 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.06.26 14:37:39 LOG6[service]: Service [logging_service_for_winlogbeat] (FD=648) bound to 0.0.0.0:10301 2023.06.26 14:37:39 LOG6[service]: Accepting new connections 2023.06.26 14:37:39 LOG7[per-second]: Per-second thread initialized 2023.06.26 14:37:39 LOG7[per-day]: Per-day thread initialized 2023.06.26 14:37:39 LOG6[per-day]: Executing per-day jobs 2023.06.26 14:37:39 LOG6[per-day]: Per-day jobs completed in 0 seconds 2023.06.26 14:37:39 LOG7[per-day]: Waiting 86400 seconds -- Seray TOKADLI KILIÇ +420778116052

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 21 Jun '23

21 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

2 7

help configuring stunnel with ssl ceritificate
by Andrei 20 Jun '23

20 Jun '23

Hello! I'm trying to configure stunnel with an ssl certificate. I have the certificate (.p12 format) from the site owners, installed it in the Personal folder of the current user and local machine. Before installing stunnel I had to select the certificate in the browser when accessing the site. With this configuration [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 key = E:\!Work\ cert_.pem CAfile = E:\!Work\ cert_.pem verify=0 the stunnel starts but I get a `No required SSL certificate was sent`when accessing from the browser. If I use this config [sts] client = yes accept = 127.0.0.1:42354 connect = y7m2zq.its:443 cert = E:\!Work\cert_.p12 key = E:\!Work\cert_.pem CAfile = E:\!Work\cert_.pem verify=0 the stunnel will not start PKCS12_parse: crypto/evp/evp_fetch.c:373: error:0308010C:digital envelope routines::unsupported LOG3[main]: Service [sts]: Failed to initialize TLS context Please help. I would like to be able to open the site without choosing the certificate. Thank you!

2 1

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

stunnel application in windows 2016 server
by noel.melvin＠tcs.com 20 Jun '23

20 Jun '23

Hi All, Please anyone know the answer, its very urgent. 1. stunnel log file are not capturing any events. (It was working before the server reboot 2 days earlier). 2. When we open stunnel.exe getting message as "server is down". Anything else apart from stunnel.conf file is located in the config folder and it was working prior to the server reboot. the only change we did was replaced a pem & .key files in c:\programfilesx86\stunnel\config and then server was rebooted. since then the events are not getting captured in d:\stunnellogs\stunnel.log file. Also how to verify the stunnel functionality till then

1 0

Inbound and outbound connection on same PC?
by trashrap22＠gmail.com 15 Jun '23

15 Jun '23

Hi, I have a linux PC that now successfully runs a stunnel client connection with a remote server. I now want to be able to access sql server on that linux PC from a remote Windows PC. What I would like to gather information on: 1. Can the client configuration of stunnel on the linux PC be used for a second connection from the remote windows PC to access data (sql server)? 2. Thus, what differentiates a client from a server - a server can have multiple connections and provides data? A client can't? 3. What is the correct route I should take? Regards,

3 3

Reading HSM Pincode from file and passing it to Stunnel/OpenSSL
by Andreas Heijdendael 30 May '23

30 May '23

Hi there, I'm running into an issue. I'm trying to run stunnel on my new Ubuntu 22.04 system whereas before I was running it on Windows. Thing is, on the Windows system I had to compile stunnel manually as I need to read an encrypted file on the filesystem that contains the user-pin for my HSM. On Windows, that worked. On Ubuntu I'm having issues with the C11 _s functions (like sscanf_s and the likes). ChatGTP suggested using clang compiler, but I have not clue on how to do that. Of enabling C11 Annex K support in Ubuntu (no such thing, apparently).... Is there anybody here that makes use of these _s functions in their code on Ubuntu 22.04? Or explain how to use these functions in gcc? Or compile stunnel (+ additional code) using Clang. Thanks!! Andreas

1 0

ssl3 wrong version number
by trashrap22＠gmail.com 18 May '23

18 May '23

I get the following error running 'sudo service stunnel4 status' : LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number is that merely a mismatch between openSSL versions used by client and server? I have tried changing the config file options, also with no specification since the default according to stunnel.org is: options = NO_SSLv2 options = NO_SSLv3 I have tried (service level option): sslVersion = TLSv1 Same error. When running sudo service stunnel4 status after start: May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP May 12 08:22:45 user-Linux stunnel4[16616]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: started May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf May 12 08:22:45 user-Linux systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: UTF-8 byte order mark not detected May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: FIPS mode disabled May 12 08:22:45 user-Linux stunnel[16630]: LOG4[ui]: Insecure file permissions on /var/lib/stunnel4/psk.txt May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Configuration successful May 12 08:22:45 user-Linux stunnel[16630]: LOG5[ui]: Switched to chroot directory: /var/lib/stunnel4/ May 12 08:22:45 user-Linux stunnel[16632]: LOG5[cron]: Updating DH parameters After trying to make a connection via FIX connection: May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Service [**redacted**] started May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Setting local socket options (FD=3) May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Option TCP_NODELAY set on local socket May 12 08:28:04 user-Linux stunnel[16798]: LOG5[0]: Service [**redacted**] accepted connection from 127.0.0.1:51954 May 12 08:28:04 user-Linux stunnel[16798]: LOG6[0]: Peer certificate not required May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: TLS state (accept): before SSL initialization May 12 08:28:04 user-Linux stunnel[16798]: LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number May 12 08:28:04 user-Linux stunnel[16798]: LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Local descriptor (FD=3) closed May 12 08:28:04 user-Linux stunnel[16798]: LOG7[0]: Service [**redacted**] finished (0 left)

2 1

TLS alert (read): warning: close notify
by trashrap22＠gmail.com 18 May '23

18 May '23

Hi All, Hopefully the last question with my struggles! Stunnel connects and the initial TLS connection works - but then it seems the client or server (I am client) does not trust the psk key? Any ideas? Note - part of the previous issue was creating a 64B/512b PSK and NOT a 32/B/256b psk. I created that key and shared it with the server. See below line referencing 256bit encryption? May 18 16:34:38 user-Linux stunnel: LOG5[0]: Service [** redacted **] connected remote server from ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG7[0]: Setting remote socket options (FD=11) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Option TCP_NODELAY set on remote socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) initialized May 18 16:34:38 user-Linux stunnel: LOG6[0]: SNI: sending servername: ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG6[0]: Peer certificate not required May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): before SSL initialization May 18 16:34:38 user-Linux stunnel: LOG7[0]: Initializing application specific data for session authenticated May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange May 18 16:34:38 user-Linux stunnel: LOG6[0]: Client certificate not requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server done May 18 16:34:38 user-Linux stunnel: LOG6[0]: PSK client configured for identity "client" May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: New session callback May 18 16:34:38 user-Linux stunnel: LOG6[0]: No peer certificate received May 18 16:34:38 user-Linux stunnel: LOG6[0]: Session id: ***** redacted **** May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) succeeded May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 client renegotiation(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 session reuse(s) May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS connected: new session negotiated May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLSv1.2 ciphersuite: ECDHE-PSK-CHACHA20-POLY1305 (256-bit encryption) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Compression: null, expansion: null May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (read): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS closed (SSL_read) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sent socket write shutdown May 18 16:34:38 user-Linux stunnel: LOG6[0]: Read socket closed (readsocket) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sending close_notify alert May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (write): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: SSL_shutdown successfully sent close_notify alert May 18 16:34:38 user-Linux stunnel: LOG5[0]: Connection closed: 98 byte(s) sent to TLS, 0 byte(s) sent to socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Local descriptor (FD=3) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Service [*redacted*]finished (0 left)

1 0

chroot jail on debian 11 for stunnel steps?
by trashrap22＠gmail.com 11 May '23

11 May '23

Does someone have all the steps in order to setup a chroot jail on debian 11 OS - I have followed [this](https://manpages.debian.org/testing/stunnel4/stunnel.8.en.html) mostly - but think I am going to miss some differences to Debian 11 and go down a rabbit hole. Anyone have done it on Debian 11 care to share the steps?

