- stunnel-users - stunnel.org

OCSPflag not processed in ocsp_stapling() ?
by King's Way 01 Dec '25

01 Dec '25

Hi there, I was trying to make stunnel ignore OCSP verification error for local certificates when doing OCSP Stapling. But it seems the flag "OCSPflag = NOVERIFY" is not properly passed to openssl. I have tried to patch it in function ocsp_stapling(), and it worked. But I wonder whether it is a bug or intentionally designed this way? With kind regards！ ------------------------------------------------------------ King's Way <io[AT]stdio.io<http://stdio.io>>

1 0

Getting Started - Unique Situation
by Kevin Morris 21 Nov '25

21 Nov '25

Hi All! About me: I've never heard of stunnel before but it sounds great. I'm not a networking/internet expert. Here is my situation: Platform: Microsoft Windows Server 2016. Two Network Interface Cards. Port 443 on both currently have HTTPS/TCP traffic on them, from two different Web Apps, each with their own domain. Everything is working properly, traffic is very low, only a few (about 20) hits per minute (each port) at max load. Both Web Apps are built using Lazarus, Free Pascal, Brook Framework. The Brook Framework has the built-in ability to handle SSL/TLS encryption. Certs are supplied by Let's Encrypt, and new certs are obtained by a bot. I now have a third and soon a forth Web App built using the same technology, but my only two 443 ports are occupied. Here is my requirement: I need something that will act as a "port splitter". Maybe this is also known as a reverse proxy. Example: Incoming URLs on port 443: https://mywebapp.companyname.com/bob/useraccount?act=login&exp=pg https://mywebapp.companyname.com/betty/useraccount?act=login&exp=pg The port splitter needs to recognize the part in teal green (maybe called an "entry point"?), and pass that unchanged traffic through to (and from) a port that the associated Web App is listening on. WebApp "bob" is listening on local port 449 (not exposed to the internet, only conversing with stunnel) WebApp "betty" is listening on local port 451 (not exposed to the internet, only conversing with stunnel) Both Web Apps will send/receive their own HTTPS traffic, handle their own decryption/encryption, and send it back through their respective listening ports, through the port splitter, back the the requesting user. No load balancing is required. No decryption/encryption/certs is/are required. This needs to happen downstream from our router, without making any changes to OS rules or router settings. I'd like to just shut down the current Web App listening on port 443, reconfig it to a new local port As I looked through the FAQ and manual, I could not determine if stunnel could do this. So my questions are: A) Can stunnel do this? B) If so, is there a "How To" I missed in the manual I can read to do this? C) If ((A = Yes) and B = No)), can you tell me in a couple sentences where to look in the config file to do some reading and get this set up? If we can get this working, there are other Lazarus/Brook developers who could benefit from using stunnel. If stunnel is not the answer, is there another "port splitter" piece of software that you know of that can? (other than IIS with ARR and WAP, I don't want to use those, I'm slowly trying to de-Microsoft my infrastructure.) Thanks in advance!

2 1

+=item B<requireCert> = yes | no ignored when client = yes
by u34＠net9.cf 13 Nov '25

13 Nov '25

In my opinion, the following emphasis worth including: --- stunnel.pod.in.orig 2025-10-07 19:50:30.097392645 +0000 +++ stunnel.pod.in.new 2025-10-07 20:25:54.448391940 +0000 @@ -1065,6 +1065,8 @@ =item B<requireCert> = yes | no +Ignored when client = yes. + require a client certificate for I<verifyChain> or I<verifyPeer> With I<requireCert> set to I<no>, the B<stunnel> server accepts client

2 1

stunnel 5.76 core dumped
by Bogdan Siara 02 Nov '25

02 Nov '25

Hi, I try to run stunnel with certs from hardware token and I get error: root@c6b200207f1a:/stunnel-5.76# stunnel free(): invalid pointer Aborted (core dumped) This is my configuration: engine = pkcs11 engineCtrl = MODULE_PATH:/usr/lib/libeToken.so engineCtrl = PIN:pin output = /var/log/stunnel.log debug=debug [in-hdt] client=no accept = 172.18.1.2:443 connect=127.0.0.1:8080 cert = /etc/stunnel/certs/hdt.pem key = /etc/stunnel/certs/hdt.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [in-vpc] client=no accept = 172.18.2.2:443 connect=127.0.0.1:8081 cert = /etc/stunnel/certs/vpc.pem key = /etc/stunnel/certs/vpc.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [in-iam] client=no accept = 172.18.3.2:443 connect=127.0.0.1:8082 cert = /etc/stunnel/certs/iam.pem key = /etc/stunnel/certs/iam.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-hdt] client=yes accept=8080 connect=ip1:443 engineId=pkcs11 sni = hdt cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-vpc] client=yes accept=8081 connect=ip2:443 engineId=pkcs11 sni = vpc cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-iam] client=yes accept=8082 connect=ip3:443 engineId=pkcs11 sni = iam cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug When I try run in gdb: root@c6b200207f1a:/stunnel-5.76# gdb stunnel GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from stunnel... (gdb) r Starting program: /usr/local/bin/stunnel [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [New Thread 0x7ffff789f640 (LWP 4875)] [Thread 0x7ffff789f640 (LWP 4875) exited] [New Thread 0x7ffff789f640 (LWP 4876)] [New Thread 0x7ffff6c78640 (LWP 4878)] free(): invalid pointer Thread 1 "stunnel" received signal SIGABRT, Aborted. __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737346406208) at ./nptl/pthread_kill.c:44 44 ./nptl/pthread_kill.c: No such file or directory. (gdb) stunnel is running in docker container ubuntu:22.04 Can someone tell where is the problem? Regards BS

1 0

Was LOG3[per-minute]: OCSP: SSL_get_certificate for a shared secret, PSK, configuration fixed with 5.76?
by u34＠net9.cf 01 Nov '25

01 Nov '25

Hello, At [stunnel 5.76 released](https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@st… - Missing OCSP stapling is no longer logged as an error. was mentioned in Bugfixes. My understanding is [LOG3[per-minute]: OCSP: SSL_get_certificate](https://www.stunnel.org/mailman3/hyperkitty/list/stunn… is fixed. But it isn't.

1 0

Should remote host IPs recorded at lower debug levels too?
by u34＠net9.cf 21 Oct '25

21 Oct '25

Does recording the IPs of the remote host depends on other configuration directives, other then the debug directive? Is it correct that at LOG5, IPs of the remote host are recorded at the log file? Is it correct that at LOG3, no IPs are recorded even when other information for a particular connection is considered worth recording? Aren't IPs considered important information worth recording when error conditions are recorded?

1 0

stunnel 5.76 released
by Michał Trojnara 18 Oct '25

18 Oct '25

Dear Users, I have released version 5.76 of stunnel. ### Version 5.76, 2025.10.18, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.4. - Service-level multivalued options now override (rather than append to) global defaults, preventing unintended configurations. * Bugfixes - Fixed enabling/disabling of the default fips=yes property. - Missing OCSP stapling is no longer logged as an error. - Fixed a crash when a PIN was required due to the PKCS#11 CKA_ALWAYS_AUTHENTICATE attribute. * Features - Quantum-resistant hybrid key agreement X25519+ML-KEM-768 (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3. - Multiple cert sources are supported, allowing a certificate to be fetched from a provider while loading the chain from a file. - Android build switched to a 16 KB page size. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: cda37eb4d0fb1e129718ed27ad77b5735e899394ce040bb2be28bbb937fd79e1 stunnel-5.76.tar.gz d93c7c01366d38ebd27689d606e45197ba8e2e2a32d1a186a81d2b01186bfb56 stunnel-5.76-win64-installer.exe f081281c92f6dc245e23d57930f3963d0155a9fc4a707b7414c941e8e60a1957 stunnel-5.76-android.zip Best regards, Mike

1 0

LOG3[per-minute]: OCSP: SSL_get_certificate
by u34＠net9.cf 15 Oct '25

15 Oct '25

With stunnel version 5.74 and debug = 3 foreground = yes setgid = abcde setuid = abcde output = /path/to/log/file [service] PSKsecrets = /path/to/secretfile accept = ip1:port1 connect = ip2:port1 debug = 3 setgid = abcde setuid = abcde This configuration looks to me similar to the [shell] option from the configuration examples. There is a 1 per minute LOG3[per-minute]: OCSP: SSL_get_certificate line at the log file. Does it a bug? This wasn't discussed 3 weeks ago at [How to get rid of "No OCSP stapling response received" warning?](https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@st…, was it?

