stunnel-users

3306 discussions

Re: [stunnel-users] https to https proxy
by Eric Eberhard 20 Aug '19

20 Aug '19

I'll bite - probably missing something. Why not have your application output clear text to stunnel and set stunnel to TLSv1.2? In other words, drop the SSL from your application. If that won't work I think you can do it with two stunnels (I got it to work once before I did the above). One accepts SSLv3 and outputs clear text . it is the client=no option. The output goes to a stunnel that is client=yes and is set to TLSv1.2 . which outputs to your final destination. The output from the client=no would be to localhost on some port that fires the second stunnel. I suspect you have to use different port numbers. All guesses as I am not sure exactly what you are doing . but if it helps, great :) Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Monday, August 19, 2019 11:21 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 1
by Brent Kimberley 20 Aug '19

20 Aug '19

Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

https to https proxy
by Daniel Trickett 19 Aug '19

19 Aug '19

Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Working OCSP example instructions?
by Mark Currie 24 Jul '19

24 Jul '19

Hi, Does anyone have a link to detailed instructions of a working example of Stunnel with OCSP? (including certificate creation if possible) I came across one some time back but can no longer find it. I would greatly appreciate any help with this. I wasn't able to get any replies to my earlier posting showing my problem: https://www.stunnel.org/pipermail/stunnel-users/2019-July/006451.html

1 0

Is there a latest version Debian stunnel package?
by Miranda Zhang 23 Jul '19

23 Jul '19

Hi everyone, I can only find stunnel4 Debian package: https://packages.debian.org/search?keywords=stunnel https://debian.pkgs.org/10/debian-main-amd64/stunnel4_5.50-3_amd64.deb.html ftp://ftp.stunnel.org/stunnel/archive/5.x/stunnel4_5.28-0ubuntu1_amd64.deb <ftp://ftp.stunnel.org/stunnel/archive/5.x/> Is there a 5.55 package? Thanks, Miranda

2 1

Multiple certificates with same hash
by Marco Göbel 23 Jul '19

23 Jul '19

Hi, we use c_rehash to upgrade client certificates and we have multiple certificates with the same hash (e.g. same subject but different start-/end validity) like: ee98f073.0 ee98f073.1 ee98f073.2 The man-page description for the CApath option seems to be correct what stunnel will do: >Note that the certificates in this directory should be named XXXXXXXX.0 >where XXXXXXXX is the hash value of the DER encoded subject of the cert. It seems only certificates with the ending .0 is used by stunnel and the others certificate hashes with higher numbers are never used/read. Can you confirm? Any idea how to use all certificates with stunnel? BTW. we tested with version 4.56 and latest 5.5 Regards, Marco

1 0

Multi-Mode-Stunnel
by MESSINGSCHLAGER Andreas 17 Jul '19

17 Jul '19

Is it possible to run stunnel in the server-mode und in the client-mode on the same server? ------------------------------------------------------ ADG Apotheken-Dienstleistungsgesellschaft mbH Salzachstrasse 15 D-68199 Mannheim ADG ist Gesamt-Sieger der "markt intern" Umfragen "Apotheken - Software 2009, 2011, 2013, 2016 & 2018". Sitz: Mannheim Registergericht: Amtsgericht Mannheim HRB 701436 USt.-IdNr.: DE132763561 Geschaeftsfuehrer: Joachim von Morstein, Bernd Hess, Dr. Max Schwesig Diese E-Mail und alle Anhaenge enthalten vertrauliche und rechtlich geschuetzte Informationen, die ausschliesslich fuer den Gebrauch des Adressaten bestimmt sind. Das unerlaubte Kopieren, die unbefugte Weitergabe oder sonstiger ungenehmigter Gebrauch der E-Mail nebst den Anhaengen sind nicht gestattet. Sollten Sie nicht der richtige Adressat sein oder die E-Mail irrtuemlich erhalten haben, informieren Sie bitte den Absender unverzueglich telefonisch oder per E-Mail und vernichten diese E-Mail und alle Anhaenge sowie etwaige Kopien und Sicherungskopien. Vielen Dank. This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If you are not the intended recipient or have received this e-mail in error, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by telephone or by electronic mail, and delete this message and all copies and backups thereof. Thank you. ------------------------------------------------------

3 2

feature ? authorizing only given certificates ?
by fmgre-dell＠yahoo.fr 15 Jul '19

