- stunnel-users - stunnel.org

OCSPflag not processed in ocsp_stapling() ?
by King's Way 01 Dec '25

01 Dec '25

Hi there, I was trying to make stunnel ignore OCSP verification error for local certificates when doing OCSP Stapling. But it seems the flag "OCSPflag = NOVERIFY" is not properly passed to openssl. I have tried to patch it in function ocsp_stapling(), and it worked. But I wonder whether it is a bug or intentionally designed this way? With kind regards！ ------------------------------------------------------------ King's Way <io[AT]stdio.io<http://stdio.io>>

1 0

Getting Started - Unique Situation
by Kevin Morris 21 Nov '25

21 Nov '25

Hi All! About me: I've never heard of stunnel before but it sounds great. I'm not a networking/internet expert. Here is my situation: Platform: Microsoft Windows Server 2016. Two Network Interface Cards. Port 443 on both currently have HTTPS/TCP traffic on them, from two different Web Apps, each with their own domain. Everything is working properly, traffic is very low, only a few (about 20) hits per minute (each port) at max load. Both Web Apps are built using Lazarus, Free Pascal, Brook Framework. The Brook Framework has the built-in ability to handle SSL/TLS encryption. Certs are supplied by Let's Encrypt, and new certs are obtained by a bot. I now have a third and soon a forth Web App built using the same technology, but my only two 443 ports are occupied. Here is my requirement: I need something that will act as a "port splitter". Maybe this is also known as a reverse proxy. Example: Incoming URLs on port 443: https://mywebapp.companyname.com/bob/useraccount?act=login&exp=pg https://mywebapp.companyname.com/betty/useraccount?act=login&exp=pg The port splitter needs to recognize the part in teal green (maybe called an "entry point"?), and pass that unchanged traffic through to (and from) a port that the associated Web App is listening on. WebApp "bob" is listening on local port 449 (not exposed to the internet, only conversing with stunnel) WebApp "betty" is listening on local port 451 (not exposed to the internet, only conversing with stunnel) Both Web Apps will send/receive their own HTTPS traffic, handle their own decryption/encryption, and send it back through their respective listening ports, through the port splitter, back the the requesting user. No load balancing is required. No decryption/encryption/certs is/are required. This needs to happen downstream from our router, without making any changes to OS rules or router settings. I'd like to just shut down the current Web App listening on port 443, reconfig it to a new local port As I looked through the FAQ and manual, I could not determine if stunnel could do this. So my questions are: A) Can stunnel do this? B) If so, is there a "How To" I missed in the manual I can read to do this? C) If ((A = Yes) and B = No)), can you tell me in a couple sentences where to look in the config file to do some reading and get this set up? If we can get this working, there are other Lazarus/Brook developers who could benefit from using stunnel. If stunnel is not the answer, is there another "port splitter" piece of software that you know of that can? (other than IIS with ARR and WAP, I don't want to use those, I'm slowly trying to de-Microsoft my infrastructure.) Thanks in advance!

2 1

+=item B<requireCert> = yes | no ignored when client = yes
by u34＠net9.cf 13 Nov '25

13 Nov '25

In my opinion, the following emphasis worth including: --- stunnel.pod.in.orig 2025-10-07 19:50:30.097392645 +0000 +++ stunnel.pod.in.new 2025-10-07 20:25:54.448391940 +0000 @@ -1065,6 +1065,8 @@ =item B<requireCert> = yes | no +Ignored when client = yes. + require a client certificate for I<verifyChain> or I<verifyPeer> With I<requireCert> set to I<no>, the B<stunnel> server accepts client

2 1

stunnel 5.76 core dumped
by Bogdan Siara 02 Nov '25

02 Nov '25

Hi, I try to run stunnel with certs from hardware token and I get error: root@c6b200207f1a:/stunnel-5.76# stunnel free(): invalid pointer Aborted (core dumped) This is my configuration: engine = pkcs11 engineCtrl = MODULE_PATH:/usr/lib/libeToken.so engineCtrl = PIN:pin output = /var/log/stunnel.log debug=debug [in-hdt] client=no accept = 172.18.1.2:443 connect=127.0.0.1:8080 cert = /etc/stunnel/certs/hdt.pem key = /etc/stunnel/certs/hdt.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [in-vpc] client=no accept = 172.18.2.2:443 connect=127.0.0.1:8081 cert = /etc/stunnel/certs/vpc.pem key = /etc/stunnel/certs/vpc.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [in-iam] client=no accept = 172.18.3.2:443 connect=127.0.0.1:8082 cert = /etc/stunnel/certs/iam.pem key = /etc/stunnel/certs/iam.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-hdt] client=yes accept=8080 connect=ip1:443 engineId=pkcs11 sni = hdt cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-vpc] client=yes accept=8081 connect=ip2:443 engineId=pkcs11 sni = vpc cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-iam] client=yes accept=8082 connect=ip3:443 engineId=pkcs11 sni = iam cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug When I try run in gdb: root@c6b200207f1a:/stunnel-5.76# gdb stunnel GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from stunnel... (gdb) r Starting program: /usr/local/bin/stunnel [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [New Thread 0x7ffff789f640 (LWP 4875)] [Thread 0x7ffff789f640 (LWP 4875) exited] [New Thread 0x7ffff789f640 (LWP 4876)] [New Thread 0x7ffff6c78640 (LWP 4878)] free(): invalid pointer Thread 1 "stunnel" received signal SIGABRT, Aborted. __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737346406208) at ./nptl/pthread_kill.c:44 44 ./nptl/pthread_kill.c: No such file or directory. (gdb) stunnel is running in docker container ubuntu:22.04 Can someone tell where is the problem? Regards BS