1 0

Client mode certificate pinning
by Ian Pilcher 11 Oct '25

11 Oct '25

Is $SUBJECT possible? I use stunnel to connect to my old "smart" switches that don't support modern TLS protocols, ciphers, etc. Recently, their existing certificates all expired, and I tried to install new certificates on all of them, only to discover that they won't accept my new CA certificate, because it was signed with a 3072-bit key. I could go through the trouble of generating a separate CA certificate with a 2048-bit key, sign new certificates with that key, etc., etc., but it starts to seem a bit silly at that point. Far better to simply generate a self-signed certificate for each switch and configure stunnel to only accept that particular certificate (i.e. "pin" it). Is this possible with stunnel? If so, how would I go about configuring it to do this? (Search engines are telling me to use "verify = 4", but stunnel(8) says that option is obsolete.) TIA! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

2 1

How to get rid of "No OCSP stapling response received" warning?
by Ian Pilcher 25 Sep '25

25 Sep '25

I use stunnel to connect to my old "smart" switches from modern browsers. Here is a subset of the configuration for one of the switches. [switch1-frontend] sni = frontend:switch1.penurio.us CAfile = /etc/ipa/ca.crt cert = /etc/pki/tls/certs/stunnel/switch1.crt key = /tmp/keys/switch1.key connect = 127.255.255.254:8081 [switch1-backend] client = yes accept = 127.255.255.254:8081 connect = 172.31.4.1:443 verifyChain = yes checkHost = switch1.penurio.us CAfile = /etc/ipa/ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 0 OCSPrequire = no OCSPaia = no Everything works, execept that every connection produces a bright red warning in my log: OCSP: No OCSP stapling response received I've read up on OCSP stapling, that this seems to mean that the switch isn't including an OCSP response in its TLS handshake. (Hardly surprising, given its age.) How can I tell stunnel to not request/expect an OCSP response from the switch (or at least to not log the missing OCSP response as a warning)? -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

4 5

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel, Gmail and Outlook Express
by landjonline＠hotmail.com 01 Sep '25

01 Sep '25

I have Outlook Express and my email addresses are Gmail. Is there a way to get Gmail to work with Outlook Express using Stunnel? Thanks

2 1

Using CAStore on Android (stunnel.conf)
by smf.forum1＠ntlworld.com 31 Jul '25

31 Jul '25

I have build stunnel with a few changes to run in a QThread (Qt 6.9.1) for Android. My Qt App starts stunnel at the start of execution and stops it when my Qt application exits. This all works fine (I need to review and clean up my stunnel changes before I use my solution for real) but I cannot get certification to work, here are two test runs one with verify set to 0 (works) and verify set to 2 (fails). What needs to change in my stunnel.conf file ? Thanks. (obfuscated details) stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 0 Works: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b640 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] needs authentication to prevent MITM attacks I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=117) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:36802 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:58660 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate not required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: OCSP: Certificate chain verification disabled I/stunnel : LOG6[0]: TLS connected: new session negotiated I/stunnel : LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) I/stunnel : LOG6[0]: Peer temporary key: X25519, 253 bits I/stunnel : LOG6[0]: Session id: 90DD6325CCBC47C3F8F560C36F76755B4959E6A8421DD97B751E37FDD1DCCAC7 I/stunnel : LOG6[0]: Session id: 24345E21753FE3B254CA089FB7621C1481B523E72EB9571DDF7A366B5E89E834 stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 2 Fails: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b0a0 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] uses "verifyChain" without subject checks W/stunnel : LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=114) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:39238 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:59154 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[0]: CERT: Pre-verification error: certificate not found in local repository: self-signed certificate W/stunnel : LOG4[0]: Rejected by CERT at depth=0: C=PL, ST=Mazovia Province, L=Warsaw, O=Stunnel Developers, OU=Provisional CA, CN=localhost E/stunnel : LOG3[0]: SSL_connect: tls_post_process_server_certificate@ssl/statem/statem_clnt.c:1890: error:0A000086:SSL routines::certificate verify failed I/stunnel : LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket I/stunnel : LOG6[ui]: Child process 17669 finished with code 0

1 0

Android Stunnel 64bit version
by emxacademy＠gmail.com 19 Jul '25

19 Jul '25

Hello everyone, I've been searching online but still haven’t found a clear or working method to build a 64-bit version of the Android stunnel executable. Since most Android devices now run on 64-bit architecture, the 32-bit version available on the official website no longer works on many phones. If anyone has experience with this or can guide me through the proper way to compile a 64-bit version, I’d really appreciate your help. Thanks in advance!

1 0

Error message when trying to set Stunnel as a start up app
by Edward Smithson 18 Jul '25

18 Jul '25

Hello Stunnel mailing list, We are trying to set Stunnel (5.75) to automatically open as a start up app on Windows 11. When the PC powers up, it gives this error message: stunnel.exe - System Error The code execution cannot proceed because libcrypto-3-x64.dll was not found. Reinstalling the program may fix this problem. We have tried reinstalling, but to no avail. NB, Stunnel works fine if opened manually. This was not an issue with Windows 10. Has anyone else had this problem (and solved it)? Many thanks, Ed Smithson Ed Smithson Reader Services Librarian Nuffield College, Oxford, OX1 1NF +44(0) 1865 278551 [cid:[email protected]]<https://bsky.app/profile/nuffieldlibrary.bsky.social>[cid:[email protected]]<https://www.facebook.com/NuffieldCollegeLibrary>[cid:[email protected]]<https://www.instagram.com/nuffieldlibrary/> [cid:[email protected]]<https://www.nuffield.ox.ac.uk/>

5 6

stunnel with aurora postgreSQL
by Grube, Rolf | Oberender AG 25 Jun '25

25 Jun '25

Hi everybody, Does anybody has already established a connection to AWS aurora postgreSQL with stunnel? I cant establish a connection and it may be an issue with channel binding. My config looks like this: ; Sample stunnel configuration file for Win64 by Michal Trojnara 1998-2025 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance fips = yes ; The CNG engine allows to integrate stunnel with the Windows Cryptography API: ; Next Generation (CNG) for authentication with private keys stored in the ; Windows certificate store. It serves as a drop-in replacement for the legacy ; OpenSSL Cryptography API (CAPI) engine. ; https://www.stunnel.org/cng-engine.html ; Each section using this feature also needs the "engineId = cng" option engine = cng ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** [postgreSQL_TLS] client = yes ;engineId = cng accept = 5433 connect = xxx.rds.amazonaws.com:5432 protocol = pgsql CAfile = C:\cert\xxx-bundle.pem verifyChain = yes checkHost = xxx.rds.amazonaws.com Thanks for any recommendations. Best regards Rolf Grube, MBA Senior Manager <https://www.credly.com/badges/443267d6-0d25-4fc3-9eee-f9654f6f3ee1/public_u rl> Oberender AG Elsenheimerstraße 59 | 80687 München t: +49 89 8207516-0 | m: +49 173 2035 133 <mailto:[email protected]> rolf.grube(a)oberender.com <http://www.oberender.com/> www.oberender.com Vorsitzender des Aufsichtsrats: Dipl.-Volkswirtin Irmtraut Gürkan Vorstand: Jan Hacker (Vorsitzender), Jochen Baierlein Handelsregister: Amtsgericht Bayreuth, HRB 4267 Sitz der Gesellschaft: Bayreuth Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren, sowie die unbefugte Weitergabe dieser Mail sind nicht gestattet.