3 3

Re: stunnel not starting
by Christopher Schultz 10 May '23

10 May '23

Hello, On 5/10/23 00:28, d3rIIIe15ter Tier wrote: > Please advise why you strongly advise running stunnel in a chroot jail? Because: 1. It's insanely easy to do (it literally IS just "chroot=/path/to/jail") and 2. If there is a problem with stunnel (e.g. security issue), the amount of damage an attacker can do is significantly limited -chris > On Tue, May 9, 2023 at 5:59 PM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Hello, > > On 5/9/23 11:13, d3rIIIe15ter Tier wrote: > > After giving access to var/log/secure/stunnel.log, I now get logs! > > > > There I get the following error: > > > > Cannot create pid file /var/run/stunnel4.pid > > create: Permission denied (13) > > What is the euid of the stunnel process? Does it have access to that > path? Are you using a chroot jail? (You should be.) Does that path > exist > in the chroot jail? Can the stunnel user write to that path? > > -chris > > > On Tue, May 9, 2023 at 4:34 PM d3rIIIe15ter Tier > <trashrap22(a)gmail.com <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> wrote: > > > > You are right... bad mistake. > > > > Now I get: cannot open log file - which I am sure is a > permission > > thing since I need to use sudo to be able to write to that file. > > Any ideas further? > > > > On Tue, May 9, 2023 at 4:21 PM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> > > wrote: > > > > Hello, > > > > On 5/9/23 10:17, d3rIIIe15ter Tier wrote: > > > I have tried changing the location to > > > > > > var/log/stunnel4/stunnel.log > > > var/log/stunnel4/stunnelLog > > > var/log/secure/ > > > var/log/secure/stunnel.log > > > etc/stunnel/stunnel.log > > > etc/stunnel/stunnelLog > > > > > > don't know how to fix it yet... > > I don't think the *value* is the problem. The problem is that > > you have > > defined "output" somewhere that isn't valid, such as within a > > specific > > service's section instead of as a global setting. > > > > -chris > > > > > On Tue, May 9, 2023 at 3:54 PM Christopher Schultz > > > <chris(a)christopherschultz.net > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>>> wrote: > > > > > > Hello, > > > > > > On 5/9/23 09:40, trashrap22(a)gmail.com > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> > > > wrote: > > > > Hi, I am on Debian - when I run "sudo stunnel > > stunnel.conf" I > > > get the following output: > > > > > > > > [ ] Clients allowed=500 > > > > [.] stunnel 5.56 on x86_64-pc-linux-gnu platform > > > > [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 > > > > [.] Running with OpenSSL 1.1.1n 15 Mar 2022 > > > > [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD > > > TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP > > > > [ ] errno: (*__errno_location ()) > > > > [.] Reading configuration from file > > /etc/stunnel/stunnel.conf > > > > [.] UTF-8 byte order mark not detected > > > > [.] FIPS mode disabled > > > > [ ] Compression disabled > > > > [ ] No PRNG seeding was required > > > > [!] /etc/stunnel/stunnel.conf:24: "output = > > /tmp/stunnel.log": > > > Specified option name is not valid here > > > > [ ] Deallocating section defaults > > > > > > > > When I run "sudo netstat -tulnp | grep -i > stunnel" I > > also get no > > > output - which means that stunnel is not starting up? > > > > > > The log message seems pretty specific to me. Maybe you > > should fix that? > > > > > > -chris > > > _______________________________________________ > > > stunnel-users mailing list -- > stunnel-users(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > To unsubscribe send an email to > > stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > > > _______________________________________________ > > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > To unsubscribe send an email to > stunnel-users-leave(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> >

1 0

stunnel not starting
by trashrap22＠gmail.com 09 May '23

09 May '23

Hi, I am on Debian - when I run "sudo stunnel stunnel.conf" I get the following output: [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 [.] Running with OpenSSL 1.1.1n 15 Mar 2022 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [!] /etc/stunnel/stunnel.conf:24: "output = /tmp/stunnel.log": Specified option name is not valid here [ ] Deallocating section defaults When I run "sudo netstat -tulnp | grep -i stunnel" I also get no output - which means that stunnel is not starting up?

4 7

Update newest version
by sportman7＠netzero.com 05 May '23

05 May '23

Have used Stunnel for years. To update I normally download the latest version and copy the files (DLL, exe, etc.) to my client's computers. But I tried this with latest update and I must be missing something as my app is not able to use this version. Went back to previous version but really need to know how to deliver the update to a client's computer. Thanks for any ideas on this.

2 2

stunnel and Google LDAP
by matt.colwell＠sduhsd.net 01 May '23

01 May '23

Hi, I'm trying to setup stunnel as a proxy to Google Workplace's LDAP service. I followed the instructions located here: https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3… I've set the up on Ubuntu 22.04.2 LTS When attempting to connect I get the following error: SSL_read: ../ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading Connection reset: 217 byte(s) sent to TLS, 164 byte(s) sent to socket What might be my issue here? thanks

1 0

error starting / restarting /etc/init.d/stunnel4 on debian
by trashrap22＠gmail.com 28 Apr '23

28 Apr '23

Hi, I am not getting any stunnel logs. Though my syslog gives me the info below. The stunnel4 file in /usr/bin/ is empty? Apr 28 15:18:01 User-Linux systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Apr 28 15:18:01 User-Linux stunnel4[30850]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: Apr 28 15:18:01 User-Linux stunnel4[30864]: /sbin/start-stop-daemon: unable to start /usr/bin/stunnel4 (Exec format error) Apr 28 15:18:01 User-Linux stunnel4[30850]: failed Apr 28 15:18:01 User-Linux stunnel4[30850]: You should check that you have specified the pid= in you configuration file

4 4

Is there installing instructions for Stunnel on Debian ?
by trashrap22＠gmail.com 26 Apr '23

26 Apr '23

Hi, I don't see installing instructions for Linux or rather for Debian specifically anywhere ?

4 4

FW: Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

Actually I think the SSLv3 in the log is a lie - as this is also in the log just before the below: TLS state (connect): before/connect initialization TLS state (connect): SSLv3 write client hello A TLS state (connect): SSLv3 read server hello A So I am thinking the eliptic curve stuff is more likely the issue? Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 _____________________________________________ From: Eberhard <flash(a)vicsmba.com> Sent: Tuesday, March 14, 2023 9:15 AM To: 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Subject: Help with disabling SSLv3 Importance: High I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

2 1

Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

1 0

Stunnel Installation.
by nathan.king＠unpredictableporridge.co.uk 12 Mar '23

12 Mar '23

Hello, New stunnel user here - or trying to ne! I manage a streaming service using both SHOUT and Icecast servers, on a Widows 10 platform. Have been hit by the update to the G/Chrome browser, and while the Website is secure, the streams are not. There is limited support for S.S.L. for Icecast, but none for SHOUTcast. Was recommended to use S.S.L., but apparently the OpenSSL library isn't downloaded for Widows, only Linux, so have tried using Debian 11, which have installed within VirtualBox. However, have had no luck making the connection. Happened to read in another tutorial that if stunnel isn't installed on the same Computer, as the Playout system and encoder - use B.U.T.T., and Sound Empire Caster - one has to have stunnel installed on both Computers? Is the above true? EIther way,, would appreciate some advice on how to resolve this issue, and am new to stunnel, and only a basic knowledge of Debian. Thanks for your help with this issue. Cheers.

