- stunnel-users - stunnel.org

Client Authentication and CRL Verification
by Mehdi B. 02 Dec '15

02 Dec '15

Hello everybody I am using stunnel in server mode with mutual authentication. Auth is ok, but the crl didn't work, and I need it in production next week.... I do many tries with CRLpath/CRLfile, with my production version (5.08), the last one (5.26) Same result. With a revoked certificate, my client connect on the server. Do you have some idea? Or maybe found my mistake? If you need something else please contact me. Stunnel 1 is the server. Stunnel 1 certificate is revoked ** Configuration ** *** root@auditd:/var/lib/stunnel/2/ca# cat /etc/stunnel/1.conf *** ; * Global options * chroot = /var/lib/stunnel/1/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel5 setgid = stunnel5 pid = /pid/1.pid ;debug = 0 debug = 7 output = /log/1.log ;foreground = yes options = NO_SSLv2 options = NO_SSLv3 options = DONT_INSERT_EMPTY_FRAGMENTS [1] verify = 2 CAFile = /root/CA/CA.cert cert = /root/CA/1.cert key = /root/CA/1.key client = no accept = 127.0.0.1:59062 connect = 127.0.0.1:22 ciphers = ECDHE-RSA-AES256-GCM-SHA384 sslVersion = TLSv1.2 *** root@auditd:/var/lib/stunnel/2/ca# cat /etc/stunnel/2.conf *** ; * Global options * chroot = /var/lib/stunnel/2/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel5 setgid = stunnel5 pid = /pid/2.pid ;debug = 0 debug = 7 output = /log/2.log ;foreground = yes options = NO_SSLv2 options = NO_SSLv3 options = DONT_INSERT_EMPTY_FRAGMENTS [2] verify = 2 ;CRLfile = /var/lib/stunnel/2/CA.crl.pem ;CAFile = /var/lib/stunnel/2/CA.pem CRLpath = /crl/ CApath = /ca/ cert = /var/lib/stunnel/2/2.cert key = /var/lib/stunnel/2/2.key client = yes accept = 127.0.0.1:23 connect = 127.0.0.1:59062 ciphers = ECDHE-RSA-AES256-GCM-SHA384 sslVersion = TLSv1.2 ** Logs ** ==> /var/lib/stunnel/1/log/1.log <== 2015.12.02 12:11:46 LOG7[25595]: Clients allowed=500 2015.12.02 12:11:46 LOG5[25595]: stunnel 5.08 on x86_64-unknown-linux-gnu platform 2015.12.02 12:11:46 LOG5[25595]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.12.02 12:11:46 LOG5[25595]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP 2015.12.02 12:11:46 LOG7[25595]: errno: (*__errno_location ()) 2015.12.02 12:11:46 LOG5[25595]: Reading configuration from file /etc/stunnel/1.conf 2015.12.02 12:11:46 LOG5[25595]: UTF-8 byte order mark not detected 2015.12.02 12:11:46 LOG5[25595]: FIPS mode disabled 2015.12.02 12:11:46 LOG7[25595]: Compression disabled 2015.12.02 12:11:46 LOG7[25595]: Snagged 64 random bytes from /root/.rnd 2015.12.02 12:11:46 LOG7[25595]: Wrote 1024 new random bytes to /root/.rnd 2015.12.02 12:11:46 LOG7[25595]: PRNG seeded successfully 2015.12.02 12:11:46 LOG6[25595]: Initializing service [1] 2015.12.02 12:11:46 LOG6[25595]: Loading cert from file: /root/CA/1.cert 2015.12.02 12:11:46 LOG6[25595]: Loading key from file: /root/CA/1.key 2015.12.02 12:11:46 LOG7[25595]: Private key check succeeded 2015.12.02 12:11:46 LOG7[25595]: Loaded /root/CA/CA.cert revocation lookup file 2015.12.02 12:11:46 LOG7[25595]: Client CA list: /root/CA/CA.cert 2015.12.02 12:11:46 LOG6[25595]: Client CA: C=FR, ST=Some-State, O=Internet Widgits Pty Ltd 2015.12.02 12:11:46 LOG7[25595]: DH initialization 2015.12.02 12:11:46 LOG7[25595]: Could not load DH parameters from /root/CA/1.cert 2015.12.02 12:11:46 LOG7[25595]: Using hardcoded DH parameters 2015.12.02 12:11:46 LOG7[25595]: DH initialized with 2048-bit key 2015.12.02 12:11:46 LOG7[25595]: ECDH initialization 2015.12.02 12:11:46 LOG7[25595]: ECDH initialized with curve prime256v1 2015.12.02 12:11:46 LOG7[25595]: SSL options: 0x03000804 (+0x03000800, -0x00000000) 2015.12.02 12:11:46 LOG5[25595]: Configuration successful 2015.12.02 12:11:46 LOG7[25595]: Listening file descriptor created (FD=6) 2015.12.02 12:11:46 LOG7[25595]: Service [1] (FD=6) bound to 127.0.0.1:59062 2015.12.02 12:11:46 LOG7[25596]: Created pid file /pid/1.pid ==> /var/lib/stunnel/2/log/2.log <== 2015.12.02 12:11:46 LOG7[25604]: Clients allowed=500 2015.12.02 12:11:46 LOG5[25604]: stunnel 5.08 on x86_64-unknown-linux-gnu platform 2015.12.02 12:11:46 LOG5[25604]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.12.02 12:11:46 LOG5[25604]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP 2015.12.02 12:11:46 LOG7[25604]: errno: (*__errno_location ()) 2015.12.02 12:11:46 LOG5[25604]: Reading configuration from file /etc/stunnel/2.conf 2015.12.02 12:11:46 LOG5[25604]: UTF-8 byte order mark not detected 2015.12.02 12:11:46 LOG5[25604]: FIPS mode disabled 2015.12.02 12:11:46 LOG7[25604]: Compression disabled 2015.12.02 12:11:46 LOG7[25604]: Snagged 64 random bytes from /root/.rnd 2015.12.02 12:11:46 LOG7[25604]: Wrote 1024 new random bytes to /root/.rnd 2015.12.02 12:11:46 LOG7[25604]: PRNG seeded successfully 2015.12.02 12:11:46 LOG6[25604]: Initializing service [2] 2015.12.02 12:11:46 LOG6[25604]: Loading cert from file: /var/lib/stunnel/2/2.cert 2015.12.02 12:11:46 LOG6[25604]: Loading key from file: /var/lib/stunnel/2/2.key 2015.12.02 12:11:46 LOG7[25604]: Private key check succeeded 2015.12.02 12:11:46 LOG7[25604]: Verify directory set to /ca/ 2015.12.02 12:11:46 LOG7[25604]: Added /ca/ revocation lookup directory 