- stunnel-users - stunnel.org

How to install CA at client side?
by MingHeng Wang 15 Sep '15

15 Sep '15

Hello Stunnel maintainers, I try to use real certificates of my web server for stunnel. I combine private key, my site's cert, and ca-bundle into a pem file, and it works fine when the client doesn't verify any certificate. Then I specify CAfile which is the ca bundle file from my registrar, at client side and turn on verification and always get errors below, whatever level 2 or 3: Sep 15 14:53:28 y400 stunnel[11666]: LOG5[11]: Service [http-proxy3] connected remote server from 192.168.1.104:45746 Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: CERT: Pre-verification error: unable to get issuer certificate Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: Rejected by CERT at depth=2: However, level 4 works. I want to prevent man-in-middle-attack, so can level 4 achieve that regarding to my current setup? Both server and client side use stunnel 5.17 which are fairly recent.

2 1

Windows 2012 R2 Error on startup
by Han-Earl Guhm 13 Sep '15

13 Sep '15

I installed the latest version of stunnel and am having problems starting it up. I have attached an error log and my config file. I tested on Windows 7 and it worked with no problems, but I would really like it to work on my Windows 2012 server. Thank you, Han-Earl Guhm Coventry Christian Schools hanguhm(a)educatingforlife.com

2 1

The Error with Engine
by Donne, Ann 08 Sep '15

08 Sep '15

Hi all, Need your help. When I configured the Stunnel without the Engine LunaCA3 (product from SafeNet), everything worked fine. After add the global option with the engine: engine=LunaCA3 engineCtrl=SO_PATH:/usr/local/ssl/lib/engines/liblunaca3.so I got the following error. I also searched previous engine issues and saw someone else with the similar issues. Hope that the issue was resolved. The Stunnel and the open SSL info: stunnel 5.20 on x86_64 Linux. Compiled/running with OpenSSL 1.0.1i-fips. The setting is for server with sslVersion = TLSv1 and ciphers = AES128-SHA. 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.09.08 11:11:01 LOG7[0]: SSL alert (write): fatal: bad record mac 2015.09.08 11:11:01 LOG3[0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2015.09.08 11:11:01 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.09.08 11:11:01 LOG7[0]: Deallocating application specific data for addr index 2015.09.08 11:11:01 LOG7[0]: Local socket (FD=3) closed Any help and info are greatly appreciated!! Thanks Ann Donne ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

1 0

stunnel 5.23 released
by Michal Trojnara 02 Sep '15

02 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.23 of stunnel. The ChangeLog entry: Version 5.23, 2015.09.02, urgency: LOW * New features - Client-side support for the SOCKS protocol. See https://www.stunnel.org/socksvpn.html for details. - Reject SOCKS requests to connect loopback addresses. - New service-level option "OCSPnonce". The default value is "OCSPnonce = no". - Win32 directory structure rearranged. The installer script provides automatic migration for common setups. - Added Win32 installer option to install stunnel for the current user only. This feature does not deploy the NT service, but it also does not require aministrative privileges to install and configure stunnel. - stunnel.cnf was renamed to openssl.cnf in order to to prevent users from mixing it up with stunnel.conf. - Win32 desktop is automatically refreshed when the icon is created or removed. - The ca-certs.pem file is now updated on stunnel upgrade. - Inactive ports were removed from the PORTS file. - Added IPv6 support to the transparent proxy code. * Bugfixes - Compilation fix for OpenSSL version older than 1.0.0. - Compilation fix for mingw. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0fc4a702afd2e857bae8ad1f39c51546eb282c3d0ff4f4d55d62aece7328ddea stunnel-5.23.tar.gz 40739ac4124bbe5192d7f68b020758295586ae65a16c1612829bffd1d3873363 stunnel-5.23-installer.exe 001e7d0a6d53b05b64fe62b0ca0623077d89f090b473e2cabed1eafa49196725 stunnel-5.23-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV5q76AAoJEC78f/DUFuAUG54P/2ycqSOKbP3CN1MMKJj9NxBM 1uDuv/voF9OT/Y064X2bjy6dApo5HA9a4VHr1EaF+3x+Wofemhc5puLsgbfuFJKl nogN8cNdR2sk+GLooytfKp+jRZ8NAl2Rv5lLi/YE57RsMe91wI5kRxWKpeIDeG4L y7LhsCLmHNYkffsGSeOaXfc3rBBWOY39Lc78t3kezK14jIGZiCH/V32HRHMaWGiw 9oLBIRxGOVAscKcC2+MOGtXelKeJFrnAfW+v6qcZE1/SL4JnGHz8jBxOcvFbfrko 5yJfWYpgQg7NeLNovY+o1EXVxxw4Ty9ppLob9cRTGmx1Fgb6eE1uYVSAbx53lYKF 2z0J2MkKgMj07Mao5j45DiqRqa/kWDzKIN4sTCm5atDKB2ozrcfuDLLEU3W6XKrw 7XHPSs+FdkXQXYsfK7wbftLKfNEu8ojGKyMTMuKQcX/SkxyQuV6rYXA8gBm3HJCY dNp5lU5FdoiMv9S+uQpDL2j9GjOSNAV7qPzyRk8ivl1a1LonkbjQxHApvktSwkHt Gey6xweW5vt7FsKb15mFhx6ctBldM9lR7u4EacXWy+hq5UY6/5Rr/rbyCkCvG/NU Oq5LD2bqX22Xl4XeiVCW2gpLcqPWdbREY3YklGt22ln+PdyA+iGpxbeczUHjV5qX a6P76JpGk/pL5lhWfRV4 =i2gK -----END PGP SIGNATURE-----

