Hi guys,
I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server.
Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL.
I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake.
My stunnel conf file is here:
[Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443
Can you please comment on this?
Best regards,
Denis
Denis,
Looks like your configuration is incomplete. Check the sample stunnel.conf file in the stunnel distribution. Read the man page. Post your log file.
Try adding lines like these before [Router]
sslVersion = SSLv3
cert=stunnel.pem key=stunnel.pem
# Authentication stuff, try 0 for test verify = 0
CApath = /your/CAcerts/path
debug = 7 output = stunnel.log
________________________________ From: Denis Berezhnoy [email protected] To: [email protected] Sent: Tuesday, January 24, 2012 6:10 PM Subject: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi guys, I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server. Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL. I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake. My stunnel conf file is here: [Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443 Can you please comment on this? Best regards, Denis _______________________________________________ stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users
Hi Jose,
Thank you for your reply. I double checked and actually there is SSL handshake. Sorry, it was my mistake I did not analyze WireShark capture carefully.
But handshake failed and here is stunnel log:
2012.01.25 09:39:58 LOG5[1944:6264]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.25 09:39:58 LOG5[1944:6264]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.25 09:39:58 LOG5[1944:6264]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.25 09:39:58 LOG5[1944:6264]: Reading configuration from file stunnel.conf 2012.01.25 09:39:58 LOG5[1944:6264]: FIPS mode is enabled 2012.01.25 09:39:58 LOG5[1944:6264]: Configuration successful 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router accepted connection from 192.168.1.161:59519 2012.01.25 09:40:13 LOG5[1944:4724]: connect_blocking: connected 192.168.160.168:55443 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router connected remote server from 192.168.1.121:52250 2012.01.25 09:40:13 LOG3[1944:4724]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.01.25 09:40:13 LOG5[1944:4724]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Server is setup for SSL3.0.
Best regards, Denis
2012/1/24 Jose Alf. [email protected]
Denis,
Looks like your configuration is incomplete. Check the sample stunnel.conf file in the stunnel distribution. Read the man page. Post your log file.
Try adding lines like these before [Router]
sslVersion = SSLv3
cert=stunnel.pem key=stunnel.pem
# Authentication stuff, try 0 for test verify = 0
CApath = /your/CAcerts/path
debug = 7 output = stunnel.log
*From:* Denis Berezhnoy [email protected] *To:* [email protected] *Sent:* Tuesday, January 24, 2012 6:10 PM *Subject:* [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi guys, I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server. Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL. I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake. My stunnel conf file is here: [Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443 Can you please comment on this? Best regards, Denis
stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users
Denis,
Please review this:
http://stunnel.mirt.net/pipermail/stunnel-users/2011-May/003080.html
In particular, check that you have your signing CA certificates (hashed) in your CaPath.
Do the tests with openssl connect and post sanitized results if you are in trouble.
Regards, Jose
________________________________ From: Denis Berezhnoy [email protected] To: Jose Alf. [email protected] Cc: "[email protected]" [email protected] Sent: Wednesday, January 25, 2012 9:55 AM Subject: Re: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi Jose, Thank you for your reply. I double checked and actually there is SSL handshake. Sorry, it was my mistake I did not analyze WireShark capture carefully. But handshake failed and here is stunnel log: 2012.01.25 09:39:58 LOG5[1944:6264]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.25 09:39:58 LOG5[1944:6264]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.25 09:39:58 LOG5[1944:6264]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.25 09:39:58 LOG5[1944:6264]: Reading configuration from file stunnel.conf 2012.01.25 09:39:58 LOG5[1944:6264]: FIPS mode is enabled 2012.01.25 09:39:58 LOG5[1944:6264]: Configuration successful 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router accepted connection from 192.168.1.161:59519 2012.01.25 09:40:13 LOG5[1944:4724]: connect_blocking: connected 192.168.160.168:55443 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router connected remote server from 192.168.1.121:52250 2012.01.25 09:40:13 LOG3[1944:4724]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.01.25 09:40:13 LOG5[1944:4724]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
Server is setup for SSL3.0. Best regards, Denis
2012/1/24 Jose Alf. [email protected]
Denis,
Looks like your configuration is incomplete. Check the sample stunnel.conf file in the stunnel distribution. Read the man page. Post your log file.
