stunnel-users

2 participants
3307 discussions

SSLv3 on Win32 does not work
by Zdenek Valach (INBOX) 24 Feb '12

24 Feb '12

Hi I am using the latest version of stunnel in server mode (converting POP3S to POP3) I need to make service work in SSLv3 mode. In TLSv1 it works fine, when I add to stunnel.conf tag sslVersion = all, it still works fine, but when I use sslVersion = SSLv3 although config file is loaded properly, process EXE crashed during establishing the connection. It looks like some bug in actual version of stunnel. Does somebody experience same problem? Thank you very much in advance for any advice Thanks Zdenek ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 1

Stunnel for Android
by Huzella Balázs 23 Feb '12

23 Feb '12

Hi! I have downloaded the Android port of stunnel: http://mirrors.zerg.biz/stunnel/stunnel-4.52-android.zip I would like to use it on my Android tablet but I don't know how to start or use it. I have root access on the device. I placed the stunnel and openssl files into /data/stunnel/ directory. Both files have execute permission. Can anybody please provide some information on how to use this application? I haven't found any info on stunnel.org. Best Regards, Balázs Huzella

2 1

Multiple Domains for https
by Thomas Manson 23 Feb '12

23 Feb '12

Hi, I want to setup the following architecture : stunnel ---> haproxy --> 2 webserver. I run severa virtual host on the 2 webservers, and a subset of them needs https. I can allocate several IP address for the host that run stunnel. How do I configure a single stunnel process to have a certificate per IP for the port https? I tryed to add several section like the following : [mansonthomas.com] cert = /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.crt accept = 88.190.17.222:443 connect = 127.0.0.1:82 xforwardedfor = yes TIMEOUTclose = 0 So the question is : Is it possible ? do you have a sample configuration file to share for this use case? Thanks, Thomas.

4 9

:o( Stunnel KO on Windows Server 2003 VM
by BOXI31 TEST 22 Feb '12

22 Feb '12

Hi all ! I'm new with Stunnel. It'a nice tool that works perfectly on Windows 7 64-bit host but won't start on Windows Server 2003 guest VM (VMWare Player 3.1.x). When I try to start it, I have a message like "can't initialize...". I'll give you the exact message tomorrow, I don't have now the VM on hand. On Windows 7, when I started Stunnel for the 1st time, I was asked to create a certificate with a kind of wizard but on the Windows Server 2003 VM, it stops before this step. Is it a known problem on VM ? What could I check ? I managed to make the software I'm testing (SMTP sending function) on the VM "talk" to Stunnel on my host by I'd really like to install it on the VM to be independant from host. Thanks by advance, Regards, Steve.

2 1

Stunnel Not supporting DSA key
by Anand Krishnan 16 Feb '12

16 Feb '12

Hi All, I have query regarding Stunnel (version 4) working. We have a windows client application which communicates with a web service via SSL encryption with DSA algorithm. The windows client machine is using a pfx file for authentication with server. Now we need to convert this windows machine with a linux machine and hence we converted the pfx into pem file. But when i tried to start the Stunnel using this pem file it threws up below error. 2012.02.13 18:23:23 LOG3[23972:47049761923264]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2012.02.13 18:23:23 LOG3[23972:47049761923264]: SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key It seems the .pem file I mapped in the stunnel.conf is expecting RSA algorithm but when I opened it I can see it as DSA coded. Can some body help me on this. I am attaching the pfx and pem file along with this. Regards, Anand K DISCLAIMER: "The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect." DISCLAIMER: "The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect."

2 1

Key files across NFS
by James Devine 15 Feb '12

15 Feb '12

I have an stunnel config saved on an NFS mount so it can be shared with other servers, it only seems to work if the key file is stored locally, as soon as I move the key onto the NFS mount I get the error: /disks/disk1/stunnel/certs/wildcard.key: Value too large for defined data type (75) Any idea why that might be and what I might do to fix it?