1 0

(no subject)
by Eric Poythress 02 Sep '15

02 Sep '15

I am having some issues with getting Stunnel to work for my application. I'm using a logger that is able to email out alarms but it is not encrypted. I have Stunnel on the PC that connects to the logger. Both are able to see each other just fine but I have the following error in the log: Service [SMTP Outgoing] needs authentication to prevent MITM attacks I only want mail to go out and on the logger side of things my only inputs are SMTP Server, Use SMTP Authentication check box, Username, Password and Port. Any help or suggests would be greatly appreciated. Thank you, Eric Poythress Test Manager 1600 West Tacoma Street Broken Arrow, Oklahoma 74012 [Description: Air Hygiene Office - email signature] Direct - (918) 994-4171 Fax - (918) 307-9131 Mobile - (573) 587-0226 Toll Free - (888) 461-8778 virtual tour Air Hygiene: http://host.newspin360.net/airhygiene/ e-mail: epoythress(a)airhygiene.com<mailto:epoythress@airhygiene.com> website: www.airhygiene.com<http://www.airhygiene.com/>

2 3

Security suggestions on stunnel with SSL/TLS and SNI configuration
by Secure-Mail User 28 Aug '15

28 Aug '15

2 2

Re: [stunnel-users] stunk closing connections with RST
by Ade Ajibade 26 Aug '15

26 Aug '15

> > Hi All, > > I am having the same problem in my lab. > > I am trying to set up a secure connection between my Bluecoat proxy and stunnel running on windows. I need to encrypt the connection between the 2 devices. > > I am new to stunnel. > > My Bluecoat is configured to do health checks to the stunnel on the specified stunnel port. However every now and again, it reports the server is down. Looking at the capture, I can see the stunnel is sending RESETS back to the proxy. > > The TLS connection to the proxy appears to be working fine. But I need to be able to monitor the servers health. > > How do I do this? > > You have mentioned in your post the stunnel configured of client = yes. > > On what side does this need to be configured and what exactly does this mean? If it is configured as client = no what will be the implication. > > I have been looking at how you solved the F5 issue but how does that apply to what I am doing from my proxy. > > Please any help will be useful. I just subscribed to your site. > > Thank you > > > > Adekunle

1 0

New Windows installer
by Michal Trojnara 19 Aug '15

19 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have performed a major rewrite of the stunnel installer for Windows. It now allows installing stunnel for all users (as before), and also for the current user (in the user's home directory). It also no longer installs all the files into a single directory. The installer attempts to automatically migrate the previous layout into the new one. https://www.stunnel.org/downloads/beta/stunnel-5.23b4-installer.exe Please give it a try and let me know your comments and any bugs you can find. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVziEpAAoJEC78f/DUFuAUFFIP/1CN9Bh5PFvpUlmnC67exLA4 CfPLXK4jj3PjFISF3scKAGJJjaCmyWQzF3mmTTn5HXprCfwOtZXf3jJQVI0YFZjE 8OgxpdcWhAyuOr2wQLSs5DX+WBILuxHBpIIJrjYIlrAsKMwmB7ucLHf17K+AkCjb j++ctJdFDQygpX0w9Qp0oyIbiEGlgaFHAn/aeYKdLSzTGaDkTptswMsM+SZzNcHF bK9VxQ15xFE6EwOp45roxc7eMuOd6VGQ9uyj1DcLaHygE0m5ALzXFN2Xsnii9UIq ZbzoOMBYlGYAya8Hbgrrb3D+53CwwQrhjVgE27FbMp3qc4ijboaBlfSzd+Bci3Rg B84EkJjBNC1cOcl5JvB/QAuJgXReBbFecS5+8PYNTzii6HU4bFXKb9JlbxCA7eGm HiCkn+DM4GJ3RXtWYjcyWfhlgCx69SUaEJvtphHl9QLbyGnDsJTE7rLlmpnp4B2N MNvZFhxuZrBsMmDRydQSYKaJ7S5e9H6soi630OfLxHDIbOGD+vDVvO9XrjtdYWBO 6Fm4ed0lDuTcqTzCxy93vbwPkWzvPyOykQPCED/UQ1RgtC8AIi6JVXhCwLs30pwj rSHgBKGxC5E19MXYwrNq3cr0nJdkw4oh8NShaXiplfhdCMdjRZHZz1HpbQzW0WP/ Z5BrUzv9yYpA/aAk4r7V =RSFJ -----END PGP SIGNATURE-----