Try adding lines like these before [Router]
sslVersion = SSLv3
cert=stunnel.pem key=stunnel.pem
# Authentication stuff, try 0 for test verify = 0
CApath = /your/CAcerts/path
debug = 7 output = stunnel.log
From: Denis Berezhnoy [email protected] To: [email protected] Sent: Tuesday, January 24, 2012 6:10 PM Subject: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi guys, I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server. Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL. I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake. My stunnel conf file is here: [Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443 Can you please comment on this? Best regards, Denis _______________________________________________ stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users
Hi Jose,
Thank you for your help! Finally I made it working.
But there is one thing that is not quite clear for me. In logs I can see "Socket closed on read". Here it is:
2012.01.31 12:57:12 LOG7[6748:6808]: Socket closed on read 2012.01.31 12:57:12 LOG7[6748:6808]: Sending close_notify alert"
Can you please explain what it means? Why socket is closed?
Here is log:
2012.01.31 12:56:58 LOG7[6748:4740]: No limit detected for the number of clients 2012.01.31 12:56:58 LOG5[6748:4740]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.31 12:56:58 LOG5[6748:4740]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.31 12:56:58 LOG5[6748:4740]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.31 12:56:58 LOG5[6748:4740]: Reading configuration from file stunnel.conf 2012.01.31 12:56:58 LOG5[6748:4740]: FIPS mode is disabled 2012.01.31 12:56:58 LOG7[6748:4740]: Compression not enabled 2012.01.31 12:56:58 LOG7[6748:4740]: Snagged 64 random bytes from C:/.rnd 2012.01.31 12:56:58 LOG7[6748:4740]: Wrote 1024 new random bytes to C:/.rnd 2012.01.31 12:56:58 LOG7[6748:4740]: PRNG seeded successfully 2012.01.31 12:56:58 LOG6[6748:4740]: Initializing SSL context for service Router 2012.01.31 12:56:58 LOG7[6748:4740]: SSL options set: 0x05000004 2012.01.31 12:56:58 LOG6[6748:4740]: SSL context initialized 2012.01.31 12:56:58 LOG5[6748:4740]: Configuration successful 2012.01.31 12:56:58 LOG7[6748:4740]: Service Router bound FD=292 to 192.168.1.121:55555 2012.01.31 12:57:12 LOG7[6748:4740]: Service Router accepted FD=332 from 192.168.1.161:59076 2012.01.31 12:57:12 LOG7[6748:4740]: Creating a new thread 2012.01.31 12:57:12 LOG7[6748:4740]: New thread created 2012.01.31 12:57:12 LOG7[6748:6808]: Service Router started 2012.01.31 12:57:12 LOG5[6748:6808]: Service Router accepted connection from 192.168.1.161:59076 2012.01.31 12:57:12 LOG6[6748:6808]: connect_blocking: connecting 192.168.160.169:55443 2012.01.31 12:57:12 LOG7[6748:6808]: connect_blocking: s_poll_wait 192.168.160.169:55443: waiting 10 seconds 2012.01.31 12:57:12 LOG5[6748:6808]: connect_blocking: connected 192.168.160.169:55443 2012.01.31 12:57:12 LOG5[6748:6808]: Service Router connected remote server from 192.168.1.121:52050 2012.01.31 12:57:12 LOG7[6748:6808]: Remote FD=412 initialized 2012.01.31 12:57:12 LOG7[6748:6808]: Peer certificate was cached (1017 bytes) 2012.01.31 12:57:12 LOG6[6748:6808]: SSL connected: new session negotiated 2012.01.31 12:57:12 LOG6[6748:6808]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2012.01.31 12:57:12 LOG6[6748:6808]: Compression: null, expansion: null 2012.01.31 12:57:12 LOG7[6748:6808]: Socket closed on read 2012.01.31 12:57:12 LOG7[6748:6808]: Sending close_notify alert 2012.01.31 12:57:12 LOG6[6748:6808]: SSL_shutdown successfully sent close_notify alert 2012.01.31 12:57:22 LOG3[6748:6808]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.01.31 12:57:22 LOG5[6748:6808]: Connection closed: 200 bytes sent to SSL, 1 bytes sent to socket 2012.01.31 12:57:22 LOG7[6748:6808]: Service Router finished (0 left)
Best regards, Denis
2012/1/25 Jose Alf. [email protected]
Denis,
Please review this:
http://stunnel.mirt.net/pipermail/stunnel-users/2011-May/003080.html
In particular, check that you have your signing CA certificates (hashed) in your CaPath.
