- stunnel-users - stunnel.org

TLS alert (read): warning: close notify
by trashrap22＠gmail.com 18 May '23

18 May '23

Hi All, Hopefully the last question with my struggles! Stunnel connects and the initial TLS connection works - but then it seems the client or server (I am client) does not trust the psk key? Any ideas? Note - part of the previous issue was creating a 64B/512b PSK and NOT a 32/B/256b psk. I created that key and shared it with the server. See below line referencing 256bit encryption? May 18 16:34:38 user-Linux stunnel: LOG5[0]: Service [** redacted **] connected remote server from ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG7[0]: Setting remote socket options (FD=11) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Option TCP_NODELAY set on remote socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) initialized May 18 16:34:38 user-Linux stunnel: LOG6[0]: SNI: sending servername: ** redacted ** May 18 16:34:38 user-Linux stunnel: LOG6[0]: Peer certificate not required May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): before SSL initialization May 18 16:34:38 user-Linux stunnel: LOG7[0]: Initializing application specific data for session authenticated May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server hello May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange May 18 16:34:38 user-Linux stunnel: LOG6[0]: Client certificate not requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server done May 18 16:34:38 user-Linux stunnel: LOG6[0]: PSK client configured for identity "client" May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS write finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read server session ticket May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS state (connect): SSLv3/TLS read finished May 18 16:34:38 user-Linux stunnel: LOG7[0]: New session callback May 18 16:34:38 user-Linux stunnel: LOG6[0]: No peer certificate received May 18 16:34:38 user-Linux stunnel: LOG6[0]: Session id: ***** redacted **** May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 1 client connect(s) succeeded May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 client renegotiation(s) requested May 18 16:34:38 user-Linux stunnel: LOG7[0]: 0 session reuse(s) May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS connected: new session negotiated May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLSv1.2 ciphersuite: ECDHE-PSK-CHACHA20-POLY1305 (256-bit encryption) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Compression: null, expansion: null May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (read): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: TLS closed (SSL_read) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sent socket write shutdown May 18 16:34:38 user-Linux stunnel: LOG6[0]: Read socket closed (readsocket) May 18 16:34:38 user-Linux stunnel: LOG7[0]: Sending close_notify alert May 18 16:34:38 user-Linux stunnel: LOG7[0]: TLS alert (write): warning: close notify May 18 16:34:38 user-Linux stunnel: LOG6[0]: SSL_shutdown successfully sent close_notify alert May 18 16:34:38 user-Linux stunnel: LOG5[0]: Connection closed: 98 byte(s) sent to TLS, 0 byte(s) sent to socket May 18 16:34:38 user-Linux stunnel: LOG7[0]: Remote descriptor (FD=11) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Local descriptor (FD=3) closed May 18 16:34:38 user-Linux stunnel: LOG7[0]: Service [*redacted*]finished (0 left)

1 0

chroot jail on debian 11 for stunnel steps?
by trashrap22＠gmail.com 11 May '23

11 May '23

Does someone have all the steps in order to setup a chroot jail on debian 11 OS - I have followed [this](https://manpages.debian.org/testing/stunnel4/stunnel.8.en.html) mostly - but think I am going to miss some differences to Debian 11 and go down a rabbit hole. Anyone have done it on Debian 11 care to share the steps?

3 3

Re: stunnel not starting
by Christopher Schultz 10 May '23

10 May '23

Hello, On 5/10/23 00:28, d3rIIIe15ter Tier wrote: > Please advise why you strongly advise running stunnel in a chroot jail? Because: 1. It's insanely easy to do (it literally IS just "chroot=/path/to/jail") and 2. If there is a problem with stunnel (e.g. security issue), the amount of damage an attacker can do is significantly limited -chris > On Tue, May 9, 2023 at 5:59 PM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Hello, > > On 5/9/23 11:13, d3rIIIe15ter Tier wrote: > > After giving access to var/log/secure/stunnel.log, I now get logs! > > > > There I get the following error: > > > > Cannot create pid file /var/run/stunnel4.pid > > create: Permission denied (13) > > What is the euid of the stunnel process? Does it have access to that > path? Are you using a chroot jail? (You should be.) Does that path > exist > in the chroot jail? Can the stunnel user write to that path? > > -chris > > > On Tue, May 9, 2023 at 4:34 PM d3rIIIe15ter Tier > <trashrap22(a)gmail.com <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> wrote: > > > > You are right... bad mistake. > > > > Now I get: cannot open log file - which I am sure is a > permission > > thing since I need to use sudo to be able to write to that file. > > Any ideas further? > > > > On Tue, May 9, 2023 at 4:21 PM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> > > wrote: > > > > Hello, > > > > On 5/9/23 10:17, d3rIIIe15ter Tier wrote: > > > I have tried changing the location to > > > > > > var/log/stunnel4/stunnel.log > > > var/log/stunnel4/stunnelLog > > > var/log/secure/ > > > var/log/secure/stunnel.log > > > etc/stunnel/stunnel.log > > > etc/stunnel/stunnelLog > > > > > > don't know how to fix it yet... > > I don't think the *value* is the problem. The problem is that > > you have > > defined "output" somewhere that isn't valid, such as within a > > specific > > service's section instead of as a global setting. > > > > -chris > > > > > On Tue, May 9, 2023 at 3:54 PM Christopher Schultz > > > <chris(a)christopherschultz.net > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>>> wrote: > > > > > > Hello, > > > > > > On 5/9/23 09:40, trashrap22(a)gmail.com > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> > > > wrote: > > > > Hi, I am on Debian - when I run "sudo stunnel > > stunnel.conf" I > > > get the following output: > > > > > > > > [ ] Clients allowed=500 > > > > [.] stunnel 5.56 on x86_64-pc-linux-gnu platform > > > > [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 > > > > [.] Running with OpenSSL 1.1.1n 15 Mar 2022 > > > > [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD > > > TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP > > > > [ ] errno: (*__errno_location ()) > > > > [.] Reading configuration from file > > /etc/stunnel/stunnel.conf > > > > [.] UTF-8 byte order mark not detected > > > > [.] FIPS mode disabled > > > > [ ] Compression disabled > > > > [ ] No PRNG seeding was required > > > > [!] /etc/stunnel/stunnel.conf:24: "output = > > /tmp/stunnel.log": > > > Specified option name is not valid here > > > > [ ] Deallocating section defaults > > > > > > > > When I run "sudo netstat -tulnp | grep -i > stunnel" I > > also get no > > > output - which means that stunnel is not starting up? > > > > > > The log message seems pretty specific to me. Maybe you > > should fix that? > > > > > > -chris > > > _______________________________________________ > > > stunnel-users mailing list -- > stunnel-users(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > To unsubscribe send an email to > > stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > > > _______________________________________________ > > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > To unsubscribe send an email to > stunnel-users-leave(a)stunnel.org <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > <mailto:[email protected]> > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org > <mailto:[email protected]> >

1 0

stunnel not starting
by trashrap22＠gmail.com 09 May '23

09 May '23

Hi, I am on Debian - when I run "sudo stunnel stunnel.conf" I get the following output: [ ] Clients allowed=500 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled with OpenSSL 1.1.1k 25 Mar 2021 [.] Running with OpenSSL 1.1.1n 15 Mar 2022 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [!] /etc/stunnel/stunnel.conf:24: "output = /tmp/stunnel.log": Specified option name is not valid here [ ] Deallocating section defaults When I run "sudo netstat -tulnp | grep -i stunnel" I also get no output - which means that stunnel is not starting up?

