Hi
I have a strange issue with stunnel 5.09 - which connects up to a F5 loadbalancer/SSL-offloading engine. In my config, I specify that the protocol must be TLSv1 - from Linux, I can connect - but it does not work from Windows..
Linux log:
2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=3) from 127.0.0.1:33247 2015.02.10 15:58:29 LOG7[22887]: Service [rb20] started 2015.02.10 15:58:29 LOG5[22887]: Service [rb20] accepted connection from 127.0.0.1:33247 2015.02.10 15:58:29 LOG6[22887]: s_connect: connecting A.B.C.D:443 2015.02.10 15:58:29 LOG7[22887]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 15:58:29 LOG5[22887]: s_connect: connected A.B.C.D:443 2015.02.10 15:58:29 LOG5[22887]: Service [rb20] connected remote server from 10.11.12.101:33477 2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) initialized 2015.02.10 15:58:29 LOG6[22887]: SNI: sending servername: host.domain.com 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): before/connect initialization 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write client hello A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read server hello A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read finished A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write finished A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 flush data 2015.02.10 15:58:29 LOG7[22887]: 1 items in the session cache 2015.02.10 15:58:29 LOG7[22887]: 5 client connects (SSL_connect()) 2015.02.10 15:58:29 LOG7[22887]: 5 client connects that finished 2015.02.10 15:58:29 LOG7[22887]: 0 client renegotiations requested 2015.02.10 15:58:29 LOG7[22887]: 0 server connects (SSL_accept()) 2015.02.10 15:58:29 LOG7[22887]: 0 server connects that finished 2015.02.10 15:58:29 LOG7[22887]: 0 server renegotiations requested 2015.02.10 15:58:29 LOG7[22887]: 4 session cache hits 2015.02.10 15:58:29 LOG7[22887]: 0 external session cache hits 2015.02.10 15:58:29 LOG7[22887]: 0 session cache misses 2015.02.10 15:58:29 LOG7[22887]: 0 session cache timeouts 2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused 2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=12) from 127.0.0.1:33249 2015.02.10 15:58:29 LOG6[22887]: Read socket closed (read hangup) 2015.02.10 15:58:29 LOG7[22887]: Sending close_notify alert 2015.02.10 15:58:29 LOG7[22887]: SSL alert (write): warning: close notify 2015.02.10 15:58:29 LOG6[22887]: SSL_shutdown successfully sent close_notify alert 2015.02.10 15:58:29 LOG7[22888]: Service [rb20] started 2015.02.10 15:58:29 LOG5[22888]: Service [rb20] accepted connection from 127.0.0.1:33249 2015.02.10 15:58:29 LOG6[22888]: s_connect: connecting A.B.C.D:443 2015.02.10 15:58:29 LOG7[22888]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 15:58:29 LOG5[22888]: s_connect: connected A.B.C.D:443 2015.02.10 15:58:29 LOG5[22888]: Service [rb20] connected remote server from 10.11.12.101:33479 2015.02.10 15:58:29 LOG7[22888]: Remote socket (FD=13) initialized 2015.02.10 15:58:29 LOG6[22888]: SNI: sending servername: ssl39.dmsave.com 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): before/connect initialization 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write client hello A 2015.02.10 15:58:29 LOG6[22887]: SSL socket closed (SSL_read) 2015.02.10 15:58:29 LOG7[22887]: Sent socket write shutdown 2015.02.10 15:58:29 LOG5[22887]: Connection closed: 136 byte(s) sent to SSL, 52 byte(s) sent to socket 2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) closed 2015.02.10 15:58:29 LOG7[22887]: Local socket (FD=3) closed 2015.02.10 15:58:29 LOG7[22887]: Service [rb20] finished (1 left) 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read server hello A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read finished A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write finished A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 flush data 2015.02.10 15:58:29 LOG7[22888]: 1 items in the session cache 2015.02.10 15:58:29 LOG7[22888]: 6 client connects (SSL_connect()) 2015.02.10 15:58:29 LOG7[22888]: 6 client connects that finished 2015.02.10 15:58:29 LOG7[22888]: 0 client renegotiations requested 2015.02.10 15:58:29 LOG7[22888]: 0 server connects (SSL_accept()) 2015.02.10 15:58:29 LOG7[22888]: 0 server connects that finished 2015.02.10 15:58:29 LOG7[22888]: 0 server renegotiations requested 2015.02.10 15:58:29 LOG7[22888]: 5 session cache hits 2015.02.10 15:58:29 LOG7[22888]: 0 external session cache hits 2015.02.10 15:58:29 LOG7[22888]: 0 session cache misses 2015.02.10 15:58:29 LOG7[22888]: 0 session cache timeouts 2015.02.10 15:58:29 LOG6[22888]: SSL connected: previous session reused
