stunnel-users

stunnel-users@stunnel.org

4 participants
3315 discussions

PSK mode does not work correctly with TLSv1.3
by Zizhong Zhang 21 Nov '18

21 Nov '18

Hello, In TLSv1.3, session resumption has been reworked to be the same way as PSK. The client attempts resumption by appending a ticket as PSK identity to the head of the list. With OpenSSL 1.1.1, the server side should use the new SSL_CTX_set_psk_find_session_callback() callback instead of SSL_CTX_set_psk_server_callback() which is used by stunnel now. Because stunnel only verifies against the first PSK identity, stunnel will fail for every other connections it makes. This impacts the default configuration when running with OpenSSL 1.1.1 because TLSv1.3 is enabled by default. It may be confusing because only half of the connections will fail as the client will try to resume the last successful session for every second connections. I purpose that stunnel should switch to SSL_CTX_set_psk_find_session_callback() for OpenSSL 1.1.1, and that it preferably should default to a maximum version of TLSv1.2 because it might be compiled with OpenSSL 1.0.x but runs with OpenSSL 1.1.1 which will enable TLSv1.3 automatically. With regards, --Zizhong

1 0

Installing stunnel as a Windows service with another service name?
by Al Birchall 16 Nov '18

16 Nov '18

Hi, Is it possible to install stunnel as a Windows service with another name? I want to have multiple instances of stunnel running on the same Windows 2008 server, if possible. Many thanks. Al

2 1

Server is down
by Paul Muller 12 Nov '18

12 Nov '18

I've installed Stunnel before with no issues. But now I'm getting the following: ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Outgoing] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Outgoing] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Outgoing] [ ] Listening file descriptor created (FD=1388) [ ] Setting accept socket options (FD=1388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Outgoing] to 0.0.0.0:25: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [SMTP Outgoing] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Outgoing] [ ] Service [SMTP Outgoing] closed [ ] Deallocating section [SMTP Outgoing] [!] Server is down Please let me know what I'm doing wrong here. Thank you, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:paul.muller@earnestassoc.com> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

1 0

Issue with Office365 certificates
by milanimarco82＠libero.it 09 Nov '18

09 Nov '18

Hello, I'm encountering an issue while using sTunnel with an Office365 account. sTunnel worked properly for a few months, while it gived an error with certificates since yesterday, whilst didn't change anything in the configuration. This is our configuration: [pop3s] client = yes accept = 127.0.0.1:2001 connect = outlook.office365.com:995 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem checkHost = outlook.office365.com verifyChain = yes OCSPaia = yes This is what we get in the log: 2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s) 2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=--- 2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) from 127.0.0.1:49619 2018.11.09 11:34:09 LOG7[main]: Creating a new thread 2018.11.09 11:34:09 LOG7[main]: New thread created 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started 2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection from 127.0.0.1:49619 2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 40.101.9.178:995 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 40.101.9.178:995: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 40.101.9.178:995 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server from 172.31.20.23:49620 2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized 2018.11.09 11:34:09 LOG6[30]: SNI: sending servername: outlook.office365.com 2018.11.09 11:34:09 LOG6[30]: Peer certificate required 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect initialization 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client hello A 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello A 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocsp.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocsp.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good 2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG6[30]: CERT: Host name "outlook.office365.com" matched with "*.office365.com" 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocspx.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocspx.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized 2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure 2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for session connect address 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed 2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left) Can you please help me? Thanks in advance!

2 3

Please need urgent help
by Alix Janeth Jerez 09 Nov '18

09 Nov '18

Hi, I have installed the last stunnel version 5.4.9, i get this fatal error [cid:60207984-5796-4d47-986e-21551ff82966] The stunnel.conf is configured so: debug = 7 output = stunnel.log # GLOBAL OPTIONS client = yes taskbar=yes [SMTP Outgoing] protocol = smtp accept = 172.31.41.84:117 connect = smtp.outlook.com:587 checkHost = smtp.outlook.com verifyChain = yes CAfile = ca-certs.pem OCSPaia = yes cert = stunnel.pem I tried to enable this option ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 But stunnel does't work. Thank you in advance for your help. Best regards,

2 3

Re: [stunnel-users] Multiple Instance of sTunnel on same machine
by Shah, Marmik 31 Oct '18

31 Oct '18

I would be connecting to different Vendors using sTunnel from my machine. I want to run multiple instance of sTunnel as hosted service on Window Server. How can I achieve that ? I can do that through Terminal but I want to install stunnel service per vendor (in Service Control Manager) so that I can manage them independently and stop or start based on Vendor's requirement. I can do this through Command Prompt. Thanks Marmik ............................................................................ For further important information about AllianceBernstein please click here http://www.alliancebernstein.com/disclaimer/email/disclaimer.html

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 171, Issue 16
by Johann Hörmann 25 Oct '18