1 0

Duplicate Received trusted client CA messages
by Sean Burford 18 Jun '25

18 Jun '25

Hi, While configuring stunnel to connect as a client to a TLS server that requires client certificate auth (known as mutual TLS auth), I noticed that each new connection generates lots (up to hundreds) of duplicate logs like: 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA I expect one log per trusted client CA provided by the server. Openssl s_client -msg shows that the server only sends a small CertificateRequest. Stunnel logs show that only one connection is made. This only happens if the server offers exactly one trusted client CA. If multiple client CA options are offered by the server then a single log entry is recorded for each. What appears to be happening is that OpenSSL’s state machine generates lots of info callbacks (the number depends on latency). This appears to be harmless except for the excessive logging. I’m running stunnel 5.75 against OpenSSL 3.5.0 (compiled with enable-weak-ssl-ciphers, enable-ssl3 and enable-ssl3-method): $ stunnel [ ] Initializing inetd mode configuration [ ] Clients allowed=125 [.] stunnel 5.75 on sparc-sun-solaris2.10 platform [.] Compiled/running with OpenSSL 3.5.0 8 Apr 2025 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*(___errno())) … $ openssl version OpenSSL 3.5.0 8 Apr 2025 (Library: OpenSSL 3.5.0 8 Apr 2025) This is probably NOT caused by an OpenSSL 3.5.0 behaviour change, I also see duplicate messages from the public stunnel build running on Windows: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.74 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.3.2 3 Sep 2024 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) To diagnose this further, I modified stunnel src/ctx.c info_callback() to log the TLS state in callbacks: //#if 0 // s_log(LOG_DEBUG, "state = %x", state); state_string=SSL_state_string_long(ssl); s_log(LOG_DEBUG, "TLS state (where %08X state %08X): %s", where, state, state_string); //#endif This shows that there are many callbacks from where SSL_CB_ACCEPT_EXIT and one final callback from SSL_CB_ACCEPT_LOOP: 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001001 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate request Modifying info_callback to look for SSL_CB_LOOP in where suppresses the excess messages: /* log the client certificate request (if received) */ #ifndef SSL3_ST_CR_CERT_REQ_A if(state==TLS_ST_CR_CERT_REQ && *where & SSL_CB_LOOP*) #else if(state==SSL3_ST_CR_CERT_REQ_A && *where & SSL_CB_LOOP*) #endif print_CA_list("Received trusted client CA", SSL_get_client_CA_list(ssl)); Here’s my config: debug=info [outbound-http-to-https-mtls] accept = 127.0.0.1:8447 connect = 127.0.0.1:8445 client = yes ; verify 2 - verify peer certificate chain verify = 2 sni = www.example.com checkHost = www.example.com verifyChain = yes CAfile = /export/home/user/stunnel/trusted-ca-certs.pem ; Authenticate ourselves to peer using a client certificate. cert = /export/home/user/stunnel/user.ecdsa-p256.pem key = /export/home/user/stunnel/user.ecdsa-p256.key -- Thanks, Sean Burford

1 0

[PATCH 0/3] Improve stunnel performance by ~17%
by Edwin Torok 12 Jun '25

12 Jun '25

Hello, Flamegraph profiling on stunnel has shown that most time is NOT spent in encryption/decryption, but in sending/receiving data. Experimental setup: ``` CPU: 2x 18-core Intel Xeon Gold 6354 NIC: Intel E810-XXV, 100 Gbit/s Kernel: 6.14.8-300.fc42.x86_64 x86_64 Mem: 251.32 GiB OS: Fedora Linux 42 openssl version: OpenSSL 3.2.4 11 Feb 2025 (Library: OpenSSL 3.2.4 11 Feb 2025) stunnel: 5.75 from git ``` Network, encryption and memory copy speeds converted into Gbit/s on the above HW: ``` iperf3: 40Gbit/s openssl speed -evp aes-256-gcm: 72Gbit/s perf bench memcpy: 100Gbit/s ``` Under ideal conditions we should be able to achieve at most ~20.5Gbit/s, however I only measured ~7.6Gbit/s. The scripts that I used to perform measurements are included in the attached patch 3. See also related discussion on curl: https://github.com/curl/curl/pull/17548 Enabling readahead, avoiding excessive alloc/free of buffers, increasing buffer sizes, and improving buffer handling can all improve performance. For now I'm sending just the first small patches as proofs of concept, each of them one-liners. I hope you can include these in some form in the next release. Eventually these should probably be exposed as configuration flags in stunnel.conf, I can help implementing that, or I can leave implementing that to you if you prefer. In fact readahead was enabled in previous versions of stunnel, and then disabled again, so I assume you ran into some bugs with it on certain protocols? Increasing the buffer size is not a clear win (as with curl), due to the excessive use of memmove/memset, and that SSL_read/SSL_write only still processes 1 TLS record at a time. I have some further changes that can improve that, but the patches are larger and I haven't finished testing them for correctness yet. Please let me know if you'd want these as patches, or if you'd rather implement them yourself. Edwin Török (3): openssl: enable readahead openssl: disable SSL_MODE_RELEASE_BUFFERS Benchmark scripts src/ctx.c | 5 +- tests/benchmark/benchmark.sh | 120 +++++++++++++++++++++++ tests/benchmark/launch.sh | 185 +++++++++++++++++++++++++++++++++++ 3 files changed, 309 insertions(+), 1 deletion(-) create mode 100644 tests/benchmark/benchmark.sh create mode 100755 tests/benchmark/launch.sh -- 2.43.5

4 6

Is TLS 1.2 supported with stunnel 5.01
by joverton＠vital-soft.com 02 Jun '25

02 Jun '25

I have searched online, but was unable to fine any definitive answer on the minimum version of stunnel required for TLS 1.2. I have a client using stunnel 5.01 with our solution and they want to activate TLS 1.2. Their setup looks like this: 2014.05.15 13:38:22 LOG5[10132]: stunnel 5.01 on x86-pc-msvc-1500 platform 2014.05.15 13:38:22 LOG5[10132]: Compiled/running with OpenSSL 1.0.1g-fips 7 Apr 2014 2014.05.15 13:38:22 LOG5[10132]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2014.05.15 13:38:22 LOG5[10132]: Reading configuration from file stunnel.conf 2014.05.15 13:38:22 LOG5[10132]: FIPS mode disabled 2014.05.15 13:38:22 LOG5[10132]: Configuration successful Everything works fine without requiring TLS 1.2, but when that is required, we get the following error: 2025.05.14 07:04:45 LOG7[3796]: SSL state (connect): before/connect initialization 2025.05.14 07:04:45 LOG7[3796]: SSL state (connect): SSLv3 write client hello A 2025.05.14 07:04:45 LOG7[3796]: SSL alert (read): fatal: protocol version 2025.05.14 07:04:45 LOG3[3796]: SSL_connect: 1409442E: error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version 2025.05.14 07:04:45 LOG5[3796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2025.05.14 07:04:45 LOG7[3796]: Remote socket (FD=840) closed 2025.05.14 07:04:45 LOG7[3796]: Local socket (FD=832) closed - Do we need to change anything in stunnel.conf? - Do we need to upgrade stunnel? Many Thanks, John

4 5

Re: stunnel 5.75 released
by Christian Ullrich 28 May '25

28 May '25

* Michal Trojnara wrote: > I have released version 5.75 of stunnel. > > ### Version 5.75, 2025.05.26, urgency: MEDIUM Hello, why does the Windows release include "libgcc_s_seh-1.dll"? I cannot find anything that uses it, and a basic configuration works without any attempts to load it. I went to some lengths to find indications it might be loaded dynamically, but found nothing. Thanks, -- Christian

2 1

stunnel 5.75 released
by Michał Trojnara 26 May '25

26 May '25

Dear Users, I have released version 5.75 of stunnel. ### Version 5.75, 2025.05.26, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.4.1. - OpenSSL FIPS Provider updated to version 3.1.2. * Bugfixes - Fixed infinite loop triggered by OCSP URL parsing errors (thx to Richard Könning for reporting). - Fixed OPENSSL_NO_OCSP build issues (thx to Dmitry Mostovoy for reporting). - Fixed default curve selection in FIPS mode with OpenSSL 3.4+. - Fixed tests with modern Python versions. - Fixed tests with multiple OpenSSL versions installed. * Features - Added provider URI support for "cert" and "key" options. - Added new "CAstore" service-level option (OpenSSL 3.0+). - Added "provider" (OpenSSL 3.0+), "providerParameter" (OpenSSL 3.5+), and "setEnv" global options. - Key file/URI path added to passphrase prompt on Unix. - PKCS#11 provider installed on Windows. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0c1ef0ed85240974dccb94fe74fb92d6383474c7c0d10e8796d1f781a3ba5683 stunnel-5.75.tar.gz 18ec3b83bda9143c79479ecdc1e3ecf515eeb8a8b11e6ea3a6856cd77399317d stunnel-5.75-win64-installer.exe d1a04ec51840d8cbf5fb6d897d2eb999af573b5b66268fdec109cddaff2acfb7 stunnel-5.75-android.zip Best regards, Mike

