stunnel-users

1 participants
3311 discussions

certificate verify failed
by Roman Tuchyna 19 Jun '13

19 Jun '13

Hi All, I'm trying to create SSl tunnel between my server (Win 2008 R2, 4.56 version of stunnel) and remote application server - I have merged both root and sub certificate into 1 file and it looks like it can verify them and accept them as well, but then it tries to verify it at depth=0 and says certificate not found in local repository. Am I missing anything here ? (I modified messages to not disclose details of certificates in the debug below). Thank you! BR, Roman 2013.06.18 11:22:34 LOG7[272:2156]: Service [SZX] started 2013.06.18 11:22:34 LOG5[272:2156]: Service [SZX] accepted connection from 127.0.0.1:49397 2013.06.18 11:22:34 LOG6[272:2156]: connect_blocking: connecting 10.254.0.21:443 2013.06.18 11:22:34 LOG7[272:2156]: connect_blocking: s_poll_wait 10.254.0.21:443: waiting 10 seconds 2013.06.18 11:22:34 LOG5[272:2156]: connect_blocking: connected 10.254.0.21:443 2013.06.18 11:22:34 LOG5[272:2156]: Service [SZX] connected remote server from 192.168.20.23:49398 2013.06.18 11:22:34 LOG7[272:2156]: Remote socket (FD=396) initialized 2013.06.18 11:22:34 LOG7[272:2156]: SNI: sending servername: 10.254.0.21 2013.06.18 11:22:34 LOG7[272:2156]: SSL state (connect): before/connect initialization 2013.06.18 11:22:34 LOG7[272:2156]: SSL state (connect): SSLv3 write client hello A 2013.06.18 11:22:34 LOG7[272:2156]: SSL state (connect): SSLv3 read server hello A 2013.06.18 11:22:34 LOG7[272:2156]: Starting certificate verification: depth=2, /CN=xxx RootCA 2013.06.18 11:22:34 LOG5[272:2156]: Certificate accepted: depth=2, /CN=xxx RootCA 2013.06.18 11:22:34 LOG7[272:2156]: Starting certificate verification: depth=1, /CN=xxx 2013.06.18 11:22:34 LOG5[272:2156]: Certificate accepted: depth=1, /CN=xxx SubCA1 2013.06.18 11:22:34 LOG7[272:2156]: Starting certificate verification: depth=0, /C=zzz 2013.06.18 11:22:34 LOG4[272:2156]: CERT: Certificate not found in local repository 2013.06.18 11:22:34 LOG4[272:2156]: Certificate check failed: depth=0, /C=zzz 2013.06.18 11:22:34 LOG7[272:2156]: SSL alert (write): fatal: certificate unknown 2013.06.18 11:22:34 LOG3[272:2156]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2013.06.18 11:22:34 LOG5[272:2156]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.06.18 11:22:34 LOG7[272:2156]: Remote socket (FD=396) closed 2013.06.18 11:22:34 LOG7[272:2156]: Local socket (FD=376) closed 2013.06.18 11:22:34 LOG7[272:2156]: Service [SZX] finished (0 left)

3 2

stunnel RHEL 6.3 and HTTPS header fields
by xxxxxxxxxxxxxxxxx 16 Jun '13

16 Jun '13

I'm an Stunnel newbie so forgive me if this question has been asked previously. I am using stunnel to accept a connection from http://127.0.0.1:someport/url/to/wsdland connect to hostname.somewhere.abc:443 Everything is working fine with the exception of a certain endpoint that responds with an HTTP status code of 403 "forbidden". What I have determined is that the server is rejecting the request due to the HTTP "Host:" field value, it's set to 127.0.0.1. Is there anyway to pass the value of the config file "connect" property instead (in my case "hostname.somewhere")?I have tried various config settings without success. Config entry: [testnesiis]client = yesaccept = 127.0.0.1:1445connect = testnesiis:443;protocolHost = testnesiis:443protocol = proxy;sni = testnesiis;transparent = both Thanks and Kudos to the authors of stunnel !