2015.12.02 12:11:46 LOG7[25604]: Added /crl/ revocation lookup directory 2015.12.02 12:11:46 LOG7[25604]: SSL options: 0x03000804 (+0x03000800, -0x00000000) 2015.12.02 12:11:46 LOG5[25604]: Configuration successful 2015.12.02 12:11:46 LOG7[25604]: Listening file descriptor created (FD=6) 2015.12.02 12:11:46 LOG7[25604]: Service [2] (FD=6) bound to 127.0.0.1:23 2015.12.02 12:11:46 LOG7[25605]: Created pid file /pid/2.pid ** ls ** root@auditd:/var/lib/stunnel/2/ca# ll total 4 lrwxrwxrwx 1 root root 6 Dec 2 12:05 1a870aad.0 -> CA.pem lrwxrwxrwx 1 root root 6 Dec 2 12:05 aeb35906.0 -> CA.pem -rw-r----- 1 stunnel5 root 1919 Dec 1 16:55 CA.pem root@auditd:/var/lib/stunnel/2/ca# ll ../crl/ total 4 lrwxrwxrwx 1 root root 10 Dec 2 12:04 aeb35906.r0 -> CA.crl.pem -rw-r----- 1 stunnel5 root 1129 Dec 2 11:42 CA.crl.pem ** check openssl ** root@auditd:~/stunnel-5.26# openssl verify -crl_check -CAfile /var/lib/stunnel/2/ca/aeb35906.0 -CRLfile /var/lib/stunnel/2/crl/aeb35906.r0 /root/CA/1.cert /root/CA/1.cert: C = FR, ST = FR, O = PLOP, CN = 1 error 23 at 0 depth lookup:certificate revoked ** other :** root@auditd:~/CA# openssl crl -in /opt/syslog-ng/etc/crl/1a870aad.r0 -text Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: /C=FR/ST=Some-State/O=Internet Widgits Pty Ltd Last Update: Dec 2 09:04:38 2015 GMT Next Update: Jan 1 09:04:38 2016 GMT CRL extensions: X509v3 CRL Number: 2 Revoked Certificates: Serial Number: 01 Revocation Date: Dec 1 14:46:38 2015 GMT Serial Number: 02 Revocation Date: Dec 2 09:04:29 2015 GMT Serial Number: 03 Revocation Date: Dec 2 07:25:34 2015 GMT Serial Number: 04 Revocation Date: Dec 2 07:27:45 2015 GMT Serial Number: 05 Revocation Date: Dec 2 07:32:21 2015 GMT Serial Number: 06 Revocation Date: Dec 2 08:21:48 2015 GMT Signature Algorithm: sha256WithRSAEncryption 16:24:d4:f8:77:82:7b:ca:70:1a:01:26:5f:83:9f:13:6f:51: 67:85:b0:2c:a7:25:c1:46:66:ca:b8:46:74:85:4a:ca:26:2b: ff:46:e7:91:a3:10:09:ce:6b:84:1d:58:a1:4a:1c:38:ac:1a: 58:fc:50:0a:7a:1e:1c:5c:f9:2b:ef:25:7a:93:27:b3:5e:65: d6:66:89:33:23:52:fd:0d:38:7e:66:d6:74:d7:e4:b2:72:d8: 74:49:73:d3:2a:b5:e0:23:8a:03:b5:c6:ce:2a:f4:03:ef:8c: 50:83:be:9f:68:04:47:79:ff:5d:4b:cb:8a:cd:3c:6a:5f:02: 33:e6:61:86:ff:4c:f3:74:2c:81:70:c1:13:05:43:54:1a:04: a0:7b:df:fe:f8:e5:50:53:ce:2c:04:86:36:ed:0a:98:24:72: 5e:68:1a:23:7f:8e:85:5c:2c:2b:7b:df:23:56:fe:2f:c7:da: ec:ca:8f:48:a0:29:15:72:38:e3:ff:48:1e:89:30:b1:72:1b: 21:3f:0b:e0:ad:eb:89:c3:65:70:cc:29:03:f0:6e:73:be:c8: 24:64:93:b8:7b:af:21:a0:67:24:5a:be:e8:b0:ec:e0:a1:5f: 0c:a9:e5:de:09:39:08:23:60:d9:d9:4e:07:a2:f2:1e:4f:96: 0c:b7:c6:bb:5b:2a:e3:78:92:2e:fa:39:9c:ae:d4:4c:b2:b2: e3:7f:2a:58:14:86:80:97:fd:5e:95:b1:9d:d6:23:3d:cc:ce: 2b:0b:65:b2:43:f5:15:fb:20:2c:72:8f:fd:62:7d:7f:54:80: 54:22:22:42:15:7b:27:18:2f:24:70:81:ca:44:cc:c4:d8:9c: d8:99:69:f2:fd:4a:7f:3e:11:57:91:25:d8:6f:42:ae:b0:d5: bc:fd:cd:0b:9b:a5:c2:f6:d0:ce:8b:e3:66:7b:78:03:90:a6: ca:44:f9:e1:cb:80:70:2e:db:b0:3c:d1:fc:5a:d8:f5:fd:c6: 44:5f:4f:19:f5:da:13:a5:2f:11:f3:db:73:22:a1:98:83:b0: 44:0d:2b:59:2f:3a:54:fb:00:a0:8f:1b:19:2b:c0:3c:9d:fb: f0:80:50:9a:9e:7b:b6:46:84:d3:df:b2:36:6b:d2:97:53:f9: da:1e:8c:7a:e8:40:15:17:3b:17:b7:c6:0d:e0:64:e4:68:96: 11:43:d2:d8:d4:f8:1b:7b:44:15:29:d9:ca:e5:3a:97:b6:b4: c6:b9:2b:c2:8a:6d:47:62:75:33:a1:dd:e9:93:28:eb:82:00: 8d:ef:0d:b6:17:72:a6:59:95:4c:97:fa:47:a8:ff:27:60:dd: c1:6e:6a:62:dc:1b:a8:e7 -----BEGIN X509 CRL----- MIIDGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwRTELMAkGA1UEBhMCRlIxEzARBgNV BAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0 ZBcNMTUxMjAyMDkwNDM4WhcNMTYwMTAxMDkwNDM4WjB4MBICAQEXDTE1MTIwMTE0 NDYzOFowEgIBAhcNMTUxMjAyMDkwNDI5WjASAgEDFw0xNTEyMDIwNzI1MzRaMBIC AQQXDTE1MTIwMjA3Mjc0NVowEgIBBRcNMTUxMjAyMDczMjIxWjASAgEGFw0xNTEy MDIwODIxNDhaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsFAAOCAgEAFiTU +HeCe8pwGgEmX4OfE29RZ4WwLKclwUZmyrhGdIVKyiYr/0bnkaMQCc5rhB1YoUoc OKwaWPxQCnoeHFz5K+8lepMns15l1maJMyNS/Q04fmbWdNfksnLYdElz0yq14COK A7XGzir0A++MUIO+n2gER3n/XUvLis08al8CM+Zhhv9M83QsgXDBEwVDVBoEoHvf /vjlUFPOLASGNu0KmCRyXmgaI3+OhVwsK3vfI1b+L8fa7MqPSKApFXI44/9IHokw sXIbIT8L4K3ricNlcMwpA/Buc77IJGSTuHuvIaBnJFq+6LDs4KFfDKnl3gk5CCNg 2dlOB6LyHk+WDLfGu1sq43iSLvo5nK7UTLKy438qWBSGgJf9XpWxndYjPczOKwtl skP1FfsgLHKP/WJ9f1SAVCIiQhV7JxgvJHCBykTMxNic2Jlp8v1Kfz4RV5El2G9C rrDVvP3NC5ulwvbQzovjZnt4A5CmykT54cuAcC7bsDzR/FrY9f3GRF9PGfXaE6Uv EfPbcyKhmIOwRA0rWS86VPsAoI8bGSvAPJ378IBQmp57tkaE09+yNmvSl1P52h6M euhAFRc7F7fGDeBk5GiWEUPS2NT4G3tEFSnZyuU6l7a0xrkrwoptR2J1M6Hd6ZMo 64IAje8NthdyplmVTJf6R6j/J2DdwW5qYtwbqOc= -----END X509 CRL----- root@auditd:~/CA# openssl x509 -in /opt/syslog-ng/etc/cert.d/1.cert -text Certificate: Data: Version: 3 (0x2) Serial Number: 6 (0x6) Signature Algorithm: sha256WithRSAEncryption Issuer: C=FR, ST=Some-State, O=Internet Widgits Pty Ltd Validity Not Before: Dec 2 07:32:36 2015 GMT Not After : Nov 29 07:32:36 2025 GMT Subject: C=FR, ST=FR, O=PLOP, CN=1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:ae:2a:9e:a6:6f:54:eb:f7:1f:7f:d6:67:b5:68: 11:9d:a8:79:93:78:e8:b6:48:f6:64:7e:e5:bf:72: 33:61:6f:4a:e9:c0:25:f6:61:47:de:f7:a3:5d:3d: da:fa:2d:97:08:20:5b:b1:a9:10:2b:50:18:ca:40: ea:16:f8:3d:a5:5e:cc:18:d4:80:30:62:cc:4c:b7: 2b:99:9e:6a:3a:09:97:2b:1d:79:36:d2:53:7a:8d: 