3 8

stunnel as server dont connect to endpoint
by mahdi.section8＠gmail.com 05 Mar '23

05 Mar '23

hello everyone i have a setup of openvpn + stunnel stunnel(client) in a server stunnel(server) + openvpn in another server both were working fine until i moved the second server to another one i moved all openvpn and stunnel files to new one but even though its same stunnel it dont work properly i even compiled latest 5.69 version thinking it was a bug this is my stunnel config: setuid = root setgid = root [openvpn] cert=/etc/stunnel/cert.pem key=/etc/stunnel/key.pem accept = 0.0.0.0:1381 connect = 127.0.0.1:1194 its so simple yet idk whats the problem, cause in the logs i only see from stunnel that a connection from ip x accepted but nothing else saying that it connected to 127.0.0.1:1194 its just accepting connections and nothing more like it forgot there is a connect option there. but i confirm openvpn is correct as i tested with netcat and openvpn showed up in logs saying there is a connection but somehow stunnel dont connect to 127.0.0.1:1194 its crazy that either i forgot something or misconfig of stunnel cause its so simple and its not working

2 2

stunnel 5.69 released
by Michał Trojnara 04 Mar '23

04 Mar '23

Dear Users, I have released version 5.69 of stunnel. ### Version 5.69, 2023.03.04, urgency: MEDIUM * New features - Improved logging performance with the "output" option. - Improved file read performance on the WIN32 platform. - DH and kDHEPSK ciphersuites removed from FIPS defaults. - Set the LimitNOFILE ulimit in stunnel.service to allow for up to 10,000 concurrent clients. * Bugfixes - Fixed the "CApath" option on the WIN32 platform by applying https://github.com/openssl/openssl/pull/20312. - Fixed stunnel.spec used for building rpm packages. - Fixed tests on some OSes and architectures by merging Debian 07-tests-errmsg.patch (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1ff7d9f30884c75b98c8a0a4e1534fa79adcada2322635e6787337b4e38fdb81 stunnel-5.69.tar.gz 66c4f3bbb94c4a274f2e8e98e3d44e74c0460d6494986f0a94b9b8becdc63cc3 stunnel-5.69-win64-installer.exe 74813a0be13270b5348fc4bc7c16ada668d151773be19f404db1176b7e22aafc stunnel-5.69-android.zip Best regards, Mike

1 0

Can I use SCCM to push the install of stunnel to multiple devices
by kmbpabvmkrmtzuzurk＠bbitf.com 27 Feb '23

27 Feb '23

Just a quick question around this and are there any documentation/guides that could be useful?

1 0

Stunnel Configuration issues
by ringbretson＠keplp.com 22 Feb '23

22 Feb '23

I'm trying to create a FIX application that interfaces with ICE using Stunnel to provide encryption. I'm encountering a handshake failure trying to interface with the FIX application. I've copies portions of the Stunnel configuration file as well as the entire FIX configuration file below. Can you do a quick review of the two configuration files and tell me what I'm doing wrong? Both FIX and Stunnel are running on the same Windows 10 virtual pc. *** Stunnel ERRORS with accept set to 127.0.0.1:83 *** 2023.02.21 20:07:13 LOG5[main]: stunnel 5.68 on x64-pc-mingw32-gnu platform 2023.02.21 20:07:13 LOG5[main]: Compiled/running with OpenSSL 3.0.8 7 Feb 2023 2023.02.21 20:07:13 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.02.21 20:07:13 LOG5[main]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2023.02.21 20:07:13 LOG5[main]: UTF-8 byte order mark detected 2023.02.21 20:07:13 LOG5[main]: FIPS mode disabled 2023.02.21 20:07:13 LOG3[main]: No trusted certificates found 2023.02.21 20:07:13 LOG5[main]: Configuration successful 2023.02.21 20:07:25 LOG5[0]: Service [fix_initiator_session1_tunnel] accepted connection from 127.0.0.1:62314 2023.02.21 20:07:25 LOG5[0]: s_connect: connected 63.247.113.201:443 2023.02.21 20:07:25 LOG5[0]: Service [fix_initiator_session1_tunnel] connected remote server from 192.168.1.219:62315 2023.02.21 20:07:25 LOG3[0]: SSL_connect: ssl/record/rec_layer_s3.c:1605: error:0A000410:SSL routines::sslv3 alert handshake failure 2023.02.21 20:07:25 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.02.21 20:07:26 LOG5[1]: Service [fix_initiator_session1_tunnel] accepted connection from 127.0.0.1:62316 2023.02.21 20:07:26 LOG5[1]: s_connect: connected 63.247.113.201:443 2023.02.21 20:07:26 LOG5[1]: Service [fix_initiator_session1_tunnel] connected remote server from 192.168.1.219:62317 2023.02.21 20:07:26 LOG3[1]: SSL_connect: ssl/record/rec_layer_s3.c:1605: error:0A000410:SSL routines::sslv3 alert handshake failure 2023.02.21 20:07:26 LOG5[1]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket *** FIX ERRORS with accept set to 127.0.0.1:49200 *** Same errors in stunnel, but (Socket Error: An existing connection was forcibly closed by the remote host.) in FIX Application *** Stunnel configuration *** [fix_initiator_session1_tunnel] client = yes accept = 127.0.0.1:83 connect = 63.247.113.201:443 cert = stunnel.pem ciphers = PSK PSKsecrets = psk.txt *** FIX 4.4 Configuration *** [DEFAULT] ConnectionType=initiator ReconnectInterval=60 FileStorePath=c:\Temp\WebIce_Initiator FileLogPath=c:\Temp\WebIce_Initiator StartTime=00:00:00 EndTime=23:59:59 SocketConnectHost=127.0.0.1 SocketConnectPort=83 ResetOnLogon=Y ResetOnLogout=Y ResetOnDisconnect=Y [SESSION] BeginString=FIX.4.4 SenderCompID=8655 SenderSubID=0921 TargetCompID=ICE HeartBtInt=30 ValidateFieldsOutOfOrder=N UseDataDictionary=Y DataDictionary=C:\Applications\WebIceInitiator_Pub\FIX44.xml CheckLatency=N SSLEnable=Y SSLProtocols=Tls12 SSLValidateCertificates=N SSLCertificateRevocation=N SSLCertificate=C:\Applications\WebIceInitiator_Pub\Wildcard.ingsoftware.net. pfx SSLCertificatePassword=9322 SSLRequireClientCertificate=N ScreenLogEvents=N ScreenLogShowIncoming=N ScreenLogShowOutgoing=N ScreenLogShowHeartBeats=N

1 0

tstunnel.exe fails to start after updating from 5.67 to 5.68
by Yasuhiro Kimura 21 Feb '23