1 0

Preserving Client IP Address
by atritium＠hushmail.com 21 May '25

21 May '25

Has anyone followed the stunnel man page instructions and been able to successfully pass/preserve the connecting client's original IP address? Checking history on this issue back to 2010, it looks people with problems, no reports of success. Though it seems so fundamental, you would hope it was smooth as the man page indicates For example, I set up an iptables 'mangle' table for DIVERT routing, ip rule, ip route, etc, for the server as given in the stunnel man page for a Red Hat 8 system. When the stunnel server is then also configured with "transparent = source" and restarted, the remote-initiated connection -hangs- without connecting for a few seconds before closing. Take out "transparent = source" from the server config, and the connection works successfully (though the client IP address is not available to applications). Logs are the same up until the point (shown below), which shows the "hanging/failed" case timing out after reporting "Cannot assign an AF=2 address an AF=10 socket". Don't know what the "Cannot assign AF ..." refers to, or how to address it, but the process goes downhill and hangs after that. 7111 is the open port stunnel is monitoring. 2025.05.21 10:07:16 LOG7[0]: Cannot assign an AF=2 address an AF=10 socket 2025.05.21 10:07:16 LOG6[0]: IP_TRANSPARENT socket option set 2025.05.21 10:07:16 LOG6[0]: bind succeeded on the original port 2025.05.21 10:07:16 LOG6[0]: s_connect: connecting 127.0.0.1:7111 2025.05.21 10:07:16 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:7111: waiting 10 seconds 2025.05.21 10:07:16 LOG7[0]: FD=6 events=0x2001 revents=0x0 2025.05.21 10:07:16 LOG7[0]: FD=11 events=0x2005 revents=0x1 2025.05.21 10:07:26 LOG3[0]: s_connect: s_poll_wait 127.0.0.1:7111: TIMEOUTconnect exceeded 2025.05.21 10:07:26 LOG3[0]: No more addresses to connect 2025.05.21 10:07:26 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.05.21 10:07:26 LOG7[0]: local_rfd/local_wfd reset (FD=3) 2025.05.21 10:07:26 LOG7[0]: Local descriptor (FD=3) closed 2025.05.21 10:07:26 LOG7[0]: Service [TLS SERVER] finished (0 left) The log for the successful case when "transparent = source is NOT specified in server config) instead says: 2025.05.21 09:59:58 LOG6[0]: s_connect: connecting ::1:7111 2025.05.21 09:59:58 LOG7[0]: s_connect: s_poll_wait ::1:7111: waiting 10 seconds 2025.05.21 09:59:58 LOG7[0]: FD=6 events=0x2001 revents=0x0 2025.05.21 09:59:58 LOG7[0]: FD=11 events=0x2005 revents=0x1 2025.05.21 09:59:58 LOG5[0]: s_connect: connected ::1:7111 2025.05.21 09:59:58 LOG6[0]: persistence: ::1:7111 cached 2025.05.21 09:59:58 LOG5[0]: Service [TLS SERVER] connected remote server from ::1:49806 2025.05.21 09:59:58 LOG7[0]: Setting remote socket options (FD=11) Any insight on what "Cannot assign an AF=2 address an AF=10 socket" is and how to fix it to preserve client IP address? stunnel is running as root, setuid is not used. I might not correctly understand the man page comment "This option is currently available in: Remote mode (connect option) on Linux >=2.6.28", but think it means a normal external connection request. Hopefully not a special configuration on the client side.

1 0

SSL_CTX_load_verify_locations: Peer suddenly disconnected
by lynn9a＠yahoo.com 13 May '25

13 May '25

Hi, All When we try to start stunnel(stunnel 5.67, wolfSSL5.6.4 on linux), there is an error randomly happened like following, anybody knows why this happen and how to fix this? Thanks May 9 09:09:01 [ ] Initializing inetd mode configuration May 9 09:09:01 [ ] Clients allowed=500 May 9 09:09:01 [.] stunnel 5.67 on arm-oe-linux-gnueabi platform May 9 09:09:01 [.] Compiled/running with wolfSSL 5.6.4 May 9 09:09:01 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:OCSP,PSK,SNI May 9 09:09:01 [ ] errno: (*__errno_location ()) May 9 09:09:01 [ ] Initializing inetd mode configuration May 9 09:09:01 [.] Reading configuration from file /opt/config/stunnel.conf May 9 09:09:01 [.] UTF-8 byte order mark not detected May 9 09:09:01 [ ] No PRNG seeding was required May 9 09:09:01 [ ] Initializing service [xxxHost] May 9 09:09:01 [ ] stunnel default security level set: 2 May 9 09:09:01 [ ] Ciphers: TLS_AES_256_GCM_SHA384 May 9 09:09:01 [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 May 9 09:09:01 [ ] TLS options: 0x4D474C4C003000 (+0x0, -0x0) May 9 09:09:01 [ ] Session resumption enabled May 9 09:09:01 [ ] Loading certificate from file: ./config/client.pem May 9 09:09:01 [ ] Certificate loaded from file: ./config/client.pem May 9 09:09:01 [ ] Loading private key from file: ./config/client.key May 9 09:09:01 [:] Insecure file permissions on ./config/client.key May 9 09:09:01 [ ] Private key loaded from file: ./config/client.key May 9 09:09:01 [ ] Private key check succeeded May 9 09:09:01 [!] SSL_CTX_load_verify_locations: Peer suddenly disconnected May 9 09:09:01 [!] Service [xxxHost]: Failed to initialize TLS context May 9 09:09:01 [!] Configuration failed May 9 09:09:01 [ ] Deallocating temporary section defaults May 9 09:09:01 [ ] Deallocating section [xxxHost]

3 2

Using intermediate CA as a trust anchor in stunnel
by Vít Holásek 30 Mar '25

30 Mar '25

Hi, I'm trying to setup stunnel to trust only certificates issued by intermediate CA and not other CAs issues by the same root CA. I came across this discussion about the same topic: https://www.stunnel.org/ mailman3/hyperkitty/list/stunnel-users(a)stunnel.org/thread/DUF6C6 BRNFVAWVCDIGXPUDTAPZR5KV5W/. I tested described options but it always authenticates also other sub CAs, because the whole chain must be always supplied in configured CAfile or CApath. In my opinion, the proper solution would be to add "partial chain" OpenSSL configuration option to stunnel config. This would allow admin to decide how intermediate CA will be verified. What do you think about that? See corresponding OpenSSL issue: https://github.com/openssl/openssl/issues/ 7871. Thanks Vit

1 0

stunnel - client conexion close by TLS alert (write) fatal decode error
by Rodigo Alvarez 07 Mar '25