25 Oct '18

Am 25.10.18 um 12:00 schrieb stunnel-users-request(a)stunnel.org: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Johann Hörmann) > 2. Re: stunnel 5.06 not yet linked against OpenSSL 1.0.1t on > debian jessie (Eric Eberhard) > 3. stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian > jessie (Jakob Hirsch) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 24 Oct 2018 17:29:18 +0200 > From: Johann Hörmann <support(a)hans-hoermann.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <f9fb3d42-c0f2-dffd-e0b1-249d8e068081(a)hans-hoermann.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against > openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences > $ > > Is that - stunnel not being linked against the current openssl-lib - a > serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > > > ------------------------------ > > Message: 2 > Date: Wed, 24 Oct 2018 15:02:08 -0700 > From: "Eric Eberhard" <flash(a)vicsmba.com> > To: 'Johann Hörmann' <support(a)hans-hoermann.de>, > <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] stunnel 5.06 not yet linked against > OpenSSL 1.0.1t on debian jessie > Message-ID: <03bb01d46be5$40d264c0$c2772e40$(a)vicsmba.com> > Content-Type: text/plain; charset="utf-8" > > Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. > > My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. > > Eric > > -----Original Message----- > From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Johann Hörmann > Sent: Wednesday, October 24, 2018 8:29 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie > > Hi, > > that's the log on a debian jessie, starting stunnel: > > 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform > 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 > 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 > 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel > > All debian packages are upgraded: > $ sudo apt-get update > ... > $ sudo apt-get upgrade > 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > $ > > $ dpkg -l|egrep 'openssl|stunnel' > ... > ii openssl 1.0.1t-1+deb8u9 > ... > ii stunnel4 3:5.06-2+deb8u1 > $ > > Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. > > No pinning is active: > $ ls -l /etc/apt/preferences > -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ > > Is that - stunnel not being linked against the current openssl-lib - a serious problem? > Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > > Thanks in Advance > -- > Hans > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > > ------------------------------ > > Message: 3 > Date: Thu, 25 Oct 2018 10:58:48 +0200 > From: Jakob Hirsch <jh(a)plonk.de> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL > 1.0.1t on debian jessie > Message-ID: <a518f51f-180d-b1a3-96e1-c3f976dd1e42(a)Message-ID.plonk.de> > Content-Type: text/plain; charset=utf-8 > > Hi, > > On 2018-10-24 17:29, Johann Hörmann wrote: >> Is that - stunnel not being linked against the current openssl-lib - a >> serious problem? > > It is usually not necessary to rebuild all packages using a specific lib > just because it got updated. > >> Will there soon be a stunnel-package being linked against openssl 1.0.1t? > > The debian people are doing that, so that would be something to ask > them, specifically the package maintainers (see > https://packages.debian.org/jessie/stunnel4). But since jessie support > ended last June and LTS won't rebuild , I would not hold my breath. > > Why do you care about this in the first place? You are using a stunnel > version that is 4 years old and got last patched more than 3 years ago. > If it's of any importance to you, you should really upgrade to stretch > (optionally with bpo) or at least use jessie-backports. > > > Regards > Jakob > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > ------------------------------ > > End of stunnel-users Digest, Vol 171, Issue 16 > ********************************************** > Thanks a lot for your valuable advices, Eric and Jakob! Being just a dumb user, i supposed the distribution should stay 'in harmony': Ok now i know for oldstable this can be solved by backports or compiling stunnel with a static openssl-lib. Upgrading to stretch is not yet a choice because i am using stunnel with 'verify=3' which results in checking the self-signed client-certs at the server: Can't tell why but my cacert file was generated with a CAFile value of FALSE, which worked until jessie but at stretch the request results in a reject by the openssl-lib because of the FALSE-value. So first i have to renew and deploy all my customers certs - about 80 - with a stretch-conform cacert performing with CAFile=true. Hans -- https://hoermann-solutions.com

1 0

stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Johann Hörmann 25 Oct '18

25 Oct '18

Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans

2 1

Re: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie
by Eric Eberhard 24 Oct '18

24 Oct '18

Static linking is much easier, especially when put in a non-standard place, such as /usr/local/customer-name/lib -- this means if somebody does an update of say openssl alone you won't have this problem. You can also do it non-static as long as it is in a non-standard place and be pretty safe. My versions have stunnel 5.44 and openssl 1.0.2 -- works fine. It is static and keeps on ticking. Eric -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Johann Hörmann Sent: Wednesday, October 24, 2018 8:29 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel 5.06 not yet linked against OpenSSL 1.0.1t on debian jessie Hi, that's the log on a debian jessie, starting stunnel: 2018.10.24 ..: stunnel 5.06 on x86_64-pc-linux-gnu platform 2018.10.24 ..: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2018.10.24 ..: Running with OpenSSL 1.0.1t 3 May 2016 2018.10.24 ..: Update OpenSSL shared libraries or rebuild stunnel All debian packages are upgraded: $ sudo apt-get update ... $ sudo apt-get upgrade 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. $ $ dpkg -l|egrep 'openssl|stunnel' ... ii openssl 1.0.1t-1+deb8u9 ... ii stunnel4 3:5.06-2+deb8u1 $ Guess the log tells the current stunnel-package is not linked against openssl 1.0.1t lib yet. No pinning is active: $ ls -l /etc/apt/preferences -rw-r--r-- 1 root root 0 Jun 4 2010 /etc/apt/preferences $ Is that - stunnel not being linked against the current openssl-lib - a serious problem? Will there soon be a stunnel-package being linked against openssl 1.0.1t? Thanks in Advance -- Hans _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel logging of OpenSSL error source file and line number?
by Eric Eberhard 19 Oct '18

19 Oct '18

Good idea and about as much fun as watching grass grow :) E From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Tom Hood Sent: Friday, October 19, 2018 7:09 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel logging of OpenSSL error source file and line number? Hi, Was it by design that stunnel's logging of OpenSSL errors does not include the OpenSSL source file and line number? If not, please consider switching from ERR_get_error to ERR_get_error_line <https://www.openssl.org/docs/man1.0.2/crypto/ERR_get_error_line.html> . Thanks, -- Tom

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users