Do the tests with openssl connect and post sanitized results if you are in trouble.
Regards, Jose
*From:* Denis Berezhnoy [email protected] *To:* Jose Alf. [email protected] *Cc:* "[email protected]" [email protected] *Sent:* Wednesday, January 25, 2012 9:55 AM *Subject:* Re: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi Jose,
Thank you for your reply. I double checked and actually there is SSL handshake. Sorry, it was my mistake I did not analyze WireShark capture carefully.
But handshake failed and here is stunnel log:
2012.01.25 09:39:58 LOG5[1944:6264]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.25 09:39:58 LOG5[1944:6264]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.25 09:39:58 LOG5[1944:6264]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.25 09:39:58 LOG5[1944:6264]: Reading configuration from file stunnel.conf 2012.01.25 09:39:58 LOG5[1944:6264]: FIPS mode is enabled 2012.01.25 09:39:58 LOG5[1944:6264]: Configuration successful 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router accepted connection from 192.168.1.161:59519 2012.01.25 09:40:13 LOG5[1944:4724]: connect_blocking: connected 192.168.160.168:55443 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router connected remote server from 192.168.1.121:52250 2012.01.25 09:40:13 LOG3[1944:4724]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.01.25 09:40:13 LOG5[1944:4724]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Server is setup for SSL3.0.
Best regards, Denis
2012/1/24 Jose Alf. [email protected]
Denis,
Looks like your configuration is incomplete. Check the sample stunnel.conf file in the stunnel distribution. Read the man page. Post your log file.
Try adding lines like these before [Router]
sslVersion = SSLv3
cert=stunnel.pem key=stunnel.pem
# Authentication stuff, try 0 for test verify = 0
CApath = /your/CAcerts/path
debug = 7 output = stunnel.log
*From:* Denis Berezhnoy [email protected] *To:* [email protected] *Sent:* Tuesday, January 24, 2012 6:10 PM *Subject:* [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi guys, I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server. Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL. I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake. My stunnel conf file is here: [Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443 Can you please comment on this? Best regards, Denis
stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users
Denis,
As I understand stunnel is logging the fact that the client closed the connection (socket) while it was waiting for data (reading) from the client.
Looks like your client connects for a very short time, sends just 1 byte, the disconnects.
Mike can correct me if I am wrong.
Regards, Jose
________________________________ From: Denis Berezhnoy [email protected] To: Jose Alf. [email protected] Cc: "[email protected]" [email protected] Sent: Tuesday, January 31, 2012 1:11 PM Subject: Re: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi Jose,
Thank you for your help! Finally I made it working.
But there is one thing that is not quite clear for me. In logs I can see "Socket closed on read". Here it is:
2012.01.31 12:57:12 LOG7[6748:6808]: Socket closed on read 2012.01.31 12:57:12 LOG7[6748:6808]: Sending close_notify alert"
Can you please explain what it means? Why socket is closed?
Here is log:
2012.01.31 12:56:58 LOG7[6748:4740]: No limit detected for the number of clients 2012.01.31 12:56:58 LOG5[6748:4740]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.31 12:56:58 LOG5[6748:4740]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.31 12:56:58 LOG5[6748:4740]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.31 12:56:58 LOG5[6748:4740]: Reading configuration from file stunnel.conf 2012.01.31 12:56:58 LOG5[6748:4740]: FIPS mode is disabled 2012.01.31 12:56:58 LOG7[6748:4740]: Compression not enabled 2012.01.31 12:56:58 LOG7[6748:4740]: Snagged 64 random bytes from C:/.rnd 2012.01.31 12:56:58 LOG7[6748:4740]: Wrote 1024 new random bytes to C:/.rnd 2012.01.31 12:56:58 LOG7[6748:4740]: PRNG seeded successfully 2012.01.31 12:56:58 LOG6[6748:4740]: Initializing SSL context for service Router 2012.01.31 12:56:58 LOG7[6748:4740]: SSL options set: 0x05000004 2012.01.31 12:56:58 LOG6[6748:4740]: SSL context initialized 2012.01.31 12:56:58 LOG5[6748:4740]: Configuration successful 2012.01.31 12:56:58 