07 Mar '25

Hi All! I would appreciate any clue to solve the problem we are having with a client mode service that stopped working this week (we verified that the service works directly without stunnel). The error I identify in the trace is the following: "TLS alert (write): fatal: decode error" Stunnel Config (windows version): [afip-prod-fce] client = yes accept = ARSASSRV4DMS06:1031 connect = serviciosjava.afip.gob.ar:443 debug = 7 ws: https://serviciosjava.afip.gob.ar/wsfecred/FECredService Complete trace: 2024.01.24 09:28:46 LOG5[main]: stunnel 5.71 on x64-pc-mingw32-gnu platform 2024.01.24 09:28:46 LOG5[main]: Compiled/running with OpenSSL 3.1.3 19 Sep 2023 2024.01.24 09:28:46 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2024.01.24 09:28:46 LOG5[main]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2024.01.24 09:28:46 LOG5[main]: UTF-8 byte order mark detected 2024.01.24 09:28:46 LOG5[main]: FIPS mode disabled 2024.01.24 09:28:46 LOG4[main]: Service [afip-prod-fce] needs authentication to prevent MITM attacks 2024.01.24 09:28:46 LOG5[main]: Configuration successful 2024.01.24 09:29:23 LOG7[0]: Service [afip-prod-fce] started 2024.01.24 09:29:23 LOG7[0]: Setting local socket options (FD=892) 2024.01.24 09:29:23 LOG7[0]: Option TCP_NODELAY set on local socket 2024.01.24 09:29:23 LOG5[0]: Service [afip-prod-fce] accepted connection from 10.70.162.24:57723 2024.01.24 09:29:23 LOG6[0]: s_connect: connecting 200.1.116.19:443 2024.01.24 09:29:23 LOG7[0]: s_connect: s_poll_wait 200.1.116.19:443: waiting 10 seconds 2024.01.24 09:29:23 LOG7[0]: FD=896 ifds=rwx ofds=--- 2024.01.24 09:29:24 LOG5[0]: s_connect: connected 200.1.116.19:443 2024.01.24 09:29:24 LOG5[0]: Service [afip-prod-fce] connected remote server from 10.72.0.69:64788 2024.01.24 09:29:24 LOG7[0]: Setting remote socket options (FD=896) 2024.01.24 09:29:24 LOG7[0]: Option TCP_NODELAY set on remote socket 2024.01.24 09:29:24 LOG7[0]: Remote descriptor (FD=896) initialized 2024.01.24 09:29:24 LOG6[0]: SNI: sending servername: serviciosjava.afip.gob.ar 2024.01.24 09:29:24 LOG6[0]: Peer certificate not required 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): before SSL initialization 2024.01.24 09:29:24 LOG7[0]: Initializing application specific data for session authenticated 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2024.01.24 09:29:24 LOG6[0]: CERT: Certificate verification disabled 2024.01.24 09:29:24 LOG6[0]: CERT: Certificate verification disabled 2024.01.24 09:29:24 LOG6[0]: CERT: Certificate verification disabled 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2024.01.24 09:29:24 LOG7[0]: OCSP stapling: Client callback called 2024.01.24 09:29:24 LOG6[0]: OCSP: Certificate chain verification disabled 2024.01.24 09:29:24 LOG6[0]: Client certificate not requested 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2024.01.24 09:29:24 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2024.01.24 09:29:24 LOG7[0]: New session callback 2024.01.24 09:29:24 LOG7[0]: Peer certificate was cached (6643 bytes) 2024.01.24 09:29:24 LOG6[0]: Session id: D63C79766AC02C9A3E8494AD528954A183E9F7C250856695BA05C16A2219A4B3 2024.01.24 09:29:24 LOG7[0]: 1 client connect(s) requested 2024.01.24 09:29:24 LOG7[0]: 1 client connect(s) succeeded 2024.01.24 09:29:24 LOG7[0]: 0 client renegotiation(s) requested 2024.01.24 09:29:24 LOG7[0]: 0 session reuse(s) 2024.01.24 09:29:24 LOG6[0]: TLS connected: new session negotiated 2024.01.24 09:29:24 LOG6[0]: TLSv1.2 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2024.01.24 09:29:24 LOG6[0]: Peer temporary key: ECDH, P-256, 256 bits 2024.01.24 09:29:24 LOG7[0]: Compression: null, expansion: null 2024.01.24 09:29:24 LOG7[0]: Remove session callback 2024.01.24 09:29:24 LOG7[0]: TLS alert (write): fatal: decode error 2024.01.24 09:29:24 LOG6[0]: TLS socket closed (SSL_read) 2024.01.24 09:29:24 LOG7[0]: Sent socket write shutdown 2024.01.24 09:29:24 LOG5[0]: Connection closed: 1755 byte(s) sent to TLS, 634 byte(s) sent to socket 2024.01.24 09:29:24 LOG7[0]: Remote descriptor (FD=896) closed 2024.01.24 09:29:24 LOG7[0]: Local descriptor (FD=892) closed 2024.01.24 09:29:24 LOG7[0]: Service [afip-prod-fce] finished (0 left) Thank you! Kind regards, Rodrigo.

3 3

stunnel warning: SSL_accept: ../ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number
by Marcel de Rooy 23 Jan '25

23 Jan '25

Hi, Taking this opportunity to ask a question on the mentioned warning. In our stunnel setup (stunnel server in a Docker container on Linux, version 5.68 and windows clients on version 5.73, no certificate verification) I am seeing every minute the following lines in stunnel.log on the server side: 2025.01.20 04:12:27 LOG5[0]: Service [siptest] accepted connection from 172.20.23.1:46658 2025.01.20 04:12:27 LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:354: error:0A00010B:SSL routines::wrong version number 2025.01.20 04:12:27 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is every minute, so 04:13:27 again, etc. The warning is there already shortly after container restart without active connections to our SIP devices. I only see it recently. And changing the server/client config with sslVersionMin = TLSv1.2 and sslVersionMax = TLSv1.3 did not resolve it. Since it comes back every minute, I was thinking in the direction of keepalive settings. But do keep alives need encryption? Probably not. Is this just an innocent bug in the stunnel code or could I still do something in my configuration to clear the warn? Thank you for your attention. Marcel de Rooy Rijksmuseum Netherlands xxx

3 4

How do I setup stunnel + openvpn for android (I already have the server running, I just need a android client, Sslsocks isn't working for some reason for me.)
by sharifkashif224＠gmail.com 23 Jan '25

23 Jan '25

I've tried using Sslsocks but it keeps giving me an error called unexpected eof while reading. This occurs when I try to initiate a connection via OpenVPN in android.

1 0

How do I use the android zip file provided in the download section in the stunnel website for android
by sharifkashif224＠gmail.com 22 Jan '25

22 Jan '25

I want to try connecting my openvpn server thats wrapped around stunnel onto my phone, any help will be appreciated!

1 0

Re: stunnel log file fills up with errors very fast
by Alan M Varghese (Nokia) 22 Jan '25

22 Jan '25

After digging into this a bit further, I was able to confirm that these "retries" are not created by stunnel itself. Rather, stunnel is simply trying to forward the connection attempts from NFS. Changing the NFS mount's "timeo" and "retrans" parameters affects duration for which NFS attempts to connect to the server. Thanks, Alan M Varghese

1 0

stunnel log file fills up with errors very fast
by Alan M Varghese (Nokia) 19 Jan '25

19 Jan '25

Hello stunnel users, With stunnel (version: 5.71) setup and running (used to secure NFSv4 mounts), when the network interface is brought down, a huge number of messages are written to the log file (configured with the "output" option) in a very short amount of time. Below are some sample logs: 2025.01.19 14:19:58 LOG5[1044766]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.01.19 14:19:58 LOG5[1044767]: Service [xxxxx] accepted connection from 127.0.0.1:994 2025.01.19 14:19:58 LOG3[1044767]: s_connect: connect 192.168.x.xx:xxxx: Network is unreachable (101) 2025.01.19 14:19:58 LOG3[1044767]: No more addresses to connect 2025.01.19 14:19:58 LOG5[1044767]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.01.19 14:19:58 LOG5[1044768]: Service [xxxxx] accepted connection from 127.0.0.1:994 2025.01.19 14:19:58 LOG3[1044768]: s_connect: connect 192.168.x.xx:xxxx: Network is unreachable (101) 2025.01.19 14:19:58 LOG3[1044768]: No more addresses to connect ... This causes the log size to grow very quickly, sometimes overwhelming the filesystem. Log rotation alleviates this issue to some extent. But still, the archived logs would be filled with duplicate logs. This issue has been discussed by another user in the following thread: https://www.stunnel.org/mailman3/hyperkitty/list/[email protected]/… (Note, while the user in the thread above received "Connection refused" messages, here the error is "Network is unreachable". Otherwise, the behaviour with respect to logs is the same.) We would like to know if there is a way to control this connection behaviour from stunnel when "Network is unreachable" in such a manner. If not, is there a way to control/limit the log output from stunnel (without reducing the log level from default)? Steps to reproduce the issue: 1. Mount an NFSv4 filesystem using stunnel (configured to output logs to a file) 2. Bring down the network interfaces such that stunnel is not able to reach the configured server. (Please make sure to not lose access to the server while doing this.) 3. Wait ~300 seconds 4. Bring the interface(s) back up. 5. Examine the log size and contents. Thanks, Alan M Varghese

1 0

Issue with OCSP messages in stunnel 5.73 and above
by Alexander Moisseev 02 Jan '25