96:4f:20:c0:f3:ac:e9:01:d1:a0:d7:00:37:83:1f: 64:ee:df:4f:27:61:a2:5f:94:66:be:35:58:9e:52: a0:91:0a:00:57:13:d5:b4:b3:90:10:8c:42:4f:34: 69:3f:9c:1b:7d:9b:ae:eb:79:8d:d9:9d:2c:3c:74: 58:c2:ba:a5:34:e5:15:01:45:d3:47:85:82:eb:34: b2:21:ba:97:2b:4e:90:92:4f:85:19:c7:b0:7f:cd: 8c:49:08:4e:32:d0:9e:34:af:b9:02:aa:40:2e:af: f5:6b:41:92:9f:5a:ab:09:b5:bd:7a:73:fe:4d:f4: 1b:c6:23:22:15:7c:b5:47:e1:88:bd:8a:b7:d7:1b: 5e:4a:53:f9:41:33:e9:30:97:ce:9b:b4:88:77:f6: 35:9c:47:a7:12:5d:98:9e:e4:1c:27:bf:bd:e5:85: b1:c1:1f:dc:17:03:c0:00:9f:0b:d8:40:c3:1c:31: f3:9b:60:17:05:0d:ac:79:9e:53:2b:aa:da:78:e7: f4:a8:3e:f9:14:f1:40:1f:47:df:45:c7:57:14:3d: 26:68:9c:a7:77:da:29:50:85:1c:e3:62:e6:66:f0: 5e:59:6f:35:61:32:e4:a8:7d:a1:30:b5:85:69:0e: e3:fd:8e:67:78:c3:47:58:5d:88:36:65:85:09:52: 46:47:bb:48:03:9c:e5:42:48:66:7d:34:7d:01:9c: 67:ea:82:f0:d5:4e:9b:64:0c:c6:db:1c:0d:2a:de: 67:ba:a5:04:44:4a:fc:12:94:77:b0:30:fc:d0:06: 26:d4:e8:94:ed:a1:78:4d:cd:fa:8b:a4:4e:45:fc: cf:2b:d8:47:11:e0:68:e0:78:36:34:4f:76:5c:76: 4b:69:02:4c:22:47:57:10:92:ce:b9:d8:20:7e:80: 80:a7:ca:55:7c:41:a4:0a:0e:08:e0:86:e2:63:9f: e4:f6:e0:13:fd:67:7a:14:f7:e2:fe:6e:14:2a:ba: 80:e1:29:0d:7c:5a:36:91:60:ae:9b:14:6f:1e:2d: 40:b9:28:03:e5:d6:f8:f4:64:6d:ca:8b:1d:38:48: 30:92:fa:6f:75:c9:7a:62:61:47:0e:32:3e:e5:7e: 0a:3b:d5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 33:1A:1E:42:87:07:1F:05:83:C6:14:DE:5D:BC:90:89:8C:10:39:44 X509v3 Authority Key Identifier: keyid:C0:B7:97:89:CD:42:1E:6A:FB:7D:AE:3B:1E:A1:30:7E:94:FA:FB:35 X509v3 CRL Distribution Points: Full Name: URI:https://deb.plop.net/ssl/ Signature Algorithm: sha256WithRSAEncryption ad:d7:d0:1f:d1:f2:10:88:d4:4c:5e:fe:80:88:96:35:55:26: 12:8d:1f:1f:38:d2:36:6e:75:00:37:e8:45:28:eb:c3:b5:e7: 71:90:91:5a:96:2d:b6:3e:5b:c0:45:84:e5:dc:07:65:63:54: b1:06:4b:6a:ee:63:80:54:63:4c:72:1a:2f:eb:00:7c:36:0b: 18:22:3a:d2:90:e6:3f:69:9a:cf:b7:50:72:19:f6:3d:d5:19: fa:2a:46:09:cf:86:f7:12:0e:2c:4a:59:6c:26:45:2b:52:90: 72:55:a9:7d:16:27:db:ba:19:cb:c8:96:4c:e1:42:79:6b:ab: f9:87:97:43:e0:d1:71:2d:ef:fc:c9:f0:02:b1:7d:6c:59:ef: fd:00:76:4b:a7:f9:9c:1a:05:90:5b:df:2e:35:52:c7:79:f9: f3:31:d5:3f:60:2a:93:78:48:19:3b:53:43:ed:ee:f0:39:c8: fa:88:b8:7e:b0:5e:ce:73:c2:b2:c2:da:95:39:d9:1e:b7:02: d7:98:20:31:d2:91:c2:c9:61:45:cd:9b:f1:54:3d:17:df:96: 09:3d:11:96:b4:97:2a:9f:e8:9e:77:d4:1b:67:d9:a1:9d:1e: b8:d9:58:3a:b4:26:24:23:d5:a0:d6:52:78:1d:2f:d9:ce:f4: 41:66:82:7c:56:d9:df:a0:08:cb:b4:ae:2a:79:16:bf:91:09: 46:be:35:17:44:73:7b:48:e0:3e:f4:03:45:a7:36:3e:8e:8e: 58:7c:02:a9:c7:9d:22:98:bc:d3:05:90:81:39:d6:00:09:a4: 33:58:0f:57:b9:a5:e2:d0:3f:e4:ad:4e:47:a4:af:98:b6:d0: 49:f0:f9:d5:9b:b1:18:c6:fb:7d:3d:18:6c:90:62:1f:cb:c9: 97:00:92:57:29:32:1d:be:02:61:af:1f:17:48:eb:6a:b0:a2: f4:96:e1:0f:24:63:11:c7:66:2f:bc:7e:c2:e0:fd:25:3c:ac: 83:5b:05:35:b3:45:64:8e:93:21:3d:ed:1c:95:ae:24:55:98: 07:5f:99:71:28:8e:01:5d:94:16:62:03:a1:63:1f:08:88:6f: 9b:0b:db:43:21:31:4a:08:a2:a2:f6:af:7a:b3:20:94:5f:7d: 2f:53:3a:20:ea:08:5f:db:38:89:24:83:bd:9c:a0:78:ea:68: cd:39:47:b8:b6:f3:f4:bb:14:cc:e8:d0:24:59:7e:fc:0f:05: e9:73:18:5b:5d:31:0b:d2:e0:17:0f:ff:0d:b8:39:54:32:42: a2:07:b3:d3:53:5c:89:f7:b4:c3:44:60:7e:0c:5f:d1:80:e8: d2:6b:89:8d:1f:a9:79:7b -----BEGIN CERTIFICATE----- MIIFnDCCA4SgAwIBAgIBBjANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJGUjET MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ dHkgTHRkMB4XDTE1MTIwMjA3MzIzNloXDTI1MTEyOTA3MzIzNlowNDELMAkGA1UE BhMCRlIxCzAJBgNVBAgMAkZSMQwwCgYDVQQKDANPVkgxCjAIBgNVBAMMATEwggIi MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCuKp6mb1Tr9x9/1me1aBGdqHmT eOi2SPZkfuW/cjNhb0rpwCX2YUfe96NdPdr6LZcIIFuxqRArUBjKQOoW+D2lXswY 1IAwYsxMtyuZnmo6CZcrHXk20lN6jZZPIMDzrOkB0aDXADeDH2Tu308nYaJflGa+ NVieUqCRCgBXE9W0s5AQjEJPNGk/nBt9m67reY3ZnSw8dFjCuqU05RUBRdNHhYLr NLIhupcrTpCST4UZx7B/zYxJCE4y0J40r7kCqkAur/VrQZKfWqsJtb16c/5N9BvG IyIVfLVH4Yi9irfXG15KU/lBM+kwl86btIh39jWcR6cSXZie5Bwnv73lhbHBH9wX A8AAnwvYQMMcMfObYBcFDax5nlMrqtp45/SoPvkU8UAfR99Fx1cUPSZonKd32ilQ hRzjYuZm8F5ZbzVhMuSofaEwtYVpDuP9jmd4w0dYXYg2ZYUJUkZHu0gDnOVCSGZ9 NH0BnGfqgvDVTptkDMbbHA0q3me6pQRESvwSlHewMPzQBibU6JTtoXhNzfqLpE5F /M8r2EcR4GjgeDY0T3ZcdktpAkwiR1cQks652CB+gICnylV8QaQKDgjghuJjn+T2 4BP9Z3oU9+L+bhQquoDhKQ18WjaRYK6bFG8eLUC5KAPl1vj0ZG3Kix04SDCS+m91 yXpiYUcOMj7lfgo71QIDAQABo4GnMIGkMAkGA1UdEwQCMAAwLAYJYIZIAYb4QgEN BB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBQzGh5C hwcfBYPGFN5dvJCJjBA5RDAfBgNVHSMEGDAWgBTAt5eJzUIeavt9rjseoTB+lPr7 NTApBgNVHR8EIjAgMB6gHKAahhhodHRwczovL2RlYi5vdmgubmV0L3NzbC8wDQYJ KoZIhvcNAQELBQADggIBAK3X0B/R8hCI1Exe/oCIljVVJhKNHx840jZudQA36EUo 68O153GQkVqWLbY+W8BFhOXcB2VjVLEGS2ruY4BUY0xyGi/rAHw2CxgiOtKQ5j9p ms+3UHIZ9j3VGfoqRgnPhvcSDixKWWwmRStSkHJVqX0WJ9u6GcvIlkzhQnlrq/mH l0Pg0XEt7/zJ8AKxfWxZ7/0Adkun+ZwaBZBb3y41Usd5+fMx1T9gKpN4SBk7U0Pt 7vA5yPqIuH6wXs5zwrLC2pU52R63AteYIDHSkcLJYUXNm/FUPRfflgk9EZa0lyqf 6J531Btn2aGdHrjZWDq0JiQj1aDWUngdL9nO9EFmgnxW2d+gCMu0rip5Fr+RCUa+ NRdEc3tI4D70A0WnNj6Ojlh8AqnHnSKYvNMFkIE51gAJpDNYD1e5peLQP+StTkek r5i20Enw+dWbsRjG+309GGyQYh/LyZcAklcpMh2+AmGvHxdI62qwovSW4Q8kYxHH Zi+8fsLg/SU8rINbBTWzRWSOkyE97RyVriRVmAdfmXEojgFdlBZiA6FjHwiIb5sL 20MhMUoIoqL2r3qzIJRffS9TOiDqCF/bOIkkg72coHjqaM05R7i28/S7FMzo0CRZ fvwPBelzGFtdMQvS4BcP/w24OVQyQqIHs9NTXIn3tMNEYH4MX9GA6NJriY0fqXl7 -----END CERTIFICATE-----