21 Feb '23

Hello, I install stunnel to my 64bit Windows 10 22H2 PC with official Windows installer and use tstunnel.exe to create TLS connection to IMAP server with configuration file as following ("debug=debug" line is added for debugging purpose). ---------------------------------------------------------------------- client=yes verify=2 checkHost=imap.example.org CApath=C:/Users/yasu/.certs debug=debug [13579] accept=localhost:13579 connect=imap.example.org:143 protocol=imap ---------------------------------------------------------------------- With version 5.67, tstunnel.exe successfully starts as following. ---------------------------------------------------------------------- C:\Users\yasu>tstunnel C:\Users\yasu\Temp\tstunnel.conf 2023.02.19 04:29:11 LOG6[ui]: Initializing inetd mode configuration 2023.02.19 04:29:11 LOG7[ui]: Running on Windows 6.2 2023.02.19 04:29:11 LOG7[ui]: No limit detected for the number of clients 2023.02.19 04:29:11 LOG5[ui]: stunnel 5.67 on x64-pc-mingw32-gnu platform 2023.02.19 04:29:11 LOG5[ui]: Compiled/running with OpenSSL 3.0.7 1 Nov 2022 2023.02.19 04:29:11 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.02.19 04:29:11 LOG7[ui]: errno: (*_errno()) 2023.02.19 04:29:11 LOG6[ui]: Initializing inetd mode configuration 2023.02.19 04:29:11 LOG7[ui]: Running on Windows 6.2 2023.02.19 04:29:11 LOG5[ui]: Reading configuration from file C:\Users\yasu\Temp\tstunnel.conf 2023.02.19 04:29:11 LOG5[ui]: UTF-8 byte order mark not detected 2023.02.19 04:29:11 LOG5[ui]: FIPS mode disabled 2023.02.19 04:29:11 LOG6[ui]: Compression disabled 2023.02.19 04:29:11 LOG7[ui]: No PRNG seeding was required 2023.02.19 04:29:11 LOG6[ui]: Initializing service [13579] 2023.02.19 04:29:11 LOG6[ui]: stunnel default security level set: 2 2023.02.19 04:29:11 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2023.02.19 04:29:11 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.02.19 04:29:11 LOG7[ui]: TLS options: 0x2100000 (+0x0, -0x0) 2023.02.19 04:29:11 LOG6[ui]: Session resumption enabled 2023.02.19 04:29:11 LOG7[ui]: No certificate or private key specified 2023.02.19 04:29:11 LOG6[ui]: DH initialization skipped: client section 2023.02.19 04:29:11 LOG7[ui]: ECDH initialization 2023.02.19 04:29:11 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.02.19 04:29:11 LOG5[ui]: Configuration successful 2023.02.19 04:29:11 LOG7[ui]: Deallocating deployed section defaults 2023.02.19 04:29:11 LOG7[ui]: Binding service [13579] 2023.02.19 04:29:11 LOG7[ui]: Listening file descriptor created (FD=524) 2023.02.19 04:29:11 LOG7[ui]: Setting accept socket options (FD=524) 2023.02.19 04:29:11 LOG7[ui]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.02.19 04:29:11 LOG6[ui]: Service [13579] (FD=524) bound to ::1:13579 2023.02.19 04:29:11 LOG7[ui]: Listening file descriptor created (FD=528) 2023.02.19 04:29:11 LOG7[ui]: Setting accept socket options (FD=528) 2023.02.19 04:29:11 LOG7[ui]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.02.19 04:29:11 LOG6[ui]: Service [13579] (FD=528) bound to 127.0.0.1:13579 2023.02.19 04:29:11 LOG7[cron]: Cron thread initialized 2023.02.19 04:29:11 LOG6[cron]: Executing cron jobs 2023.02.19 04:29:11 LOG6[cron]: Cron jobs completed in 0 seconds 2023.02.19 04:29:11 LOG7[cron]: Waiting 86400 seconds ---------------------------------------------------------------------- And if I try `telnet localhost 13579`, then I can successfully connect to IMAP server. But after updating from 5.67 to 5.68, it fails to start as following. ---------------------------------------------------------------------- C:\Users\yasu>tstunnel C:\Users\yasu\Temp\tstunnel.conf [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.68 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.8 7 Feb 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Users\yasu\Temp\tstunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [13579] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] No certificate or private key specified [!] No trusted certificates found [!] Service [13579]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [13579] ---------------------------------------------------------------------- Why these different results happen? Is it bug of 5.68? Or it there any incompatible change between 5.67 and 5.68? --- Yasuhiro Kimura

2 2

No peer temporary key received
by Michael S. Chusovitin 17 Feb '23

17 Feb '23

Hi folks, is there any chance to grasp why such a line - "No peer temporary key received" - is logged immediately after successful negotiation? It does not look harmful but I cannot understand *how ECDHE can do without the ephemeral key*. 2023.02.17 20:33:41 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:33:41 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:33:41 LOG6[4]: No peer temporary key received 2023.02.17 20:33:41 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:33:41 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:33:41 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:33:41 LOG7[4]: FD=524 ifds=--- ofds=r-- 2023.02.17 20:33:41 LOG7[4]: FD=540 ifds=rwx ofds=--- 2023.02.17 20:33:41 LOG5[4]: s_connect: connected 127.0.0.1:9000 The above is logged by Stunnel 5.67/5.68; whereas Stunnel 5.66 logs the very same moments differently: it says "SSL_get_peer_tmp_key: Peer suddenly disconnected" (but this can hardly be true). 2023.02.17 20:27:15 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:27:15 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:27:15 LOG3[4]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2023.02.17 20:27:15 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:27:15 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:27:15 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:27:15 LOG7[4]: FD=512 ifds=--- ofds=r-- 2023.02.17 20:27:15 LOG7[4]: FD=528 ifds=rwx ofds=--- 2023.02.17 20:27:15 LOG5[4]: s_connect: connected 127.0.0.1:9000 Thanks in advance, Mikhail

1 0

blat, stunnel, and gmail with an app password
by blat_stunnel2023＠protonmail.com 17 Feb '23

17 Feb '23

I was using a Windows command line blat.exe mailer with stunnel along with a gmail account to send emails from a Windows command line batch file. Gmail started requiring I se the gmail account to allow "less secure" sign in options. That worked for a while, but in May 2022, gmail discontinued that option. It sounds like you can set two factor on the gmail account and then generate an app password for the gmail account. So I did that. I'm stumped on how to get either blat or stunnel to use that gmail app password though. Any ideas? Blat is looking super old though. I see when I set up this computer to with blat-stunnel-gmail, that I ran a line with blat.exe to store the gmail password. I don't see a way to store an app password, but blat is old. This is blat. http://www.blat.net./ Looks like the last update was in 2012, so app passwords may not have even existed then. Is there any way to stunnel to store a gmail app password? My goal is just to send an email from a Windows machine with either a Windows batch file or PowerShell script. It's not mission critical. It's for home use. I just like to get email alerts when my home machines complete some task. If something else works, I'm interested. It needs to work in a batch file though, or at least powershell if a batch file can't work. For my previous set up, I just kept stunnel updated, initially set up blat with the email information, and used only a batch file with blat to send emails from a gmail account. And then it was making sure less secure apps was an option on the gmail account. Now it's been broken for almost a year.

