Mike:

Here are the configuration and the log files as you requested....

---------------------------------------------BEGIN CONFIG --------------------------------- # switch-simulator stunnel configuration file # Copyright by Michal Trojnara 2002

# Certs and keys cert = /etc/certs/demoedge2-cert.pem key = /etc/keys/demoedge2-key.pem

# PID is created inside chroot jail pid = /var/opt/stunnel/stunnel_server.pid

# Authentication stuff verify = 2 options = NO_SSLv2

# don't forget about c_rehash CApath # it is located inside chroot jail:

CApath = /etc/CApath

# CRL path or file (inside chroot jail): CRLpath = /etc/crl

# Some debugging stuff

debug = local4.5 output = /var/opt/log/pras_test_server.log

# Use it for client mode #client = no

# Service-level configuration

[APF] accept = 10.172.86.128:51101 connect = 127.0.0.1:50111

----------------------------------------------END CONFIG ---------------------------------- --------------------------------------------- BEGIN LOG FILE -------------------------------

2006.06.11 19:27:25 LOG5[8839:7]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.11 19:27:25 LOG4[8839:7]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.11 19:27:25 LOG3[8839:7]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.11 19:27:25 LOG5[8839:7]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.12 17:41:52 LOG5[8839:8]: APF connected from 10.172.86.96:35225 2006.06.12 17:41:52 LOG5[8839:8]: VERIFY OK: depth=2, /C=US/O=VISA/OU=Visa International Service Association/CN=TEST Visa Info Delivery Root CA 2006.06.12 17:41:52 LOG5[8839:8]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, , lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.12 17:41:52 LOG4[8839:8]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.12 17:41:52 LOG3[8839:8]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.12 17:41:52 LOG5[8839:8]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.12 23:01:08 LOG5[8839:9]: APF connected from 10.172.86.96:35371 2006.06.12 23:01:08 LOG5[8839:9]: VERIFY OK: depth=2, <VISA CA> 2006.06.12 23:01:08 LOG5[8839:9]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.12 23:01:08 LOG4[8839:9]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.12 23:01:08 LOG3[8839:9]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.12 23:01:08 LOG5[8839:9]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

------------------------------------------- END LOG FILE -------------------------------------- On 2006-06-12, at 22:17, Nagasundaram, Sekhar wrote:

We download crls everyday from a CRL server using LDAP and a cronjob. These CRLs are stored in the CRLpath directory along with its hash. It appears that the stunnel is not refreshing its cache, and it still shows "Found CRL is expired - revoking all certificates until you get updated CRL" when we try to connect to it even though there is

a New and valid CRL in the CRLPath folder. Is there a special option In Stunnel configuration for it to recognize/cache/add the new hash file

Just to make sure: the problem disappears after restarting stunnel, right?

The simple workaround could be disabling all SSL caches: ./configure --with-threads=fork make clean make make install

Can you send your stunnel.conf and debug log?

TIA, Mike

Sekhar Nagasundaram <<Nagasundaram, Sekhar.vcf>>