Complete newbie here, so please bear with me. I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify). This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of? Many thanks, - Joe
On Wed, Oct 25, 2006 at 03:32:02PM -0600, [email protected] wrote:
Complete newbie here, so please bear with me.
I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify).
This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of?
A quick Google search for "stunnel HTTPS wrapper" turned up http://www.stunnel.org/examples/https_windows.html among others. Even though the instructions there are for Windows, it could be useful as a starting point - the basic procedures (configuring OpenSSL, creating a self-signed certificate, the basic stunnel config file) are pretty much the same for most OS's. Hope that helps! G'luck, Peter -- Peter Pentchev [email protected] [email protected] [email protected] PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 I've heard that this sentence is a rumor.
[email protected] wrote:
I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify).
This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it?
The simplest configuration could be: [web] accept=443 connect=80 Please read the fine manual for details: http://stunnel.mirt.net/static/stunnel.html
Any gotchas or caveats I should be aware of?
Stunnel does not support HTTP protocol directly, so any server-generated redirects are kept intact (pointing to the http instead of https). Best regards, Mike
I've read the fine manual, and spent quite a while experimenting, but still have not managed to get stunnel to actually run. I have tried my own from-scratch configuration file, as well as a modified version of stunnel.conf-sample, with the same result, which is currently: 2006.11.13 16:18:16 LOG3[14237:2684415384]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.11.13 16:18:16 LOG3[14237:2684415384]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line Note that this is when running stunnel with sudo (since it needs root privs to read my certificate file -- cert.pem -- and I imagine may need them for other things too). If I turn the Debug option up to 7, then I get a few lines about the PRNG, followed by 2006.11.13 16:21:33 LOG7[14249:2684415384]: Certificate: /usr/local/etc/stunnel/cert.pem 2006.11.13 16:21:33 LOG7[14249:2684415384]: Certificate loaded 2006.11.13 16:21:33 LOG7[14249:2684415384]: Key file: /usr/local/etc/stunnel/cert.pem 2 and then followed by the same errors as above. I'm running under OS X 10.4.8, compiled and installed stunnel-4.19 just today, and I have a key.pem and cert.pem obtained from StartCom. Note that the above errors were obtained with no "key=" line in my .conf file; it wasn't clear to me if I need that for my goal (which is layering HTTPS service over my existing HTTP server). But I also tried specifying the path to my key.pem, and that results in different errors: 2006.11.13 16:24:29 LOG7[14259:2684415384]: Key file: /usr/local/etc/stunnel/key.pem 2006.11.13 16:24:29 LOG3[14259:2684415384]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.11.13 16:24:29 LOG3[14259:2684415384]: error stack: 906A065 : error:0906A065:PEM routines:PEM_do_header:bad decrypt 2006.11.13 16:24:29 LOG3[14259:2684415384]: error stack: 6065064 : error:06065064:digital envelope routines:EVP_DecryptFinal:bad decrypt 2006.11.13 16:24:29 LOG3[14259:2684415384]: Wrong pass phrase: retrying 2006.11.13 16:24:29 LOG3[14259:2684415384]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.11.13 16:24:29 LOG3[14259:2684415384]: error stack: 906A065 : error:0906A065:PEM routines:PEM_do_header:bad decrypt 2006.11.13 16:24:29 LOG3[14259:2684415384]: SSL_CTX_use_RSAPrivateKey_file: 6065064: error:06065064:digital envelope routines:EVP_DecryptFinal:bad decrypt ..of course, it never asked me for my pass phrase, so maybe it's not surprising that whatever it's using is wrong. But I don't see how to make it ask me for one. Can anyone give me a clue? Thanks, - Joe --
participants (3)
-
joe＠strout.net -
Michal Trojnara -
Peter Pentchev