15 Jul '19

Hello My european organization is using a certificate chain which signs tens of thousands of user certificates. My local organization counts 300 users ... and i only want these 300 to get in the IT system. I'd like to know if there is a way to restrict the connection to a subset of certificates ( for example based on a list of authorized emails which are written in the certificate ) Sincerely Fred

3 4

Possible to verify client certificate BUT ignore expiration-date?
by Brent Kimberley 11 Jul '19

11 Jul '19

Would libfaketime or run_as_date help? Date: Thu, 11 Jul 2019 10:48:39 -0400 From: Christopher Schultz <chris(a)christopherschultz.net> To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? Eric, (Coming back to this.) On 5/14/19 14:41, Eric Eberhard wrote: > Chris, > > There are "real" certificates you purchase from a certificate authority and pay an annual fee. If this is https you pretty much need that or the user gets errors. By private I meant "self signed." > > However, openssl has an option to create a certificate. You type the name, address, whatever, and it makes a certificate. It is JUST AS GOOD as a purchased certificate (except https or perhaps others that want certificate authority certificates). I use them for FTP and SSH and many things . > > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 > > You can put your own expire date(days) when you make the cert. A screen will come up and ask 20 questions :-) If you cannot do it (don't have openssl installed) I can do it for you. It certainly will work as a stop-gap. We don't need it for https as it is Apache on a machine that is hosted. So... everything above is exactly what we do with this vendor. We don't have a problem getting a well-known-CA to sign the certificate. We have (had) a problem with the vendor just getting the damned work done. Yes, I know it is a 5-minute process but when you are dealing with a big company where you have to have 6 managers in multiple time zones call each other to confirm the problem, have a meeting about the solution, determine a course of action, allocate a resource to perform the work, QA the solution, then get an IT review of everything before placing something into production, that 5-minute fix can take days or weeks. I just wanted to say "I still trust this certificate, even though it has expired." Is that possible to do without recompiling stunnel? Thanks, -chris

1 0

Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?
by Christopher Schultz 11 Jul '19

11 Jul '19

Eric, (Coming back to this.) On 5/14/19 14:41, Eric Eberhard wrote: > Chris, > > There are "real" certificates you purchase from a certificate authority and pay an annual fee. If this is https you pretty much need that or the user gets errors. By private I meant "self signed." > > However, openssl has an option to create a certificate. You type the name, address, whatever, and it makes a certificate. It is JUST AS GOOD as a purchased certificate (except https or perhaps others that want certificate authority certificates). I use them for FTP and SSH and many things . > > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 > > You can put your own expire date(days) when you make the cert. A screen will come up and ask 20 questions :-) If you cannot do it (don't have openssl installed) I can do it for you. It certainly will work as a stop-gap. We don't need it for https as it is Apache on a machine that is hosted. So... everything above is exactly what we do with this vendor. We don't have a problem getting a well-known-CA to sign the certificate. We have (had) a problem with the vendor just getting the damned work done. Yes, I know it is a 5-minute process but when you are dealing with a big company where you have to have 6 managers in multiple time zones call each other to confirm the problem, have a meeting about the solution, determine a course of action, allocate a resource to perform the work, QA the solution, then get an IT review of everything before placing something into production, that 5-minute fix can take days or weeks. I just wanted to say "I still trust this certificate, even though it has expired." Is that possible to do without recompiling stunnel? Thanks, -chris > -----Original Message----- > From: stunnel-users [mailto:[email protected]] On Behalf Of Christopher Schultz > Sent: Tuesday, May 14, 2019 6:49 AM > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? > > Eric, > > On 5/13/19 18:06, Eric Eberhard wrote: >> Use openssl to make a private cert? > > What is a "private cert"? > > Also, I need to trust an existing certificate... If they can create a new certificate, then I can just trust the new one. I'm looking for a stop-gap measure, here. > > Thanks, > -chris > >> -----Original Message----- >> From: stunnel-users [mailto:[email protected]] On >> Behalf Of Christopher Schultz >> Sent: Monday, May 13, 2019 2:28 PM >> To: stunnel-users(a)stunnel.org >> Subject: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? >> >> All, >> >> Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? >> >> We have a vendor whose certificate has expired, and we want to allow >> their old certificate to work while they chase their tails trying to >> figure out the best way to re-issue a new cert for us. *eyeroll* >> >> Is it possible? >> >> Thanks, >> -chris >> >> >> >> > > >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users