02 Jan '25

Hello, I am experiencing an issue with stunnel versions 5.73 and above where the server logs are continuously filled with the following message: "OCSP: SSL_get_certificate" This issue does not occur in version 5.72. I am using PSK for encryption and have not configured OCSP. Here are the details of my setup: [.] stunnel 5.74 on amd64-portbld-freebsd14.1 platform [.] Compiled with OpenSSL 3.0.13 30 Jan 2024 [.] Running with OpenSSL 3.0.15 3 Sep 2024 - Server configuration file: ``` setuid = stunnel setgid = nogroup pid = /var/run/stunnel/stunnel.pid [bayes] accept = 6478 connect = 6378 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt cert = /usr/local/etc/stunnel/cert.pem key = /usr/local/etc/stunnel/private.key [fuzzy] accept = 6477 connect = 6377 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt cert = /usr/local/etc/stunnel/cert.pem key = /usr/local/etc/stunnel/private.key ``` - Client configuration file: ``` setuid = stunnel setgid = nogroup pid = /var/run/stunnel/stunnel.pid [bayes] client = yes accept = localhost:6478 connect = host.example.org:6478 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt [fuzzy] client = yes accept = localhost:6477 connect = host.example.org:6477 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt ``` - Relevant log entries: ``` Dec 27 09:00:10 mx stunnel[22113]: LOG3[per-minute]: OCSP: SSL_get_certificate ``` As a temporary workaround, I generated a self-signed certificate and configured stunnel to use it. This has resolved the issue with OCSP messages. However, I believe this is not the intended behavior when using PSK without configuring OCSP. I would appreciate any help or guidance on how to properly configure stunnel to avoid this issue without requiring a self-signed certificate. Thank you, Alexander

3 4

STUNNEL Installation to Windows Failover Cluster
by John Pipolo 19 Dec '24

19 Dec '24

Hi Is there any documentation or how to on installing STUNNEL to a 2 node Windows failover cluster? thx

1 0

[Bug][5.73] stunnel segfault and coredump due to OCSP handling
by stunnel＠benary.org 15 Dec '24

15 Dec '24

Hi everyone, I've recently upgraded from NixOS 24.05 to 24.11 which went from stunnel 5.72 to 5.73 and have since had stunnel crash on me multiple times on different servers (pretty much identical setup however) due to what looks like a memory allocation race? Since 5.73 moved OCSP fetches to a thread, and the problem hasn't ever happened with 5.72 it sounds like an issue specific to that. Someone familiar with the codebase probably has a better idea of what's going on. Given that my updates happened somewhen mid last month and there have been no certificate renewals since (except for one that wouldn't affect the systems that were affected, thanks so much to crt.sh and CT existing) the error message of "OCSP routines::status expired" also seems out of place at least for the certificate itself (the staple may be expired, but stunnel should probably get a new one in that case which may have to do with the error in question). ``` Dec 06 04:43:02 shell stunnel[1124111]: LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: 2024.12.06 04:43:02 LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: 2024.12.06 04:43:02 LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:02 shell stunnel[1124111]: 2024.12.06 04:43:02 LOG5[per-minute]: OCSP: Certificate accepted Dec 06 04:43:56 shell stunnel[1124111]: LOG5[ui]: Log file reopened Dec 06 04:43:56 shell stunnel[1124111]: 2024.12.06 04:43:56 LOG5[ui]: Log file reopened Dec 06 04:44:02 shell stunnel[1124111]: LOG3[per-minute]: OCSP: OCSP_check_validity: crypto/ocsp/ocsp_cl.c:351: error:1380007D:OCSP routines::status expired Dec 06 04:44:02 shell stunnel[1124111]: 2024.12.06 04:44:02 LOG3[per-minute]: OCSP: OCSP_check_validity: crypto/ocsp/ocsp_cl.c:351: error:1380007D:OCSP routines::status expired Dec 06 04:44:02 shell stunnel[1124111]: 2024.12.06 04:44:02 LOG4[per-minute]: OCSP: Unknown verification status Dec 06 04:44:02 shell stunnel[1124111]: INTERNAL ERROR: Memory allocated in a different thread at ocsp.c, line 412 Dec 06 04:44:02 shell stunnel[1124111]: LOG4[per-minute]: OCSP: Unknown verification status Dec 06 04:44:02 shell stunnel[1124111]: INTERNAL ERROR: Memory allocated in a different thread at ocsp.c, line 412 Dec 06 04:44:02 shell systemd-coredump[282485]: Process 1124111 (stunnel) of user 988 terminated abnormally with signal 6/ABRT, processing... Dec 06 04:44:02 shell systemd[1]: Started Process Core Dump (PID 282485/UID 0). Dec 06 04:44:02 shell systemd-coredump[282486]: [🡕] Process 1124111 (stunnel) of user 988 dumped core. Module libgcc_s.so.1 without build-id. Module libcap.so.2 without build-id. Module stunnel without build-id. Stack trace of thread 1124120: #0 0x00007f9191c99a9c __pthread_kill_implementation (libc.so.6 + 0x92a9c) #1 0x00007f9191c47576 raise (libc.so.6 + 0x40576) #2 0x00007f9191c2f935 abort (libc.so.6 + 0x28935) #3 0x000056142e23e435 fatal_debug.cold (stunnel + 0xc435) #4 0x000056142e23eebc get_alloc_list_ptr (stunnel + 0xcebc) #5 0x000056142e23f0b9 str_detach_debug.part.0 (stunnel + 0xd0b9) #6 0x000056142e23f856 str_free_debug (stunnel + 0xd856) #7 0x000056142e259635 ocsp_stapling (stunnel + 0x27635) #8 0x000056142e25a18f per_minute_thread (stunnel + 0x2818f) #9 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #10 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676245: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 1124111: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e25b5f6 daemon_loop (stunnel + 0x295f6) #3 0x000056142e23e680 main (stunnel + 0xc680) #4 0x00007f9191c3127e __libc_start_call_main (libc.so.6 + 0x2a27e) #5 0x00007f9191c31339 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x2a339) #6 0x000056142e23e875 _start (stunnel + 0xc875) Stack trace of thread 1124119: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e250acd s_poll_sleep (stunnel + 0x1eacd) #3 0x000056142e25a21c per_second_thread (stunnel + 0x2821c) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676190: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 1124121: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e250acd s_poll_sleep (stunnel + 0x1eacd) #3 0x000056142e259fab per_day_thread (stunnel + 0x27fab) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676445: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676300: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) Stack trace of thread 676491: #0 0x00007f9191d090af __poll (libc.so.6 + 0x1020af) #1 0x000056142e2509f1 s_poll_wait (stunnel + 0x1e9f1) #2 0x000056142e241f82 client_run (stunnel + 0xff82) #3 0x000056142e2438fc client_thread (stunnel + 0x118fc) #4 0x00007f9191c97d02 start_thread (libc.so.6 + 0x90d02) #5 0x00007f9191d173ac __clone3 (libc.so.6 + 0x1103ac) ELF object binary architecture: AMD x86-64 Dec 06 04:44:02 shell systemd[1]: stunnel.service: Main process exited, code=dumped, status=6/ABRT Dec 06 04:44:02 shell systemd[1]: stunnel.service: Failed with result 'core-dump'. Dec 06 04:44:02 shell systemd[1]: stunnel.service: Consumed 2min 11.812s CPU time, 21.6M memory peak, 19.6M memory swap peak, 50.9M read from disk, 47.1M written to disk, 587.2M incoming IP traffic, 588.8M outgoing IP traffic. ``` Note that stunnel is handling mTLS for my prometheus, which means that it is indeed getting hammered by one scrape per exporter at a time, which in this case would make exactly five scrapes per minute but all of them happening at the same time, which, if this is a race, does make me a lot more likely to hit this issue. Also a huge Thank You for building what has been an integral part of my infrastructure for almost a decade now.

