- stunnel-users - stunnel.org

error:0A000126:SSL routines::unexpected eof while reading
by sburke＠unitedelectric.com 07 Nov '22

07 Nov '22

Hello, I am trying to get a system notification email back up and running after google disabled the "use less secure apps" functionality in the Gmail platform. I have set up the Gmail account to use an app password which I assigned to the system that was sending emails before this change. It appears the system is now connecting to Stunnel running on a windows 10 machine and Stunnel is making the connection with the Gmail server again, but no email actually gets sent out. I am running Stunnel 5.66 Here is the configuration currently: [gmail-smtp] client = yes accept = 25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.Gmail.com OCSPaia = yes Here is a copy of the log file: 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] accepted connection from 192.168.100.200:56399 2022.09.20 07:40:49 LOG5[0]: s_connect: connected 74.125.138.109:465 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] connected remote server from 172.16.4.220:60367 2022.09.20 07:40:49 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gtsr1" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gts1c3" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: Certificate accepted at depth=0: CN=smtp.gmail.com 2022.09.20 07:40:51 LOG3[0]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.09.20 07:40:51 LOG5[0]: Connection reset: 92 byte(s) sent to TLS, 620 byte(s) sent to socket Is this something I can remedy from the configuration, or is this something that requires modification on the email server side? Thank you sean

3 2

Re: stunnel 5.67 released
by Rok Berlec 07 Nov '22

07 Nov '22

Hi, When we install version 5.67 we sometimes get the message: "The procedure entry point OPENSSL_strcasecmp could not be located" After start of service everything looks fine. We upgrade by uninstalling the previous version and installing the latest one. Best regards, Rok Berlec

1 0

stunnel 5.67 released
by Michał Trojnara 01 Nov '22

01 Nov '22

Dear Users, I have released version 5.67 of stunnel. ### Version 5.67, 2022.11.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.7. * New features - Provided a logging callback to custom engines. * Bugfixes - Fixed "make cert" with OpenSSL older than 3.0. - Fixed the code and the documentation to use conscious language for SNI servers (thx to Clemens Lang). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3086939ee6407516c59b0ba3fbf555338f9d52f459bcab6337c0f00e91ea8456 stunnel-5.67.tar.gz a6bdc2a735eb34465d10e3c7e61f32d679ba29a68de8ea8034db79c0c8b328a3 stunnel-5.67-win64-installer.exe 893f53d6647900eb34041be8f21a21c052a31de3fb393a97627021a1ef2752f5 stunnel-5.67-android.zip Best regards, Mike

1 0

"make cert" get "Error configuring OpenSSL modules"
by decatur93＠163.com 28 Oct '22

28 Oct '22

Hi, all. I have done "make && make install" under "sudo", then I got this when "make cert" --------------------------------------------------------------- make -C tools cert make[1]: Entering directory '/opt/stunnel-5.66/tools' ./makecert.sh . /usr /dev/urandom OpenSSL 1.1.1f 31 Mar 2020 1+0 records in 1+0 records out 256 bytes copied, 0.0001303 s, 2.0 MB/s Error configuring OpenSSL modules 139784943940928:error:25066067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(libproviders.so): libproviders.so: cannot open shared object file: No such file or directory 139784943940928:error:25070067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:162: 139784943940928:error:0E07506E:configuration file routines:module_load_dso:error loading dso:../crypto/conf/conf_mod.c:224:module=providers, path=providers 139784943940928:error:0E076071:configuration file routines:module_run:unknown module name:../crypto/conf/conf_mod.c:165:module=providers Certificate details: Can't open stunnel.pem for reading, No such file or directory 139707919738176:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:69:fopen('stunnel.pem','r') 139707919738176:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:76: unable to load certificate /usr/bin/install -c -b -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem /usr/bin/install: cannot stat 'stunnel.pem': No such file or directory make[1]: *** [Makefile:579: cert] Error 1 make[1]: Leaving directory '/opt/stunnel-5.66/tools' make: *** [Makefile:894: cert] Error 2 ------------------------------------------------------------------ It seems I have no libproviders.so, but I have installed openssl. Can anyone help me? Thx.