LOG7[6748:4740]: Service Router bound FD=292 to 192.168.1.121:55555 2012.01.31 12:57:12 LOG7[6748:4740]: Service Router accepted FD=332 from 192.168.1.161:59076 2012.01.31 12:57:12 LOG7[6748:4740]: Creating a new thread 2012.01.31 12:57:12 LOG7[6748:4740]: New thread created 2012.01.31 12:57:12 LOG7[6748:6808]: Service Router started 2012.01.31 12:57:12 LOG5[6748:6808]: Service Router accepted connection from 192.168.1.161:59076 2012.01.31 12:57:12 LOG6[6748:6808]: connect_blocking: connecting 192.168.160.169:55443 2012.01.31 12:57:12 LOG7[6748:6808]: connect_blocking: s_poll_wait 192.168.160.169:55443: waiting 10 seconds 2012.01.31 12:57:12 LOG5[6748:6808]: connect_blocking: connected 192.168.160.169:55443 2012.01.31 12:57:12 LOG5[6748:6808]: Service Router connected remote server from 192.168.1.121:52050 2012.01.31 12:57:12 LOG7[6748:6808]: Remote FD=412 initialized 2012.01.31 12:57:12 LOG7[6748:6808]: Peer certificate was cached (1017 bytes) 2012.01.31 12:57:12 LOG6[6748:6808]: SSL connected: new session negotiated 2012.01.31 12:57:12 LOG6[6748:6808]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2012.01.31 12:57:12 LOG6[6748:6808]: Compression: null, expansion: null 2012.01.31 12:57:12 LOG7[6748:6808]: Socket closed on read 2012.01.31 12:57:12 LOG7[6748:6808]: Sending close_notify alert 2012.01.31 12:57:12 LOG6[6748:6808]: SSL_shutdown successfully sent close_notify alert 2012.01.31 12:57:22 LOG3[6748:6808]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.01.31 12:57:22 LOG5[6748:6808]: Connection closed: 200 bytes sent to SSL, 1 bytes sent to socket 2012.01.31 12:57:22 LOG7[6748:6808]: Service Router finished (0 left)
Best regards, Denis
2012/1/25 Jose Alf. [email protected]
Denis,
Please review this:
http://stunnel.mirt.net/pipermail/stunnel-users/2011-May/003080.html
In particular, check that you have your signing CA certificates (hashed) in your CaPath.
Do the tests with openssl connect and post sanitized results if you are in trouble.
Regards, Jose
From: Denis Berezhnoy [email protected] To: Jose Alf. [email protected] Cc: "[email protected]" [email protected] Sent: Wednesday, January 25, 2012 9:55 AM Subject: Re: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi Jose, Thank you for your reply. I double checked and actually there is SSL handshake. Sorry, it was my mistake I did not analyze WireShark capture carefully. But handshake failed and here is stunnel log: 2012.01.25 09:39:58 LOG5[1944:6264]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.25 09:39:58 LOG5[1944:6264]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.25 09:39:58 LOG5[1944:6264]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.25 09:39:58 LOG5[1944:6264]: Reading configuration from file stunnel.conf 2012.01.25 09:39:58 LOG5[1944:6264]: FIPS mode is enabled 2012.01.25 09:39:58 LOG5[1944:6264]: Configuration successful 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router accepted connection from 192.168.1.161:59519 2012.01.25 09:40:13 LOG5[1944:4724]: connect_blocking: connected 192.168.160.168:55443 2012.01.25 09:40:13 LOG5[1944:4724]: Service Router connected remote server from 192.168.1.121:52250 2012.01.25 09:40:13 LOG3[1944:4724]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.01.25 09:40:13 LOG5[1944:4724]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
Server is setup for SSL3.0. Best regards, Denis
2012/1/24 Jose Alf. [email protected]
Denis,
Looks like your configuration is incomplete. Check the sample stunnel.conf file in the stunnel distribution. Read the man page. Post your log file.
Try adding lines like these before [Router]
sslVersion = SSLv3
cert=stunnel.pem key=stunnel.pem
# Authentication stuff, try 0 for test verify = 0
CApath = /your/CAcerts/path
debug = 7 output = stunnel.log
From: Denis Berezhnoy [email protected] To: [email protected] Sent: Tuesday, January 24, 2012 6:10 PM Subject: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
Hi guys, I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server. Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL. I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake. My stunnel conf file is here: [Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443 Can you please comment on this? Best regards, Denis _______________________________________________ stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users
-
Denis Berezhnoy -
Jose Alf.