2 2

Windows offical release - Anyone knows which compiler is used ? VS or minigw ?
by roie rachamim 13 Feb '23

13 Feb '23

Many thanks, Roie

1 0

stunnel 5.68 released
by Michał Trojnara 12 Feb '23

12 Feb '23

Dear Users, I have released version 5.68 of stunnel. ### Version 5.68, 2023.02.07, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.8. * New features - Added the new 'CAengine' service-level option to load a trusted CA certificate from an engine. - Added requesting client certificates in server mode with 'CApath' besides 'CAfile'. * Bugfixes - Fixed EWOULDBLOCK errors in protocol negotiation. - Fixed handling TLS errors in protocol negotiation. - Prevented following fatal TLS alerts with TCP resets. - Improved OpenSSL initialization on WIN32. - Improved testing suite stability. - Improved file read performance. - Improved logging performance. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: dcd895ab088b043d4e0bafa8b934e7ab3e697293828dbe9fce46cb7609a7dacf stunnel-5.68.tar.gz 62807f6233c8a5693104c09b44ebde6cc395877d948651c3ff0767e07ccdd316 stunnel-5.68-win64-installer.exe 93291060fdfc889431e8bce5cfe875b23be2bac11e2338f8f8f84d509f1b33fa stunnel-5.68-android.zip Best regards, Mike

2 1

Cannot establish tunnel
by andrew.haworth＠roche.com 11 Feb '23

11 Feb '23

Hi, I am new to stunnel on a MAC. When I run stunnel with the enabled configuration [mllp-to-dip], I am prompted for a local password and then for my certificate passphrase. I am not able to establish a tunnel. See logs: Initializing service [mllp-to-dip] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Certificate loaded from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Loading private key from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [:] Insecure file permissions on /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key loaded from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key check succeeded [:] Service [mllp-to-dip] needs authentication to prevent MITM attacks [ ] DH initialization skipped: client section [ ] ECDH initialization [ ] ECDH initialized with curves X25519:P-256:X448:P-521:P-384 [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [mllp-to-dip] [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to :::6661: Address already in use (48) [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to 0.0.0.0:6661: Address already in use (48) [!] Binding service [mllp-to-dip] failed [ ] Unbinding service [mllp-to-dip] [ ] Service [mllp-to-dip] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [mllp-to-dip] Can someone help with my troubleshooting steps?

4 5

Setup Error
by Paul Gabriel 11 Feb '23

11 Feb '23

Hi, I am attempting to setup stunnel 5.67 in Windows Server 2022 core. I believe I have enabled TLS 1.2. Here is the output of stunnel starting up: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.67 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.7 1 Nov 2022 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [Integration Profile 1] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: art&music.pem [!] error queue: ssl/ssl_rsa.c:448: error:0A080002:SSL routines::system lib [!] error queue: crypto/bio/bss_file.c:300: error:10080002:BIO routines::system lib [!] SSL_CTX_use_certificate_chain_file: crypto/bio/bss_file.c:297: error:80000002:system library::No such file or directory [!] Service [Integration Profile 1]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [Integration Profile 1] Any suggestions on what is wrong? Thanks, Paul

2 1

Long time to tear off the certificate
by nizdiminov＠itopcase.ru 02 Feb '23

02 Feb '23

Good afternoon, I observe a problem in the operation of the stunnel. There are 5 active connections. I get an error **** Server unexpectedly disconnected Error performing handshake Before that, there is a pattern, it takes a very long time to tear off the certificate 5 мин. 2023.01.31 17:13:37 LOG7[15674:140480621389568]: open file /etc/stunnel/cert/eis/dit.cer with certificate 2023.01.31 17:18:25 LOG3[15674:140480621389568]: Credentials complete /opt/cprocsp/sbin/amd64/stunnel_thread -version stunnel 4.18 on x86_64-pc-linux-gnu Threading:PTHREAD Sockets:POLL,IPv6 Auth:LIBWRAP

1 0

Monitoring stunnel
by nizdiminov＠itopcase.ru 01 Feb '23

01 Feb '23

Good afternoon, tell me how best to monitor the stunnel? I use zabbix monitoring 5.4 , in my stunnel 5 connections 3 server 2 clients, all with certificate verification. It is necessary to monitor each connection separately. Maybe there is a template for zabbix monitoring 5.4 ?

1 0

help
by Gurjit Singh Jhutti 27 Jan '23

27 Jan '23

Is it possible to configure username and password for SMTP connection on Windows Server, did try this with any success in stunnel.conf [client] username = user password = password error: LOG6[main]: Initializing service [client] LOG3[main]: ....\stunnel.conf:73: "username = user": Specified option name is not valid here LOG3[main]: Configuration failed

1 0

Odd stunnel problem
by Phil Smith III 26 Jan '23

26 Jan '23

Well, odd to me. I use K9, a free Bayesian spam proxy I've used for ~20 years. It doesn't do TLS. So I have: Outlook <-> K9 <-> stunnel <-> Internet for email connections. This morning I wasn't getting anything on my dozen or so POP connections that go through that (Exchange email was fine). Restarted Outlook (making sure it had really closed), no joy. Then I noticed that while doing a mail check, K9 was throbbing for long periods. There's not much to do with K9, so next I looked at stunnel, whose log was full of: 2023.01.26 09:39:26 LOG3[18110]: No more addresses to connect 2023.01.26 09:39:36 LOG3[18111]: s_connect: s_poll_wait 146.20.147.244:995: TIMEOUTconnect exceeded Reloaded stunnel config and all is well. So, not a big deal, but.any guesses what was going on here? stunnel 5.57, Windows 10.

1 0

Stunnel activity issue
by Денис Голубятников 26 Jan '23

26 Jan '23

I have problems with stunnel on OS Windows. After a successful connection with stunnel, the connection drops after approximately 9 minutes of inactivity. On Linux, this problem was solved by changing this parametrs: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 I don't have access to the server side router, so I can't change anything. Stunnel log: 2023.01.25 17:18:10 LOG7[1]: Service [test] started 2023.01.25 17:18:10 LOG7[1]: Setting local socket options (FD=964) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on local socket 2023.01.25 17:18:10 LOG5[1]: Service [test] accepted connection from 127.0.0.1:50145 2023.01.25 17:18:10 LOG6[1]: s_connect: connecting 225.179.85.93:18572 2023.01.25 17:18:10 LOG7[1]: s_connect: s_poll_wait 225.179.85.93:18572: waiting 10 seconds 2023.01.25 17:18:10 LOG7[1]: FD=716 ifds=rwx ofds=--- 2023.01.25 17:18:10 LOG5[1]: s_connect: connected 225.179.85.93:18572 2023.01.25 17:18:10 LOG5[1]: Service [onegomed] connected remote server from 192.168.1.84:50146 2023.01.25 17:18:10 LOG7[1]: Setting remote socket options (FD=716) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on remote socket 2023.01.25 17:18:10 LOG7[1]: Remote descriptor (FD=716) initialized 2023.01.25 17:18:10 LOG6[1]: SNI: sending servername: 225.179.85.93 2023.01.25 17:18:10 LOG6[1]: Peer certificate not required 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): before SSL initialization 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read encrypted extensions 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server certificate 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read server certificate verify 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read finished 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write change cipher spec 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write finished 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) requested 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) succeeded 2023.01.25 17:18:10 LOG7[1]: 0 client renegotiation(s) requested 2023.01.25 17:18:10 LOG7[1]: 0 session reuse(s) 2023.01.25 17:18:10 LOG6[1]: TLS connected: new session negotiated 2023.01.25 17:18:10 LOG6[1]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2023.01.25 17:18:10 LOG6[1]: Peer temporary key: X25519, 253 bits 2023.01.25 17:18:10 LOG7[1]: Compression: null, expansion: null 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 8E91DBE369D9E16221CCA288A7C1F652AB045BAE96C19B4240B1B7F710069CCE 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 6UIA254BF9D027B3D4BE5F966BDE9DE2058CF167C4EF0CD5A460958B698DF322 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:33:25 LOG3[1]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2023.01.25 17:33:25 LOG5[1]: Connection reset: 5184 byte(s) sent to TLS, 10344 byte(s) sent to socket 2023.01.25 17:33:25 LOG7[1]: Remote descriptor (FD=716) closed 2023.01.25 17:33:25 LOG7[1]: Local descriptor (FD=964) closed 2023.01.25 17:33:25 LOG7[1]: Service [test] finished (0 left)` I tried: * changing the windows registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveInterval HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissions HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TdxPrematureConnectIndDisabled HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\KeepAliveTimeout HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\ServerInfoTimeout * changing stunnel config on client side: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 * changing parametrs on linux server side: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 * add server cert on stunnel client config; * downgrade and update stunnel. -- Gordon Stevenson Отправлено из Почты Mail.ru

1 0

forward all UDP port
by Ahmad Kiamanesh 23 Jan '23

23 Jan '23

Hi how can forward all inner UDP ports from one server to another server?