3 4

stunnel 5.74 released
by Michał Trojnara 13 Dec '24

13 Dec '24

Dear Users, I have released version 5.74 of stunnel. ### Version 5.74, 2024.12.13, urgency: HIGH * Bugfixes - Fixed a stapling cache deallocation crash. - Fixed "redirect" with protocol negotiation. * Features - "protocolHost" support for "socks" protocol clients. - More detailed logs in OpenSSL 3.0 or later. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9bef235ab5d24a2a8dff6485dfd782ed235f4407e9bc8716deb383fc80cd6230 stunnel-5.74.tar.gz 8ce19cc782a64b0cacf32356249265ed16b3888e3578454853f5497726778d76 stunnel-5.74-win64-installer.exe 68c3395c1bebcc8b4eee2c7f58190aa2fe39b835dd7a4cce5ad37d5dfc1c5542 stunnel-5.74-android.zip Best regards, Mike

1 0

Stunnel on a windwos 11 pro installation not working
by ron.reijgwart＠gmail.com 09 Dec '24

09 Dec '24

I'm trying to use Stunnel on a windwos 11 pro installation. I tried version 5.56, 5.73 and 5.74b1. On my old pc all was working fine but now I get the following errors: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.73 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.3.2 3 Sep 2024 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [ssmtp] [ ] Initializing context [ssmtp] [ ] OpenSSL security level is used: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: C:\Program Files (x64)\stunnel\config\stunnel.pem [!] error queue: ssl/ssl_rsa.c:472: error:0A080002:SSL routines::system lib [!] error queue: crypto/bio/bss_file.c:300: error:10080002:BIO routines::system lib [!] SSL_CTX_use_certificate_chain_file: crypto/bio/bss_file.c:297: error:80000003:system library::No such process [!] Service [ssmtp]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Cleaning up context [(null)] [ ] Deallocating section [ssmtp] [ ] Cleaning up context [ssmtp] On a windows 10 Education installation it works fine with this logging: 2024.12.05 13:38:58 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2024.12.05 13:38:58 LOG5[service]: UTF-8 byte order mark detected 2024.12.05 13:38:58 LOG5[service]: FIPS mode disabled 2024.12.05 13:38:58 LOG4[service]: Service [ssmtp] needs authentication to prevent MITM attacks 2024.12.05 13:38:58 LOG5[service]: Configuration successful My conf-file looks like this: ;use it for client mode client = yes [ssmtp] accept = 1925 cert = C:\Program Files (x64)\stunnel\config\stunnel.pem connect = smtp.bhosted.nl:465 Can you please give me some advice?

2 2

Is it possible for stunnel to reject client connections if the server end cannot connect?
by mohmmad170720＠gmail.com 05 Dec '24

05 Dec '24

Hi all Say we have two machines set up, ClientPC and ServerPC. On ClientPC I run stunnel accepting a connection on a local port and connecting to an stunnel port on ServerPC. On ServerPC I run stunnel accepting a connection on the local stunnel port and connecting to the 'encryption unaware' server on another port on the same ServerPC machine. OK, pretty simple stuff so far. The problem is, when I connect to ClientPC with the 'encryption unaware' client app. then I always get a successful connection, even if there is no server running on ServerPC. Of course once the client has a successful connection, it then performs a write(), and that fails with 'Connection reset by peer'. Really, since there is no server running on ServerPC, I want the connect() to stunnel on ClientPC to fail. Is there a way to do this?

1 0

Router + Cudy mesh system
by trashrap22＠gmail.com 26 Nov '24

26 Nov '24

Hi, My stunnel setup was working. I since moved and had to add a Cudy mesh system / extension to the router to extend the internet through the building. Now I can't get stunnel to work again - I have done port forwarding on the Cudy system too. Has anyone done this extentions of router setup and got stunnel to work?

1 0

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Is it possible to hide "Acceptable client certificate CA names" during SSL handshaking?
by hshh 12 Nov '24

12 Nov '24

Since version 5.68, when stunnel is configured with verifyPeer=yes, CApath=/path and CAfile=/path/file, the 'Acceptable client certificate CA names' and required certificates are displayed during SSL handshaking. Is it possible to hide this information?

3 4

s_ssl_read_eof: SSL_ERROR_WANT_READ: Retrying
by stavultras＠gmail.com 07 Nov '24

07 Nov '24

Hello, i've encountered a very strange issue when you use stunnel 7.53 (doesn't matter actually, happens in 5.68 as well) like this: [server] accept = 443 protocol = socks [client] accept = 1080 protocol = socks connect = server:443 with iptables -A OUTPUT -p tcp -d 10.8.0.1 -j REDIRECT --to-ports 1080, I see in 95% cases in logs for every request from curl: curl http://10.8.0.1 (server's internal IP), however, it never happens if you use client like this: [client] accept = 1080 connect = server:443 and curl -x socks5://127.0.0.1:1080 http://10.8.0.1 (internal server's IP). Technically it affects nothing, but I still guess there's a small time overhead due to retry. Maybe i'm wrong. Please advise. Thanks.

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

socks mode doesn't verify peer
by stavultras＠gmail.com 05 Nov '24

05 Nov '24

Hello. I'm trying to configure "protocol = socks" with "redirect = 127.0.0.1:80" and "verifyPeer = yes", but accordingly to the debug logs stunnel doesn't verify peer when I'm trying to connect without client's certificate, for an example, from browser: https://192.168.200.131:9013/, where 192.168.200.131 is stunnel server. Config file: [socks] cert = /usr/local/etc/stunnel/server.pem CAfile = /usr/local/etc/stunnel/client.crt verifyPeer = yes redirect = 127.0.0.1:80 accept = 0.0.0.0:9013 protocol = socks Debug log: 2024.10.02 07:24:19 LOG6[9]: No peer certificate received 2024.10.02 07:24:19 LOG6[9]: Session id: AFA5F9CE2997328612F76E3B3572FE00C71C53ED31A98567E56DCC084EF580AD 2024.10.02 07:24:19 LOG7[9]: TLS state (accept): SSLv3/TLS write session ticket 2024.10.02 07:24:19 LOG6[9]: TLS accepted: new session negotiated 2024.10.02 07:24:19 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_128_GCM_SHA256 (128-bit encryption) 2024.10.02 07:24:19 LOG6[9]: Peer temporary key: X25519, 253 bits 2024.10.02 07:24:19 LOG7[9]: Compression: null, expansion: null 2024.10.02 07:24:19 LOG7[9]: Waiting for the SOCKS request 2024.10.02 07:24:19 LOG3[9]: Unsupported SOCKS version 0x47 2024.10.02 07:24:19 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket It tries to accept SOCKS info even without certificate and doesn't redirect to 127.0.0.1:80. In browser, I'm getting: Secure Connection Failed An error occurred during a connection to 192.168.200.131:9013. PR_CONNECT_RESET_ERROR Error code: PR_CONNECT_RESET_ERROR Can you check why it happens? Thank you.

1 9

"direct" protocol support
by stavultras＠gmail.com 05 Nov '24

05 Nov '24

Hello, is it possible to implement "direct" protocol support? For an example: You have OpenVPN TCP on a server and let's say SSH (or any other TCP software) and you want to use stunnel on the same port or under the same SNI. Configs would like: [server] accept = 443 protocol = direct [client_openvpn_tcp] sni=test.com protocolHost = 127.0.0.1:2000 connect = server:443 accept = 127.0.0.1:2000 [client_ssh] sni=test.com protocolHost = 127.0.0.1:22 connect = server:443 accept = 127.0.0.1:222 I know, you can use "protocol = socks", but in this case you can't use this thing directly with your software that doesn't support socks5 (OpenVPN isn't a fully good example, because it supports socks5 proxy). SSH is a good example if you want to use it under TLS on the same port with OpenVPN TCP and other TCP applications. It will be useful for many other applications without socks5 support and if you won't occupy more than 1 port or SNI. P.S.: I'm still trying to use socks5 code from stunnel to implement "direct" protocol, but i'm not very good at C. Thanks.