3 2

stunnel as simple TLS terminator to web backend -- works, but 1st response is blank page, after reload all's good ?
by PGNet Dev 15 Oct '22

15 Oct '22

I'm running [.] stunnel 5.66 on x86_64-redhat-linux-gnu platform [.] Compiled/running with OpenSSL 3.0.5 5 Jul 2022 on lsb_release -rd Description: Fedora release 36 (Thirty Six) Release: 36 uname -rm 5.19.15-201.fc36.x86_64 x86_64 it's setup to frontend terminate TLS in front of a bind9 nameserver instance's statistics (http-only) web server backend. it's a trivial config, cat /etc/stunnel/stunnel.conf debug = 5 syslog = yes [bind9-stats] accept = ns.example.com:10000 connect = 127.0.0.1:10001 sslVersion = TLSv1.3 ciphersuites = TLS_CHACHA20_POLY1305_SHA256 requireCert = yes verifyChain = yes verifyPeer = no CAfile = /usr/local/etc/stunnel/example_CA.CHAIN.crt.pem cert = /usr/local/etc/stunnel/ns.example.com.COMBINED.pem key = /usr/local/etc/stunnel/ns.example.com.server.key.pem sessionCacheSize = 1 sessionCacheTimeout = 360 and it does provide access, with no apparent/reported *error*, afaict. but, on initial access, i.e. first nav to the exposed site page, I get a blank page. simply RELOADING the browser page cures the problem. page display, with current/correct data -- as do all (sub)links on the page. this is repeatable behavior in multiple browsers (Firefox, Chromium, Chrome). so far i've not found any indication of an actual error -- only this 1st-page-visit-is-blank behavior, unique to my stunnel usage. other/heavier frontends have no such issue. odd, but not fatal. or even, apparently, problematic (so far, i think). is this a pebkac/config issue? or a known issue/bug? other?

1 0

SSL Termination Issue
by Gary Jackson 15 Oct '22

15 Oct '22

We have an STunnel configuration running to take encrypted TLS traffic from customers and pass it to our application unencrypted. We have purchased a CA signed certificate, but we are receiving an error when negotiating. We have tried many searches/configurations with no progress. STunnel General Config ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-;RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:AES256-GCM-;SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-;AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:AES128-GCM-SHA256 curves = X25519:P-256:X448:P-521:P-384 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d STunnel Service Specific Config ; TLS front-end to a web server [https] accept = 27015 connect = 172.31.4.10:9000 cert = mycert.pem key = mycert.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 STunnel Debug 2022.10.15 11:16:08 LOG6[769]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.15 11:16:08 LOG3[769]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.15 11:16:08 LOG7[769]: Compression: null, expansion: null 2022.10.15 11:16:08 LOG7[769]: Deallocating application specific data for session connect address 2022.10.15 11:16:08 LOG6[769]: s_connect: connecting x.x.x.x:9000 2022.10.15 11:16:08 LOG7[769]: s_connect: s_poll_wait x.x.x.x:9000: waiting 10 seconds 2022.10.15 11:16:08 LOG7[769]: FD=792 ifds=--- ofds=r-- 2022.10.15 11:16:08 LOG7[769]: FD=888 ifds=rwx ofds=--- 2022.10.15 11:16:08 LOG5[769]: s_connect: connected x.x.x.x:9000 2022.10.15 11:16:08 LOG6[769]: persistence: x.x.x.x:9000 cached 2022.10.15 11:16:08 LOG5[769]: Service [https] connected remote server from x.x.x.x:52720 2022.10.15 11:16:08 LOG7[769]: Setting remote socket options (FD=888) 2022.10.15 11:16:08 LOG7[769]: Option TCP_NODELAY set on remote socket 2022.10.15 11:16:08 LOG7[769]: Remote descriptor (FD=888) initialized 2022.10.15 11:16:09 LOG6[769]: SSL_read: Socket is closed 2022.10.15 11:16:09 LOG6[769]: TLS socket closed (SSL_read) 2022.10.15 11:16:09 LOG7[769]: Sent socket write shutdown Any assistance would be GREATLY appreciated! Thank you. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

