stunnel-users

3306 discussions

A series of minor patches from Debian
by Luis Rodrigo Gallardo Cruz 23 Sep '07

23 Sep '07

Hello. I have recently become the maintainer for the Debian package of stunnel. During the adoption process I noticed a few things that I think would be good to fix in the code. I will be sending the patches to this list (unless a better place for this is pointed out) as separate mails, to allow them to have individual responses, but thought I'd better introduce myself first. Thank you all, -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

4 14

[patch] FSF postal address is outdated
by Luis Rodrigo Gallardo Cruz 14 Sep '07

14 Sep '07

The following long but rather trivial patch fixes up the FSF's postal address in the licencing statements for source files. This is a minor change, mostly for the benefit of tying up loose ends. ---------------------------------------------------------------------- diff --git a/src/client.c b/src/client.c index 6b3c5a4..a578b81 100644 --- a/src/client.c +++ b/src/client.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/common.h b/src/common.h index c666086..f96a537 100644 --- a/src/common.h +++ b/src/common.h @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. */ #ifndef COMMON_H diff --git a/src/ctx.c b/src/ctx.c index 90dbdbc..dd4e01b 100644 --- a/src/ctx.c +++ b/src/ctx.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/env.c b/src/env.c index c195950..cbf105d 100644 --- a/src/env.c +++ b/src/env.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/file.c b/src/file.c index 5075b77..e00a82b 100644 --- a/src/file.c +++ b/src/file.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/gui.c b/src/gui.c index df1d6a8..d820b15 100644 --- a/src/gui.c +++ b/src/gui.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/log.c b/src/log.c index 0e3f927..45186b2 100644 --- a/src/log.c +++ b/src/log.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/network.c b/src/network.c index 98b1f5a..dfb76fa 100644 --- a/src/network.c +++ b/src/network.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/nogui.c b/src/nogui.c index deeca5b..a02cea7 100644 --- a/src/nogui.c +++ b/src/nogui.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/options.c b/src/options.c index bad281b..25a6e81 100644 --- a/src/options.c +++ b/src/options.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/protocol.c b/src/protocol.c index f579138..218450c 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/prototypes.h b/src/prototypes.h index 004a576..50b2aec 100644 --- a/src/prototypes.h +++ b/src/prototypes.h @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. */ #ifndef PROTOTYPES_H diff --git a/src/pty.c b/src/pty.c index d44a624..645492b 100644 --- a/src/pty.c +++ b/src/pty.c @@ -17,7 +17,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/resolver.c b/src/resolver.c index 6180113..84133cc 100644 --- a/src/resolver.c +++ b/src/resolver.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/ssl.c b/src/ssl.c index 84c79ee..7797747 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/sthreads.c b/src/sthreads.c index de8388a..7588f61 100644 --- a/src/sthreads.c +++ b/src/sthreads.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/stunnel.c b/src/stunnel.c index bdb5dd3..3312cca 100644 --- a/src/stunnel.c +++ b/src/stunnel.c @@ -20,7 +20,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL diff --git a/src/verify.c b/src/verify.c index 72fcdb2..88b010b 100644 --- a/src/verify.c +++ b/src/verify.c @@ -15,7 +15,7 @@ * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. * * In addition, as a special exception, Michal Trojnara gives * permission to link the code of this program with the OpenSSL ---------------------------------------------------------------------- -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

[patch] Move shared library into app specific dir
by Luis Rodrigo Gallardo Cruz 14 Sep '07

14 Sep '07

While upgrading the Debian package for stunnel, I noticed that it installs a shared library into /usr/lib/libstunnel.so This is recommended against by Debian policy, because misguided users might end up linking against it. The following (minor) patch moves the library into /usr/lib/stunnel/ which is a better location for it. ---------------------------------------------------------------------- Index: stunnel-4.20/src/Makefile.am =================================================================== --- stunnel-4.20.orig/src/Makefile.am 2007-07-24 20:36:58.000000000 -0500 +++ stunnel-4.20/src/Makefile.am 2007-07-24 20:39:04.000000000 -0500 @@ -17,7 +17,7 @@ # Unix shared library -lib_LTLIBRARIES = libstunnel.la +pkglib_LTLIBRARIES = libstunnel.la libstunnel_la_SOURCES = $(shared_sources) libstunnel_la_LDFLAGS = -avoid-version @@ -27,7 +27,7 @@ # Additional compiler flags -AM_CPPFLAGS = -DLIBDIR='"$(libdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"' +AM_CPPFLAGS = -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"' # Win32 executable ---------------------------------------------------------------------- -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 38, Issue 2
by Saraka, Luc 12 Sep '07