4 7

Update newest version
by sportman7＠netzero.com 05 May '23

05 May '23

Have used Stunnel for years. To update I normally download the latest version and copy the files (DLL, exe, etc.) to my client's computers. But I tried this with latest update and I must be missing something as my app is not able to use this version. Went back to previous version but really need to know how to deliver the update to a client's computer. Thanks for any ideas on this.

2 2

stunnel and Google LDAP
by matt.colwell＠sduhsd.net 01 May '23

01 May '23

Hi, I'm trying to setup stunnel as a proxy to Google Workplace's LDAP service. I followed the instructions located here: https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3… I've set the up on Ubuntu 22.04.2 LTS When attempting to connect I get the following error: SSL_read: ../ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading Connection reset: 217 byte(s) sent to TLS, 164 byte(s) sent to socket What might be my issue here? thanks

1 0

error starting / restarting /etc/init.d/stunnel4 on debian
by trashrap22＠gmail.com 28 Apr '23

28 Apr '23

Hi, I am not getting any stunnel logs. Though my syslog gives me the info below. The stunnel4 file in /usr/bin/ is empty? Apr 28 15:18:01 User-Linux systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Apr 28 15:18:01 User-Linux stunnel4[30850]: Starting TLS tunnels: /etc/stunnel/stunnel.conf: Apr 28 15:18:01 User-Linux stunnel4[30864]: /sbin/start-stop-daemon: unable to start /usr/bin/stunnel4 (Exec format error) Apr 28 15:18:01 User-Linux stunnel4[30850]: failed Apr 28 15:18:01 User-Linux stunnel4[30850]: You should check that you have specified the pid= in you configuration file

4 4

Is there installing instructions for Stunnel on Debian ?
by trashrap22＠gmail.com 26 Apr '23

26 Apr '23

Hi, I don't see installing instructions for Linux or rather for Debian specifically anywhere ?

4 4

FW: Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

Actually I think the SSLv3 in the log is a lie - as this is also in the log just before the below: TLS state (connect): before/connect initialization TLS state (connect): SSLv3 write client hello A TLS state (connect): SSLv3 read server hello A So I am thinking the eliptic curve stuff is more likely the issue? Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 _____________________________________________ From: Eberhard <flash(a)vicsmba.com> Sent: Tuesday, March 14, 2023 9:15 AM To: 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Subject: Help with disabling SSLv3 Importance: High I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

2 1

Help with disabling SSLv3
by Eberhard 14 Mar '23

14 Mar '23

I am suddenly getting errors from Fedex: TLS state (connect): SSLv3 read server certificate A error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long My .conf file says: output = /tmp/fedex.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ws.fedex.com:443 ;connect = gateway.fedex.com:443 ;connect = wssha1ends12172016.fedex.com:443 sslVersion = TLSv1.2 options = NO_SSLv3 sslVersionMin = TLSv1.2 CAfile = /usr/local/ssl/certs/cacert.pem It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform Compiled/running with OpenSSL 1.0.2 22 Jan 2015 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI Invalid configuration file name "--version" realpath: No such file or directory (2) Yet the log implies I am still trying SSLv3. Any ideas? Thanks in advance. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115

1 0

Stunnel Installation.
by nathan.king＠unpredictableporridge.co.uk 12 Mar '23

12 Mar '23

Hello, New stunnel user here - or trying to ne! I manage a streaming service using both SHOUT and Icecast servers, on a Widows 10 platform. Have been hit by the update to the G/Chrome browser, and while the Website is secure, the streams are not. There is limited support for S.S.L. for Icecast, but none for SHOUTcast. Was recommended to use S.S.L., but apparently the OpenSSL library isn't downloaded for Widows, only Linux, so have tried using Debian 11, which have installed within VirtualBox. However, have had no luck making the connection. Happened to read in another tutorial that if stunnel isn't installed on the same Computer, as the Playout system and encoder - use B.U.T.T., and Sound Empire Caster - one has to have stunnel installed on both Computers? Is the above true? EIther way,, would appreciate some advice on how to resolve this issue, and am new to stunnel, and only a basic knowledge of Debian. Thanks for your help with this issue. Cheers.

3 8

stunnel as server dont connect to endpoint
by mahdi.section8＠gmail.com 05 Mar '23

05 Mar '23

hello everyone i have a setup of openvpn + stunnel stunnel(client) in a server stunnel(server) + openvpn in another server both were working fine until i moved the second server to another one i moved all openvpn and stunnel files to new one but even though its same stunnel it dont work properly i even compiled latest 5.69 version thinking it was a bug this is my stunnel config: setuid = root setgid = root [openvpn] cert=/etc/stunnel/cert.pem key=/etc/stunnel/key.pem accept = 0.0.0.0:1381 connect = 127.0.0.1:1194 its so simple yet idk whats the problem, cause in the logs i only see from stunnel that a connection from ip x accepted but nothing else saying that it connected to 127.0.0.1:1194 its just accepting connections and nothing more like it forgot there is a connect option there. but i confirm openvpn is correct as i tested with netcat and openvpn showed up in logs saying there is a connection but somehow stunnel dont connect to 127.0.0.1:1194 its crazy that either i forgot something or misconfig of stunnel cause its so simple and its not working

2 2

stunnel 5.69 released
by Michał Trojnara 04 Mar '23

04 Mar '23

Dear Users, I have released version 5.69 of stunnel. ### Version 5.69, 2023.03.04, urgency: MEDIUM * New features - Improved logging performance with the "output" option. - Improved file read performance on the WIN32 platform. - DH and kDHEPSK ciphersuites removed from FIPS defaults. - Set the LimitNOFILE ulimit in stunnel.service to allow for up to 10,000 concurrent clients. * Bugfixes - Fixed the "CApath" option on the WIN32 platform by applying https://github.com/openssl/openssl/pull/20312. - Fixed stunnel.spec used for building rpm packages. - Fixed tests on some OSes and architectures by merging Debian 07-tests-errmsg.patch (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1ff7d9f30884c75b98c8a0a4e1534fa79adcada2322635e6787337b4e38fdb81 stunnel-5.69.tar.gz 66c4f3bbb94c4a274f2e8e98e3d44e74c0460d6494986f0a94b9b8becdc63cc3 stunnel-5.69-win64-installer.exe 74813a0be13270b5348fc4bc7c16ada668d151773be19f404db1176b7e22aafc stunnel-5.69-android.zip Best regards, Mike

1 0

Can I use SCCM to push the install of stunnel to multiple devices
by kmbpabvmkrmtzuzurk＠bbitf.com 27 Feb '23

27 Feb '23

Just a quick question around this and are there any documentation/guides that could be useful?