2 1

Certificate failure to verify with verify = 4 option
by Thomas Eifert 16 Jun '13

16 Jun '13

Greetings; Stunnel 4.56 running under Win 7 SP1 x86. Recently, the owners of a server I regularly connect to updated their server certificate; the former had expired at the end of May. As soon as that event occurred, I deleted the old certificate, then used the "save peer certificate" function of Stunnel to get the updated one. However, the new certificate fails to verify, even with the verify = 4 option in Stunnel. The error message is similar to what I used to get when doing a verify = 3 with some certificates. The general error output of Stunnel is: CERT: Verification error: unable to get local issuer certificate 2013.06.09 16:37:46 LOG4[608:2336]: Certificate check failed: depth=0 When I open the new certificate with: openssl x509 -text -in certname.pem and view the certificate details, I'm not seeing anything obvious. The certificate is within a valid date range, and contains the same basic elements as other certs I've viewed. The certificate appears to have been issued by Startcom LLC. If I comment out the verify statement, I'm able to successfully negotiate an SSL connection with the server. I realize that this may be more of an openssl issue than an issue with Stunnel. Nevertheless, I thought I'd start here and throw it out to the floor for comments. Anyone have any ideas or have run into this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2

tuning/multiple stunnel instance
by William Kwan 13 Jun '13

13 Jun '13

Dear all, I would like to find out if there's anyway to tune stunnel or what's the best practice you would recommend. I have a bit more than 100 sessions defined in stunnel.conf. It appears that clients started to see latency increase. Would you say 1. Split the conf file to multiple conf files and start multiple stunnel with each conf file? 2. Any way to tune stunnel to run muliple process with more threads? 3. Any other options? Thanks Will

2 1

stunnel doesn't create tunnel
by Roman Tuchyna 13 Jun '13

13 Jun '13

Hi All, I'm trying to create SSL tunnel between my server and remote application server and according to log file, stunnel fails to 0.0.0.0:43 Service [SZR] (FD=716) bound to 0.0.0.0:443 (although connect and accept are configured for this service). I'm using stunnel on Windows and apparently I'm doing something wrong - any hint or advice would be appreciated. I was searching for the reason, but couldn't find any pointer... Thank you! BR, Roman 2013.06.13 16:25:19 LOG7[2884:3032]: Dispatching signals from the signal pipe 2013.06.13 16:25:19 LOG7[2884:3032]: Processing SIGNAL_RELOAD_CONFIG 2013.06.13 16:25:19 LOG5[2884:3032]: Reading configuration from file stunnel.conf 2013.06.13 16:25:19 LOG5[2884:3032]: FIPS mode is enabled 2013.06.13 16:25:19 LOG7[2884:3032]: Compression not enabled 2013.06.13 16:25:19 LOG7[2884:3032]: Snagged 64 random bytes from C:/.rnd 2013.06.13 16:25:19 LOG7[2884:3032]: Wrote 1024 new random bytes to C:/.rnd 2013.06.13 16:25:19 LOG7[2884:3032]: PRNG seeded successfully 2013.06.13 16:25:19 LOG6[2884:3032]: Initializing service [SZR] 2013.06.13 16:25:19 LOG7[2884:3032]: Loaded verify certificates from SZR.pem 2013.06.13 16:25:19 LOG7[2884:3032]: Loaded SZR.pem revocation lookup file 2013.06.13 16:25:19 LOG7[2884:3032]: SSL options set: 0x01000004 2013.06.13 16:25:19 LOG5[2884:3032]: Configuration successful 2013.06.13 16:25:19 LOG7[2884:3032]: Closing service [SZR] 2013.06.13 16:25:19 LOG7[2884:3032]: Service [SZR] closed (FD=716) 2013.06.13 16:25:19 LOG7[2884:3032]: Sessions cached before flush: 0 2013.06.13 16:25:19 LOG7[2884:3032]: Sessions cached after flush: 0 2013.06.13 16:25:19 LOG7[2884:3032]: Service [SZR] closed 2013.06.13 16:25:19 LOG7[2884:3032]: Service [SZR] (FD=716) bound to 0.0.0.0:443 2013.06.13 16:25:19 LOG7[2884:3032]: Signal pipe is empty

1 0

Re: [stunnel-users] Getting Stunnel working with Verizon.net SMTP
by Gary Kuznitz 13 Jun '13