2 3

net::ERR_TIMED_OUT error when connecting to a websocket via stunnel
by Mike Alhayek 17 Aug '15

17 Aug '15

Hi, I hope someone can help me here as I have been stuck for the past 3 days. I need to allow a client to connect to a websocket running on server 10.0.4.160 on port 8080. I need to setup a secure tunnel to allow the client to connect to the websocket via port 58443. I installed the latest version of stunnel on my windows Server 2008 R2. Then I changed my stunnel.conf file to look like this [websockets] client = yes accept = 58443 connect = 8080 verify = 2 checkIP = 10.0.4.195 CAfile = ca-certs.pem debug = 7 OCSPaia = yes ##The rest have been removed I am expecting to open a connection from the user's console on port 58443 and the stunnel will allow the client to connect to port 8080 This is the code that I use in the client's console "Of course, the console is on a PC that is on my internal network" var conn = new WebSocket('wss://10.0.4.160:58443'); conn.onopen = function(e) { console.log("Connection established!"); }; conn.onmessage = function(e) { console.log(e.data); }; While on the server, I open up a command line and I execute this telnet localhost 8080 to open up a command line where I can see the incoming request. As soon as I fire the code above from a client javascript's console I see this in the server's command line [cid:image001.png@01D0D8E6.8F1CC750] But few seconds later I get this error in the client's console WebSocket connection to 'wss://10.0.4.160:58443/' failed: Error in connection establishment: net::ERR_TIMED_OUT If I try to send a command using conn.sent('Hello') I get this error VM289:2 Uncaught DOMException: Failed to execute 'send' on 'WebSocket': Still in CONNECTING state. at Error (native) at <anonymous>:2:6 at Object.InjectedScript._evaluateOn (<anonymous>:905:140) at Object.InjectedScript._evaluateAndWrap (<anonymous>:838:34) at Object.InjectedScript.evaluate (<anonymous>:694:21) Additionally, I tried to turn on debugging in strunnel by adding debug = 7 to the config file This is what I got in the stunnel console. I don't understand what is wrong as the logs show that the client is connected but I can't send messages from the client to the server 2015.08.16 16:40:06 LOG7[36]: Service [websockets] started 2015.08.16 16:40:06 LOG5[36]: Service [websockets] accepted connection from 10.0.4.195:21963 2015.08.16 16:40:06 LOG6[36]: s_connect: connecting 127.0.0.1:8080 2015.08.16 16:40:06 LOG7[36]: s_connect: s_poll_wait 127.0.0.1:8080: waiting 10 seconds 2015.08.16 16:40:06 LOG5[36]: s_connect: connected 127.0.0.1:8080 2015.08.16 16:40:06 LOG5[36]: Service [websockets] connected remote server from 127.0.0.1:50891 2015.08.16 16:40:06 LOG7[36]: Remote socket (FD=668) initialized 2015.08.16 16:40:06 LOG6[36]: SNI: sending servername: localhost 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): before/connect initialization 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): SSLv2/v3 write client hello A What am I doing wrong here? How come the connection keeps failing?

1 0

Accept connection from sub-net?
by v v 12 Aug '15

12 Aug '15

Hi, Is it possible to configure stunnel server to accept connection from any IP in some subnet. For example, 111.22.33.xx. The proxy I connect through every time uses the different IP (from some IP pool) to connect to stunnel server. I don't want to add to the config file 255 possible host addresses. I don't see any suitable option in the stunnel documentation. Do I miss something? Any idea it could be done? Thanks, vov

1 0