1 0

Stunnel Configuration issues
by ringbretson＠keplp.com 22 Feb '23

22 Feb '23

I'm trying to create a FIX application that interfaces with ICE using Stunnel to provide encryption. I'm encountering a handshake failure trying to interface with the FIX application. I've copies portions of the Stunnel configuration file as well as the entire FIX configuration file below. Can you do a quick review of the two configuration files and tell me what I'm doing wrong? Both FIX and Stunnel are running on the same Windows 10 virtual pc. *** Stunnel ERRORS with accept set to 127.0.0.1:83 *** 2023.02.21 20:07:13 LOG5[main]: stunnel 5.68 on x64-pc-mingw32-gnu platform 2023.02.21 20:07:13 LOG5[main]: Compiled/running with OpenSSL 3.0.8 7 Feb 2023 2023.02.21 20:07:13 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.02.21 20:07:13 LOG5[main]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2023.02.21 20:07:13 LOG5[main]: UTF-8 byte order mark detected 2023.02.21 20:07:13 LOG5[main]: FIPS mode disabled 2023.02.21 20:07:13 LOG3[main]: No trusted certificates found 2023.02.21 20:07:13 LOG5[main]: Configuration successful 2023.02.21 20:07:25 LOG5[0]: Service [fix_initiator_session1_tunnel] accepted connection from 127.0.0.1:62314 2023.02.21 20:07:25 LOG5[0]: s_connect: connected 63.247.113.201:443 2023.02.21 20:07:25 LOG5[0]: Service [fix_initiator_session1_tunnel] connected remote server from 192.168.1.219:62315 2023.02.21 20:07:25 LOG3[0]: SSL_connect: ssl/record/rec_layer_s3.c:1605: error:0A000410:SSL routines::sslv3 alert handshake failure 2023.02.21 20:07:25 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.02.21 20:07:26 LOG5[1]: Service [fix_initiator_session1_tunnel] accepted connection from 127.0.0.1:62316 2023.02.21 20:07:26 LOG5[1]: s_connect: connected 63.247.113.201:443 2023.02.21 20:07:26 LOG5[1]: Service [fix_initiator_session1_tunnel] connected remote server from 192.168.1.219:62317 2023.02.21 20:07:26 LOG3[1]: SSL_connect: ssl/record/rec_layer_s3.c:1605: error:0A000410:SSL routines::sslv3 alert handshake failure 2023.02.21 20:07:26 LOG5[1]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket *** FIX ERRORS with accept set to 127.0.0.1:49200 *** Same errors in stunnel, but (Socket Error: An existing connection was forcibly closed by the remote host.) in FIX Application *** Stunnel configuration *** [fix_initiator_session1_tunnel] client = yes accept = 127.0.0.1:83 connect = 63.247.113.201:443 cert = stunnel.pem ciphers = PSK PSKsecrets = psk.txt *** FIX 4.4 Configuration *** [DEFAULT] ConnectionType=initiator ReconnectInterval=60 FileStorePath=c:\Temp\WebIce_Initiator FileLogPath=c:\Temp\WebIce_Initiator StartTime=00:00:00 EndTime=23:59:59 SocketConnectHost=127.0.0.1 SocketConnectPort=83 ResetOnLogon=Y ResetOnLogout=Y ResetOnDisconnect=Y [SESSION] BeginString=FIX.4.4 SenderCompID=8655 SenderSubID=0921 TargetCompID=ICE HeartBtInt=30 ValidateFieldsOutOfOrder=N UseDataDictionary=Y DataDictionary=C:\Applications\WebIceInitiator_Pub\FIX44.xml CheckLatency=N SSLEnable=Y SSLProtocols=Tls12 SSLValidateCertificates=N SSLCertificateRevocation=N SSLCertificate=C:\Applications\WebIceInitiator_Pub\Wildcard.ingsoftware.net. pfx SSLCertificatePassword=9322 SSLRequireClientCertificate=N ScreenLogEvents=N ScreenLogShowIncoming=N ScreenLogShowOutgoing=N ScreenLogShowHeartBeats=N

1 0

tstunnel.exe fails to start after updating from 5.67 to 5.68
by Yasuhiro Kimura 21 Feb '23

21 Feb '23

Hello, I install stunnel to my 64bit Windows 10 22H2 PC with official Windows installer and use tstunnel.exe to create TLS connection to IMAP server with configuration file as following ("debug=debug" line is added for debugging purpose). ---------------------------------------------------------------------- client=yes verify=2 checkHost=imap.example.org CApath=C:/Users/yasu/.certs debug=debug [13579] accept=localhost:13579 connect=imap.example.org:143 protocol=imap ---------------------------------------------------------------------- With version 5.67, tstunnel.exe successfully starts as following. ---------------------------------------------------------------------- C:\Users\yasu>tstunnel C:\Users\yasu\Temp\tstunnel.conf 2023.02.19 04:29:11 LOG6[ui]: Initializing inetd mode configuration 2023.02.19 04:29:11 LOG7[ui]: Running on Windows 6.2 2023.02.19 04:29:11 LOG7[ui]: No limit detected for the number of clients 2023.02.19 04:29:11 LOG5[ui]: stunnel 5.67 on x64-pc-mingw32-gnu platform 2023.02.19 04:29:11 LOG5[ui]: Compiled/running with OpenSSL 3.0.7 1 Nov 2022 2023.02.19 04:29:11 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2023.02.19 04:29:11 LOG7[ui]: errno: (*_errno()) 2023.02.19 04:29:11 LOG6[ui]: Initializing inetd mode configuration 2023.02.19 04:29:11 LOG7[ui]: Running on Windows 6.2 2023.02.19 04:29:11 LOG5[ui]: Reading configuration from file C:\Users\yasu\Temp\tstunnel.conf 2023.02.19 04:29:11 LOG5[ui]: UTF-8 byte order mark not detected 2023.02.19 04:29:11 LOG5[ui]: FIPS mode disabled 2023.02.19 04:29:11 LOG6[ui]: Compression disabled 2023.02.19 04:29:11 LOG7[ui]: No PRNG seeding was required 2023.02.19 04:29:11 LOG6[ui]: Initializing service [13579] 2023.02.19 04:29:11 LOG6[ui]: stunnel default security level set: 2 2023.02.19 04:29:11 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2023.02.19 04:29:11 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2023.02.19 04:29:11 LOG7[ui]: TLS options: 0x2100000 (+0x0, -0x0) 2023.02.19 04:29:11 LOG6[ui]: Session resumption enabled 2023.02.19 04:29:11 LOG7[ui]: No certificate or private key specified 2023.02.19 04:29:11 LOG6[ui]: DH initialization skipped: client section 2023.02.19 04:29:11 LOG7[ui]: ECDH initialization 2023.02.19 04:29:11 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2023.02.19 04:29:11 LOG5[ui]: Configuration successful 2023.02.19 04:29:11 LOG7[ui]: Deallocating deployed section defaults 2023.02.19 04:29:11 LOG7[ui]: Binding service [13579] 2023.02.19 04:29:11 LOG7[ui]: Listening file descriptor created (FD=524) 2023.02.19 04:29:11 LOG7[ui]: Setting accept socket options (FD=524) 2023.02.19 04:29:11 LOG7[ui]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.02.19 04:29:11 LOG6[ui]: Service [13579] (FD=524) bound to ::1:13579 2023.02.19 04:29:11 LOG7[ui]: Listening file descriptor created (FD=528) 2023.02.19 04:29:11 LOG7[ui]: Setting accept socket options (FD=528) 2023.02.19 04:29:11 LOG7[ui]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2023.02.19 04:29:11 LOG6[ui]: Service [13579] (FD=528) bound to 127.0.0.1:13579 2023.02.19 04:29:11 LOG7[cron]: Cron thread initialized 2023.02.19 04:29:11 LOG6[cron]: Executing cron jobs 2023.02.19 04:29:11 LOG6[cron]: Cron jobs completed in 0 seconds 2023.02.19 04:29:11 LOG7[cron]: Waiting 86400 seconds ---------------------------------------------------------------------- And if I try `telnet localhost 13579`, then I can successfully connect to IMAP server. But after updating from 5.67 to 5.68, it fails to start as following. ---------------------------------------------------------------------- C:\Users\yasu>tstunnel C:\Users\yasu\Temp\tstunnel.conf [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.68 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.8 7 Feb 2023 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Users\yasu\Temp\tstunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [13579] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] No certificate or private key specified [!] No trusted certificates found [!] Service [13579]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [13579] ---------------------------------------------------------------------- Why these different results happen? Is it bug of 5.68? Or it there any incompatible change between 5.67 and 5.68? --- Yasuhiro Kimura