2 7

Upcoming stunnel 5.27 release
by Michal Trojnara 01 Dec '15

01 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, stunnel 5.27 will be made available on 3rd December. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWXHz/AAoJEC78f/DUFuAUcxAQAK5PrsoU4i0n25IYfFnuGWm/ R9Y4BJKO6/4+VHjRN9Yi4gJb0t7QpVxYQH9RuQAYVWp5RYeYqnxyb55m5iZ5IYBl V5ke5+DjTtPpMuTDShLz9BkL01lyrw8c+mwLy1IZM4nUgAQHyWp4lgcKgKukoY6N DYxloE5GmWW3ylGLAJUFlcVZmNayo8pmmVeWLbhsCRt0OyFJbrS8XUcVviZVcxAD q3Lly63NFC0Nsl+5MGmKxO8sRCu3UW0WkT4P5MbJr2f5b9AuTlrBmBNZ/fmyPAV9 5/LvAc5vdh9DwJEgGF3yvFqdFghR8TNuGNqBJaDn5pk+6rmc0qNeQkFFsq0CRX34 jSwNCl0A0SuXp4YGPTOFK9rp8bKjxq5VDUAGa6OyEhd92H2pSLxDA/aJqlY6f1vs MZQb6az60lrUq1JNnoYeUfO9AFMCFpqyFV4kqmfUOlnJox99JbZ5/U38CeaO9n8P tIz7jgijYRDK6itaCuf1QaWJxCU5S7yCUL1dtyi2nTDTvrG8WmTr93SniyGXScix fXIIb4Aa7mg3/p9J9TFONzxw0CySj/32ZBIgiLAWcAaa1Gnuy3+ARSAu1U6t9to8 Unnzppd1B7qn0qk1QANtktz4JAu63FUg7RSPHFt8+nLcABtslkjHdcVvzGl3F02k zjYq9bMufBOqlCDctGQO =rtq3 -----END PGP SIGNATURE-----

2 1

Failover behavior with stunnel
by Thireus 30 Nov '15

30 Nov '15

Hi, I have a couple of questions regarding failover with stunnel: 1. I would like to know if there is a way to use failover with two servers with two different set of TLS cert/key. The following rule doesn't work, because the cert and key parameters are overwritten, but it shows what I would like to achieve: [failover] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 cert = cert_2.cert key = key_2.pem connect = server-2:1234 2. On the same topic, I would like to know if there is an option that could open the local port (accept) only when the connection (connect) is established? The problem I'm facing is that I use a PAC profile with failover on several stunnel entries: "return PROXY 127.0.0.1:4441 <http://127.0.0.1:4441/>; PROXY 127.0.0.1:4442 <http://127.0.0.1:4442/>; PROXY 127.0.0.1:4443 <http://127.0.0.1:4443/>;". However, when one of the remote server is down (i.e. server-1), it is not easily detected by web-browsers (Chrome does not seem to detect it well), and so instead of switching to the next PROXY, it simply dies on the first one. If the port 4441 relative to server-1 (which is unavailable) was closed, then the webrowser could easily detect it and switch to the second server with port 4442. 3. Is there another way to tweak stunnel behavior when a remote server is down? I'm thinking about a couple of things, like being able to switch to a different rule set: [failover1] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 connect = 127.0.0.1:4442 <http://127.0.0.1:4442/> ; This is failover2 [failover2] accept = 127.0.0.1:4442 <http://127.0.0.1:4442/> cert = cert_2.cert key = key_2.pem connect = server-2:1234 Or maybe there are some options that I'm not aware of to timeout connections more efficiently: so that Chrome (or other clients using HTTP proxies) will immediately know that stunnel cannot connect to the remote server and so that the proxy is down. Thank you for your help. Cheers, Thireus.

2 3

Where is stunnel.exe ?
by Manu Egen 25 Nov '15

25 Nov '15

Hello, Can you tell me from which stunnel version, the "bin" folder and the "config" folder appeared ? The change is between the version 4.53 and 5.26, but which one ? Thanks a lot for the answer Best regards, Manu

1 0

syslog communication using TLS with the help of stunnel
by Girish Kumar 24 Nov '15

24 Nov '15

Dear All, Currently we are using syslog communication without any security. That is using UDP protocol with the server listening on port number 514. This is unsecure. I want to use syslog over TLS that is over TCP . As of now in my project syslogd daemon is used. I am planning to use stunnel to achieve this. I have few questions. Please clarify * To support stunnel, syslogd should be on TCP and not on UDP? * Is stunnel is a daemon ? * My understanding is syslogd forwards messages to the stunnel local portal at port 61514. The local stunnel forwards data via the network to port 60514 to its remote peer. * I assume stunnel-5.26(stunnel-5.26.tar.gz) is the latest version and this can be used on linux Regards, Girish

2 1

A trivial patch for two minor typos in 5.26
by Peter Pentchev 19 Nov '15

19 Nov '15

Hi, Once again, thanks a lot for taking care of stunnel! Attached is a trivial patch for two minor typo fixes. Thanks in advance for looking over it :) G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

OCSP stapling
by Joó Ádám 17 Nov '15

17 Nov '15

Hi, The website and the documentation does not indicate and a Google search does not give any relevant results, so I would like to ask if Stunnel supports OCSP stapling? Thank you, Ádám

2 1

STunnel 5.22
by Deepak Subbanarasimha 17 Nov '15

17 Nov '15

Is STunnel 5.22 supported on Windows 2003 server? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Compilation issues - AIX 6.1 XLC and GXLC
by Rob Lockhart 16 Nov '15