1 0

STunnel not passing traffic
by Gary Jackson 15 Jan '23

15 Jan '23

I have an application that sends XML encrypted traffic over TCP to Stunnel. Stunnel is supposed to unencrypt and send to backend application unencrypted, however no traffic is sent. I have used wireshark and I do see the client hello for tls1.2 and the server hello for tls 1.2 so the cipher negotiation is completed. Here is my config: sslVersionMax = TLSv1.2 options = -NO_SSLv3 [https] accept = 27015 connect = 27001 cert = cert.pem key = key.pem TIMEOUTclose = 0 STunnel Log in Debug 7 2023.01.13 14:03:42 LOG7[16572]: Service [https] started 2023.01.13 14:03:42 LOG7[16572]: Setting local socket options (FD=1888) 2023.01.13 14:03:42 LOG7[16572]: Option TCP_NODELAY set on local socket 2023.01.13 14:03:42 LOG5[16572]: Service [https] accepted connection from xx.xx.xx.xx:62478 2023.01.13 14:03:42 LOG6[16572]: Peer certificate not required 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): before SSL initialization 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): before SSL initialization 2023.01.13 14:03:42 LOG7[16572]: Decrypt session ticket callback 2023.01.13 14:03:42 LOG7[16572]: Initializing application specific data for session authenticated 2023.01.13 14:03:42 LOG7[16572]: SNI: no virtual services defined 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read client hello 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server hello 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write certificate 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write key exchange 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server done 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server done 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read client key exchange 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read change cipher spec 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read finished 2023.01.13 14:03:42 LOG7[16572]: Generate session ticket callback 2023.01.13 14:03:42 LOG7[16572]: Initializing application specific data for session authenticated 2023.01.13 14:03:42 LOG7[16572]: Deallocating application specific data for session connect address 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write session ticket 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write change cipher spec 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write finished 2023.01.13 14:03:42 LOG7[16572]: 33 server accept(s) requested 2023.01.13 14:03:42 LOG7[16572]: 33 server accept(s) succeeded 2023.01.13 14:03:42 LOG7[16572]: 0 server renegotiation(s) requested 2023.01.13 14:03:42 LOG7[16572]: 0 session reuse(s) 2023.01.13 14:03:42 LOG7[16572]: 1 internal session cache item(s) 2023.01.13 14:03:42 LOG7[16572]: 0 internal session cache fill-up(s) 2023.01.13 14:03:42 LOG7[16572]: 0 internal session cache miss(es) 2023.01.13 14:03:42 LOG7[16572]: 0 external session cache hit(s) 2023.01.13 14:03:42 LOG7[16572]: 0 expired session(s) retrieved 2023.01.13 14:03:42 LOG6[16572]: TLS accepted: new session negotiated 2023.01.13 14:03:42 LOG6[16572]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.01.13 14:03:42 LOG3[16572]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2023.01.13 14:03:42 LOG7[16572]: Compression: null, expansion: null 2023.01.13 14:03:42 LOG7[16572]: Deallocating application specific data for session connect address 2023.01.13 14:03:42 LOG6[16572]: s_connect: connecting 127.0.0.1:27001 2023.01.13 14:03:42 LOG7[16572]: s_connect: s_poll_wait 127.0.0.1:27001: waiting 10 seconds 2023.01.13 14:03:42 LOG7[16572]: FD=1472 ifds=rwx ofds=--- 2023.01.13 14:03:42 LOG5[16572]: s_connect: connected 127.0.0.1:27001 2023.01.13 14:03:42 LOG6[16572]: persistence: 127.0.0.1:27001 cached 2023.01.13 14:03:42 LOG5[16572]: Service [https] connected remote server from 127.0.0.1:56732 2023.01.13 14:03:42 LOG7[16572]: Setting remote socket options (FD=1472) 2023.01.13 14:03:42 LOG7[16572]: Option TCP_NODELAY set on remote socket 2023.01.13 14:03:42 LOG7[16572]: Remote descriptor (FD=1472) initialized 2023.01.13 14:03:42 LOG6[16572]: SSL_read: Socket is closed 2023.01.13 14:03:42 LOG6[16572]: TLS socket closed (SSL_read) 2023.01.13 14:03:42 LOG7[16572]: Sent socket write shutdown 2023.01.13 14:03:42 LOG5[16572]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.01.13 14:03:42 LOG7[16572]: Remote descriptor (FD=1472) closed 2023.01.13 14:03:42 LOG7[16572]: Local descriptor (FD=1888) closed 2023.01.13 14:03:42 LOG7[16572]: Service [https] finished (1 left) Any assistance you can provide would be glorious! _________________________________ Gary Jackson

2 1

Setup and Installing stunnel on windows wsl2 Ubuntu
by adamsaltlake＠hotmail.com 25 Nov '22

25 Nov '22

I am new to stunnel and have been struggling for weeks to get it to work on windows wsl2 ubuntu; it keep failing with pid error "You should check that you have specified the pid= in you configuration file" any idea is welcome

1 0

Self signed certificate check
by Bob Bob 20 Nov '22

20 Nov '22

Hi, I have two Windows based stations with one hosting a specific service. Stunnel is used to create a secure connection. As stated on the auth page, I have implemented PSK to prevent MITM Attack but also as a way to authenticate connections and limit who can connect to the server. I would like to add an extra layer of security by having the Server only accept connections when the client submits a pre-agreed self cert. verifyPeer does not seem to work with self certificate. I would like to end up with PSK + certificate check. Is there a way to achieve that with self certificate on Stunnel? Thanks.

1 0

Windows 10 Pro - StartService: error 1053
by jason99si＠gmail.com 11 Nov '22

11 Nov '22

I'm installing stunnel for a second time. I'm using it for Blue Iris on a Windows 10 Pro machine. I'm using stunnel 5.67 on Win64. GUI shows "Configuration successful". I've tried uninstalling and reinstalling numerous times. When I run stunnel Service Start I receive a dialog box that says: stunnel 5.67 on Win64 (not configured) StartService: error 1053: The service did not respond to the start or control request in a timely fashion Can anyone help?

2 2

Two certificates on same connection
by perisnagini＠gmail.com 07 Nov '22

07 Nov '22

hi, I am into implementations and generally use stunnel with a certification provided by our third party connections in stunnel for encryption/ decryption both ways. Recently we had a query from one of our vendors stating we must use one cert to encrypt which they will decrypt using the key provided by us and they will encrypt which must be decrypted using the key provided. Keeping it simple we have below: Client Key - clt.pem Client cert - clt.cer Vendor key - vndr.pem our ca certs - ca-cert.pem Could anyone help me in understanding how do I leverage vendor key for decrypting and clt key for encrypting in stunnel.conf using the above certs. Many Thanks.