Windows log:
2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1128) from 127.0.0.1:50353 2015.02.10 16:07:36 LOG7[9528]: Creating a new thread 2015.02.10 16:07:36 LOG7[9528]: New thread created 2015.02.10 16:07:36 LOG7[7056]: Service [rb20] started 2015.02.10 16:07:36 LOG5[7056]: Service [rb20] accepted connection from 127.0.0.1:50353 2015.02.10 16:07:36 LOG6[7056]: s_connect: connecting A.B.C.D:443 2015.02.10 16:07:36 LOG7[7056]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 16:07:36 LOG5[7056]: s_connect: connected A.B.C.D:443 2015.02.10 16:07:36 LOG5[7056]: Service [rb20] connected remote server from 192.168.225.103:50354 2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) initialized 2015.02.10 16:07:36 LOG6[7056]: SNI: sending servername: host.domain.com 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): before/connect initialization 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client hello A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server hello A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server certificate A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server done A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client key exchange A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write finished A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 flush data 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read finished A 2015.02.10 16:07:36 LOG7[7056]: 1 items in the session cache 2015.02.10 16:07:36 LOG7[7056]: 1 client connects (SSL_connect()) 2015.02.10 16:07:36 LOG7[7056]: 1 client connects that finished 2015.02.10 16:07:36 LOG7[7056]: 0 client renegotiations requested 2015.02.10 16:07:36 LOG7[7056]: 0 server connects (SSL_accept()) 2015.02.10 16:07:36 LOG7[7056]: 0 server connects that finished 2015.02.10 16:07:36 LOG7[7056]: 0 server renegotiations requested 2015.02.10 16:07:36 LOG7[7056]: 0 session cache hits 2015.02.10 16:07:36 LOG7[7056]: 0 external session cache hits 2015.02.10 16:07:36 LOG7[7056]: 0 session cache misses 2015.02.10 16:07:36 LOG7[7056]: 0 session cache timeouts 2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes) 2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated 2015.02.10 16:07:36 LOG6[7056]: Negotiated TLSv1 ciphersuite RC4-MD5 (128-bit encryption) 2015.02.10 16:07:36 LOG7[7056]: Compression: null, expansion: null 2015.02.10 16:07:36 LOG6[7056]: Read socket closed (readsocket) 2015.02.10 16:07:36 LOG7[7056]: Sending close_notify alert 2015.02.10 16:07:36 LOG7[7056]: SSL alert (write): warning: close notify 2015.02.10 16:07:36 LOG6[7056]: SSL_shutdown successfully sent close_notify alert 2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1132) from 127.0.0.1:50355 2015.02.10 16:07:36 LOG7[9528]: Creating a new thread 2015.02.10 16:07:36 LOG7[9528]: New thread created 2015.02.10 16:07:36 LOG7[2164]: Service [rb20] started 2015.02.10 16:07:36 LOG5[2164]: Service [rb20] accepted connection from 127.0.0.1:50355 2015.02.10 16:07:36 LOG6[2164]: s_connect: connecting A.B.C.D:443 2015.02.10 16:07:36 LOG7[2164]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 16:07:36 LOG5[2164]: s_connect: connected A.B.C.D:443 2015.02.10 16:07:36 LOG5[2164]: Service [rb20] connected remote server from 192.168.225.103:50356 2015.02.10 16:07:36 LOG7[2164]: Remote socket (FD=1152) initialized 2015.02.10 16:07:36 LOG6[2164]: SNI: sending servername: host.domain.com 2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): before/connect initialization 2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): SSLv3 write client hello A 2015.02.10 16:07:36 LOG6[7056]: SSL socket closed (SSL_read) 2015.02.10 16:07:36 LOG7[7056]: Sent socket write shutdown 2015.02.10 16:07:36 LOG5[7056]: Connection closed: 89 byte(s) sent to SSL, 52 byte(s) sent to socket 2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) closed 2015.02.10 16:07:36 LOG7[7056]: Local socket (FD=1128) closed 2015.02.10 16:07:36 LOG7[7056]: Service [rb20] finished (1 left)
The main difference I can see, is that on Linux I get:
2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused
Whereas Windows gives me:
2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes) 2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated
Any idea why this happens ? The final result is that connections are possible from linux - but not Windows - and this is a problem for me...
Regards /Brian