1 2

Smpp with stunnel
by Andrew Z 16 Oct '24

16 Oct '24

Hello, I'm trying to leverage stunnel with smpp to communicate over by smppS protocol. I saw an older message from Pierre Delaage (2019) outlining the process ( https://www.stunnel.org/pipermail/stunnel-users/2010-September/002752.html) Unfortunately, that is not working for me. What may I be overlooking? Data: Fedora 39, stunnel 5.72 on x86_64-redhat-linux-gnu platform stunnel config from /etc/stunnel: cat ./stunnel.conf output = /var/log/stunnel.log foreground = yes [smpps] client = yes accept = 3775 connect = <vendor dnsname>:3550 cert = /tmp/nginx-selfsigned.crt key=/tmp/nginx-selfsigned.key sslVersion=all [root@dell5000 stunnel]# stunnel ./stunnel.conf 2024.10.16 13:52:44 LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform 2024.10.16 13:52:44 LOG5[ui]: Compiled with OpenSSL 3.1.1 30 May 2023 2024.10.16 13:52:44 LOG5[ui]: Running with OpenSSL 3.1.4 24 Oct 2023 2024.10.16 13:52:44 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.10.16 13:52:44 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2024.10.16 13:52:44 LOG5[ui]: UTF-8 byte order mark not detected 2024.10.16 13:52:44 LOG5[ui]: FIPS mode disabled 2024.10.16 13:52:44 LOG4[ui]: Service [smpps] needs authentication to prevent MITM attacks 2024.10.16 13:52:44 LOG5[ui]: Configuration successful 2024.10.16 13:53:02 LOG5[0]: Service [smpps] accepted connection from 192.168.1.114:11270 2024.10.16 13:53:02 LOG5[0]: s_connect: connected <vendor IP>:3550 2024.10.16 13:53:02 LOG5[0]: Service [smpps] connected remote server from 192.168.1.114:55508 2024.10.16 13:53:07 LOG5[0]: Connection closed: 293 byte(s) sent to TLS, 0 byte(s) sent to socket the smpp client is pointed to localhost:3775 and I running in the container. As such the "localhost" is "host.containers.internal". Here is the smpp log: 2024-10-16 17:53:02 INFO 1 Establishing SSL connection to host.containers.internal:3775 2024-10-16 17:53:02 INFO 1 Connecting to IPv4Address(type='TCP', host='host.containers.internal', port=3775) ... 2024-10-16 17:53:02 WARNING 1 SMPP connection established from 192.168.1.114 to port 40554 2024-10-16 17:53:02 INFO 1 Connection made to host.containers.internal:3775 2024-10-16 17:53:02 WARNING 1 Requesting bind as transceiver 2024-10-16 17:53:07 WARNING 1 SMPP 192.168.1.114 disconnected from port 40554: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionLost'>: Connection to the other side was lost in a non-clean fashion: Connection lost. ] 2024-10-16 17:53:07 ERROR 1 Connection lost. Reason: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly. ] 2024-10-16 17:53:07 INFO 1 Reconnecting after 10 seconds ... 2024-10-16 17:53:17 INFO 1 Connecting to IPv4Address(type='TCP', host='host.containers.internal', port=3775) ... 2024-10-16 17:53:17 WARNING 1 SMPP connection established from 192.168.1.114 to port 54806 2024-10-16 17:53:17 INFO 1 Connection made to host.containers.internal:3775 2024-10-16 17:53:17 WARNING 1 Requesting bind as transceiver 2024-10-16 17:53:22 WARNING 1 SMPP 192.168.1.114 disconnected from port 54806: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionLost'>: Connection to the other side was lost in a non-clean fashion: Connection lost. ] 2024-10-16 17:53:22 ERROR 1 Connection lost. Reason: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly. ] 2024-10-16 17:53:22 INFO 1 Reconnecting after 10 seconds ... 2024-10-16 17:53:32 ERROR 1 Request timed out after 30 secs: PDU [command: CommandId.bind_transceiver, sequence_number: 1, command_status: CommandStatus.ESME_ROK system_id: b'XXXXX' password: b'XXXXX' system_type: b'' interface_version: 52 addr_ton: <AddrTon.UNKNOWN: 1> addr_npi: <AddrNpi.UNKNOWN: 1> address_range: None ] 2024-10-16 17:53:32 ERROR 1 Bind failed [[Failure instance: Traceback (failure with no frames): <class 'smpp.pdu.error.SMPPRequestTimoutError'>: Request timed out after 30 secs: PDU [command: CommandId.bind_transceiver, sequence_number: 1, command_status: CommandStatus.ESME_ROK system_id: b'XXXX' password: b'XXXXX' system_type: b'' interface_version: 52 addr_ton: <AddrTon.UNKNOWN: 1> addr_npi: <AddrNpi.UNKNOWN: 1> address_range: None ] ]]. Disconnecting...

1 0

stunnel overhead: Tunneling over stunnel - How does this affect MTU?
by Marek Küthe 15 Oct '24

15 Oct '24

Hello, I am tunneling packets via stunnel using OpenVPN. I would now like to have an MTU in my tunnel where no fragmentation occurs. Hence my question: What overhead does stunnel introduce? Is the plaintext with a length one-to-one translated into the ciphertext? How large is the stunnel / TLS header? I look forward to any answer! Regards Marek Küthe -- Marek Küthe m.k(a)mk16.de er/ihm he/him

1 0

Newbie: installation and config
by ajbguinto＠yahoo.com 30 Sep '24

30 Sep '24

Hi, I am tasked to make stunnel work in our organization but a newbie I seem not to be able to follow the instructions for installation. can you help me out? plan to install this on our servers that will cater to oracle / mssql in transit data encryption. how do I know if im installing on a client or a server? will this work standalone (server will act as server and client too). how will this be configured.

2 5

External PSK and TLS 1.3
by mike ads 18 Sep '24

18 Sep '24

Hello, I'm looking for a solution to connect to a server using TLS 1.3 and an external PSK. Does stunnel support this? I see that there are configuration options to set TLS 1.3, and configuration options to specify a PSK; if those were used together, would that result in TLS 1.3 with the PSK? If so, how would I choose between ephemeral vs non-ephemeral DH? This doesn't seem to be an option. Ephemeral is an important choice for forward secrecy. Would it default to ephemeral? Thank you.

1 0

stunnel 5.73 released
by Michał Trojnara 09 Sep '24

09 Sep '24

Dear Users, I have released version 5.73 of stunnel. ### Version 5.73, 2024.09.09, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.3.2. - OpenSSL FIPS Provider updated to version 3.0.9. * Bugfixes - Fixed a memory leak while reloading stunnel.conf sections with "client=yes" and "delay=no". - Fixed TIMEOUTocsp with values greater than 4. - Fix the IPv6 test on a non-IPv6 machine. * Features - HELO replaced with EHLO in the post-STARTTLS SMTP protocol negotiation (thx to Peter Pentchev). - OCSP stapling fetches moved away from server threads. - Improved client-side session resumption. - Added support for the mimalloc allocator. - Check for protocolHost moved to configuration file processing for the client-side CONNECT protocol. - Clarified some confusing OpenSSL's certificate verification error messages. - stunnel.nsi updated for Debian 13 and Fedora. - Improved NetBSD compatibility. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: bc917c3bcd943a4d632360c067977a31e85e385f5f4845f69749bce88183cb38 stunnel-5.73.tar.gz d686b1a4135947718e7a8157a8cb6694ed50e2267713de1972941148a8859789 stunnel-5.73-win64-installer.exe 9d6065ea1e7fa59405b5a152eeeaed9296bd5a0d2b11964800e95867e7391f16 stunnel-5.73-android.zip Best regards, Mike

1 0

Re: GMail and OAuth 2.0
by meirman＠fastmail.com 02 Sep '24

02 Sep '24

I would prefer to use stunnel, which I used for 10 or 20 years until recently, but this proxy is supposed to work for the new problem: SIMON ROB'S EMAIL-OAUTH2-PROXY Go to https://github.com/simonrob/email-oauth2-proxy/releases Download emailproxy-YYYY-MM-DD_pyinstaller-Windows.zip from the most recent release. Unzip the emailproxy-YYYY-MM-DD_pyinstaller-Windows.zip file, extracting the contents to the desired location; avoid the protected system folders such as "Program Files", "Program Files (x86)", etc. Right-click each extracted file, go to Properties, and enable "Unblock"..... Write me at traveler(a)mm.st if you want me to post the rest of the instructions. Maybe experienced people don't need them. I havent' tried to install either this or stunnel yet.

1 0

No key from stunnel TLS handshake ?
by atritium＠hushmail.com 31 Aug '24

31 Aug '24

In a TLS handshake, the server presents the signed public key (certificate from a CA) to the client to use so that it doesn't have to be pre-existing in a file on the arbitrary systems making connections. Am I correct that stunnel does NOT do this? It appears stunnel clients MUST have a pre-existing -file- containing the server's signed public key and pointed at in the config file's CAfile setting. Sort of like "authorized_keys" file for ssh, except the certificates have short lifespans before going invalid. This makes authentication unworkable for services that could have thousands of semi-random people connecting, especially with certificate lifespans creeping down to 1 year and probably months. Even if the certificate was bundled in the initial stunnel set-up, remote clients would have to constantly be updating the file. If this is correct, I wonder why stunnel doesn't handle the TLS handshake like a browser and supply the current server public certificate for the client to authenticate. It seems like stunnel is presupposing a handful of clients in close contact who can be constantly fed current certificates to place in files on their machine. Really limits usability of the tool. Or maybe I am missing something (?)

4 3