16 Nov '15

On AIX 6.1 using IBM's XLC compiler, I do "configure" and that successfully completes. However, when I "make", it fails due to the parameters "-fstack-protector" and "-fPIE"... apparently it couldn't find the files "stack-protector" and "PIE" as "-f" specifies a file. However, gcc and perhaps many other cc variants, "-f" specifies a compile option. I was able to compile with XLC by ripping out the "stack-protector" and "PIE" sections of "configure" and running "make" but it would be best to use the stack protector mechanisms used for AIX's XLC: https://www.ibm.com/developerworks/mydeveloperworks/blogs/b10932b4-0edd-4e6… Has anyone compiled Stunnel 5.26 using IBM's XLC without removing the stack-protector and PIE sections in the configure file? The other option is to use gxlc instead of xlc to map the GNU C compiler options to XLC options. Would that be preferred (less modification of configure file)? I was able to get that working, but still an unusually high number of warnings. http://geco.mines.edu/files/manuals/xlc/mapping.pdf The article above (from IBM) has "-qstackprotect=size=N" - what suggestion parameter to use for "N"? To be nice to everyone's mailbox, I have posted the logs here: Stunnel 5.26 AIX XLC - fails http://pastebin.ca/3250237 Stunnel 5.26 AIX GXLC - passes http://pastebin.ca/3250242 Thanks, -Rob

3 5

Virtual Machine/Server
by Duane Moody - Global Data Specialists 13 Nov '15

13 Nov '15

We are currently using Stunnel on a stand-alone PC to link a 3rd party application that monitors a Graphical User Interface application for alarm notification. Stunnel is used to link this 3rd party alarm notification software to be able to send message to Amazon Web Services for email distribution to the users/operators that need this information. IT would like to investigate having all applications operate from a server possibly running 2012 OS, in a virtual environment. The GUI and 3rd party software will operate in this environment and I wanted to see if Stunnel would have any issues continuing to send messages out to Amazon. Thank you, Duane Moody Global Data Specialists 1815 W. 1st Ave, Suite 110 Mesa, AZ 85202 PH: 480-461-3401, Ext 223 Fax: 480-461-3411 Cell: 602-696-9457 www.gbl-data.com

2 1

stunnel 5.26 released
by Michal Trojnara 06 Nov '15

06 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.26 of stunnel. The ChangeLog entry: Version 5.26, 2015.11.06, urgency: MEDIUM * Bugfixes - Compilation fixes for OSX, *BSD and Solaris. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2c90d469011eed8dc94f003013e3c055de6fdb687ef1e71fa004281d7f7c2726 stunnel-5.26.tar.gz 797e89783bbab29d5eedbd3193da2cb2461bcf47d314a9ee671b228e207e2b15 stunnel-5.26-installer.exe cd62a3ed4818677e7eeab36017accbae697a67cfd85f58eae82d2ad2db781664 stunnel-5.26-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWPJBJAAoJEC78f/DUFuAUSWUQAKglnyE5OkITYqd7deO768mv AC7DvDrP+mwmICbl/ZQhVzuUB4E9WYUnbyrOduIbCoN3FrDr1hROcO6Tuf63DFXa 5Qal5tFFEgVm5LKi7MxPn022d5e8Q04RADtJ7DNzSrJNltyivHG3h6jAVlXcmlui BkFORjWbZAZ2AUvKBbUYYdjfR2rnpqlrUNIcZwMz0hR5e4JT5Yw5WHa3NfAcXknh XZ27+BoKg6jDyEx+mk2aXYFpeCvWPx5vaKmtAqbIkEaNKhmolpYxf02JespwmvpJ Y/rD0kko+r8zSwMQRZ8FSNncVbQ1Zir3rZM6IE78TkNeGnJKiq29H3dzrUuZP4uW Hv5qjAW7IaVMFUMUOsM/eyKTyh7ibgXLIshb7byn9zm5BHmlY4PgVUyeAXVVbYfK qgfMq43VjgXcyvFw4osQx5xYnA0P3edxFyx1v+GMeHssxh2CLv5MwrcmTcnf5SSm t2COdxi+4gA0mJwsSrdw8d7fuTLg/zhzWKSwB9XZqZ+xM+nTNVI3hzoQJ+Fhe/KP kfJ6qPrSHMj2WX740DDY/tGDTdxKnOEgJb0sJepEJyprIm8LFMSrBBt5fAdqgrPy a9znXn7RG+C71oxoaP/Q77fdAUQ9147SfGOO18ooYDzev5w5nHRg0kaPRrMDHxUg CyNsej8I/7CSXCH4PtjL =KQPP -----END PGP SIGNATURE-----

1 0

stunnel 5.25 released
by Michal Trojnara 05 Nov '15

05 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.25 of stunnel. The ChangeLog entry: Version 5.25, 2015.11.02, urgency: MEDIUM * New features - SMTP client protocol negotiation support for "protocolUsername", "protocolPassword", and "protocolAuthentication" (thx to Douglas Harris). - New service-level option "config" to specify OpenSSL >=1.0.2 configuration commands (thx to Stephen Wall). - The global option "foreground" now also accepts "quiet" parameter, which does not enable logging to stderr. - Manual page updated. - Obsolete OpenSSL engines removed from the Windows build: 4758cca, aep, atalla, cswift, nuron, sureware. - Improved compatibility with the current OpenSSL 1.1.0-dev tree: gracefully handle symbols renamed from SSLeay* to OpenSSL*. * Bugfixes - Fixed the "s_poll_wait returned 1, but no descriptor is ready" internal error. - Fixed "exec" hangs due to incorrect thread-local storage handling (thx to Philip Craig). - Fixed PRNG initialization (thx to Philip Craig). - Setting socket options no longer performed on PTYs. - Fixed 64-bit Windows build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1fb2209f1e006cc01813e1688599c4d0fb0adde4434c31ab95745b1db97484b7 stunnel-5.25.tar.gz 506846a28154e5111c6f374de5861c51221a5c9ddcf012952eaf7b4819176cd9 stunnel-5.25-installer.exe 58e79879a5fa922e2ae28ef0892f447d92d27517dfc0f921095b7180a7fd6905 stunnel-5.25-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWN2IVAAoJEC78f/DUFuAUhBoP/ifLB0Bl8yz13uGyy7mFghTN qwGLfLc5Nmu/flGOnynGWj6gXdRQT7WFaVkPCEoeNpttXEHzt+Q9psNAM4syOhBx KqiGJvq3atGfwGZwrIwUKZIXWT2jZldwL2vIctNe4i2oh6iWROcuTJqVa8eyLobw NJyuWCJqs60UK6IZN0ByrrO5Hc6Z7aTgJRkKmaWYY52ZeFrEUBY56yodfw8wvzAi JL/drDdJCyx4Q7ZQR14ZjhegAIqiEJ7GsbfosxBq3eApJKX/5L7zTP+BHL/jrFCu kiU/BhnjeYIuZ+R2j4tFWVhReMYjYIvjMAvPEo7GG1Z6xuVPpCQ90VW376cPbh8N 918Q/Gh/PF60covJmNYdW8Wn4L84vJrOM5uHkDCH2ZVFWWXUBGHZ0ZxBb1lB+kVC 69AzbK5hwHwEyfs/JjXjaIW3Tih9/Ig9t/+CD/131eWEqjGAxGtCGYgJMi0JgAt0 ei/kXeNuq39DxhTquGD1QOn98rVyrFsvvvV7aaMIECPri2MTHnZyMAF+N7txpcT2 UhD8Dlfnif6nF3JJ08/KWRh7x2tvmsFyZyqNV+uw3q3unUvZD6lcW7DCWAuXK4ap 5+fFJsxdvMUlqKZWrPrA2xrpObKAVdRdlLjDTl/oD3DuT9xfW3UQ6WKB76aLlnkL MdkEcOQuN+oCQNSlAv// =WhEM -----END PGP SIGNATURE-----

5 15

Re: [stunnel-users] One Time Password for https two factor authentication
by hamburg-barmbek＠gmx.de 02 Nov '15

02 Nov '15

2 2

One Time Password for https two factor authentication
by hamburg-barmbek＠gmx.de 30 Oct '15

30 Oct '15

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 135, Issue 19
by Reese Wilson 30 Oct '15

30 Oct '15

Unfortunately that's not an option for our use case On Thu, Oct 29, 2015 at 4:00 AM <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. hex key support for psk (Reese Wilson) > 2. Re: hex key support for psk (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 28 Oct 2015 23:12:01 +0000 > From: Reese Wilson <reesew(a)tzmedical.com> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] hex key support for psk > Message-ID: > < > CAJU_q421ksnS8mCtkc6tApdTwUXJrNBZ+69Zt_HxJMpJLGBoiA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I ran into an issue with PSK reading the key as ascii instead of hex. I had > a gnutls-serv and gnutls-cli set up with a hex key, and I switched the > server for one wrapped using stunnel, but using the same key in psk.txt was > failing. I eventually got it working by converting the hex characters to > binary and placing that in the contents of the file specified by PSKsecrets > (psk.txt), but this won't work for certain scenarios. For example, what if > the key contains ascii newline characters? >

1 0

hex key support for psk
by Reese Wilson 29 Oct '15

29 Oct '15

I ran into an issue with PSK reading the key as ascii instead of hex. I had a gnutls-serv and gnutls-cli set up with a hex key, and I switched the server for one wrapped using stunnel, but using the same key in psk.txt was failing. I eventually got it working by converting the hex characters to binary and placing that in the contents of the file specified by PSKsecrets (psk.txt), but this won't work for certain scenarios. For example, what if the key contains ascii newline characters?