2 2

No peer temporary key received
by Michael S. Chusovitin 17 Feb '23

17 Feb '23

Hi folks, is there any chance to grasp why such a line - "No peer temporary key received" - is logged immediately after successful negotiation? It does not look harmful but I cannot understand *how ECDHE can do without the ephemeral key*. 2023.02.17 20:33:41 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:33:41 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:33:41 LOG6[4]: No peer temporary key received 2023.02.17 20:33:41 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:33:41 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:33:41 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:33:41 LOG7[4]: FD=524 ifds=--- ofds=r-- 2023.02.17 20:33:41 LOG7[4]: FD=540 ifds=rwx ofds=--- 2023.02.17 20:33:41 LOG5[4]: s_connect: connected 127.0.0.1:9000 The above is logged by Stunnel 5.67/5.68; whereas Stunnel 5.66 logs the very same moments differently: it says "SSL_get_peer_tmp_key: Peer suddenly disconnected" (but this can hardly be true). 2023.02.17 20:27:15 LOG6[4]: TLS accepted: new session negotiated 2023.02.17 20:27:15 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.02.17 20:27:15 LOG3[4]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2023.02.17 20:27:15 LOG7[4]: Compression: null, expansion: null 2023.02.17 20:27:15 LOG6[4]: s_connect: connecting 127.0.0.1:9000 2023.02.17 20:27:15 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2023.02.17 20:27:15 LOG7[4]: FD=512 ifds=--- ofds=r-- 2023.02.17 20:27:15 LOG7[4]: FD=528 ifds=rwx ofds=--- 2023.02.17 20:27:15 LOG5[4]: s_connect: connected 127.0.0.1:9000 Thanks in advance, Mikhail

1 0

blat, stunnel, and gmail with an app password
by blat_stunnel2023＠protonmail.com 17 Feb '23

17 Feb '23

I was using a Windows command line blat.exe mailer with stunnel along with a gmail account to send emails from a Windows command line batch file. Gmail started requiring I se the gmail account to allow "less secure" sign in options. That worked for a while, but in May 2022, gmail discontinued that option. It sounds like you can set two factor on the gmail account and then generate an app password for the gmail account. So I did that. I'm stumped on how to get either blat or stunnel to use that gmail app password though. Any ideas? Blat is looking super old though. I see when I set up this computer to with blat-stunnel-gmail, that I ran a line with blat.exe to store the gmail password. I don't see a way to store an app password, but blat is old. This is blat. http://www.blat.net./ Looks like the last update was in 2012, so app passwords may not have even existed then. Is there any way to stunnel to store a gmail app password? My goal is just to send an email from a Windows machine with either a Windows batch file or PowerShell script. It's not mission critical. It's for home use. I just like to get email alerts when my home machines complete some task. If something else works, I'm interested. It needs to work in a batch file though, or at least powershell if a batch file can't work. For my previous set up, I just kept stunnel updated, initially set up blat with the email information, and used only a batch file with blat to send emails from a gmail account. And then it was making sure less secure apps was an option on the gmail account. Now it's been broken for almost a year.

2 2

Windows offical release - Anyone knows which compiler is used ? VS or minigw ?
by roie rachamim 13 Feb '23

13 Feb '23

Many thanks, Roie

1 0

stunnel 5.68 released
by Michał Trojnara 12 Feb '23

12 Feb '23

Dear Users, I have released version 5.68 of stunnel. ### Version 5.68, 2023.02.07, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.8. * New features - Added the new 'CAengine' service-level option to load a trusted CA certificate from an engine. - Added requesting client certificates in server mode with 'CApath' besides 'CAfile'. * Bugfixes - Fixed EWOULDBLOCK errors in protocol negotiation. - Fixed handling TLS errors in protocol negotiation. - Prevented following fatal TLS alerts with TCP resets. - Improved OpenSSL initialization on WIN32. - Improved testing suite stability. - Improved file read performance. - Improved logging performance. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: dcd895ab088b043d4e0bafa8b934e7ab3e697293828dbe9fce46cb7609a7dacf stunnel-5.68.tar.gz 62807f6233c8a5693104c09b44ebde6cc395877d948651c3ff0767e07ccdd316 stunnel-5.68-win64-installer.exe 93291060fdfc889431e8bce5cfe875b23be2bac11e2338f8f8f84d509f1b33fa stunnel-5.68-android.zip Best regards, Mike

2 1

Cannot establish tunnel
by andrew.haworth＠roche.com 11 Feb '23

11 Feb '23

Hi, I am new to stunnel on a MAC. When I run stunnel with the enabled configuration [mllp-to-dip], I am prompted for a local password and then for my certificate passphrase. I am not able to establish a tunnel. See logs: Initializing service [mllp-to-dip] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Certificate loaded from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Loading private key from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [:] Insecure file permissions on /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key loaded from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key check succeeded [:] Service [mllp-to-dip] needs authentication to prevent MITM attacks [ ] DH initialization skipped: client section [ ] ECDH initialization [ ] ECDH initialized with curves X25519:P-256:X448:P-521:P-384 [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [mllp-to-dip] [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to :::6661: Address already in use (48) [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to 0.0.0.0:6661: Address already in use (48) [!] Binding service [mllp-to-dip] failed [ ] Unbinding service [mllp-to-dip] [ ] Service [mllp-to-dip] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [mllp-to-dip] Can someone help with my troubleshooting steps?

