May 2021 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

How to get high-precision timestamps in the stunnel logs
by jori.gielis＠telenetgroup.be 27 May '21

27 May '21

Hi, I want to use more accurate timestamps in the logs of stunnel. It would be nice to have milliseconds. Current format: 2021.05.27 19:00:59 LOG7[3]: Remote descriptor (FD=70) closed Needed format: 2021.05.27 19:00:59,718 LOG7[3]: Remote descriptor (FD=70) closed Is it possible to accomplish this in stunnel version 5.56? Thanks! Best regards

1 0

stunnel.pem Failure
by waynesmith philosophical-vistas.net 27 May '21

27 May '21

I preface this message to alert the reader that I remain a novice both in use of STunnel and Linux. I am trying to generate an SSL/TLS certificate for use w/ my various e-mail clients. I downloaded and extracted STunnel 5.59 on my Linux Mint Debian box. After perusing the files I issued the following command sudo ./configure --enable-fips Without repeating all the verbiage, it seemed to run properly. I then issued the following command make cert It returned the usual information requests (though it didn't ask for an e-mail address) but returned the following: /usr/bin/install -c -b -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem /usr/bin/install: cannot create regular file ‘/usr/local/etc/stunnel/stunnel.pem’: No such file or directory Makefile:549: recipe for target 'cert' failed make[1]: *** [cert] Error 1 make[1]: Leaving directory '/home/was/stunnel-5.59/tools' Makefile:883: recipe for target 'cert' failed make: *** [cert] Error 2 I negotiated through </usr/local/etc> and ascertained there was no </stunnel> folder. Unfortunately the permissions prevent me from creating this folder. I am thus stumped. Suggestions?

2 2

fixes for Solaris
by Pavel Heimlich 25 May '21

25 May '21

Hi, please find attached two patches that make stunnel 5.59 work better with Oracle Solaris. The first one fixes a few issues with the tests* - it removes unnecessary warning/error messages and adjusts the calls to netcat and ifconfig to what works on Solaris. The second one adds the location of 64 bit shared libraries for linking OpenSSL, similar to what has been added for Fedora. best regards P. * test result: test 010_require_cert ok test 011_verify_peer ok test 012_verify_chain ok test 013_CRL_file ok test 014_PSK_secrets ok test 015_p12_cert ok test 020_IPv6 ok test 021_FIPS skipped test 022_bind ok test 028_redirect_chain ok test 029_no_redirect_chain ok test 030_simple_execute ok test 031_redirect ok test 032_no_redirect ok test 033_redirect_exec ok test 034_no_redirect_exec ok test 035_SNI ok test 036_no_SNI ok test 037_failover_prio1 ok test 038_failover_prio2 ok test 039_failover_rr ok test 040_reload ok test 041_exec_connect ok test 042_inetd ok test 043_session_delay ok test 044_session_nodelay ok test 045_include ok test 046_resume_PSK ok test 047_resume_redirect ok test 048_resume_noredirect ok test 049_redirect_nocert ok test 050_ticket_secrets ok test 051_resume_cache_old skipped test 052_resume_cache ok test 053_resume_ticket ok test 054_resume_TLSv1_3 ok test 055_socket_close ok test 110_failure_require_cert ok test 111_failure_verify_peer ok test 112_failure_verify_chain ok test 113_failure_CRL_file ok test 114_failure_PSK_secrets ok test 115_failure_wrong_config ok test 121_failure_FIPS_ciphers skipped test 122_failure_FIPS_curves skipped summary: success 41, skip 4, fail 0 -- Pavel Heimlich | SW Developer Security Compliance & Globalization Oracle Czech s. r. o., U Trezorky 921/2, 158 00 Praha 5, Czech Republic

1 0

Stunnel stopped working..
by Alastair ＠ Expert Geeks 23 May '21

23 May '21

Hi all, I've been happily using stunnel for the same purpose and the same config for over year but it's suddenly stopped working. I was using it to wrap http shoutcast (port 8000) to https (port 8444). I'm using a letsencrypt cert. config: client = no [shoutcast] accept = 8444 connect = 127.0.0.1:8000 cert = /etc/letsencrypt/live/*server name*/fullchain.pem key = /etc/letsencrypt/live/*server name*/privkey.pem This keeps getting repeated in the log: 2021.05.22 22:18:27 LOG7[main]: Found 1 ready file descriptor(s) 2021.05.22 22:18:27 LOG7[main]: FD=4 events=0x2001 revents=0x0 2021.05.22 22:18:27 LOG7[main]: FD=9 events=0x2001 revents=0x1 2021.05.22 22:18:27 LOG7[main]: Service [shoutcast] accepted (FD=3) from *server ip*:40506 2021.05.22 22:18:27 LOG7[4]: Service [shoutcast] started 2021.05.22 22:18:27 LOG7[4]: Setting local socket options (FD=3) 2021.05.22 22:18:27 LOG7[4]: Option TCP_NODELAY set on local socket 2021.05.22 22:18:27 LOG5[4]: Service [shoutcast] accepted connection from *server ip*:40506 2021.05.22 22:18:27 LOG6[4]: Peer certificate not required 2021.05.22 22:18:27 LOG7[4]: TLS state (accept): before SSL initialization 2021.05.22 22:18:27 LOG3[4]: SSL_accept: ../ssl/record/ssl3_record.c:322: error:1408F09C:SSL routines:ssl3_get_record:http request 2021.05.22 22:18:27 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.05.22 22:18:27 LOG7[4]: Local descriptor (FD=3) closed 2021.05.22 22:18:27 LOG7[4]: Service [shoutcast] finished (0 left) (server ip & server name removed) Suggestions and recommendations gratefully received! Thanks.

2 1

Re: stunnel in Citrix Environment
by Eberhard 21 May '21

21 May '21

It is pretty much impossible for users to hijack each other. The connections are persistent and if a user drops it is gone. It won’t hijack or share. Having said that, if your app works like a Web browser (not persistent) then of course they will interleave and of course you need to use the same technique as browsers – cookies, hidden fields, whatever. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Bruce Liptak <bliptakjr(a)gmail.com> Sent: Friday, May 21, 2021 10:35 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel in Citrix Environment Hello stunnel-users, Currently we have an application using stunnel being presented by a Citrix presentation server. The first user authenticates over stunnel with a PKI cert and every user thereafter creates a prompt for the first user again and again for each user that also tries to get into the app. Is there a way for stunnel to be separated based on something that pertains to the user trying to get access? We are using a PKI solution based on certificates. It's like every new user is hijacking the first users' stunnel session. Any help would be appreciated! Thank you, Bruce Liptak <mailto:bliptakjr@gmail.com> bliptakjr(a)gmail.com CCNA R&S | VCA-DCV | Linux+ | Security+ | Network+

1 0