[stunnel-users] stunnel and CAPI on Windows

Wed May 23 11:16:39 CEST 2018

Hi

 I am trying to use the Microsoft certificate store/API for client validation of Windows hosts towards an F5.

Everything works, when we use file-based certificates - but for security purposes I would prefer to use the windows certificate store, and set the private key on the client as non-exportable...

I have enabled the

engineId = capi 

in the global section of stunnel.conf - and for the required client/service I have:

[F5CertAdmin]

client=yes

accept = 127.0.0.1:1679

connect = w.x.y.z:443

delay = yes

sni = ssl79admpki.xxxx.com

CApath = C:\Program Files (x86)\stunnel\config\certs

CAFile = C:\Program Files (x86)\stunnel\config\certs\GlobalSign-Cert-Chain.pem

verify = 2

engineId = capi

key = BaaSClientCertificateCP

cert = BaaSClientCertificateCP

I have a certificate  in the local computer certificate store with the supplied name - but stunnel is not able to locate it... Is it because it will look under the user account? If yes, will it look under the local machine when running as local system ?

The output from stunnel says:

[ ] Initializing service [F5CertAdmin]
[ ] Ciphers: HIGH:!DH:!aNULL:!SSLv2
[ ] TLS options: 0x03000004 (+0x03000000, -0x00000000)
[ ] Client certificate engine (capi) enabled
[ ] Loading certificate from engine ID: BaaSClientCertificateCP
[!] ENGINE_ctrl_cmd: Peer suddenly disconnected
[ ] Initializing private key on engine ID: BaaSClientCertificateCP
[!] ENGINE_load_private_key: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key
[ ] Loading certificate from file: BaaSClientCertificateCP
[!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib
[!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib
[!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory
[!] Service [F5CertAdmin]: Failed to initialize TLS context

 @am6pr03mb3813.eurprd03.prod.outlook.com>Any advice appreciated...

Thanks

Brian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20180523/e3c67738/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 5375 bytes
Desc: not available
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20180523/e3c67738/attachment.png>