4 5

Setup Error
by Paul Gabriel 11 Feb '23

11 Feb '23

Hi, I am attempting to setup stunnel 5.67 in Windows Server 2022 core. I believe I have enabled TLS 1.2. Here is the output of stunnel starting up: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.67 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.7 1 Nov 2022 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [Integration Profile 1] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: art&music.pem [!] error queue: ssl/ssl_rsa.c:448: error:0A080002:SSL routines::system lib [!] error queue: crypto/bio/bss_file.c:300: error:10080002:BIO routines::system lib [!] SSL_CTX_use_certificate_chain_file: crypto/bio/bss_file.c:297: error:80000002:system library::No such file or directory [!] Service [Integration Profile 1]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [Integration Profile 1] Any suggestions on what is wrong? Thanks, Paul

2 1

Long time to tear off the certificate
by nizdiminov＠itopcase.ru 02 Feb '23

02 Feb '23

Good afternoon, I observe a problem in the operation of the stunnel. There are 5 active connections. I get an error **** Server unexpectedly disconnected Error performing handshake Before that, there is a pattern, it takes a very long time to tear off the certificate 5 мин. 2023.01.31 17:13:37 LOG7[15674:140480621389568]: open file /etc/stunnel/cert/eis/dit.cer with certificate 2023.01.31 17:18:25 LOG3[15674:140480621389568]: Credentials complete /opt/cprocsp/sbin/amd64/stunnel_thread -version stunnel 4.18 on x86_64-pc-linux-gnu Threading:PTHREAD Sockets:POLL,IPv6 Auth:LIBWRAP

1 0

Monitoring stunnel
by nizdiminov＠itopcase.ru 01 Feb '23

01 Feb '23

Good afternoon, tell me how best to monitor the stunnel? I use zabbix monitoring 5.4 , in my stunnel 5 connections 3 server 2 clients, all with certificate verification. It is necessary to monitor each connection separately. Maybe there is a template for zabbix monitoring 5.4 ?

1 0

help
by Gurjit Singh Jhutti 27 Jan '23

27 Jan '23

Is it possible to configure username and password for SMTP connection on Windows Server, did try this with any success in stunnel.conf [client] username = user password = password error: LOG6[main]: Initializing service [client] LOG3[main]: ....\stunnel.conf:73: "username = user": Specified option name is not valid here LOG3[main]: Configuration failed

1 0

Odd stunnel problem
by Phil Smith III 26 Jan '23

26 Jan '23

Well, odd to me. I use K9, a free Bayesian spam proxy I've used for ~20 years. It doesn't do TLS. So I have: Outlook <-> K9 <-> stunnel <-> Internet for email connections. This morning I wasn't getting anything on my dozen or so POP connections that go through that (Exchange email was fine). Restarted Outlook (making sure it had really closed), no joy. Then I noticed that while doing a mail check, K9 was throbbing for long periods. There's not much to do with K9, so next I looked at stunnel, whose log was full of: 2023.01.26 09:39:26 LOG3[18110]: No more addresses to connect 2023.01.26 09:39:36 LOG3[18111]: s_connect: s_poll_wait 146.20.147.244:995: TIMEOUTconnect exceeded Reloaded stunnel config and all is well. So, not a big deal, but.any guesses what was going on here? stunnel 5.57, Windows 10.

1 0

Stunnel activity issue
by Денис Голубятников 26 Jan '23

26 Jan '23

I have problems with stunnel on OS Windows. After a successful connection with stunnel, the connection drops after approximately 9 minutes of inactivity. On Linux, this problem was solved by changing this parametrs: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 I don't have access to the server side router, so I can't change anything. Stunnel log: 2023.01.25 17:18:10 LOG7[1]: Service [test] started 2023.01.25 17:18:10 LOG7[1]: Setting local socket options (FD=964) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on local socket 2023.01.25 17:18:10 LOG5[1]: Service [test] accepted connection from 127.0.0.1:50145 2023.01.25 17:18:10 LOG6[1]: s_connect: connecting 225.179.85.93:18572 2023.01.25 17:18:10 LOG7[1]: s_connect: s_poll_wait 225.179.85.93:18572: waiting 10 seconds 2023.01.25 17:18:10 LOG7[1]: FD=716 ifds=rwx ofds=--- 2023.01.25 17:18:10 LOG5[1]: s_connect: connected 225.179.85.93:18572 2023.01.25 17:18:10 LOG5[1]: Service [onegomed] connected remote server from 192.168.1.84:50146 2023.01.25 17:18:10 LOG7[1]: Setting remote socket options (FD=716) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on remote socket 2023.01.25 17:18:10 LOG7[1]: Remote descriptor (FD=716) initialized 2023.01.25 17:18:10 LOG6[1]: SNI: sending servername: 225.179.85.93 2023.01.25 17:18:10 LOG6[1]: Peer certificate not required 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): before SSL initialization 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read encrypted extensions 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server certificate 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read server certificate verify 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read finished 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write change cipher spec 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write finished 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) requested 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) succeeded 2023.01.25 17:18:10 LOG7[1]: 0 client renegotiation(s) requested 2023.01.25 17:18:10 LOG7[1]: 0 session reuse(s) 2023.01.25 17:18:10 LOG6[1]: TLS connected: new session negotiated 2023.01.25 17:18:10 LOG6[1]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2023.01.25 17:18:10 LOG6[1]: Peer temporary key: X25519, 253 bits 2023.01.25 17:18:10 LOG7[1]: Compression: null, expansion: null 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 8E91DBE369D9E16221CCA288A7C1F652AB045BAE96C19B4240B1B7F710069CCE 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 6UIA254BF9D027B3D4BE5F966BDE9DE2058CF167C4EF0CD5A460958B698DF322 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:33:25 LOG3[1]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2023.01.25 17:33:25 LOG5[1]: Connection reset: 5184 byte(s) sent to TLS, 10344 byte(s) sent to socket 2023.01.25 17:33:25 LOG7[1]: Remote descriptor (FD=716) closed 2023.01.25 17:33:25 LOG7[1]: Local descriptor (FD=964) closed 2023.01.25 17:33:25 LOG7[1]: Service [test] finished (0 left)` I tried: * changing the windows registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveInterval HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissions HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TdxPrematureConnectIndDisabled HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\KeepAliveTimeout HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\ServerInfoTimeout * changing stunnel config on client side: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 * changing parametrs on linux server side: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 * add server cert on stunnel client config; * downgrade and update stunnel. -- Gordon Stevenson Отправлено из Почты Mail.ru

1 0

forward all UDP port
by Ahmad Kiamanesh 23 Jan '23

23 Jan '23

Hi how can forward all inner UDP ports from one server to another server?