1 0

Was LOG3[per-minute]: OCSP: SSL_get_certificate for a shared secret, PSK, configuration fixed with 5.76?
by u34＠net9.cf 01 Nov '25

01 Nov '25

Hello, At [stunnel 5.76 released](https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@st… - Missing OCSP stapling is no longer logged as an error. was mentioned in Bugfixes. My understanding is [LOG3[per-minute]: OCSP: SSL_get_certificate](https://www.stunnel.org/mailman3/hyperkitty/list/stunn… is fixed. But it isn't.

1 0

Should remote host IPs recorded at lower debug levels too?
by u34＠net9.cf 21 Oct '25

21 Oct '25

Does recording the IPs of the remote host depends on other configuration directives, other then the debug directive? Is it correct that at LOG5, IPs of the remote host are recorded at the log file? Is it correct that at LOG3, no IPs are recorded even when other information for a particular connection is considered worth recording? Aren't IPs considered important information worth recording when error conditions are recorded?

1 0

stunnel 5.76 released
by Michał Trojnara 18 Oct '25

18 Oct '25

Dear Users, I have released version 5.76 of stunnel. ### Version 5.76, 2025.10.18, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.4. - Service-level multivalued options now override (rather than append to) global defaults, preventing unintended configurations. * Bugfixes - Fixed enabling/disabling of the default fips=yes property. - Missing OCSP stapling is no longer logged as an error. - Fixed a crash when a PIN was required due to the PKCS#11 CKA_ALWAYS_AUTHENTICATE attribute. * Features - Quantum-resistant hybrid key agreement X25519+ML-KEM-768 (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3. - Multiple cert sources are supported, allowing a certificate to be fetched from a provider while loading the chain from a file. - Android build switched to a 16 KB page size. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: cda37eb4d0fb1e129718ed27ad77b5735e899394ce040bb2be28bbb937fd79e1 stunnel-5.76.tar.gz d93c7c01366d38ebd27689d606e45197ba8e2e2a32d1a186a81d2b01186bfb56 stunnel-5.76-win64-installer.exe f081281c92f6dc245e23d57930f3963d0155a9fc4a707b7414c941e8e60a1957 stunnel-5.76-android.zip Best regards, Mike

1 0

LOG3[per-minute]: OCSP: SSL_get_certificate
by u34＠net9.cf 15 Oct '25

15 Oct '25

With stunnel version 5.74 and debug = 3 foreground = yes setgid = abcde setuid = abcde output = /path/to/log/file [service] PSKsecrets = /path/to/secretfile accept = ip1:port1 connect = ip2:port1 debug = 3 setgid = abcde setuid = abcde This configuration looks to me similar to the [shell] option from the configuration examples. There is a 1 per minute LOG3[per-minute]: OCSP: SSL_get_certificate line at the log file. Does it a bug? This wasn't discussed 3 weeks ago at [How to get rid of "No OCSP stapling response received" warning?](https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@st…, was it?

1 0

Client mode certificate pinning
by Ian Pilcher 11 Oct '25

11 Oct '25

Is $SUBJECT possible? I use stunnel to connect to my old "smart" switches that don't support modern TLS protocols, ciphers, etc. Recently, their existing certificates all expired, and I tried to install new certificates on all of them, only to discover that they won't accept my new CA certificate, because it was signed with a 3072-bit key. I could go through the trouble of generating a separate CA certificate with a 2048-bit key, sign new certificates with that key, etc., etc., but it starts to seem a bit silly at that point. Far better to simply generate a self-signed certificate for each switch and configure stunnel to only accept that particular certificate (i.e. "pin" it). Is this possible with stunnel? If so, how would I go about configuring it to do this? (Search engines are telling me to use "verify = 4", but stunnel(8) says that option is obsolete.) TIA! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

2 1

How to get rid of "No OCSP stapling response received" warning?
by Ian Pilcher 25 Sep '25

25 Sep '25

I use stunnel to connect to my old "smart" switches from modern browsers. Here is a subset of the configuration for one of the switches. [switch1-frontend] sni = frontend:switch1.penurio.us CAfile = /etc/ipa/ca.crt cert = /etc/pki/tls/certs/stunnel/switch1.crt key = /tmp/keys/switch1.key connect = 127.255.255.254:8081 [switch1-backend] client = yes accept = 127.255.255.254:8081 connect = 172.31.4.1:443 verifyChain = yes checkHost = switch1.penurio.us CAfile = /etc/ipa/ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 0 OCSPrequire = no OCSPaia = no Everything works, execept that every connection produces a bright red warning in my log: OCSP: No OCSP stapling response received I've read up on OCSP stapling, that this seems to mean that the switch isn't including an OCSP response in its TLS handshake. (Hardly surprising, given its age.) How can I tell stunnel to not request/expect an OCSP response from the switch (or at least to not log the missing OCSP response as a warning)? -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

4 5