13 Jun '13

Hi Jochen, With your help I selected "Do not use CRAM-MD5 authentication even if it is advertised" It's now woking. Thank you very much for your help. Do you know if there is any way to remove the emails with the user name and password from the archives? Thanks, Gary On 12 Jun 2013 at 23:08, Jochen (Jochen Bern <Jochen.Bern(a)LINworks.de>) commented about Re: [stunnel-users] Getting Stunnel working with : > On 12.06.2013 21:28, Gary Kuznitz wrote: > > On your first post I didn't see the difference in port numbers. I have corrected that. > > I'm getting this log from my email client: > > --- Wed, 12 Jun 2013 12:22:46 --- > > Connect to 'localhost' port 10115, timeout 60. > > 12:22:46.960 [*] Connection established to 127.0.0.1 > > 12:22:47.226 >> 0120 220 vms173007pub.verizon.net -- Server ESMTP (Sun Java(tm) > > System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))\0D\0A > > First and foremost, this shows that your e-mail client can now talk to > the server, which means that stunnel's job (the SSL negotiation) gets > done successfully. > > > 12:22:47.288 >> 0042 250-AUTH DIGEST-MD5 PLAIN LOGIN CRAM-MD5\0D\0A > > 12:22:47.288 >> 0022 250-AUTH=LOGIN PLAIN\0D\0A > > This part of the server's reply to the EHLO command shows the auth > mechanisms the server supports; CRAM-MD5 is listed ... > > > 12:22:47.288 << 0015 AUTH CRAM-MD5\0D\0A > > ... and your client requests it. > > > 12:22:47.335 >> 0050 334 PDEzNTYyOTY5MjEuMTIxMTA1NTFAdm1zMTczMDA3Pg==\0D\0A > > The servers issues (a base64 encoded version of) > "<1356296921.12110551@vms173007>" as a "random" string challenge. > > > 12:22:47.335 << 0058 YXR1cHJlcyBkYTlmZTI3MWFjODNjYWUxOTVjNmZhZWQ5ZGE0NTUzYg==\0D\0A > > This is a base64 encoded version of "atupres > da9fe271ac83cae195c6faed9da4553b". "atupres" should be your username and > da9fe271ac83cae195c6faed9da4553b the HMAC-MD5 digest of the challenge > with your password as the key. > > I don't know a tool to compute HMAC-MD5 digests that is readily > available under Windows, I'm afraid. If you're desperate, try > http://www.freeformatter.com/hmac-generator.html > (note that they won't know a) on which server and b) with what username > you'll be using the password ...). > > > 12:22:47.397 >> 0066 500 5.7.0 Unknown AUTH error -1 (Internal authentication error).\0D\0A > > ... and there the server says it cannot verify that. > > > Do you have any idea why I am getting [that]? > > I can think of several *possible* reasons, but ultimately, the server > doesn't tell us what exactly is wrong. > > 1. It may be that the server is announcing CRAM-MD5 auth though it > actually does *not* support it. (The DIGEST-MD5 and CRAM-MD5 mechs > require that the server *knows* the (plaintext) password, while for > PLAIN and LOGIN, storing only a hash of the password is enough, and > foils attackers who manage to steal a copy of the password database.) > Enforcing use of a different mechanism can probably be done through > your e-mail client's settings, but I'm afraid that it's usually > rather cryptic how exactly to do that ... > If you want to have a *manual* try at another mech, here's a web > page explaining what to input for PLAIN and LOGIN: > http://www.gadgetwiz.com/protocols/smtp-auth-example.html > and here's an MS KB article with a base64 en-/decoder: > http://support.microsoft.com/kb/191239 > Problem is that the strings to be base64 encoded are supposed *not* > to have an end-of-line, and sometimes even to contain NUL bytes > ("\0") ... Verify that your method of choice properly reproduces the > examples in the howto page. :-C > 2. I'm a bit surprised that your username supposedly is "atupres", > rather than "atupres(a)your.dom.ain", "atupres%your.dom.ain" or > something to that effect ... ? > 3. The obvious one, a mistyped password ... > > Regards, > J. Bern > -- > *NEU* - NEC IT-Infrastruktur-Produkte im <http://www.linworks-shop.de/>: > Server--Storage--Virtualisierung--Management SW--Passion for Performance > Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> > Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt > PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 > Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 > Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

2 1

Re: [stunnel-users] Getting Stunnel working with Verizon.net SMTP
by Gary Kuznitz 12 Jun '13