1 0

STunnel not passing traffic
by Gary Jackson 15 Jan '23

15 Jan '23

I have an application that sends XML encrypted traffic over TCP to Stunnel. Stunnel is supposed to unencrypt and send to backend application unencrypted, however no traffic is sent. I have used wireshark and I do see the client hello for tls1.2 and the server hello for tls 1.2 so the cipher negotiation is completed. Here is my config: sslVersionMax = TLSv1.2 options = -NO_SSLv3 [https] accept = 27015 connect = 27001 cert = cert.pem key = key.pem TIMEOUTclose = 0 STunnel Log in Debug 7 2023.01.13 14:03:42 LOG7[16572]: Service [https] started 2023.01.13 14:03:42 LOG7[16572]: Setting local socket options (FD=1888) 2023.01.13 14:03:42 LOG7[16572]: Option TCP_NODELAY set on local socket 2023.01.13 14:03:42 LOG5[16572]: Service [https] accepted connection from xx.xx.xx.xx:62478 2023.01.13 14:03:42 LOG6[16572]: Peer certificate not required 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): before SSL initialization 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): before SSL initialization 2023.01.13 14:03:42 LOG7[16572]: Decrypt session ticket callback 2023.01.13 14:03:42 LOG7[16572]: Initializing application specific data for session authenticated 2023.01.13 14:03:42 LOG7[16572]: SNI: no virtual services defined 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read client hello 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server hello 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write certificate 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write key exchange 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server done 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write server done 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read client key exchange 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read change cipher spec 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS read finished 2023.01.13 14:03:42 LOG7[16572]: Generate session ticket callback 2023.01.13 14:03:42 LOG7[16572]: Initializing application specific data for session authenticated 2023.01.13 14:03:42 LOG7[16572]: Deallocating application specific data for session connect address 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write session ticket 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write change cipher spec 2023.01.13 14:03:42 LOG7[16572]: TLS state (accept): SSLv3/TLS write finished 2023.01.13 14:03:42 LOG7[16572]: 33 server accept(s) requested 2023.01.13 14:03:42 LOG7[16572]: 33 server accept(s) succeeded 2023.01.13 14:03:42 LOG7[16572]: 0 server renegotiation(s) requested 2023.01.13 14:03:42 LOG7[16572]: 0 session reuse(s) 2023.01.13 14:03:42 LOG7[16572]: 1 internal session cache item(s) 2023.01.13 14:03:42 LOG7[16572]: 0 internal session cache fill-up(s) 2023.01.13 14:03:42 LOG7[16572]: 0 internal session cache miss(es) 2023.01.13 14:03:42 LOG7[16572]: 0 external session cache hit(s) 2023.01.13 14:03:42 LOG7[16572]: 0 expired session(s) retrieved 2023.01.13 14:03:42 LOG6[16572]: TLS accepted: new session negotiated 2023.01.13 14:03:42 LOG6[16572]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2023.01.13 14:03:42 LOG3[16572]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2023.01.13 14:03:42 LOG7[16572]: Compression: null, expansion: null 2023.01.13 14:03:42 LOG7[16572]: Deallocating application specific data for session connect address 2023.01.13 14:03:42 LOG6[16572]: s_connect: connecting 127.0.0.1:27001 2023.01.13 14:03:42 LOG7[16572]: s_connect: s_poll_wait 127.0.0.1:27001: waiting 10 seconds 2023.01.13 14:03:42 LOG7[16572]: FD=1472 ifds=rwx ofds=--- 2023.01.13 14:03:42 LOG5[16572]: s_connect: connected 127.0.0.1:27001 2023.01.13 14:03:42 LOG6[16572]: persistence: 127.0.0.1:27001 cached 2023.01.13 14:03:42 LOG5[16572]: Service [https] connected remote server from 127.0.0.1:56732 2023.01.13 14:03:42 LOG7[16572]: Setting remote socket options (FD=1472) 2023.01.13 14:03:42 LOG7[16572]: Option TCP_NODELAY set on remote socket 2023.01.13 14:03:42 LOG7[16572]: Remote descriptor (FD=1472) initialized 2023.01.13 14:03:42 LOG6[16572]: SSL_read: Socket is closed 2023.01.13 14:03:42 LOG6[16572]: TLS socket closed (SSL_read) 2023.01.13 14:03:42 LOG7[16572]: Sent socket write shutdown 2023.01.13 14:03:42 LOG5[16572]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2023.01.13 14:03:42 LOG7[16572]: Remote descriptor (FD=1472) closed 2023.01.13 14:03:42 LOG7[16572]: Local descriptor (FD=1888) closed 2023.01.13 14:03:42 LOG7[16572]: Service [https] finished (1 left) Any assistance you can provide would be glorious! _________________________________ Gary Jackson

2 1

Setup and Installing stunnel on windows wsl2 Ubuntu
by adamsaltlake＠hotmail.com 25 Nov '22

25 Nov '22

I am new to stunnel and have been struggling for weeks to get it to work on windows wsl2 ubuntu; it keep failing with pid error "You should check that you have specified the pid= in you configuration file" any idea is welcome

1 0

Self signed certificate check
by Bob Bob 20 Nov '22

20 Nov '22

Hi, I have two Windows based stations with one hosting a specific service. Stunnel is used to create a secure connection. As stated on the auth page, I have implemented PSK to prevent MITM Attack but also as a way to authenticate connections and limit who can connect to the server. I would like to add an extra layer of security by having the Server only accept connections when the client submits a pre-agreed self cert. verifyPeer does not seem to work with self certificate. I would like to end up with PSK + certificate check. Is there a way to achieve that with self certificate on Stunnel? Thanks.

1 0

Windows 10 Pro - StartService: error 1053
by jason99si＠gmail.com 11 Nov '22

11 Nov '22

I'm installing stunnel for a second time. I'm using it for Blue Iris on a Windows 10 Pro machine. I'm using stunnel 5.67 on Win64. GUI shows "Configuration successful". I've tried uninstalling and reinstalling numerous times. When I run stunnel Service Start I receive a dialog box that says: stunnel 5.67 on Win64 (not configured) StartService: error 1053: The service did not respond to the start or control request in a timely fashion Can anyone help?

2 2

Two certificates on same connection
by perisnagini＠gmail.com 07 Nov '22

07 Nov '22

hi, I am into implementations and generally use stunnel with a certification provided by our third party connections in stunnel for encryption/ decryption both ways. Recently we had a query from one of our vendors stating we must use one cert to encrypt which they will decrypt using the key provided by us and they will encrypt which must be decrypted using the key provided. Keeping it simple we have below: Client Key - clt.pem Client cert - clt.cer Vendor key - vndr.pem our ca certs - ca-cert.pem Could anyone help me in understanding how do I leverage vendor key for decrypting and clt key for encrypting in stunnel.conf using the above certs. Many Thanks.

1 0

error:0A000126:SSL routines::unexpected eof while reading
by sburke＠unitedelectric.com 07 Nov '22

07 Nov '22

Hello, I am trying to get a system notification email back up and running after google disabled the "use less secure apps" functionality in the Gmail platform. I have set up the Gmail account to use an app password which I assigned to the system that was sending emails before this change. It appears the system is now connecting to Stunnel running on a windows 10 machine and Stunnel is making the connection with the Gmail server again, but no email actually gets sent out. I am running Stunnel 5.66 Here is the configuration currently: [gmail-smtp] client = yes accept = 25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.Gmail.com OCSPaia = yes Here is a copy of the log file: 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] accepted connection from 192.168.100.200:56399 2022.09.20 07:40:49 LOG5[0]: s_connect: connected 74.125.138.109:465 2022.09.20 07:40:49 LOG5[0]: Service [gmail-smtp] connected remote server from 172.16.4.220:60367 2022.09.20 07:40:49 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gtsr1" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gts1c3" 2022.09.20 07:40:50 LOG5[0]: s_connect: connected 142.251.40.67:80 2022.09.20 07:40:50 LOG5[0]: OCSP: Certificate accepted 2022.09.20 07:40:50 LOG5[0]: Certificate accepted at depth=0: CN=smtp.gmail.com 2022.09.20 07:40:51 LOG3[0]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.09.20 07:40:51 LOG5[0]: Connection reset: 92 byte(s) sent to TLS, 620 byte(s) sent to socket Is this something I can remedy from the configuration, or is this something that requires modification on the email server side? Thank you sean

3 2

Re: stunnel 5.67 released
by Rok Berlec 07 Nov '22

07 Nov '22

Hi, When we install version 5.67 we sometimes get the message: "The procedure entry point OPENSSL_strcasecmp could not be located" After start of service everything looks fine. We upgrade by uninstalling the previous version and installing the latest one. Best regards, Rok Berlec