2 3

Peer Suddenly Disconnects after Negotiating TLS
by Gary Jackson 13 Oct '22

13 Oct '22

I have a TLS Connection that appears to be established but then is terminating and not sure what would cause this. 2022.10.13 14:56:36 LOG5[12435]: Service [https] accepted connection from 97.72.232.10:62890 2022.10.13 14:56:36 LOG6[12435]: Peer certificate not required 2022.10.13 14:56:36 LOG6[12435]: TLS accepted: new session negotiated 2022.10.13 14:56:36 LOG6[12435]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.13 14:56:36 LOG3[12435]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.13 14:56:36 LOG6[12435]: s_connect: connecting 172.31.4.10:9000 2022.10.13 14:56:36 LOG5[12435]: s_connect: connected 172.31.4.10:9000 2022.10.13 14:56:36 LOG6[12435]: persistence: 172.31.4.10:9000 cached 2022.10.13 14:56:36 LOG5[12435]: Service [https] connected remote server from 172.31.4.20:59907 2022.10.13 14:56:36 LOG6[12435]: SSL_read: Socket is closed 2022.10.13 14:56:36 LOG6[12435]: TLS socket closed (SSL_read) 2022.10.13 14:56:36 LOG5[12435]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Thanks in advance. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

1 0

SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading
by carango＠ingeniocarmelita.com 13 Oct '22

13 Oct '22

Hello I have the same problem, any solution? SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading

1 0

32-bit windows download
by Ágnes Kakasi 27 Sep '22

27 Sep '22

Hi, I'm looking for help to download and install Stunnel on a laptop with 32-bit Windows 7. I have downloaded the available download file from the website (stunnel-5.66-win64-installer.exe) but the computer indicates it cannot open the file. I tried to find info on this and in the platform sections I found Stunnel can run on 32-bit, as well, but I don't know how to make it work. Can you please advise me on what the correct download file is and how to install it so that it works on this computer? Thank you in advance. Agnes

2 1

error:0A000438:SSL routines::tlsv1 alert internal error
by johannwang＠ami.com 21 Sep '22

21 Sep '22

Hello, I am trying to use the xvncviewer on Ubuntu by VNC over stunnel, it will connect failed and print "xvncviewer: read: Connection reset by peer". The LOG on VNC server is here: 2012.01.01 00:21:58 LOG7[1]: Initializing application specific data for session authenticated 2012.01.01 00:21:58 LOG7[1]: SNI: no virtual services defined 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS read client hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write key exchange 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate request 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server done 2012.01.01 00:21:58 LOG7[1]: TLS alert (read): fatal: internal error 2012.01.01 00:21:58 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1584: error:0A000438:SSL routines::tlsv1 alert internal error 2012.01.01 00:21:58 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2012.01.01 00:21:58 LOG7[1]: Deallocating application specific data for session connect address 2012.01.01 00:21:58 LOG7[1]: Local descriptor (FD=3) closed 2012.01.01 00:21:58 LOG7[1]: Service [vnc] finished (0 left) I am running Stunnel 5.63 Here is the configuration currently: stunnel.conf on VNC client: cert = /home/server.pem key = /home/privkey.pem [VNC] client = yes accept = 127.0.0.1:5901 connect = 172.31.100.121:5901 sslVersion = all verifyChain = yes CAfile = /home/server.pem checkIP = 172.31.100.121 stunnel.conf on VNC server: cert = /conf/server.pem ;key = /conf/certs/privkey.pem setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:TCP_NODELAY=1 debug = 7 foreground = yes client = no ciphers=AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM sslVersion = TLSv1.2 [vnc] accept = :::5901 connect = 5900 verify = 3 CAfile = /conf/server.pem Is this something I can remedy from the configuration, or is this something that requires modification? Thank you Johan

1 0

v5.66: failing test 081
by Andreas Vetter 20 Sep '22

20 Sep '22

Hi, in open build system I get the following failing test, when building and testing stunnel 5.66: [ 45s] 081. Test IPv6 support [ 45s] [client] Read '2022.09.15 21:17:15 LOG6[0]: TLS fd: Connection reset by peer (104)' [ 45s] ...................................................................... failed Is this a stunnel problem or a problem with logging inside the build system? What can I do to get more verbose information during build? The test is working for a similar target OS (openSUSE_Tumbleweed) and not for this one (openSUSE:Factory). The difference is small, but sometimes not neglectible: openSUSE:Factory is the to be tested submissions, always in the flow. openSUSE_Tumbleweed is a tested working snapshot of Factory. Best regards, Andreas