1 0

error:0A000126:SSL routines::unexpected eof while reading
by sburke＠unitedelectric.com 07 Nov '22

07 Nov '22

Hello, I am trying to get a system notification email back up and running after google disabled the "use less secure apps" functionality in the Gmail platform. I have set up the Gmail account to use an app password which I assigned to the system that was sending emails before this change. It appears the system is now connecting to Stunnel running on a windows 10 machine and Stunnel is making the connection with the Gmail server again, but no email actually gets sent out. I am running Stunnel 5.66 Here is the configuration currently: [gmail-smtp] client = yes accept = 25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.Gmail.com OCSPaia = yes Here is a copy of the log file: 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] accepted connection from 192.168.100.200:56399 2022.09.20 07:40:49 LOG5[0]: s_connect: connected 74.125.138.109:465 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] connected remote server from 172.16.4.220:60367 2022.09.20 07:40:49 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gtsr1" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gts1c3" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: Certificate accepted at depth=0: CN=smtp.gmail.com 2022.09.20 07:40:51 LOG3[0]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.09.20 07:40:51 LOG5[0]: Connection reset: 92 byte(s) sent to TLS, 620 byte(s) sent to socket Is this something I can remedy from the configuration, or is this something that requires modification on the email server side? Thank you sean

3 2

Re: stunnel 5.67 released
by Rok Berlec 07 Nov '22

07 Nov '22

Hi, When we install version 5.67 we sometimes get the message: "The procedure entry point OPENSSL_strcasecmp could not be located" After start of service everything looks fine. We upgrade by uninstalling the previous version and installing the latest one. Best regards, Rok Berlec

1 0

stunnel 5.67 released
by Michał Trojnara 01 Nov '22

01 Nov '22

Dear Users, I have released version 5.67 of stunnel. ### Version 5.67, 2022.11.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.7. * New features - Provided a logging callback to custom engines. * Bugfixes - Fixed "make cert" with OpenSSL older than 3.0. - Fixed the code and the documentation to use conscious language for SNI servers (thx to Clemens Lang). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3086939ee6407516c59b0ba3fbf555338f9d52f459bcab6337c0f00e91ea8456 stunnel-5.67.tar.gz a6bdc2a735eb34465d10e3c7e61f32d679ba29a68de8ea8034db79c0c8b328a3 stunnel-5.67-win64-installer.exe 893f53d6647900eb34041be8f21a21c052a31de3fb393a97627021a1ef2752f5 stunnel-5.67-android.zip Best regards, Mike

1 0

"make cert" get "Error configuring OpenSSL modules"
by decatur93＠163.com 28 Oct '22

28 Oct '22

Hi, all. I have done "make && make install" under "sudo", then I got this when "make cert" --------------------------------------------------------------- make -C tools cert make[1]: Entering directory '/opt/stunnel-5.66/tools' ./makecert.sh . /usr /dev/urandom OpenSSL 1.1.1f 31 Mar 2020 1+0 records in 1+0 records out 256 bytes copied, 0.0001303 s, 2.0 MB/s Error configuring OpenSSL modules 139784943940928:error:25066067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(libproviders.so): libproviders.so: cannot open shared object file: No such file or directory 139784943940928:error:25070067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:162: 139784943940928:error:0E07506E:configuration file routines:module_load_dso:error loading dso:../crypto/conf/conf_mod.c:224:module=providers, path=providers 139784943940928:error:0E076071:configuration file routines:module_run:unknown module name:../crypto/conf/conf_mod.c:165:module=providers Certificate details: Can't open stunnel.pem for reading, No such file or directory 139707919738176:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:69:fopen('stunnel.pem','r') 139707919738176:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:76: unable to load certificate /usr/bin/install -c -b -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem /usr/bin/install: cannot stat 'stunnel.pem': No such file or directory make[1]: *** [Makefile:579: cert] Error 1 make[1]: Leaving directory '/opt/stunnel-5.66/tools' make: *** [Makefile:894: cert] Error 2 ------------------------------------------------------------------ It seems I have no libproviders.so, but I have installed openssl. Can anyone help me? Thx.

3 2

stunnel as simple TLS terminator to web backend -- works, but 1st response is blank page, after reload all's good ?
by PGNet Dev 15 Oct '22

15 Oct '22

I'm running [.] stunnel 5.66 on x86_64-redhat-linux-gnu platform [.] Compiled/running with OpenSSL 3.0.5 5 Jul 2022 on lsb_release -rd Description: Fedora release 36 (Thirty Six) Release: 36 uname -rm 5.19.15-201.fc36.x86_64 x86_64 it's setup to frontend terminate TLS in front of a bind9 nameserver instance's statistics (http-only) web server backend. it's a trivial config, cat /etc/stunnel/stunnel.conf debug = 5 syslog = yes [bind9-stats] accept = ns.example.com:10000 connect = 127.0.0.1:10001 sslVersion = TLSv1.3 ciphersuites = TLS_CHACHA20_POLY1305_SHA256 requireCert = yes verifyChain = yes verifyPeer = no CAfile = /usr/local/etc/stunnel/example_CA.CHAIN.crt.pem cert = /usr/local/etc/stunnel/ns.example.com.COMBINED.pem key = /usr/local/etc/stunnel/ns.example.com.server.key.pem sessionCacheSize = 1 sessionCacheTimeout = 360 and it does provide access, with no apparent/reported *error*, afaict. but, on initial access, i.e. first nav to the exposed site page, I get a blank page. simply RELOADING the browser page cures the problem. page display, with current/correct data -- as do all (sub)links on the page. this is repeatable behavior in multiple browsers (Firefox, Chromium, Chrome). so far i've not found any indication of an actual error -- only this 1st-page-visit-is-blank behavior, unique to my stunnel usage. other/heavier frontends have no such issue. odd, but not fatal. or even, apparently, problematic (so far, i think). is this a pebkac/config issue? or a known issue/bug? other?

1 0

SSL Termination Issue
by Gary Jackson 15 Oct '22

15 Oct '22

We have an STunnel configuration running to take encrypted TLS traffic from customers and pass it to our application unencrypted. We have purchased a CA signed certificate, but we are receiving an error when negotiating. We have tried many searches/configurations with no progress. STunnel General Config ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-;RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:AES256-GCM-;SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-;AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:AES128-GCM-SHA256 curves = X25519:P-256:X448:P-521:P-384 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d STunnel Service Specific Config ; TLS front-end to a web server [https] accept = 27015 connect = 172.31.4.10:9000 cert = mycert.pem key = mycert.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 STunnel Debug 2022.10.15 11:16:08 LOG6[769]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.15 11:16:08 LOG3[769]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.15 11:16:08 LOG7[769]: Compression: null, expansion: null 2022.10.15 11:16:08 LOG7[769]: Deallocating application specific data for session connect address 2022.10.15 11:16:08 LOG6[769]: s_connect: connecting x.x.x.x:9000 2022.10.15 11:16:08 LOG7[769]: s_connect: s_poll_wait x.x.x.x:9000: waiting 10 seconds 2022.10.15 11:16:08 LOG7[769]: FD=792 ifds=--- ofds=r-- 2022.10.15 11:16:08 LOG7[769]: FD=888 ifds=rwx ofds=--- 2022.10.15 11:16:08 LOG5[769]: s_connect: connected x.x.x.x:9000 2022.10.15 11:16:08 LOG6[769]: persistence: x.x.x.x:9000 cached 2022.10.15 11:16:08 LOG5[769]: Service [https] connected remote server from x.x.x.x:52720 2022.10.15 11:16:08 LOG7[769]: Setting remote socket options (FD=888) 2022.10.15 11:16:08 LOG7[769]: Option TCP_NODELAY set on remote socket 2022.10.15 11:16:08 LOG7[769]: Remote descriptor (FD=888) initialized 2022.10.15 11:16:09 LOG6[769]: SSL_read: Socket is closed 2022.10.15 11:16:09 LOG6[769]: TLS socket closed (SSL_read) 2022.10.15 11:16:09 LOG7[769]: Sent socket write shutdown Any assistance would be GREATLY appreciated! Thank you. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