12 Sep '07

-----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of stunnel-users-request(a)mirt.net Sent: Wednesday, September 12, 2007 6:00 AM To: stunnel-users(a)mirt.net Subject: stunnel-users Digest, Vol 38, Issue 2 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. certificates, openssl and stunnel on windows (David Schulberg) 2. [RE] certificates, openssl and stunnel on windows (algol sigfrid) ---------------------------------------------------------------------- Message: 1 Date: Wed, 12 Sep 2007 00:12:02 +1000 From: "David Schulberg" <davids(a)evertech.com.au> Subject: [stunnel-users] certificates, openssl and stunnel on windows To: <stunnel-users(a)mirt.net> Message-ID: <000001c7f47d$be12f030$1401a8c0@microsensexp> Content-Type: text/plain; charset="iso-8859-1" Hi All, Without wishing to sound na?ve I find this whole subject area to be extraordinarily riddled with cryptic explanations of how to configure stunnel to work with a key and certificate. Using openssl I have generated a file including RSA private key and certificate which stunnel running as a server happily digests. Now I want to create the cer file that Windows will happily digest on the client side. Short of ripping the certificate out of the stunnel.pem file that I created using the command openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem what are the steps to getting that holy grail with a 'cer' extension? Please educate David ------------------------------ Message: 2 Date: Tue, 11 Sep 2007 22:04:38 -0400 (EDT) From: "algol sigfrid" <m1a2(a)lycos.com> Subject: [stunnel-users] [RE] certificates, openssl and stunnel on windows To: <stunnel-users(a)mirt.net> Message-ID: <20070911220438.HM.0000000000001Lm(a)m1a2.bos-mail-wwl12.lycos.com> Content-Type: text/plain; charset="us-ascii" An HTML attachment was scrubbed... URL: http://stunnel.mirt.net/pipermail/stunnel-users/attachments/20070911/f7d 17618/attachment-0001.html ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 38, Issue 2 ********************************************

1 0

certificates, openssl and stunnel on windows
by David Schulberg 12 Sep '07

12 Sep '07

Hi All, Without wishing to sound naïve I find this whole subject area to be extraordinarily riddled with cryptic explanations of how to configure stunnel to work with a key and certificate. Using openssl I have generated a file including RSA private key and certificate which stunnel running as a server happily digests. Now I want to create the cer file that Windows will happily digest on the client side. Short of ripping the certificate out of the stunnel.pem file that I created using the command openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem what are the steps to getting that holy grail with a 'cer' extension? Please educate David

2 1

[RE] certificates, openssl and stunnel on windows
by algol sigfrid 12 Sep '07

12 Sep '07

1 0

Problem with stunnel 4.20 on Fedora 7
by Andrew M Dunn 29 Aug '07

29 Aug '07

I can't get stunnel to run on a freshly-installed Fedora 7 system. It fails with "Error resolving '0.0.0.0': servname is not supported for ai_socktype" but the usual other causes of that error (ie. ports not defined in /etc/services, bad settings in /etc/nsswitch.conf) are not the culprit this time. COMMAND LINE: /usr/sbin/stunnel /home/amdunn/security/stunnel.conf COMMAND OUTPUT: 2007.08.29 11:44:12 LOG3[13614:3086243520]: Error resolving '0.0.0.0': servname is not supported for ai_socktype (EAI_SERVICE) file /home/amdunn/security/stunnel.conf line 10: Failed to resolve accepting address STUNNEL.CONF FILE: ; ; stunnel file for testing 443 access to local http server ; cert=/home/amdunn/security/xxxxxxx key=/home/amdunn/security/yyyyyyy foreground=yes ; ; [sweb] accept=443 ; https port connect=80 ; standard httpd listening port TIMEOUTclose=0 ; must set this or IE waits 60sec on page end client=no STUNNEL -VERSION OUTPUT: stunnel 4.20 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Andrew M. Dunn VE3XAD Managing Director, Axis Computing Technologies Vice-President, South Simcoe Railway www.AndyDunn.CA