1 1

stunnel 5.66 released
by Michał Trojnara 11 Sep '22

11 Sep '22

Dear Users, I have released version 5.66 of stunnel. ### Version 5.66, 2022.09.11, urgency: MEDIUM * New features - OpenSSL 3.0 FIPS Provider support for Windows. * Bugfixes - Fixed building on machines without pkg-config. - Added the missing "environ" declaration for BSD-based operating systems. - Fixed the passphrase dialog with OpenSSL 3.0. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 558178704d1aa5f6883aac6cc5d6bbf2a5714c8a0d2e91da0392468cee9f579c stunnel-5.66.tar.gz 5fccb2e4db0d2e3c1adb26c3906585ac545baf88226f4f539b2dc43fe418a3ef stunnel-5.66-win64-installer.exe 3b1e30e060e16f6aa9a8ad1b1a6ba1210c165bf76bd01e4734cb4537e0717c09 stunnel-5.66-android.zip Best regards, Mike

1 0

Stunnel Consulting
by Gary Jackson 10 Sep '22

10 Sep '22

I am looking for someone to assist with an stunnel configuration on windows that will accept TLS1.2 connections and then send them unencrypted to an IP and port. I would need to get it working within the next week or so and am available most times if scheduled. Thank you. Gary Jackson Sent from my mobile

2 1

TLS 1.2 traffic on STunnel
by Gary Jackson 08 Sep '22

08 Sep '22

Good afternoon, I am trying to use Stunnel to accept traffic from a custom application using TLS 1.2 and a self signed cert and then send it to a back end application unencrypted. I want the configuration to only affect one listener on Stunnel and not all incoming ports. I am using Stunnel v.5.6 I am confused with all the documentation and what needs to be set in the config file for this use case. The config file currently has connections where it accepts traffic on one port and then directs it to another port internally but not with TLS 1.2. Thank you for all your knowledge and insight! _________________________________ Gary Jackson | Senior Systems Engineer

2 1

Certificate Request's "Distinguished Names" list is empty when using CAPath (but not when using CAFile)
by david.rundqvist＠gmail.com 26 Aug '22

26 Aug '22

Hi, If I hash the client certificates and put them in a folder (with file names <hash>.0), and use the CAPath parameter on the server, together with verify=3, the server's Certificate Request message contains an empty list of "Distinguished Names". However, if I put the client certificates concatenated in a .pem file, and use the CAFile parameter on the server, the Certificate Request message does contain the Distinguished Names. Is this the correct behavior? I thought CAFile and CAPath worked more or less in the same way, but perhaps the Certificate Request message is implemented differently, depending on if you use CAFile or CAPath? My preferred way is to use CAPath: Is there some way I can get the Distinguished Names not to be empty, when using CAPath? I'm on Windows, using stunnel version 5.49, currently. Thanks in advance! Kind regards, /David

2 1

looking to pay for stunnel support
by jkorman＠pcvisions1.com 24 Aug '22

24 Aug '22

I have an issue with a program that is 9 years old that uses old stunnel for email forwarding of automated alerts. I would gladly pay for support for assistance configuring the newest version of stunnel. My issue is that present configuration is sending smtp at tls 1.0 which is getting rejected. Please send me your info via email and I will promptly respond Joe Korman

1 0

FIPS-enabled Windows installer of stunnel
by Vadim Loevski 22 Aug '22

22 Aug '22

Hi, I would appreciate it if you let me know how I could obtain a FIPS-enabled Windows 64 bit installer of stunnel. Regards, Vadim

1 0

Stunnel is throwing Timeout connect and Timeout closed error
by Ferdous K 16 Aug '22

16 Aug '22

Hello, I have been using Stunnel 3.5.44 (latest for Ubuntu 18) to connect to my remote load balancer which serves traffic to several backend nodes. After recent O/S update, I have noticed one weird issue. I am seeing frequent TIMEOUTconnect and TIMEOUTclosed exceeded errors when stunnel service tries to connect to backend nodes via load balancer in round robin mode. If I replace load balancer or multiple backends (to rule out DNS issue) entries: connect = remote-load-balancer:8080 Or connect = remote-backend-node1:8080 connect = remote-backend-node2:8080 With single backend entry like this: connect = remote-backend-node1:8080 Or, connect = remote-backend-node2:8080 Then those errors go away. I have tested on multiple servers with different backends and timeout configuration and all are showing same issues so the problem seems like not related to specific server of backend. Any idea what could cause this issue? Thanks in advance, Ferdous Reference: https://launchpad.net/ubuntu/bionic/+package/stunnel4 Stunnel sample config: pid = /var/run/stunnel4/stunnel.pid output = /var/log/stunnel4/stunnel.log socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 socket = r:TCP_KEEPIDLE=120 socket = r:TCP_KEEPINTVL=30 socket = r:TCP_KEEPCNT=6 socket = l:TCP_KEEPIDLE=120 socket = l:TCP_KEEPINTVL=30 socket = l:TCP_KEEPCNT=6 [remote] client = yes accept = 127.0.0.1:6500 connect = remote-load-balancer:8080 cert = /opt/service/etc/cert.d/remote.crt key = /opt/service/etc/key.d/remote.key sslVersion = TLSv1.2 debug = info verifyChain = no verifyPeer = no