1 0

stunnel 5.67 released
by Michał Trojnara 01 Nov '22

01 Nov '22

Dear Users, I have released version 5.67 of stunnel. ### Version 5.67, 2022.11.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.7. * New features - Provided a logging callback to custom engines. * Bugfixes - Fixed "make cert" with OpenSSL older than 3.0. - Fixed the code and the documentation to use conscious language for SNI servers (thx to Clemens Lang). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3086939ee6407516c59b0ba3fbf555338f9d52f459bcab6337c0f00e91ea8456 stunnel-5.67.tar.gz a6bdc2a735eb34465d10e3c7e61f32d679ba29a68de8ea8034db79c0c8b328a3 stunnel-5.67-win64-installer.exe 893f53d6647900eb34041be8f21a21c052a31de3fb393a97627021a1ef2752f5 stunnel-5.67-android.zip Best regards, Mike

1 0

"make cert" get "Error configuring OpenSSL modules"
by decatur93＠163.com 28 Oct '22

28 Oct '22

Hi, all. I have done "make && make install" under "sudo", then I got this when "make cert" --------------------------------------------------------------- make -C tools cert make[1]: Entering directory '/opt/stunnel-5.66/tools' ./makecert.sh . /usr /dev/urandom OpenSSL 1.1.1f 31 Mar 2020 1+0 records in 1+0 records out 256 bytes copied, 0.0001303 s, 2.0 MB/s Error configuring OpenSSL modules 139784943940928:error:25066067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(libproviders.so): libproviders.so: cannot open shared object file: No such file or directory 139784943940928:error:25070067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:162: 139784943940928:error:0E07506E:configuration file routines:module_load_dso:error loading dso:../crypto/conf/conf_mod.c:224:module=providers, path=providers 139784943940928:error:0E076071:configuration file routines:module_run:unknown module name:../crypto/conf/conf_mod.c:165:module=providers Certificate details: Can't open stunnel.pem for reading, No such file or directory 139707919738176:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:69:fopen('stunnel.pem','r') 139707919738176:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:76: unable to load certificate /usr/bin/install -c -b -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem /usr/bin/install: cannot stat 'stunnel.pem': No such file or directory make[1]: *** [Makefile:579: cert] Error 1 make[1]: Leaving directory '/opt/stunnel-5.66/tools' make: *** [Makefile:894: cert] Error 2 ------------------------------------------------------------------ It seems I have no libproviders.so, but I have installed openssl. Can anyone help me? Thx.

3 2

stunnel as simple TLS terminator to web backend -- works, but 1st response is blank page, after reload all's good ?
by PGNet Dev 15 Oct '22

15 Oct '22

I'm running [.] stunnel 5.66 on x86_64-redhat-linux-gnu platform [.] Compiled/running with OpenSSL 3.0.5 5 Jul 2022 on lsb_release -rd Description: Fedora release 36 (Thirty Six) Release: 36 uname -rm 5.19.15-201.fc36.x86_64 x86_64 it's setup to frontend terminate TLS in front of a bind9 nameserver instance's statistics (http-only) web server backend. it's a trivial config, cat /etc/stunnel/stunnel.conf debug = 5 syslog = yes [bind9-stats] accept = ns.example.com:10000 connect = 127.0.0.1:10001 sslVersion = TLSv1.3 ciphersuites = TLS_CHACHA20_POLY1305_SHA256 requireCert = yes verifyChain = yes verifyPeer = no CAfile = /usr/local/etc/stunnel/example_CA.CHAIN.crt.pem cert = /usr/local/etc/stunnel/ns.example.com.COMBINED.pem key = /usr/local/etc/stunnel/ns.example.com.server.key.pem sessionCacheSize = 1 sessionCacheTimeout = 360 and it does provide access, with no apparent/reported *error*, afaict. but, on initial access, i.e. first nav to the exposed site page, I get a blank page. simply RELOADING the browser page cures the problem. page display, with current/correct data -- as do all (sub)links on the page. this is repeatable behavior in multiple browsers (Firefox, Chromium, Chrome). so far i've not found any indication of an actual error -- only this 1st-page-visit-is-blank behavior, unique to my stunnel usage. other/heavier frontends have no such issue. odd, but not fatal. or even, apparently, problematic (so far, i think). is this a pebkac/config issue? or a known issue/bug? other?

1 0

SSL Termination Issue
by Gary Jackson 15 Oct '22

15 Oct '22

We have an STunnel configuration running to take encrypted TLS traffic from customers and pass it to our application unencrypted. We have purchased a CA signed certificate, but we are receiving an error when negotiating. We have tried many searches/configurations with no progress. STunnel General Config ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-;RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:AES256-GCM-;SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-;AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:AES128-GCM-SHA256 curves = X25519:P-256:X448:P-521:P-384 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d STunnel Service Specific Config ; TLS front-end to a web server [https] accept = 27015 connect = 172.31.4.10:9000 cert = mycert.pem key = mycert.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 STunnel Debug 2022.10.15 11:16:08 LOG6[769]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.15 11:16:08 LOG3[769]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.15 11:16:08 LOG7[769]: Compression: null, expansion: null 2022.10.15 11:16:08 LOG7[769]: Deallocating application specific data for session connect address 2022.10.15 11:16:08 LOG6[769]: s_connect: connecting x.x.x.x:9000 2022.10.15 11:16:08 LOG7[769]: s_connect: s_poll_wait x.x.x.x:9000: waiting 10 seconds 2022.10.15 11:16:08 LOG7[769]: FD=792 ifds=--- ofds=r-- 2022.10.15 11:16:08 LOG7[769]: FD=888 ifds=rwx ofds=--- 2022.10.15 11:16:08 LOG5[769]: s_connect: connected x.x.x.x:9000 2022.10.15 11:16:08 LOG6[769]: persistence: x.x.x.x:9000 cached 2022.10.15 11:16:08 LOG5[769]: Service [https] connected remote server from x.x.x.x:52720 2022.10.15 11:16:08 LOG7[769]: Setting remote socket options (FD=888) 2022.10.15 11:16:08 LOG7[769]: Option TCP_NODELAY set on remote socket 2022.10.15 11:16:08 LOG7[769]: Remote descriptor (FD=888) initialized 2022.10.15 11:16:09 LOG6[769]: SSL_read: Socket is closed 2022.10.15 11:16:09 LOG6[769]: TLS socket closed (SSL_read) 2022.10.15 11:16:09 LOG7[769]: Sent socket write shutdown Any assistance would be GREATLY appreciated! Thank you. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

2 3

Peer Suddenly Disconnects after Negotiating TLS
by Gary Jackson 13 Oct '22

13 Oct '22

I have a TLS Connection that appears to be established but then is terminating and not sure what would cause this. 2022.10.13 14:56:36 LOG5[12435]: Service [https] accepted connection from 97.72.232.10:62890 2022.10.13 14:56:36 LOG6[12435]: Peer certificate not required 2022.10.13 14:56:36 LOG6[12435]: TLS accepted: new session negotiated 2022.10.13 14:56:36 LOG6[12435]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.13 14:56:36 LOG3[12435]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.13 14:56:36 LOG6[12435]: s_connect: connecting 172.31.4.10:9000 2022.10.13 14:56:36 LOG5[12435]: s_connect: connected 172.31.4.10:9000 2022.10.13 14:56:36 LOG6[12435]: persistence: 172.31.4.10:9000 cached 2022.10.13 14:56:36 LOG5[12435]: Service [https] connected remote server from 172.31.4.20:59907 2022.10.13 14:56:36 LOG6[12435]: SSL_read: Socket is closed 2022.10.13 14:56:36 LOG6[12435]: TLS socket closed (SSL_read) 2022.10.13 14:56:36 LOG5[12435]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Thanks in advance. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

