stunnel-users

1 participants
3311 discussions

Weird verify behaviour using intermediate CAs
by Simon Vallet 05 Oct '09

05 Oct '09

Hi, we're trying to make use of stunnel here for proxy purposes : any certificate-authenticated SSL client connection from the Internet would be forwarded to some internal server. This works fine, but I found some surprising behaviour when verifying client certificates. Consider the following setup, using an intermediate client CA : * RootCA ** UserCA1 *** UserCert1 ** UserCA2 *** UserCert2 To make this work, it seems I only have to include the Root CA certificate in either a CAfile or a directory of trusted certificates. I would have expected to have to include the intermediate CA (which is signing the user certificate), but it seems it is not the case. What worries me is that now *any* end-entity certificate which has been issued by *other* intermediate CAs is accepted as valid, i.e. UserCert2 is accepted as valid, even if I don't include UserCA2 anywhere in the configuration. Is this really the intended behaviour ? If not, what would I be missing ? Simon stunnel.conf ----------------------------------------------------------- connect = 127.0.0.1:25 CApath = /etc/stunnel/certs cert = /etc/stunnel/apollon.genoscope.cns.fr-RevChain.pem key = /etc/stunnel/apollon.genoscope.cns.fr-Key.pem verify = 2 debug = 7 ------------------------------------------------------------------------ [root@apollon certs]# ls -l /etc/stunnel/certs/ total 4 lrwxrwxrwx 1 root root 28 sep 30 11:01 9a5490ff.0 -> GenoscopeACRacine.cacert.pem -rw-r--r-- 1 root root 2269 sep 15 11:47 GenoscopeACRacine.cacert.pem [root@apollon certs]#

2 6

Looking for someone to install Stunnel on my server
by Nathan Mueller 02 Oct '09

02 Oct '09

I am looking to hire someone to install Stunnel (and openSSL) on my Media Temple DV account. Please send hourly rate and how long you think it would take to: nmueller(a)g.risd.edu Thank you for your time, Nate

1 0

Advanced Config Question-
by Dave Fazio 01 Oct '09

01 Oct '09

Group, Need help confirming Stunnel can be configured the following way: I have a server that has 5 local IPs, mapping to 5 public IPs on the outside. For example purposes, my local IPs are "A", "B", "C", "D", and "E"... If I connect to a stunnel port configured to "C", will Stunnel route the request outbound on "C" or will it use "A" outbound? The way I have it configured, it's using "A" apparently, no matter what local stunnel IP I bind my connection to. And help will be greatly appreciated. - Dave Windows Server 2003 64-bit Stunnel as a Service Example Config: [Connection-A] accept = 10.5.12.57:9000 connect = outbound.example.server:145 TIMEOUTidle = 4 [Connection-B] accept = 10.5.12.58:9005 connect = outbound.example.server:145 TIMEOUTidle = 4

2 2

SMTP AUTH with stunnel?
by conover＠rahul.net 30 Sep '09

30 Sep '09

Can stunnel be used for a local smtp server, that does not support upstream SMTP AUTH, to connect to an smtp server that requires it? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

2 1

Problems implementing certificate
by Marcelo Iturbe 15 Sep '09

15 Sep '09

Hello, I am using Stunnel 4.27 binary version on Windows 2003 server. In the stunnel.pam file I did the following: In the -----BEGIN RSA PRIVATE KEY----- section, I placed the same text that appeared in the -----BEGIN NEW CERTIFICATE REQUEST----- when I purchased the certificate In the -----BEGIN CERTIFICATE----- section I placed what verisign returned to me. When I try to load Stunnel I get the following error messages: : RAND_status claims sufficient entropy for the PRNG : PRNG seeded successfully : SSL context initialized for service gmail-pop3s : Certificate: stunnel.pem : Error reading certificate file: stunnel.pem : error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib : error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib : error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error : error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error : SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag : Server is down Any thoughts as to where I went wrong? Thanks for your help

1 0

Re: [stunnel-users] Stunnel Certificate generation
by Alaric Dailey 10 Sep '09

10 Sep '09

You can modify your stunnel.conf, there are lots of examples on the web to do that. Please don't use self-signed certs, you will have no end of issues, and there is NO reason to. StartCom offers free certificates, is in most browsers now, and will be included in IE by the end of September. http://blog.startcom.org/?p=205 So why would you create the headaches of using self-signed certs? Original Message ----------------------- Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Stunnel Certificate generation
by Matty Ronald 09 Sep '09

09 Sep '09

Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty

1 0

using stunnel in HP UX 11i v3
by Mostafa Arab 09 Sep '09

09 Sep '09

Hi Sorry for my question because it is too elementary but I need some help. I want to use stunnel for one of our projects on an HP Itanium server that have HP UX 11i v3 This is result for #uname –a command : HP-UX xxxxx B.11.31 U ia64 2210092972 unlimited-user license I want to start stunnel as client . I found an stunnel in ‘/opt/hpws/apache’ folder. 1- May I use this stunnel for my project? 2- If it is possible how I can start it ? I added one line to /etc/services and tried to start : stunnel –d …. (according to a document) .But it seems that this version don’t support this option. Best Regards, Mostafa

2 1

Maximum number of services
by Malenfant, Andre 04 Sep '09

04 Sep '09

Hi, we have ran into a problem and we have identified that we have reached the limit of 64 services in stunnel. I have seen some info on the net for a possibility or increasing that limit to 256 using the poll() method. There is a patch available for that but for an older version of stunnel. Is there a configuration that I can do to enable that on version 4.20? If not, what are my other options? Set-up a second stunnel? Thanks André

1 0

Re: [stunnel-users] Random Client Ports
by Ludolf Holzheid 02 Sep '09

02 Sep '09

On Wed, 2009-09-02 16:22:35 +0200, Reinier van der Gugten wrote: > I included STunnel in a VB application, and want to start it using the shell command (how else?) > If I start STunnel from the commandline (dos box) it works fine (stunnel\stunnel.exe) > However from within code I get an error: > > Dim MyProcID As Integer = 0 > MyProcID = Shell("Stunnel\STunnel") > stunnel.conf: No such file or directory (2) Reinier, This says, stunnel is found and started by the system, but stunnel does not find stunnel.conf. Maybe it doesn't correctly determine it's own location in relation to the working directory. You might try to specify stunnel.conf on the command line, e.g. MyProcID = Shell("stunnel\stunnel stunnel\stunnel.conf") or MyProcID = Shell("stunnel\stunnel .\stunnel.conf") or something along those lines. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users