1 1

TLS alert (write): fatal: decode error (pop3 to office365)
by Martijn Strunk - Mulder Connect 15 Aug '22

15 Aug '22

We now use stunnel as a solution for a pop3 import for Office365. It just stopped working since Wednesday. we have done a new installation on this, only now we run into these problems that it no longer wants to connect. Below you will find our debug list and config list. Do any of you have a solution to this problem? Debug: 2022.07.26 14:34:37 LOG6[service]: Service [POP3 Incoming] (FD=876) bound to 0.0.0.0:110 2022.07.26 14:34:37 LOG6[service]: Service [SMTP Outgoing] (FD=840) bound to 0.0.0.0:25 2022.07.26 14:34:54 LOG5[21]: Service [POP3 Incoming] accepted connection from 192.168.110.11:60494 2022.07.26 14:34:54 LOG6[21]: Peer certificate not required 2022.07.26 14:35:24 LOG3[21]: SSL_accept: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.07.26 14:35:24 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/asn1_lib.c:308: 87315 allocations 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/tasn_new.c:136: 77533 allocations 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/asn1_lib.c:350: 70711 allocations 2022.07.26 14:37:21 LOG6[service]: Initializing inetd mode configuration 2022.07.26 14:37:21 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2022.07.26 14:37:21 LOG5[service]: UTF-8 byte order mark detected 2022.07.26 14:37:21 LOG5[service]: FIPS mode disabled 2022.07.26 14:37:21 LOG6[service]: Compression enabled: 0 methods 2022.07.26 14:37:21 LOG6[service]: Initializing service [POP3 Incoming] 2022.07.26 14:37:21 LOG6[service]: User-specified security level set: 0 2022.07.26 14:37:21 LOG6[service]: Session resumption enabled 2022.07.26 14:37:21 LOG6[service]: Loading certificate from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Certificate loaded from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Loading private key from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Private key loaded from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 1999 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: O=Entrust.net<http://o=entrust.net/>, OU=www.entrust.net/CPS_2048<http://ou=www.entrust.net/CPS_2048> incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net<http://entrust.net/> Limited, CN=Entrust.net<http://cn=entrust.net/> Certification Authority (2048) 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=www.entrust.net/CPS<http://ou=www.entrust.net/CPS> is incorporated by reference, OU="(c) 2006 Entrust, Inc.", CN=Entrust Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O=SECOM Trust.net<http://trust.net/>, OU=Security Communication RootCA1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FI, O=Sonera, CN=Sonera Class2 CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org<http://ou=http//www.chambersign.org>, CN=Chambers of Commerce Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org<http://ou=http//www.chambersign.org>, CN=Global Chambersign Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, OU=www.xrampsecurity.com<http://ou=www.xrampsecurity.com/>, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="The Go Daddy Group, Inc.", OU=Go Daddy Class 2 Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Starfield Technologies, Inc.", OU=Starfield Class 2 Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=Government Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Assured ID Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Global Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert High Assurance EV Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Class 2 Primary CA 2022.07.26 14:37:21 LOG6[service]: Client CA: O=Digital Signature Trust Co., CN=DST Root CA X3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Digital Signature Trust, OU=DST ACES, CN=DST ACES CA X6 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2006 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G5 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=SecureTrust Corporation, CN=SecureTrust CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=SecureTrust Corporation, CN=Secure Global CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security Communication EV RootCA1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Dhimyotis, CN=Certigna 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: O="Cybertrust, Inc", CN=Cybertrust Global Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O="Chunghwa Telecom Co., Ltd.", OU=ePKI Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=RO, O=certSIGN, OU=certSIGN ROOT CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU="(c) 2007 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2008 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., OU=(c) 2007 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2008 VeriSign, Inc. - For authorized use only", CN=VeriSign Universal Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2007 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HU, L=Budapest, O=NetLock Kft., OU=Tanúsítványkiadók (Certification Services), CN=NetLock Arany (Class Gold) Főtanúsítvány 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="Japan Certification Services, Inc.", CN=SecureSign RootCA11 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, emailAddress=info(a)e-szigno.hu 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=IZENPE S.A., CN=Izenpe.com<http://cn=izenpe.com/> 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, L=Madrid (see current address at www.camerfirma.com/address<http://www.camerfirma.com/address>), serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, L=Madrid (see current address at www.camerfirma.com/address<http://www.camerfirma.com/address>), serialNumber=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="GoDaddy.com<http://o="godaddy.com/>y.com, Inc.", CN=Go Daddy Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Services Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Commercial 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Networking 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certinomis, OU=0002 433998903<tel:0002%20433998903>, CN=Certinomis - Autorité Racine 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security Communication RootCA2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu https://www.catcert.net/verarrel (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2011 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, O=Trustis Limited, OU=Trustis FPS Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, emailAddress=pki(a)sk.ee 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı, C=TR, L=Ankara, O=TÜRKTRUST Bilgi İletişim ve Bilişim Güvenliği Hizmetleri A.