2 1

stunnel: symbol lookup error: stunnel undefined symbol: X509_check_host
by Ryan McLeod 20 Oct '15

20 Oct '15

Hello. I get the error in the subject on 64bit Ubuntu and Debian system (32bit is fine). I've installed from source: -openssl-1.0.2.d -stunnel-5.24 When first install stunnel, it complained about not being able to find an ssl library during the configure stage and said to reinstall openssl with -fPIC. I did that using the following line: CFLAG=-fPIC ./config shared Once I did that, stunnel installed just fine. But when I run stunnel, I get the error in the subject. I tried reinstalling stunnel with a configure option: --with-ssl=/usr/local/ssl/. But no change. Any suggestions would be great. Thanks. Ryan

2 2

Windows Mobile 6.5
by Jeffrey McCain 19 Oct '15

19 Oct '15

Hello, Does Anyone know if the makece.bat for ARM actually functions anymore? I'd like to build the latest possible version of stunnel for a client that uses Window Mobile 6.5, but not if I have to go back to stunnel version 4.15, which appears to be the last time someone built binaries for it... Thanks! Jeff.

4 7

100 percent CPU usage
by asdf 17 Oct '15

17 Oct '15

Dear subscribers I am new to this so I dont know if this is just wrong configuration (that does not trigger an error message). Searching on the web for the following problem shows someone reporting sth similar on a Linux machine. I am using the newest version of stunnel (5.24) on Windows 7 and there is an stunnel thread starting that takes 100% of one core forever. I have attached a ProcMon trace with activated Registry/Filesystem/Network/Process events. The thread starts at 22:03:55 (which is 30 seconds after stunnel-start and at a time at which I did not use stunnel). The events after that follow that event are my pressing exit. Attachements: stunnel config, procMon-trace Thank you! Ben [myEmailIn] client = yes accept = 127.0.0.1:180 connect = imap.gmx.net:993 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net [myEmailOut] client = yes accept = 127.0.0.1:181 connect = mail.gmx.net:465 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net ; ***************************************** Example TLS server mode services [myServer] accept = 9999 connect = 7777 cert = stunnel.pem

1 0

Question about "forground = yes" and "output = FILE" combined options
by Michael Gebis 16 Oct '15

16 Oct '15

Hello. I have a question about the combination of the "foreground = yes" option combined with the "output = FILE" option. The man page says this: foreground = yes | no (Unix only) foreground mode Stay in foreground (don’t fork) and log to stderr instead of via syslog (unless output is specified). This implies that if you set both "foreground = yes" and "output = FILE", the log messages will not be sent to stderr and will instead be sent to the log file only. We'd like this behavior--it makes it easier for our scripts to distinguish startup errors parsing the config file (which are sent to stderr, since the log file isn't configured yet) vs. normal operation after the config file is parsed and the log file is established. However, it appears that if you specify "foreground = yes" and "output = FILE", log messages will go to *both* stderr and the output file. I guess I'm asking: is the documentation in conflict with the behavior, and if so, which is correct? It's possible I'm just misreading the man page. But in any case, here is a simple patch which changes the behavior to match our reading of the man page. It is against stunnel-5.22 but I believe it should be applicable to later versions as well. Thank you, Michael diff -ru stunnel-5.22.orig/src/log.c stunnel-5.22-foreground-outfile/src/log.c --- stunnel-5.22.orig/src/log.c 2015-06-16 06:16:35.000000000 -0700 +++ stunnel-5.22-foreground-outfile/src/log.c 2015-10-14 11:54:58.998254974 -0700 @@ -243,7 +243,8 @@ level<=opt->log_level #else (level<=opt->log_level && - global_options.option.foreground) + global_options.option.foreground && + !outfile) #endif ) ui_new_log(line);

3 7

Can stunnel do this and if so, how?
by Jason Lacoss-Arnold 15 Oct '15

15 Oct '15

I have a client and a server where the client isn't very good and the server requires a MASSL (Mutual Auth SSL aka client certificate authenticated) connection. I need to get one of two things to work. Either: 1) The client makes a non-SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate or 2) The client makes a plain SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate. Can stunnel be used in this manner? If so, would someone please give me some hints on configuration? For extra credit, it would be awesome if the client private key were stored in a pkcs11 device (HSM). Thank you, --Jason