12 Jun '13

Thank you very much for working with me on resolving this. On your first post I didn't see the difference in port numbers. I have corrected that. Thank you for catching it. It did get me closer to resolving the issue. I'm getting this log from my email client: --- Wed, 12 Jun 2013 12:22:46 --- Connect to 'localhost' port 10115, timeout 60. 12:22:46.960 [*] Connection established to 127.0.0.1 12:22:47.226 >> 0120 220 vms173007pub.verizon.net -- Server ESMTP (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))\0D\0A 12:22:47.226 << 0023 EHLO [192.168.168.11]\0D\0A 12:22:47.288 >> 0030 250-vms173007pub.verizon.net\0D\0A 12:22:47.288 >> 0014 250-8BITMIME\0D\0A 12:22:47.288 >> 0016 250-PIPELINING\0D\0A 12:22:47.288 >> 0014 250-CHUNKING\0D\0A 12:22:47.288 >> 0009 250-DSN\0D\0A 12:22:47.288 >> 0025 250-ENHANCEDSTATUSCODES\0D\0A 12:22:47.288 >> 0010 250-HELP\0D\0A 12:22:47.288 >> 0044 250-XLOOP AD6DF29B04183351BAD9935B9A483ABE\0D\0A 12:22:47.288 >> 0042 250-AUTH DIGEST-MD5 PLAIN LOGIN CRAM-MD5\0D\0A 12:22:47.288 >> 0022 250-AUTH=LOGIN PLAIN\0D\0A 12:22:47.288 >> 0010 250-ETRN\0D\0A 12:22:47.288 >> 0019 250-NO-SOLICITING\0D\0A 12:22:47.288 >> 0019 250 SIZE 20971520\0D\0A 12:22:47.288 << 0015 AUTH CRAM-MD5\0D\0A 12:22:47.335 >> 0050 334 PDEzNTYyOTY5MjEuMTIxMTA1NTFAdm1zMTczMDA3Pg==\0D\0A 12:22:47.335 << 0058 YXR1cHJlcyBkYTlmZTI3MWFjODNjYWUxOTVjNmZhZWQ5ZGE0NTUzYg==\0D\0A 12:22:47.397 >> 0066 500 5.7.0 Unknown AUTH error -1 (Internal authentication error).\0D\0A 12:22:50.845 << 0006 QUIT\0D\0A 12:22:50.892 >> 0034 221 2.3.0 Bye received. Goodbye.\0D\0A 12:22:50.892 --- Connection closed normally at Wed, 12 Jun 2013 12:22:50. ---\0A\0A I'm getting this in the Stunnel.log 2013.06.12 12:22:46 LOG7[660:2460]: New thread created 2013.06.12 12:22:46 LOG7[660:896]: Service [Verizon-smtp] started 2013.06.12 12:22:46 LOG5[660:896]: Service [Verizon-smtp] accepted connection from 127.0.0.1:52721 2013.06.12 12:22:46 LOG6[660:896]: connect_blocking: connecting 206.46.232.12:465 2013.06.12 12:22:46 LOG7[660:896]: connect_blocking: s_poll_wait 206.46.232.12:465: waiting 10 seconds 2013.06.12 12:22:46 LOG5[660:896]: connect_blocking: connected 206.46.232.12:465 2013.06.12 12:22:46 LOG5[660:896]: Service [Verizon-smtp] connected remote server from 192.168.168.11:52722 2013.06.12 12:22:46 LOG7[660:896]: Remote socket (FD=384) initialized 2013.06.12 12:22:46 LOG7[660:896]: SNI: sending servername: outgoing.verizon.net 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): before/connect initialization 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write client hello A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server hello A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server certificate A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server key exchange A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 read server done A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write client key exchange A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write change cipher spec A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 write finished A 2013.06.12 12:22:46 LOG7[660:896]: SSL state (connect): SSLv3 flush data 2013.06.12 12:22:47 LOG7[660:896]: SSL state (connect): SSLv3 read finished A 2013.06.12 12:22:47 LOG7[660:896]: 2 items in the session cache 2013.06.12 12:22:47 LOG7[660:896]: 2 client connects (SSL_connect()) 2013.06.12 12:22:47 LOG7[660:896]: 2 client connects that finished 2013.06.12 12:22:47 LOG7[660:896]: 0 client renegotiations requested 2013.06.12 12:22:47 LOG7[660:896]: 0 server connects (SSL_accept()) 2013.06.12 12:22:47 LOG7[660:896]: 0 server connects that finished 2013.06.12 12:22:47 LOG7[660:896]: 0 server renegotiations requested 2013.06.12 12:22:47 LOG7[660:896]: 0 session cache hits 2013.06.12 12:22:47 LOG7[660:896]: 0 external session cache hits 2013.06.12 12:22:47 LOG7[660:896]: 0 session cache misses 2013.06.12 12:22:47 LOG7[660:896]: 0 session cache timeouts 2013.06.12 12:22:47 LOG6[660:896]: SSL connected: new session