Ş. (c) Aralık 2007 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009 2022.07.26 14:37:21 LOG6[service]: Client CA: emailAddress=contacto(a)procert.net.ve, L=Chacao, ST=Miranda, OU=Proveedor de Certificados PROCERT, O=Sistema Nacional de Certificacion Electronica, C=VE, CN=PSCProcert 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: O=TeliaSonera, CN=TeliaSonera Root CA v1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Ankara, O=E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., OU=E-Tugra Sertifikasyon Merkezi, CN=E-Tugra Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=Atos TrustedRoot 2011, O=Atos, C=DE 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Assured ID Root G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Assured ID Root G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Global Root G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Global Root G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Trusted Root G4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=CA 沃通根证书 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign ECC Root CA - R5, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden EV Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms<http://www.entrust.net/legal-terms>, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms<http://www.entrust.net/legal-terms>, OU="(c) 2012 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - EC1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Ankara, O=TÜRKTRUST Bilgi İletişim ve Bilişim Güvenliği Hizmetleri A.Ş., CN=TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certinomis, OU=0002 433998903<tel:0002%20433998903>, CN=Certinomis - Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=WISeKey, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GB CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=CA WoSign ECC Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR ROOT CA2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2015 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions ECC RootCA 2015 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Certplus Root CA G1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Certplus Root CA G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Internet Security Research Group, CN=ISRG Root X1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=LU, O=LuxTrust S.A., CN=LuxTrust Global Root 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Gebze - Kocaeli, O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK, OU=Kamu Sertifikasyon Merkezi - Kamu SM, CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 2022.07.26 14:37:21 LOG6[service]: DH initialization needed for DHE-DSS-AES256-GCM-SHA384 2022.07.26 14:37:21 LOG6[service]: Using dynamic DH parameters 2022.07.26 14:37:21 LOG5[service]: Configuration successful 2022.07.26 14:37:21 LOG7[service]: Deallocating deployed section defaults 2022.07.26 14:37:21 LOG7[service]: Deallocating section [POP3 Incoming] 2022.07.26 14:37:21 LOG7[service]: Deallocating section [SMTP Outgoing] 2022.07.26 14:37:21 LOG7[service]: Binding service [POP3 Incoming] 2022.07.26 14:37:21 LOG7[service]: Listening file descriptor created (FD=840) 2022.07.26 14:37:21 LOG7[service]: Setting accept socket options (FD=840) 2022.07.26 14:37:21 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2022.07.26 14:37:21 LOG6[service]: Service [POP3 Incoming] (FD=840) bound to 0.0.0.0:110 2022.07.26 14:37:29 LOG7[service]: Found 1 ready file descriptor(s) 2022.07.26 14:37:29 LOG7[service]: FD=664 ifds=r-x ofds=--- 2022.07.26 14:37:29 LOG7[service]: FD=840 ifds=r-x ofds=r-- 2022.07.26 14:37:29 LOG7[service]: Service [POP3 Incoming] accepted (FD=740) from 192.168.110.11:60596 2022.07.26 14:37:29 LOG7[service]: Creating a new thread 2022.07.26 14:37:29 LOG7[service]: New thread created 2022.07.26 14:37:29 LOG7[22]: Service [POP3 Incoming] started 2022.07.26 14:37:29 LOG7[22]: Setting local socket options (FD=740) 2022.07.26 14:37:29 LOG7[22]: Option TCP_NODELAY set on local socket 2022.07.26 14:37:29 LOG5[22]: Service [POP3 Incoming] accepted connection from 192.168.110.11:60596 2022.07.26 14:37:29 LOG6[22]: Peer certificate not required 2022.07.26 14:37:29 LOG7[22]: TLS state (accept): before SSL initialization 2022.07.26 14:37:59 LOG7[22]: TLS alert (write): fatal: decode error 2022.07.26 14:37:59 LOG3[22]: SSL_accept: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.07.26 14:37:59 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2022.07.26 14:37:59 LOG7[22]: Local descriptor (FD=740) closed 2022.07.26 14:37:59 LOG7[22]: Service [POP3 Incoming] finished (0 left) Config: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log log = overwrite ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;sslVersion = all sslVersionMax=TLSv1.3 sslVersionMin=TLSv1.2 sslVersion = TLSv1.2 sslVersion = TLSv1.3 ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ciphers = ALL ;ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:AES128-GCM-SHA256 options = CIPHER_SERVER_PREFERENCE cert = stunnel.pem CAfile = ca-certs.pem OCSPaia = no verify = 0 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services ;[POP3 Incoming] ;client = yes ;accept = 110 ;connect = outlook.office365.com:995 ;verifyChain = yes ;CAfile = ca-certs.pem ;checkHost = outlook.office365.com<http://outlook.office365.com/> ;OCSPaia = yes [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 ;[SMTP Outgoing] ;accept = 25 ;connect = smtp.office365.com:587 ;[SMTP Outgoing] ;client = yes ;accept = 25 ;protocol = smtp ;connect = smtp.office365.com:587 ;verifyChain = yes ;CAfile = ca-certs.pem ;checkHost = smtp.office365.com<http://smtp.office365.com/> ;OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini Met vriendelijke groeten, Martijn Strunk Laan van de Ram 59 06 - 13 10 67 62 7324 BW APELDOORN M.Strunk(a)mulderconnect.nl 055 - 303 12 34 www.mulderconnect.nl Mulder Connect is een onderdeel van Mulder Systems, specialist op het gebied van elektrotechniek, data-infra, IT, telecommunicatie, beveiliging en duurzame technieken. Disclaimer Deze E-mail en alle daarbij meegestuurde bijlagen zijn uitsluitend bestemd voor geadresseerde(n). Verstrekking aan en gebruik door anderen is niet toegestaan. Mulder Systems sluit iedere aansprakelijkheid uit die voortvloeit uit elektronische verzending. This E-mail and any attachment sent with it are intended exclusively for the addressee(s), and may not be passed on to, or made available for use by any person other than the addressee(s). Mulder Systems rules out any and every liability resulting from any electronic transmission.

