stunnel-users

3306 discussions

stunnel errors on Solaris
by Kevin Mooney 27 Jan '06

27 Jan '06

Hello All, I am having some errors on a Solaris 8 machine with stunnel. Everything seems to be working fine, but I am just a little leary since it is under security violations. I couldn't get anything from google using the string Too many retries on SSL shutdown. I was curious if anyone has seen this before or if somebody might have an idea as to what this means. Thank You, Kevin Security Violations =-=-=-=-=-=-=-=-=-= Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown

2 1

Stunnel and Forte Agent
by Malcolm William Mason 27 Jan '06

27 Jan '06

Hello to all, I have been using Stunnel to access News Groups at ATT.net to by-pass or tunnel through ATT's SSL for some time. I have run into trouble and I am getting a message "connection" failed. At first I thought that it was Stunnel and after deleting and re-installing Stunnel, I an getting the same RESULT. Was there an older version of Stunnel that worked and will the new, updated Stunnel not work or does it need to have some settings changed? Malcolm Mason MWM1(a)jhu.edu

1 0

Proxy Support and 4.15b2
by Ben Green 26 Jan '06

26 Jan '06

Greetings everyone, I have been working for a few days with Stunnel and have been trying to get it working with the proxy servers that filter all outbound traffic at work. I stumbled across 4.15b2 today and was able to get it all to work well to SSL enable telnet and fix through the connect protocol. I plan to use this in production if all goes well in dev, test, and qa over the next 2 months. I was not around on the list when the announcement went out for 4.15b2 on November 16th (found it in the archives). I'll get to my point, now. I am wondering how testing is going with 4.15b2. Is it going to be released as 4.15, soon? Has anyone put 4.15b2 in a production situation? Thanks. Ben Green

2 1

Win32 proxy enabled version
by Richard Houston 24 Jan '06

24 Jan '06

Hi all, I am looking for a windows version of stunnel with proxy server support. I need to use this from behind a Novel Boarder manager firewall. Also is there any documentation on the config file options? Thanks much in advance! +------------------------------------+ Best regards, -Richard Houston -R.L.H. Consulting -E-Mail rhouston(a)rlhc.net -WWW http://www.rlhc.net -Blog http://www.rlhc.net/blog/

1 0

Re: [stunnel-users] exclusively TLS
by Jesse Small 24 Jan '06

24 Jan '06

I've been working through the same problem as John, but I tried using Jan's solution by setting the options and still haven't been able to get it to work. On server1 I am running openssl s_server with tls-only specified: openssl s_server -accept 8443 -cert XDS_REG_HXTI.cer -key hxti1.key -tls1 On the client side (server2), I have stunnel set up as a client listening on localhost port 8100, and forwarding over to server1, port 8443. Then to test I run 'telnet localhost 8100' and see the error message from s_server: ACCEPT ERROR 16656:error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number:s3_srvr.c:683: shutting down SSL CONNECTION CLOSED In my stunnel.log file I can see this error message: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure So to me it still seems to be sending out a client hello in sslv3, despite my efforts to the contrary. Below are the pertinent parts of my stunnel_client.conf file. Any help you could give would be greatly appreciated. Thanks, Jesse ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 [toOtherServer] accept = 8100 connect = devapp:8443 -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Friday, January 20, 2006 5:20 PM To: Moehrke, John (GE Healthcare) Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] exclusively TLS On Fri, 20 Jan 2006, Moehrke, John (GE Healthcare) wrote: > It is not the list of ciphers that I want to choose from. We are indeed > using a select set of ciphers and that seems to be working fine. My > problem is that when stunnel connects to the server it is trying sslv3, > and this causes an error as the server is only supporting TLS. I could > easily be wrong... Ah, that way. options = SSL_options OpenSSL library options The parameter is the OpenSSL option name as described in the SSL_CTX_set_options(3ssl) manual, but without SSL_OP_ prefix. Several options can be used to specify multiple options. For example for compatibility with erroneous Eudora SSL implementation the following option can be used: options = DONT_INSERT_EMPTY_FRAGMENTS Check the SSL_CTX_set_options manpage, it says -amongst other things-: SSL_OP_NO_SSLv2 Do not use the SSLv2 protocol. SSL_OP_NO_SSLv3 Do not use the SSLv3 protocol. SSL_OP_NO_TLSv1 Do not use the TLSv1 protocol. That ought to do the trick I'd say. Let us know if it did :) Jan -- http://www.surfnet.nl/organisatie/jame

1 0

ad tdions
by Malcolm William Mason 23 Jan '06

23 Jan '06

I am, apparently on this But how do I post to it as others seen to. Pro Posterioribus

1 0

Looking for a job in UK or Ireland
by Michal Trojnara 23 Jan '06

23 Jan '06

Hi, I hope you don't mind this time I'll use stunnel mailing lists for something personal. I've just updated my Resume: http://mike.mirt.net/cv-en.pdf Do you know of interesting job openings? Possibly as an architect or in a similar position. Best regards, Mike

1 0

https to http proxy is buggy with IE
by Glen 22 Jan '06

22 Jan '06

Hi Everyone, I am trying to use stunnel to do the ssl portion for the web server. Mainly because the certificate I have is easy to setup in stunnel (was originally created for an openssl based serer) and the web server supports it's own propriatery cert format which I would like to avoid having to convert to. I have it working fine with all browsers except for the buggy Internet Explorer. With internet explorer anything requiring a page redirect fails (from viewing the logs it appears the socket gets closed before the redirect is finished resulting in a blank page being sent to the browser. I have tried the TIMEOUTclose = 0 but that hasn't helped. Any suggestions? thanks, Glen

2 1

stunnel 4.14 errors and dropped connection
by stunnelusers＠tinfoil.cotse.net 21 Jan '06

21 Jan '06

Hello, If I leave my computer downloading via stunnel and come back to it later, I find the download has stopped halfway and in the stunnel log it says: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) and then a number of lines like: Error resolving 'xxx.xxx.xxx': Neither nodename nor servname known (EAI_NONAME) where xxx.xxx.xxx is the url I was downloading from. I am using stunnel 4.14 on win xp. If I try to load a web page like google I get told it cannot be found. I have to switch off the router and switch it back on. When Windows finds the "new" connection it resets itself and everything works perfectly again, for a while, and then it happens all over again. This did not happen before I upgraded to 4.14. What is happening? Why is it happening? How do i stop it? Thanks.

1 0

RE: [stunnel-users] exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

It is not the list of ciphers that I want to choose from. We are indeed using a select set of ciphers and that seems to be working fine. My problem is that when stunnel connects to the server it is trying sslv3, and this causes an error as the server is only supporting TLS. I could easily be wrong... John > > I need to talk to a server that is requiring pure TLS. It seems that > > STUNNEL always starts with SSL. How do I get STUNNEL to > start the client > > side conversation with TLS? > > http://www.stunnel.org/faq/stunnel.html#global_options > > ciphers = cipherlist > > Select permitted SSL ciphers > > A colon delimited list of the ciphers to allow in the SSL > connection. > For example DES-CBC3-SHA:IDEA-CBC-MD5 > > > For an exhaustive table of allowed ciphersuite values, if > it's not in the > stunnel manual check > http://www.modssl.org/docs/2.8/ssl_reference.html#ToC9 > > Jan > > -- > http://www.surfnet.nl/organisatie/jame > >

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users