2 3

Peer Suddenly Disconnects after Negotiating TLS
by Gary Jackson 13 Oct '22

13 Oct '22

I have a TLS Connection that appears to be established but then is terminating and not sure what would cause this. 2022.10.13 14:56:36 LOG5[12435]: Service [https] accepted connection from 97.72.232.10:62890 2022.10.13 14:56:36 LOG6[12435]: Peer certificate not required 2022.10.13 14:56:36 LOG6[12435]: TLS accepted: new session negotiated 2022.10.13 14:56:36 LOG6[12435]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.13 14:56:36 LOG3[12435]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.13 14:56:36 LOG6[12435]: s_connect: connecting 172.31.4.10:9000 2022.10.13 14:56:36 LOG5[12435]: s_connect: connected 172.31.4.10:9000 2022.10.13 14:56:36 LOG6[12435]: persistence: 172.31.4.10:9000 cached 2022.10.13 14:56:36 LOG5[12435]: Service [https] connected remote server from 172.31.4.20:59907 2022.10.13 14:56:36 LOG6[12435]: SSL_read: Socket is closed 2022.10.13 14:56:36 LOG6[12435]: TLS socket closed (SSL_read) 2022.10.13 14:56:36 LOG5[12435]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Thanks in advance. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

1 0

SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading
by carango＠ingeniocarmelita.com 13 Oct '22

13 Oct '22

Hello I have the same problem, any solution? SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading

1 0

32-bit windows download
by Ágnes Kakasi 27 Sep '22

27 Sep '22

Hi, I'm looking for help to download and install Stunnel on a laptop with 32-bit Windows 7. I have downloaded the available download file from the website (stunnel-5.66-win64-installer.exe) but the computer indicates it cannot open the file. I tried to find info on this and in the platform sections I found Stunnel can run on 32-bit, as well, but I don't know how to make it work. Can you please advise me on what the correct download file is and how to install it so that it works on this computer? Thank you in advance. Agnes

2 1

error:0A000438:SSL routines::tlsv1 alert internal error
by johannwang＠ami.com 21 Sep '22

21 Sep '22

Hello, I am trying to use the xvncviewer on Ubuntu by VNC over stunnel, it will connect failed and print "xvncviewer: read: Connection reset by peer". The LOG on VNC server is here: 2012.01.01 00:21:58 LOG7[1]: Initializing application specific data for session authenticated 2012.01.01 00:21:58 LOG7[1]: SNI: no virtual services defined 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS read client hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write key exchange 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate request 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server done 2012.01.01 00:21:58 LOG7[1]: TLS alert (read): fatal: internal error 2012.01.01 00:21:58 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1584: error:0A000438:SSL routines::tlsv1 alert internal error 2012.01.01 00:21:58 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2012.01.01 00:21:58 LOG7[1]: Deallocating application specific data for session connect address 2012.01.01 00:21:58 LOG7[1]: Local descriptor (FD=3) closed 2012.01.01 00:21:58 LOG7[1]: Service [vnc] finished (0 left) I am running Stunnel 5.63 Here is the configuration currently: stunnel.conf on VNC client: cert = /home/server.pem key = /home/privkey.pem [VNC] client = yes accept = 127.0.0.1:5901 connect = 172.31.100.121:5901 sslVersion = all verifyChain = yes CAfile = /home/server.pem checkIP = 172.31.100.121 stunnel.conf on VNC server: cert = /conf/server.pem ;key = /conf/certs/privkey.pem setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:TCP_NODELAY=1 debug = 7 foreground = yes client = no ciphers=AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM sslVersion = TLSv1.2 [vnc] accept = :::5901 connect = 5900 verify = 3 CAfile = /conf/server.pem Is this something I can remedy from the configuration, or is this something that requires modification? Thank you Johan

1 0

v5.66: failing test 081
by Andreas Vetter 20 Sep '22

20 Sep '22

Hi, in open build system I get the following failing test, when building and testing stunnel 5.66: [ 45s] 081. Test IPv6 support [ 45s] [client] Read '2022.09.15 21:17:15 LOG6[0]: TLS fd: Connection reset by peer (104)' [ 45s] ...................................................................... failed Is this a stunnel problem or a problem with logging inside the build system? What can I do to get more verbose information during build? The test is working for a similar target OS (openSUSE_Tumbleweed) and not for this one (openSUSE:Factory). The difference is small, but sometimes not neglectible: openSUSE:Factory is the to be tested submissions, always in the flow. openSUSE_Tumbleweed is a tested working snapshot of Factory. Best regards, Andreas

1 1

stunnel 5.66 released
by Michał Trojnara 11 Sep '22

11 Sep '22

Dear Users, I have released version 5.66 of stunnel. ### Version 5.66, 2022.09.11, urgency: MEDIUM * New features - OpenSSL 3.0 FIPS Provider support for Windows. * Bugfixes - Fixed building on machines without pkg-config. - Added the missing "environ" declaration for BSD-based operating systems. - Fixed the passphrase dialog with OpenSSL 3.0. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 558178704d1aa5f6883aac6cc5d6bbf2a5714c8a0d2e91da0392468cee9f579c stunnel-5.66.tar.gz 5fccb2e4db0d2e3c1adb26c3906585ac545baf88226f4f539b2dc43fe418a3ef stunnel-5.66-win64-installer.exe 3b1e30e060e16f6aa9a8ad1b1a6ba1210c165bf76bd01e4734cb4537e0717c09 stunnel-5.66-android.zip Best regards, Mike

1 0

Stunnel Consulting
by Gary Jackson 10 Sep '22

10 Sep '22

I am looking for someone to assist with an stunnel configuration on windows that will accept TLS1.2 connections and then send them unencrypted to an IP and port. I would need to get it working within the next week or so and am available most times if scheduled. Thank you. Gary Jackson Sent from my mobile

2 1

TLS 1.2 traffic on STunnel
by Gary Jackson 08 Sep '22

08 Sep '22

Good afternoon, I am trying to use Stunnel to accept traffic from a custom application using TLS 1.2 and a self signed cert and then send it to a back end application unencrypted. I want the configuration to only affect one listener on Stunnel and not all incoming ports. I am using Stunnel v.5.6 I am confused with all the documentation and what needs to be set in the config file for this use case. The config file currently has connections where it accepts traffic on one port and then directs it to another port internally but not with TLS 1.2. Thank you for all your knowledge and insight! _________________________________ Gary Jackson | Senior Systems Engineer

2 1

Certificate Request's "Distinguished Names" list is empty when using CAPath (but not when using CAFile)
by david.rundqvist＠gmail.com 26 Aug '22

26 Aug '22

Hi, If I hash the client certificates and put them in a folder (with file names <hash>.0), and use the CAPath parameter on the server, together with verify=3, the server's Certificate Request message contains an empty list of "Distinguished Names". However, if I put the client certificates concatenated in a .pem file, and use the CAFile parameter on the server, the Certificate Request message does contain the Distinguished Names. Is this the correct behavior? I thought CAFile and CAPath worked more or less in the same way, but perhaps the Certificate Request message is implemented differently, depending on if you use CAFile or CAPath? My preferred way is to use CAPath: Is there some way I can get the Distinguished Names not to be empty, when using CAPath? I'm on Windows, using stunnel version 5.49, currently. Thanks in advance! Kind regards, /David

2 1