negotiated 2013.06.12 12:22:47 LOG6[660:896]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) 2013.06.12 12:22:47 LOG6[660:896]: Compression: null, expansion: null 2013.06.12 12:22:50 LOG6[660:896]: Read socket closed (readsocket) 2013.06.12 12:22:50 LOG7[660:896]: Sending close_notify alert 2013.06.12 12:22:50 LOG7[660:896]: SSL alert (write): warning: close notify 2013.06.12 12:22:50 LOG6[660:896]: SSL_shutdown successfully sent close_notify alert 2013.06.12 12:22:50 LOG7[660:896]: SSL alert (read): warning: close notify 2013.06.12 12:22:50 LOG6[660:896]: SSL closed (SSL_read) 2013.06.12 12:22:50 LOG7[660:896]: Sent socket write shutdown 2013.06.12 12:22:50 LOG5[660:896]: Connection closed: 102 byte(s) sent to SSL, 544 byte(s) sent to socket 2013.06.12 12:22:50 LOG7[660:896]: Remote socket (FD=384) closed 2013.06.12 12:22:50 LOG7[660:896]: Local socket (FD=216) closed 2013.06.12 12:22:50 LOG7[660:896]: Service [Verizon-smtp] finished (0 left) Do you have any idea why I am getting: 12:22:47.397 >> 0066 500 5.7.0 Unknown AUTH error -1 (Internal authentication error).\0D\0A Thank you, Gary On 12 Jun 2013 at 20:36, Jochen (Jochen Bern <Jochen.Bern(a)LINworks.de>) commented about Re: [stunnel-users] Getting Stunnel working with : > On 12.06.2013 19:48, Gary Kuznitz wrote: > > Thanks for showing me how to test SSL. I installed openssl and ran the test. This is > > what I received back. > > > > C:\Programs\OpenSSL-Win32\bin>openssl s_client -connect smtp.verizon.net:465 > [...] > > Verify return code: 19 (self signed certificate in certificate chain) > > --- > > At this point, the SSL layer of the connection has been set up (s_client > ignores the non-null verification result) and the actual payload > protocol can start to do its thing. The payload protocol is SMTP, so the > server throws you a hello line: > > > 220 vms173025pub.verizon.net -- Server ESMTP (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009)) > > and then waits for the client to send its requests. Since you apparently > didn't enter anything, the server obviously terminated the connection with: > > > 421 4.4.2 Timeout while waiting for command. > > An actual SMTP session with an *attempt* at transferring an e-mail would > look like, e.g.: > > > 220 vms173023pub.verizon.net -- Server ESMTP (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009)) > > HELO this.is.my.laptop > > 250 vms173023pub.verizon.net OK, [unknown] [213.157.4.156]. > > MAIL FROM:<Jochen.Bern(a)LINworks.de> > > 550 5.7.1 Authentication Required > > rSET > > 250 2.5.0 Ok. > > QUIT > > (The lines starting with a three-digit SMTP status code number are sent > by the server; the 5xx code signals a permanent error; the lines > starting with a four-letter SMTP command are sent by the client, i.e., I > typed them into the s_client; and I typed "rSET" instead of the normal > "RSET" because s_client takes every line starting with an *uppercase* > 'R' as a command to do an SSL renegotiation.) > > > It sounds like something is wrong on this end. Any ideas? > > What about the two *****DIFFERING***** port numbers I pointed out in > your posted data? > > >> On 12.06.2013 05:12, Gary Kuznitz wrote: > >>> [Verizon-smtp] > >>> client = yes > >>> accept = 11015 > >> ^##^^ > >> [...] > >>> --- Tue, 11 Jun 2013 16:38:55 --- > >>> Connect to 'localhost' port 10115, timeout 60. > >> ^##^^ > > I don't actually use stunnel (subscribed to the list when I had a need > that I later fulfilled with socat, but that's Unix/Linux only), so I > don't know whether stunnel has a problem with the self-signed cert ... > > Regards, > J. Bern > -- > *NEU* - NEC IT-Infrastruktur-Produkte im <http://www.linworks-shop.de/>: > Server--Storage--Virtualisierung--Management SW--Passion for Performance > Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> > Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt > PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 > Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 > Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