1 0

Unable to authenticate with Outlook.com servers (SMTP)
by Aerowinder 15 Oct '15

15 Oct '15

Greetings, Running stunnel 5.25 latest beta (2015-10-15), but also had the same issues on 5.24 final. My config file looks like this: debug = debug output = xxxxx client = yes cert = stunnel.pem [outlook-smtp] accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 protocol = smtp ;protocolUsername = xxxx ;protocolPassword = xxxx CAfile = ca-certs.pem checkHost = smtp-mail.outlook.com OCSPaia = yes verify = 2 I am testing functionality to make sure that I am able to send mail with my Outlook.com address. I currently have User/Pass field commented out, but I've tried with them not commented out, and the actual values instead of "xxxx" (the app I'm using has fields for username and password). My log: 2015.10.15 11:01:24 LOG7[cron]: Cron started 2015.10.15 11:01:24 LOG7[main]: No limit detected for the number of clients 2015.10.15 11:01:24 LOG5[main]: stunnel 5.25 on x86-pc-msvc-1500 platform 2015.10.15 11:01:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2d-fips 9 Jul 2015 2015.10.15 11:01:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.10.15 11:01:24 LOG7[main]: errno: (*_errno()) 2015.10.15 11:01:24 LOG7[ui]: GUI message loop initialized 2015.10.15 11:01:24 LOG5[main]: Reading configuration from file stunnel.conf 2015.10.15 11:01:24 LOG5[main]: UTF-8 byte order mark detected 2015.10.15 11:01:24 LOG5[main]: FIPS mode disabled 2015.10.15 11:01:24 LOG7[main]: Compression disabled 2015.10.15 11:01:24 LOG7[main]: PRNG seeded successfully 2015.10.15 11:01:24 LOG6[main]: Initializing service [outlook-smtp] 2015.10.15 11:01:24 LOG6[main]: Loading certificate from file: stunnel.pem 2015.10.15 11:01:24 LOG6[main]: Loading key from file: stunnel.pem 2015.10.15 11:01:24 LOG7[main]: Private key check succeeded 2015.10.15 11:01:24 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.10.15 11:01:24 LOG5[main]: Configuration successful 2015.10.15 11:01:24 LOG7[main]: Listening file descriptor created (FD=652) 2015.10.15 11:01:24 LOG7[main]: Service [outlook-smtp] (FD=652) bound to 127.0.0.1:25 2015.10.15 11:01:31 LOG7[main]: Found 1 ready file descriptor(s) 2015.10.15 11:01:31 LOG7[main]: FD=408 ifds=r-x ofds=--- 2015.10.15 11:01:31 LOG7[main]: Service [outlook-smtp] accepted (FD=692) from 127.0.0.1:58065 2015.10.15 11:01:31 LOG7[main]: Creating a new thread 2015.10.15 11:01:31 LOG7[main]: New thread created 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] started 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] accepted connection from 127.0.0.1:58065 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 65.55.176.126:587 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 65.55.176.126:587: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 65.55.176.126:587 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] connected remote server from 172.26.1.51:58066 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) initialized 2015.10.15 11:01:31 LOG7[0]: <- 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> EHLO localhost 2015.10.15 11:01:31 LOG7[0]: <- 250-BLU436-SMTP245.smtp.hotmail.com Hello [70.90.151.129] 2015.10.15 11:01:31 LOG7[0]: <- 250-TURN 2015.10.15 11:01:31 LOG7[0]: <- 250-SIZE 41943040 2015.10.15 11:01:31 LOG7[0]: <- 250-ETRN 2015.10.15 11:01:31 LOG7[0]: <- 250-PIPELINING 2015.10.15 11:01:31 LOG7[0]: <- 250-DSN 2015.10.15 11:01:31 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.10.15 11:01:31 LOG7[0]: <- 250-8bitmime 2015.10.15 11:01:31 LOG7[0]: <- 250-BINARYMIME 2015.10.15 11:01:31 LOG7[0]: <- 250-CHUNKING 2015.10.15 11:01:31 LOG7[0]: <- 250-VRFY 2015.10.15 11:01:31 LOG7[0]: <- 250-TLS 2015.10.15 11:01:31 LOG7[0]: <- 250-STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 250 OK 2015.10.15 11:01:31 LOG7[0]: -> STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.10.15 11:01:31 LOG6[0]: SNI: sending servername: smtp-mail.outlook.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): before/connect initialization 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG7[0]: OCSP: Ignoring root certificate 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.globalsign.com/rootr1" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.204:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 19 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG6[0]: CERT: Host name "smtp-mail.outlook.com" matched with "*.outlook.com" 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp2.globalsign.com/gsorganizationvalg2" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.196:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp2.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 16 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG5[0]: Certificate accepted at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read finished A 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) requested 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) succeeded 2015.10.15 11:01:31 LOG7[0]: 0 client renegotiation(s) requested 2015.10.15 11:01:31 LOG7[0]: 0 session reuse(s) 2015.10.15 11:01:31 LOG6[0]: SSL connected: new session negotiated 2015.10.15 11:01:31 LOG7[0]: Peer certificate was cached (3461 bytes) 2015.10.15 11:01:31 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2015.10.15 11:01:31 LOG7[0]: Compression: null, expansion: null 2015.10.15 11:01:31 LOG6[0]: SSL socket closed (SSL_read) 2015.10.15 11:01:31 LOG7[0]: Sent socket write shutdown 2015.10.15 11:01:31 LOG5[0]: Connection closed: 139 byte(s) sent to SSL, 351 byte(s) sent to socket 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) closed 2015.10.15 11:01:31 LOG7[0]: Local descriptor (FD=692) closed 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] finished (0 left) I don't see any errors in the log, but Outlook is reporting an incorrect password on the security section of my Microsoft Account. More specifically, I'm seeing error 5.7.3: Requested action aborted, user not authenticated," I know the password works because I set it up as an account in Outlook 2010 and tested sending the email. It works great. I am using 2FA with an app-specific password. But I have also tried without 2FA. I am 100% certain the account name xxxx(a)outlook.com and the password are correct. As far as the config file goes, I've tried just about everything I could find on Google. Nothing works, always the same error message. I also experienced similar failures with Gmail. Any ideas?

2 1

prng_init failure
by Philip Craig 15 Oct '15

15 Oct '15

prng_init() is failing in 5.24 when cross-compiling with openssl due to a combination of two reasons: 1. The --with-random configure option is not supported when cross compiling. 2. The hardcoded /dev/urandom is no longer used if OPENSSL_NO_EGD is not defined. The following patch reverts the behaviour to how it was in 5.23, but probably the --with-random configure option should be supported too. --- stunnel-5.25.orig/src/ssl.c +++ stunnel-5.25/src/ssl.c @@ -207,7 +207,8 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g return 0; /* success */ } s_log(LOG_DEBUG, "RAND_screen failed to sufficiently seed PRNG"); -#elif !defined(OPENSSL_NO_EGD) +#else +#ifndef OPENSSL_NO_EGD if(global->egd_sock) { if((bytes=RAND_egd(global->egd_sock))==-1) { s_log(LOG_WARNING, "EGD Socket %s failed", global->egd_sock); @@ -220,7 +221,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g so no need to check if seeded sufficiently */ } } -#else +#endif /* try the good-old default /dev/urandom, if available */ totbytes+=add_rand_file(global, "/dev/urandom"); if(RAND_status())

2 1

[PATCH] only use aysnc-signal-safe functions after fork
by Philip Craig 15 Oct '15

15 Oct '15

POSIX requires that multi-threaded processes only use async-signal-safe functions after calling fork(). For more info on the problems this avoids, see the rationale at: http://pubs.opengroup.org/onlinepubs/9699919799/functions/pthread_atfork.ht… The specific problem this patch solves is that, when there are multiple simultaneous requests, stunnel is often hanging on a futex syscall when a child process calls free as a result of tls_alloc(). This problem is experienced when using uClibc. I haven't tested, but I believe the malloc implementation in glibc does not have this problem. --- stunnel-5.24.orig/src/client.c +++ stunnel-5.24/src/client.c @@ -1100,6 +1100,8 @@ NOEXPORT SOCKET connect_local(CLI *c) { NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ char *name, host[40], port[6]; + char *env[10]; + int i, envc; int fd[2], pid; X509 *peer_cert; #ifdef HAVE_PTHREAD_SIGMASK @@ -1115,19 +1117,55 @@ NOEXPORT SOCKET connect_local(CLI *c) { } else if(make_sockets(fd)) longjmp(c->err, 1); + set_nonblock(fd[1], 0); /* switch back to blocking mode */ + + envc = 0; + + if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, + host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { + /* just don't set these variables if getnameinfo() fails */ + env[envc++] = str_printf("REMOTE_HOST=%s", host); + env[envc++] = str_printf("REMOTE_PORT=%s", port); + if(c->opt->option.transparent_src) { +#ifndef LIBDIR +#define LIBDIR "." +#endif +#ifdef MACH64 + env[envc++] = str_dup("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + env[envc++] = str_dup("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used instead */ + env[envc++] = str_dup("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); +#else + env[envc++] = str_dup("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif + } + } + + if(c->ssl) { + peer_cert=SSL_get_peer_certificate(c->ssl); + if(peer_cert) { + name=X509_NAME2text(X509_get_subject_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_DN=%s", name); + name=X509_NAME2text(X509_get_issuer_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_I_DN=%s", name); + X509_free(peer_cert); + } + } + + env[envc] = NULL; pid=fork(); c->pid=(unsigned long)pid; switch(pid) { case -1: /* error */ + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[0]); closesocket(fd[1]); ioerror("fork"); longjmp(c->err, 1); case 0: /* child */ - tls_alloc(NULL, c->tls, NULL); /* reuse thread-local storage */ closesocket(fd[0]); - set_nonblock(fd[1], 0); /* switch back to blocking mode */ /* dup2() does not copy FD_CLOEXEC flag */ dup2(fd[1], 0); dup2(fd[1], 1); @@ -1135,36 +1173,6 @@ NOEXPORT SOCKET connect_local(CLI *c) { dup2(fd[1], 2); closesocket(fd[1]); /* not really needed due to FD_CLOEXEC */ - if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, - host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - /* just don't set these variables if getnameinfo() fails */ - putenv(str_printf("REMOTE_HOST=%s", host)); - putenv(str_printf("REMOTE_PORT=%s", port)); - if(c->opt->option.transparent_src) { -#ifndef LIBDIR -#define LIBDIR "." -#endif -#ifdef MACH64 - putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); - putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); -#elif __osf /* for Tru64 _RLD_LIST is used instead */ - putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); -#else - putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); -#endif - } - } - - if(c->ssl) { - peer_cert=SSL_get_peer_certificate(c->ssl); - if(peer_cert) { - name=X509_NAME2text(X509_get_subject_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_DN=%s", name)); - name=X509_NAME2text(X509_get_issuer_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_I_DN=%s", name)); - X509_free(peer_cert); - } - } #ifdef HAVE_PTHREAD_SIGMASK sigemptyset(&newmask); sigprocmask(SIG_SETMASK, &newmask, NULL); @@ -1176,11 +1184,13 @@ NOEXPORT SOCKET connect_local(CLI *c) { signal(SIGTERM, SIG_DFL); signal(SIGQUIT, SIG_DFL); signal(SIGINT, SIG_DFL); - execvp(c->opt->exec_name, c->opt->exec_args); + execve(c->opt->exec_name, c->opt->exec_args, env); ioerror(c->opt->exec_name); /* execvp failed */ _exit(1); default: /* parent */ s_log(LOG_INFO, "Local mode child started (PID=%lu)", c->pid); + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[1]); return fd[0]; }