1 0

Enter-passphrase dialog broken
by Johann Hörmann 15 Aug '22

15 Aug '22

Hi, since stunnel 5.62 it does not take the passphrase for a client key anymore, instead it gives a 'bad decrypt' log at once. It is the same behaviour at Debian/sid Distro as well as with Windows10. Up to stunnel 5.61 the same stunnel.conf is accepted and the key gets loaded. Here is the top of our stunnel.conf: cert = /home/regula/cert.pem key = /home/regula/cert.key client = yes [-- snip --] Calling stunnel at the bash: $ stunnel stunnel.conf [-- snip --] [ ] Loading certificate from file: /home/regula/cert.pem [ ] Certificate loaded from file: /home/regula/cert.pem [ ] Loading private key from file: /home/regula/cert.key [!] error queue: ../ssl/ssl_rsa.c:384: error:0A080009:SSL routines::PEM lib [!] error queue: ../crypto/pkcs12/p12_decr.c:86: error:11800074:PKCS12 routines::pkcs12 cipherfinal error [!] error queue: ../providers/implementations/ciphers/ciphercommon_block.c:124: error:1C800064:Provider routines::bad decrypt [!] error queue: ../crypto/pkcs12/p12_decr.c:86: error:11800074:PKCS12 routines::pkcs12 cipherfinal error [!] SSL_CTX_use_PrivateKey_file: ../providers/implementations/ciphers/ciphercommon_block.c:124: error:1C800064:Provider routines::bad decrypt [!] Service [guacamole]: Failed to initialize TLS context [!] Configuration failed [-- snip --] $ ls -lh *pem *key -r-------- 1 regula regula 3,4K 22. Jun 16:52 cert.key -r-------- 1 regula regula 2,2K 22. Jun 16:45 cert.pem openssl does show the enter passphrase dialog and displays the private key: $ $ openssl rsa -in cert.key Enter pass phrase for cert.key: writing RSA key -----BEGIN PRIVATE KEY----- [-- snip --] -----END PRIVATE KEY----- ~$ dpkg -l|grep openssl ii openssl 3.0.4-2 amd64 Secure Sockets Layer toolkit - cryptographic utility ~$ dpkg -l|grep stunnel ii stunnel4 3:5.63-1+b1 amd64 Universal SSL tunnel for network daemons Why is there a different behaviour between openssl and stunnel > 5.61 in loading a private key file? Regards, Johann -- https://www.hoermann-solutions.com