1 0

Mac stunnel not attempting to connect to host
by Michael Kreykenbohm 28 Aug '07

28 Aug '07

I'v used FreeBsd with stunnel without problem, so I'm a little stumped that it doesn't work properly on darwin for Mac. I recall that it might get hung up in the ssl certificates, but I can't find where to look and openssl -connect works perfectly. Any help, appreciated. Symptom: The stunnel is running in debug mode, the client makes a connection to stunnel, stunnel reports the connection stunnel does not attempt to connect to the host (the connect string) No messages suggest it is trying, no network logic show it is connecting. (Since I am using it for email, I can not copy and paste from the orginal to send this email) openssl connects fine to the server and get the correct results Any ideas how/ where to find out what is wrong with the Mac. Thanks stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /opt/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /opt/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2007.08.26 20:28:51 LOG7[207:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.08.26 20:28:51 LOG7[207:2684407808]: PRNG seeded successfully 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service pop3s 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Certificate loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: Key file: /opt/local/etc/stunnel/stunnel.pem 2007.08.26 20:28:51 LOG7[207:2684407808]: Private key loaded 2007.08.26 20:28:51 LOG7[207:2684407808]: SSL context initialized for service smtps 2007.08.26 20:28:51 LOG5[207:2684407808]: stunnel 4.20 on i686-apple-darwin8.10.1 with OpenSSL 0.9.7l 28 Sep 2006 2007.08.26 20:28:51 LOG5[207:2684407808]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2007.08.26 20:28:51 LOG6[207:2684407808]: file ulimit = 256 (can be changed with 'ulimit -n') 2007.08.26 20:28:51 LOG6[207:2684407808]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2007.08.26 20:28:51 LOG5[207:2684407808]: 125 clients allowed 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 4 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 6 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 7 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: pop3s bound to 0.0.0.0:995 2007.08.26 20:28:51 LOG7[207:2684407808]: FD 8 in non-blocking mode 2007.08.26 20:28:51 LOG7[207:2684407808]: SO_REUSEADDR option set on accept socket 2007.08.26 20:28:51 LOG7[207:2684407808]: smtps bound to 0.0.0.0:5526 2007.08.26 20:28:51 LOG7[207:2684407808]: Created pid file /tmp/stunnel.pid 2007.08.26 20:29:04 LOG7[207:2684407808]: pop3s accepted FD=9 from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: pop3s started 2007.08.26 20:29:04 LOG7[207:25185792]: FD 9 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 10 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: FD 11 in non-blocking mode 2007.08.26 20:29:04 LOG7[207:25185792]: Connection from 127.0.0.1:49162 permitted by libwrap 2007.08.26 20:29:04 LOG5[207:25185792]: pop3s accepted connection from 127.0.0.1:49162 2007.08.26 20:29:04 LOG7[207:25185792]: SSL state (accept): before/accept initialization 2007.08.26 20:29:04 LOG7[207:2684407808]: Cleaning up the signal pipe 2007.08.26 20:29:04 LOG6[207:2684407808]: Child process 212 finished with code 0 <<-- at this point I have done nothing but connect to the stunnel, so I don;t know why it should finished with code 0 yet, and has not closed the connect on the other side.

1 0

[RFC,PATCH] Port stunnel to NSS
by Miloslav Trmac 28 Aug '07

28 Aug '07

Hello, As a part of Fedora's atttempt to rely on a single, FIPS certified. crypto implementation[1], I have prepared a port of stunnel to NSS, activated by passing --with-nss to configure. The port relies on a currently unreleased version of nss_compat_ossl[2]. The NSS interface is rather different from OpenSSL, and many options that are configured explicitly by applications with OpenSSL are either not available to applications with NSS, or configured using external tools in a "NSS database", which stores certificates, private keys and configuration settings. In particular: - The EGD (option "EGD") is not supported. - "RSA support" (loading keys as "RSA PRIVATE KEY" instead of "ANY PRIVATE KEY") is irrelevant, keys are stored in the NSS database - DH key exchange is not supported for the server side - compression (option "compression") is not supported - OpenSSL engines (options "engine", "engineCtrl") are not supported; PKCS#11 plugins are configured in the NSS database - CRLs (options "CRLpath", "CRLfile") are not configured; all CRLs stored in the NSS database are used automatically - OCSP (options "OCSP", "OCSPflag") is not supported in the current port; NSS supports OCSP, but a CA certificate must be specified along with the OCSP URL. - OpenSSL options (option "options") are not supported - NTLM authentication for the "CONNECT" protocol is not supported because NSS currently does not implement MD4 - certificates (option "cert") are stored in the NSS database; the "cert" option contains a nickname of a certificate stored in the database - CA certificates (options "CApath", "CAfile") are stored in the NSS database - error_depth on certificate verification failure is not supported To convert an existing stunnel set up to NSS, at minimum it is necessary to: - select a NSS database directory, $SSL_DIR $ certutil -d $SSL_DIR -N - import server and CA certificates: $ certutil -d $SSL_DIR -A -n server_cert_nickname -i server_cert.pem - import server private key: $ openssl pkcs12 -export -in server_key.pem -out server_key.pfx $ pk12util -d $SSL_DIR -i server_key.pfx - modify stunnel.conf to use "server_cert_nickname" instead of path to "server_cert.pem" in "cert" - when starting stunnel, make sure $SSL_DIR is present in the environment I'm afraid the incompatibilities are large, but the current NSS design really requires a database, and it does not work well with separate files. We'd like to include this NSS port of stunnel in Fedora 8 (if it doesn't prove to be too buggy). I'll be grateful for any comments. Mirek [1] http://fedoraproject.org/wiki/FedoraCryptoConsolidation [2] http://rcritten.fedorapeople.org/nss_compat_ossl.html

1 0

RFC3280 support
by Nagasundaram, Sekhar 22 Aug '07

22 Aug '07

Hello: I have hopefully a quick question. Does Stunnel support reason codes identified in RFC 3280? Thanks all Regards Sekhar Nagasundaram <<Nagasundaram, Sekhar.vcf>>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users