2 2

Re: [stunnel-users] (no subject)
by Adrián Mihálko 10 Oct '15

10 Oct '15

Some good news, I remove client = yes as you suggested: 2015.10.09 12:39:29 LOG5[main]: Configuration successful 2015.10.09 12:39:29 LOG5[main]: Logging to C:\Users\adrianmihalko\AppData\Local\stunnel.log 2015.10.09 12:39:34 LOG6[57]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[57]: Connection closed: 0 byte(s) sent to SSL, 445 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[60]: Service [myservice] accepted connection from 192.168.1.25:49671 2015.10.09 12:39:34 LOG6[60]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[60]: No peer certificate received 2015.10.09 12:39:34 LOG6[60]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[60]: failover: round-robin, starting at entry #0 2015.10.09 12:39:34 LOG6[60]: s_connect: connecting ::1:41952 2015.10.09 12:39:34 LOG5[60]: s_connect: connected ::1:41952 2015.10.09 12:39:34 LOG6[60]: persistence: ::1:41952 cached 2015.10.09 12:39:34 LOG5[60]: Service [myservice] connected remote server from ::1:50598 2015.10.09 12:39:34 LOG6[60]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[60]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[61]: Service [myservice] accepted connection from 192.168.1.25:49672 2015.10.09 12:39:34 LOG6[61]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[61]: No peer certificate received 2015.10.09 12:39:34 LOG6[61]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[61]: failover: round-robin, starting at entry #1 2015.10.09 12:39:34 LOG6[61]: s_connect: connecting 127.0.0.1:41952 2015.10.09 12:39:34 LOG5[61]: s_connect: connected 127.0.0.1:41952 2015.10.09 12:39:34 LOG6[61]: persistence: 127.0.0.1:41952 cached 2015.10.09 12:39:34 LOG5[61]: Service [myservice] connected remote server from 127.0.0.1:50599 openssl_client log: http://pastebin.com/7bg3sf7J The problem is now that the site loads forever, nothing happens. (this certificate (:1988) is other than the original (:41952). This is not problem? curl test: $ curl https://192.168.1.17:1988/DYMO/DLS/Printing/Check -vk * Trying 192.168.1.17... * Connected to 192.168.1.17 (192.168.1.17) port 1988 (#0) * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 * Server certificate: localhost > GET /DYMO/DLS/Printing/Check HTTP/1.1 > Host: 192.168.1.17:1988 > User-Agent: curl/7.43.0 > Accept: */* > waiting forever. 2015-10-09 12:34 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > In the first mail I wrote ports bad, of course in the log I am using the > good ones. > > [myservice] > cert = stunnel.pem > client = yes > accept = 0.0.0.0:1988 > connect = localhost:41952 > > > 2015-10-09 12:32 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > >> Sorry, curl was only for testing. >> >> Adrians-MacBook-Pro:~ adrianmihalko$ openssl s_client -connect >> 192.168.1.17:1988 >> CONNECTED(00000003) >> 1130:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown >> protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s23_clnt.c:618: >> >> 2015.10.09 12:23:21 LOG5[main]: Reading configuration from file >> stunnel.conf >> 2015.10.09 12:23:21 LOG5[main]: UTF-8 byte order mark detected >> 2015.10.09 12:23:21 LOG5[main]: FIPS mode disabled >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-pop3] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-imap] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-smtp] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [myservice] >> 2015.10.09 12:23:21 LOG6[main]: Loading certificate from file: stunnel.pem >> 2015.10.09 12:23:21 LOG6[main]: Loading key from file: stunnel.pem >> 2015.10.09 12:23:21 LOG4[main]: Service [myservice] needs authentication >> to prevent MITM attacks >> 2015.10.09 12:23:21 LOG5[main]: Configuration successful >> 2015.10.09 12:23:21 LOG5[main]: Logging to >> C:\Users\adrianmihalko\AppData\Local\stunnel.log >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] accepted connection >> from 192.168.1.25:49454 >> 2015.10.09 12:23:42 LOG6[39]: failover: round-robin, starting at entry #0 >> 2015.10.09 12:23:42 LOG6[39]: s_connect: connecting ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: s_connect: connected ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] connected remote server >> from ::1:50564 >> 2015.10.09 12:23:42 LOG6[39]: SNI: sending servername: localhost >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: SSL connected: new session negotiated >> 2015.10.09 12:23:42 LOG6[39]: Negotiated TLSv1 ciphersuite AES128-SHA >> (128-bit encryption) >> 2015.10.09 12:23:42 LOG6[39]: SSL socket closed (SSL_read) >> 2015.10.09 12:23:42 LOG5[39]: Connection closed: 130 byte(s) sent to SSL, >> 505 byte(s) sent to socket >> >> If I am connecting to the :41952: >> >> openssl s_client -connect 192.168.1.17:41952 >> ... >> >> --- >> No client certificate CA names sent >> --- >> SSL handshake has read 1724 bytes and written 712 bytes >> --- >> New, TLSv1/SSLv3, Cipher is AES128-SHA >> Server public key is 4096 bit >> Secure Renegotiation IS supported >> Compression: NONE >> Expansion: NONE >> SSL-Session: >> Protocol : TLSv1 >> Cipher : AES128-SHA >> ... >> >> >> 2015-10-09 10:55 GMT+02:00 test rig <testrig(a)z1p.biz>: >> >>> >>> Ouch #2 missing... >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> You are connection to :9999 with curl(?) >>> Try verify it via "openssl s_client -connect yourserverip:1988" command >>> >>> Best Regards >>> Michael >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* "test rig" <testrig(a)z1p.biz> >>> *Datum:* 09.10.2015 09:48:02 >>> *An:* "stunnel-users(a)stunnel.org." <stunnel-users(a)stunnel.org> >>> *Betreff:* Re: [stunnel-users] (no subject) >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* Adrián Mihálko >>> *Datum:* 09.10.2015 08:15:19 >>> *An:* stunnel-users(a)stunnel.org >>> *Betreff:* [stunnel-users] (no subject) >>> >>> Dear stunnel users, >>> >>> I have a little service which listen only on https://localhost:4952 and >>> checks source hostname. I want to connect on "listen:1988" and redirect >>> requests with stunnel to "localhost:4952" >>> >>> https://192.168.1.10:1988 -> redirect https://localhost:4952 >>> >>> >>> I am trying to configure stunnel like this >>> >>> [myservice] >>> cert = stunnel.pem >>> client = yes >>> accept = 0.0.0.0:1988 >>> connect = localhost:4952 >>> >>> remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check >>> -v >>> * Trying 192.168.1.25... >>> * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0) >>> * WARNING: using IP address, SNI is being disabled by the OS. >>> * Unknown SSL protocol error in connection to 192.168.1.25:-9847 >>> * Closing connection 0 >>> curl: (35) Unknown SSL protocol error in connection to 192.168.1.25: >>> -9847 >>> >>> stunnel.log: >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection >>> from 192.168.1.24:60748 >>> 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1 >>> 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote >>> server from 127.0.0.1:50503 >>> 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated >>> 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA >>> (128-bit encryption) >>> 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read) >>> 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to >>> SSL, 505 byte(s) sent to socket >>> >>> I am tried verify = 1 to 4, either works. :( >>> >>> Best Regards, >>> Adrian >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>> >> >

3 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users