2 1

RTMP Stream from Milesight Camera to RTMPS server through stunnel
by nxcloudtest2021＠gmail.com 11 Aug '22

11 Aug '22

I am new to Stunnel and I would like to know how to push my RTMP Milesight Camera stream to Stunnel and then push it to my RTMP stream site here: rtmps://stream.mywebsite.com:1936/static/KI I tried modifying the method that would push a stream to nginx, then Stunnel, then Facebook, but it doesn't work for me. May I know what steps I should take to push my RTMP Milesight stream to Stunnel? Would nginx be necessary for this?

1 0

IMAP and SMTP user filtering
by snechiporus＠gmail.com 08 Aug '22

08 Aug '22

Hello all, I rebuilt Stunnel from source (Ubuntu 20.040 and now I am trying to add user filtering for IMAP and SMTP protocols. The purpose is following: I have non-SSL device that does not have permanent IP address (connected to mobile internet and its IP may change any time). This device should connect to Stunnel running on the server in Internet (not local network) to receive email from Gmail account. To prevent abuse I have to allow only one user (let's say, xxxxxx(a)gmail.com) to connect to my Stunnel instance. Is it possible? What part of code should I modify? Thank you

1 0

stunnel to the computer's IP address works, 127.0.0.1 fails
by Alan C. Bonnici 06 Aug '22

06 Aug '22

Hi, I setup a newly installed Windows 10 computer with STunnel. The same exact command using the IP address of the computer (eg 192.168.1.xxx) works while 127.0.0.1 fails. The config is set to listen on port only. What could be the problem? Thanks

1 0

Windows capi engine clarification
by raduci＠gmail.com 04 Aug '22

04 Aug '22

Dear all, I have a question related to capi engine: if stunnel is installed on a windows machine and capi tunnel is selected, which certificate is used to connect to secured server? Stunnel server machine certificate or client's certificate connecting through stunnel server? thank you!

1 0

Re: stunnel 5.65 released
by Jeff WIeland 02 Aug '22

02 Aug '22

Dennis Preiser wrote: > > On Mon, Jul 18, 2022 at 09:09:54AM +0200, Dennis Preiser wrote: >> On Sun, Jul 17, 2022 at 09:55:05PM +0200, Michał Trojnara via stunnel-users wrote: >>> I have released version 5.65 of stunnel. >> Unfortunately, it does not build here: >> >> | client.c:1514:11: error: use of undeclared identifier 'environ' >> >> I think this is caused by the following change in src/client.c (5.64 -> >> 5.65): >> >> | @@ -1396,7 +1399,9 @@ NOEXPORT SOCKET connect_local(CLI *c) { >> | >> | #else /* standard Unix version */ >> | >> | +#ifndef HAVE_UNISTD_H >> | extern char **environ; >> | +#endif >> | >> | NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ >> | int fd[2], pid; >> >> unistd.h is present on the system and thus HAVE_UNISTD_H is defined: >> >> | % grep 'HAVE_UNISTD_H' src/config.h >> | #define HAVE_UNISTD_H 1 >> >> My system: >> >> | % sw_vers >> | ProductName: macOS >> | ProductVersion: 12.4 >> | BuildVersion: 21F79 > Is there any chance this will be fixed? > > Dennis > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org I have the same problem with Solaris 10 on SPARC. -- Jeff Wieland, UNIX Systems Administrator Purdue University IT Infrastructure Services UNIX Platforms

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users