- stunnel-users - stunnel.org

Missing bytes?
by Arthur Murray 01 Jan '12

01 Jan '12

Hello, When I telnet to my pop3 server and "QUIT" this is what I see: Escape character is '^]'. +OK InterMail POP3 server ready. QUIT +OK ? InterMail POP3 server signing off. Connection closed by foreign host. When I setup an stunnel 4.5 to the same pop3 server: [pop3s] accept = 995 connect = server:110 and connect with "openssl s_client -connect localhost:995" this is what I see: +OK InterMail POP3 server ready. QUIT DONE And the stunnel log reports: Connection closed: 34 bytes sent to SSL, 0 bytes sent to socket What happened to the last line "+OK ? InterMail POP3 server signing off." and why aren't the counters counting the 5 bytes I sent ("QUIT\n") and the last line of 41 sent over the SSL? Example 2 through stunnel: +OK InterMail POP3 server ready. USER -ERR a user name MUST be entered QUIT DONE Connection closed: 68 bytes sent to SSL, 5 bytes sent to socket (still missing the last bytes)

2 4

Segfault with stunnel
by yassine ayachi 23 Dec '11

23 Dec '11

Hi all, I'am trying to encrypt a connection between two hosts using stunnel. ----- here is my config file ---- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug output = stunnel.log --- [rdps] accept = 1957 connect = remote_machine:3389 Avery think was working fine until I tried to telnet to the port 1957 on the machine running stunnel, the process stunnel was killed alone leaving this in /var/log/messages : Dec 20 16:58:01 alpha kernel: [4930384.164316] stunnel[14540]: segfault at 8 ip b7629b61 sp b758d16c error 6 in libc-2.7.so[b75bd000+138000] Does anybody have an idea about this problem, thanks in advance, Yassine

3 6

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi Guys, Thanks for your replies. I tried following commands on verisign c certificate, for both of these do not work. There is error 'unable to load certificate'. openssl x509 -inform DER -in stunnel.pem -noout -text or openssl x509 -inform PEM -in stunnel.pem -noout -text however if I run same command (openssl x509 -inform PEM -in stunnel.pem -noout -text) on VeriSign root & Intermediate certificate it works. It shows format should be 'pem'. But somehow certificate is not valid. I am using following commands to create csr and private key. Are these correct ? openssl genrsa -des3 -out server.key 2048 openssl req -new -key server.key -out server.csr Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 1

building browser like client application based on OpenSSL
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi, Can I develop an application based on OpenSSL such that it can communicate with all trusted sites ? Like browser can communicates? Actually I have desktop application that uses SSL. Now this application may communicate with any trusted server application. How can I achieve this ? Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 2

unsubscribe
by Brian McGinity 21 Dec '11

21 Dec '11

Unsubscribe

1 0

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Thanks for your response. Here is log file. 2011.12.21 13:31:30 LOG7[5144:2256]: Snagged 64 random bytes from C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: Wrote 1024 new random bytes to C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: RAND_status claims sufficient entropy for the PRNG 2011.12.21 13:31:30 LOG7[5144:2256]: PRNG seeded successfully 2011.12.21 13:31:30 LOG7[5144:2256]: Certificate: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: Error reading certificate file: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag 2011.12.21 13:31:30 LOG3[5144:2256]: Server is down Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

3 2

stunnel segfault, please advise
by Mehdi Bennani 21 Dec '11

21 Dec '11

Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

1 0

Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction.
by ayanamist 21 Dec '11

21 Dec '11

I generated a pair of key and certificates with openssl 1.0.0d, and use them in stunnel 4.36. Today i upgrade it to stunnel 4.50 and it doesnot work. All configurations remain unmodified. Then i tested many versions and found, stunnel with openssl 1.00 works fine while with openssl 0.98 does not work. I use stunnel with linux server and windows client, stunnel 4.50 windows version is using openssl 0.98, so cause this problem. 4.47 is using 1.00e which i think is newer than 0.98 bundled with 4.50. So why stunnel keep changing openssl version?

3 4

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Here are steps how I created certificate request and private key. Generate private key openssl genrsa -des3 -out server.key 2048 Generate certificate request openssl req -new -key server.key -out server.csr I submitted server.csr contents to VeriSign to get test certificate and they provided me three certificates. VeriSign signed certificated Root certificate Intermediate certificate I copied VeriSign signed certificate in stunnel.pem and other two certificates in ca.pem file. As per my observation STunnel is unable to load stunnel.pem file. If you need VeriSign test certificate I can provide you that as well. Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

1 0

Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, I got VeriSign Test SSL certificate. I have been trying to configure it with STunnel. But there are errors in STunnel. I have placed private key and CA signed certificate in a separate file named 'stunnel.pem'. Root and Intermediate certificates have been placed in following order in a file named 'ca.pem' stunnel.pem -----BEGIN RSA PRIVATE KEY----- encrypted key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- VeriSign signed certificate -----END CERTIFICATE----- ca.pem -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- VeriSign Root CA Certificate -----END CERTIFICATE----- Here is stunnel.conf file. ;key = server.key cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile CAfile = ca.pem ;CAfile=zosIntermediate.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = no I have also tried to change order of certificates but nothing is working. Anyone have idea how it can work. Your cooperation will be highly appreciated. Thanks, Zubair

2 1