1 1

server does not send its cert?
by Keresztfalvi Laszlo 14 Feb '12

14 Feb '12

Hello, after a day of trying.. - 2 box of *Win7 Pro x64* - fresh install of *stunnel 4.52* - keys generated with C:\Program Files (x86)\stunnel>* **.\openssl.exe req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem* - *certs.pem* on both box contains certificate part of stunnel.pem from both machine server stunnel.conf (192.168.0.52): debug = 7 cert = stunnel.pem verify = 2 CAfile = certs.pem options = NO_SSLv2 [unison] accept = 10001 connect = 127.0.0.1:10000 client stunnel.conf (192.168.0.216): client = yes debug = 7 cert = stunnel.pem verify = 2 CAfile = certs.pem options = NO_SSLv2 [unison] client = yes accept = 127.0.0.1:10000 connect = 192.168.0.52:10001 Test #1: *OK* C:\Program Files (x86)\stunnel>* .\openssl verify -CAfile certs.pem stunnel.pem* *stunnel.pem: OK* C:\Program Files (x86)\stunnel>* .\openssl verify -CAfile certs.pem certs.pem* *certs.pem: OK* Test #2: *OK* C:\Program Files (x86)\stunnel> *.\openssl s_server -accept 10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* vs C:\Program Files (x86)\stunnel> *.\openssl s_client -connect 192.168.0.52:10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* Test #3: *OK - "certificate accepted" * C:\Program Files (x86)\stunnel> *.\openssl s_server -accept 10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* vs *stunnel client** * Test #4: *OK - "certificate accepted" * *stunnel server* vs C:\Program Files (x86)\stunnel> *.\openssl s_client -connect 192.168.0.52:10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* Test #5: *FAILED* *stunnel server* Service unison accepted connection from 192.168.0.216:23134 2012.02.14 09:02:39 LOG3[134028:132792]: SSL_accept: 140943F2: error:140943F2:SSL routines:*SSL3_READ_BYTES:sslv3 alert unexpected message* 2012.02.14 09:02:39 LOG5[134028:132792]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket* * vs *stunnel client * 2012.02.14 09:02:33 LOG5[2500:5876]: Service unison connected remote server from 192.168.0.216:23134 2012.02.14 09:02:33 LOG7[2500:5876]: Remote FD=372 initialized 2012.02.14 09:02:33 LOG3[2500:5876]: SSL_connect: 140870E8: error:140870E8:SSL routines:*SSL3_GET_CERTIFICATE_**REQUEST:tls client cert req with anon cipher* 2012.02.14 09:02:33 LOG5[2500:5876]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket After a *stunnel.conf **reload* on both box (yes, only a reload) then the following details and differences appear: *stunnel server* vs *openssl s_client : OK - "certificate accepted" * 2012.02.14 09:42:02 LOG5[134236:132440]: Service unison accepted connection from 192.168.0.216:23698 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): before/accept initialization 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client hello B 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write server hello A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write certificate A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write key exchange A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write certificate request A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 flush data 2012.02.14 09:42:02 LOG7[134236:132440]: Starting certificate verification: depth=0, /C=HU/ST=Mazovia Province/L=Budapest/O=-/OU=client/CN=x-pc 2012.02.14 09:42:02 LOG5[134236:132440]: Certificate accepted: depth=0, /C=HU/ST=Mazovia Province/L=Budapest/O=-/OU=client/CN=x-pc 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client certificate A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client key exchange A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read certificate verify A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read finished A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write session ticket A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write change cipher spec A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write finished A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 flush data *stunnel server* vs *stunnel client : FAILED * *server:* 2012.02.14 09:45:24 LOG5[134236:134552]: Service unison accepted connection from 192.168.0.216:23752 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): before/accept initialization 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 read client hello B 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): *SSLv3 write server hello A* 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): *SSLv3 write key exchange A* 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 write certificate request A 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 flush data 2012.02.14 09:45:24 LOG7[134236:134552]: SSL alert (read): fatal: unexpected_message 2012.02.14 09:45:24 LOG3[134236:134552]: SSL_accept: 140943F2: error:140943F2:SSL routines:*SSL3_READ_BYTES:sslv3 alert unexpected message* 2012.02.14 09:45:24 LOG5[134236:134552]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.02.14 09:45:24 LOG7[134236:134552]: Service unison finished (0 left) *client:* 2012.02.14 09:45:18 LOG5[1100:7176]: Service unison connected remote server from 192.168.0.216:23752 2012.02.14 09:45:18 LOG7[1100:7176]: Remote FD=452 initialized 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): before/connect initialization 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): SSLv3 write client hello A 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): *SSLv3 read server hello A* 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): *SSLv3 read server key exchange A* 2012.02.14 09:45:18 LOG7[1100:7176]: SSL alert (write): *fatal: unexpected_message* 2012.02.14 09:45:18 LOG3[1100:7176]: SSL_connect: 140870E8: error:140870E8:SSL routines:*SSL3_GET_CERTIFICATE_**REQUEST:tls client cert req with anon cipher* 2012.02.14 09:45:18 LOG5[1100:7176]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Please, give me some clues. Thank you, Laszlo **

3 5

AUTO: Jean Daros is out of the office (returning 02/13/2012)
by Jean Daros 11 Feb '12

11 Feb '12

I am out of the office until 02/13/2012. If you need immediate assistance, please contact the helpdesk at ext. 1540. Thank you. Note: This is an automated response to your message "stunnel-users Digest, Vol 91, Issue 6" sent on 2/11/2012 6:00:01 AM. This is the only notification you will receive while this person is away.

1 0

(no subject)
by Jean Daros 07 Feb '12

07 Feb '12

We are using version 4.33 with RedRock Software - Tutortrac Stunnel will crash. The stunnel service terminated unexpectedly. Faulting application stunnel.exe, veraion 0.0.0.0, faulting module libeay32.dll, version 1.0.0.0 fault address 0x000731ee. Any ideas? -Jean Berkeley College

2 1

Improving SSL security and protecting against the BEAST attack
by Shannon Carver 06 Feb '12

06 Feb '12

Hi all, Long time lurker, but first time poster on the Stunnel mailing list. I'm currently entering into a business partnership with a prominent media group, and as such they've got some strict guidelines by which their partners should abide by when it comes to Security/Encryption, both for brand protection, and making sure that both sides are sufficiently covered (at least from a general scan point of view). Basically the big thing that is coming up in my testing now (predominantly using the Qualysis tool at www.ssllabs.com) is that I'm vulnerable to the BEAST attack, CBC-Mode vulnerabilities and a potential issue of DoS attack due to server accepting Client Side Re-negotiation. I've spent days now trawling the web looking for a solution, but haven't really found anything of use yet, short of disabling CBC Ciphers completely (e.g 'cipher = RC4-SHA:RC4-MD5:!SSLv2:!ADH:!EDH:!EXP:!aNULL:!eNULL:!NULL' or similar), but I fear this me be too restrictive when it comes to client support. I guess my question is, are there other stunnel users who've been in the same situation, and is there a recommended cipher/options list when using Stunnel for HTTPS? Thanks in advance Shannon

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users