1 0

SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading
by carango＠ingeniocarmelita.com 13 Oct '22

13 Oct '22

Hello I have the same problem, any solution? SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading

1 0

32-bit windows download
by Ágnes Kakasi 27 Sep '22

27 Sep '22

Hi, I'm looking for help to download and install Stunnel on a laptop with 32-bit Windows 7. I have downloaded the available download file from the website (stunnel-5.66-win64-installer.exe) but the computer indicates it cannot open the file. I tried to find info on this and in the platform sections I found Stunnel can run on 32-bit, as well, but I don't know how to make it work. Can you please advise me on what the correct download file is and how to install it so that it works on this computer? Thank you in advance. Agnes

2 1

error:0A000438:SSL routines::tlsv1 alert internal error
by johannwang＠ami.com 21 Sep '22

21 Sep '22

Hello, I am trying to use the xvncviewer on Ubuntu by VNC over stunnel, it will connect failed and print "xvncviewer: read: Connection reset by peer". The LOG on VNC server is here: 2012.01.01 00:21:58 LOG7[1]: Initializing application specific data for session authenticated 2012.01.01 00:21:58 LOG7[1]: SNI: no virtual services defined 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS read client hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write key exchange 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate request 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server done 2012.01.01 00:21:58 LOG7[1]: TLS alert (read): fatal: internal error 2012.01.01 00:21:58 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1584: error:0A000438:SSL routines::tlsv1 alert internal error 2012.01.01 00:21:58 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2012.01.01 00:21:58 LOG7[1]: Deallocating application specific data for session connect address 2012.01.01 00:21:58 LOG7[1]: Local descriptor (FD=3) closed 2012.01.01 00:21:58 LOG7[1]: Service [vnc] finished (0 left) I am running Stunnel 5.63 Here is the configuration currently: stunnel.conf on VNC client: cert = /home/server.pem key = /home/privkey.pem [VNC] client = yes accept = 127.0.0.1:5901 connect = 172.31.100.121:5901 sslVersion = all verifyChain = yes CAfile = /home/server.pem checkIP = 172.31.100.121 stunnel.conf on VNC server: cert = /conf/server.pem ;key = /conf/certs/privkey.pem setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:TCP_NODELAY=1 debug = 7 foreground = yes client = no ciphers=AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM sslVersion = TLSv1.2 [vnc] accept = :::5901 connect = 5900 verify = 3 CAfile = /conf/server.pem Is this something I can remedy from the configuration, or is this something that requires modification? Thank you Johan

1 0

v5.66: failing test 081
by Andreas Vetter 20 Sep '22

20 Sep '22

Hi, in open build system I get the following failing test, when building and testing stunnel 5.66: [ 45s] 081. Test IPv6 support [ 45s] [client] Read '2022.09.15 21:17:15 LOG6[0]: TLS fd: Connection reset by peer (104)' [ 45s] ...................................................................... failed Is this a stunnel problem or a problem with logging inside the build system? What can I do to get more verbose information during build? The test is working for a similar target OS (openSUSE_Tumbleweed) and not for this one (openSUSE:Factory). The difference is small, but sometimes not neglectible: openSUSE:Factory is the to be tested submissions, always in the flow. openSUSE_Tumbleweed is a tested working snapshot of Factory. Best regards, Andreas

1 1

stunnel 5.66 released
by Michał Trojnara 11 Sep '22

11 Sep '22

Dear Users, I have released version 5.66 of stunnel. ### Version 5.66, 2022.09.11, urgency: MEDIUM * New features - OpenSSL 3.0 FIPS Provider support for Windows. * Bugfixes - Fixed building on machines without pkg-config. - Added the missing "environ" declaration for BSD-based operating systems. - Fixed the passphrase dialog with OpenSSL 3.0. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 558178704d1aa5f6883aac6cc5d6bbf2a5714c8a0d2e91da0392468cee9f579c stunnel-5.66.tar.gz 5fccb2e4db0d2e3c1adb26c3906585ac545baf88226f4f539b2dc43fe418a3ef stunnel-5.66-win64-installer.exe 3b1e30e060e16f6aa9a8ad1b1a6ba1210c165bf76bd01e4734cb4537e0717c09 stunnel-5.66-android.zip Best regards, Mike

1 0

Stunnel Consulting
by Gary Jackson 10 Sep '22

10 Sep '22

I am looking for someone to assist with an stunnel configuration on windows that will accept TLS1.2 connections and then send them unencrypted to an IP and port. I would need to get it working within the next week or so and am available most times if scheduled. Thank you. Gary Jackson Sent from my mobile

2 1

TLS 1.2 traffic on STunnel
by Gary Jackson 08 Sep '22

08 Sep '22

Good afternoon, I am trying to use Stunnel to accept traffic from a custom application using TLS 1.2 and a self signed cert and then send it to a back end application unencrypted. I want the configuration to only affect one listener on Stunnel and not all incoming ports. I am using Stunnel v.5.6 I am confused with all the documentation and what needs to be set in the config file for this use case. The config file currently has connections where it accepts traffic on one port and then directs it to another port internally but not with TLS 1.2. Thank you for all your knowledge and insight! _________________________________ Gary Jackson | Senior Systems Engineer

2 1

Certificate Request's "Distinguished Names" list is empty when using CAPath (but not when using CAFile)
by david.rundqvist＠gmail.com 26 Aug '22

26 Aug '22

Hi, If I hash the client certificates and put them in a folder (with file names <hash>.0), and use the CAPath parameter on the server, together with verify=3, the server's Certificate Request message contains an empty list of "Distinguished Names". However, if I put the client certificates concatenated in a .pem file, and use the CAFile parameter on the server, the Certificate Request message does contain the Distinguished Names. Is this the correct behavior? I thought CAFile and CAPath worked more or less in the same way, but perhaps the Certificate Request message is implemented differently, depending on if you use CAFile or CAPath? My preferred way is to use CAPath: Is there some way I can get the Distinguished Names not to be empty, when using CAPath? I'm on Windows, using stunnel version 5.49, currently. Thanks in advance! Kind regards, /David

2 1

looking to pay for stunnel support
by jkorman＠pcvisions1.com 24 Aug '22

24 Aug '22

I have an issue with a program that is 9 years old that uses old stunnel for email forwarding of automated alerts. I would gladly pay for support for assistance configuring the newest version of stunnel. My issue is that present configuration is sending smtp at tls 1.0 which is getting rejected. Please send me your info via email and I will promptly respond Joe Korman

1 0

FIPS-enabled Windows installer of stunnel
by Vadim Loevski 22 Aug '22

22 Aug '22

Hi, I would appreciate it if you let me know how I could obtain a FIPS-enabled Windows 64 bit installer of stunnel. Regards, Vadim

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users