1 0

Getting Stunnel working with Verizon.net SMTP
by Gary Kuznitz 12 Jun '13

12 Jun '13

I can't seem to connect with email at Verizon.net SMTP. I can connect with POP3. The Stunnel.log shows: 2013.06.11 19:27:04 LOG5[3752:2524]: stunnel 4.56 on x86-pc-msvc-1500 platform 2013.06.11 19:27:04 LOG5[3752:2524]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2013.06.11 19:27:04 LOG5[3752:2524]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2013.06.11 19:27:04 LOG5[3752:2524]: Reading configuration from file stunnel.conf 2013.06.11 19:27:04 LOG5[3752:2524]: FIPS mode is enabled 2013.06.11 19:27:04 LOG5[3752:2524]: Configuration successful I have IPv6 turned off in my network settings. The Stunnel.conf looks like this: output = stunnel.log cert = stunnel.pem options = NO_SSLv2 [Verizon-pop3] client = yes accept = 11014 connect = pop.verizon.net:995 delay = yes [Verizon-smtp] client = yes accept = 11015 connect = smtp.verizon.net:465 delay = yes I do not have SSL turned on in my email client. The log from my email client looks like this: --- Tue, 11 Jun 2013 16:38:55 --- Connect to 'localhost' port 10115, timeout 60. 16:38:56.897 15: Peer connect failure (the host has refused the connection). The Verizon account is FIOS. I am not connected directly to the Verizon ISP. I can't send email without SSL. Does anyone have any idea how I can get this working? Thanks, Gary Kuznitz

3 4

Certificate failure to verify with verify = 4 option
by Thomas Eifert 10 Jun '13

10 Jun '13

Correction: The cert issuer is Startcom Ltd, not Startcom LLC. -- Greetings; Stunnel 4.56 running under Win 7 SP1 x86. Recently, the owners of a server I regularly connect to updated their server certificate; the former had expired at the end of May. As soon as that event occurred, I deleted the old certificate, then used the "save peer certificate" function of Stunnel to get the updated one. However, the new certificate fails to verify, even with the verify = 4 option in Stunnel. The error message is similar to what I used to get when doing a verify = 3 with some certificates. The general error output of Stunnel is: CERT: Verification error: unable to get local issuer certificate 2013.06.09 16:37:46 LOG4[608:2336]: Certificate check failed: depth=0 When I open the new certificate with: openssl x509 -text -in certname.pem and view the certificate details, I'm not seeing anything obvious. The certificate is within a valid date range, and contains the same basic elements as other certs I've viewed. The certificate appears to have been issued by Startcom LLC. If I comment out the verify statement, I'm able to successfully negotiate an SSL connection with the server. I realize that this may be more of an openssl issue than an issue with Stunnel. Nevertheless, I thought I'd start here and throw it out to the floor for comments. Anyone have any ideas or have run into this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

3 3

weird stunnel problem
by Stephen Griffin 03 Jun '13

03 Jun '13

Hello A few days ago we ran into issue where the number of stunnel threads sky rocketed to over 3000 open stunnel threads. When this happen connections to our website slowed down considerably or failed to connect. It was resolved by flipping to our other proxy which accepted any new connections. It took about 5 minutes for the threads to die off on the other proxy. I was wondering if anyone has come across this problem? Here are some details of our stunnel version and config. Stunnel 4.44 with patch for x-forwarder [root@brm-proxy01 ~]# stunnel -version stunnel 4.44 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none appriacated Our stunnel.conf. /etc/stunnel/stunnel.conf #sslVersion = TLSv1 pid = /var/run/stunnel.pid syslog = yes output = /var/log/stunnel.log debug = 3 [https] cert = /etc/stunnel/ssl/wildcard.blah.com.pem accept = 443 connect = 80 xforwardedfor = yes TIMEOUTbusy = 300 TIMEOUTclose = 0 TIMEOUTconnect = 10 TIMEOUTidle = 60 Is there anything we could add for performance tuning in stunnel? Any suggestions on what I could look for when this happens again would be appreciated. Our platform does between 2000 to 3000 rpm (request per minute) during peak hours. We constantly see a lot of these messages every hour but I am not sure what is happening as the connections seem to be working. SSL_accept: Peer suddenly disconnected There was a higher spike of them as per the normal rate during our incident described above. Thanks Stephen Griffin Sr. System Administrator www.achievers.com<http://www.achievers.com/> Confidentiality: The information contained in this e-mail and any attachments are confidential. If you are not the intended recipient, you may not copy or distribute this information. If you have received this communication in error, please notify the sender immediately and delete it from your system.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users