- stunnel-users - stunnel.org

Help installing stunnel 5.72 as service in windows 10
by William Wood 04 Jul '24

04 Jul '24

Apparently to get stunnel to work, I have to install it as a service in Windows. In order to do this, I fire up a powershell, change directories to the stunnel\bin\, and run the command: .\stunnel -install This results in the error message: OpenSCManager: error 5: Access is denied Not sure what to do, as I am running as an administrator Any help would be appreciated Thanks -William Wood

2 2

How to connect to a website through a port
by William Wood 02 Jul '24

02 Jul '24

Hi - I am trying to connect securely to a website from a Windows 10 machine: gainfutures.com through the port: 9400 I am told I need to do this using SSL. I have a python script which successfully connects through their non-secure ports. I am given no other information about what is needed for the connection, so I am asking how to do this. I have added to the configuration file: accept=gainfutures.com:9400 connect=gainfutures:9400 The "accept" line results in the error: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) the "connect" line has no effect in the messages. Any suggestions would be much appreciated. Thank you -WW

2 1

help connecting to a website through a port from Windows 10
by William Wood 02 Jul '24

02 Jul '24

Hi - I am trying to connect securely to a website from a Windows 10 machine: gainfutures.com through the port: 9400 I am told I need to do this using SSL. I have a python script which successfully connects through their non-secure ports. I am given no other information about what is needed for the connection, so I am asking how to do this. I have added to the configuration file: accept=gainfutures.com:9400 connect=gainfutures:9400 The "accept" line results in the error: Can't assign requested address (WSAEADDRNOTAVAIL) (10049) the "connect" line has no effect in the messages. Any suggestions would be much appreciated. Thank you -WW

1 0

How to specify OCSP responder URL in "server" mode?
by sbworkde＠gmail.com 02 Jul '24

02 Jul '24

I want to specify OCSP responder URL while stunnel in "server" mode. I tried to use the option "OCSP" in configuration file, but it only works in "client" mode. The OCSP responder URL is always read form AIA while stunnel is in "server" mode, even when I set "OCSPaia = no". Is there a way to specify OCSP resonder URL for "server" mode?

2 1

Stunnel with tinyproxy seem failed to forward
by jensen＠fixes.hk 29 Jun '24

29 Jun '24

Stunnel config client = no cert = /path/to/fullchain.pem key = /path/to/privkey.pem pid = /var/run/stunnel4/stunnel.pid debug = 7 output = /var/log/stunnel4/stunnel.log [tinyproxy] accept = 0.0.0.0:8443 connect = 127.0.0.1:7777 here's the log 2024.06.28 11:08:26 LOG7[main]: Found 1 ready file descriptor(s) 2024.06.28 11:08:26 LOG7[main]: FD=4 events=0x2001 revents=0x0 2024.06.28 11:08:26 LOG7[main]: FD=9 events=0x2001 revents=0x1 2024.06.28 11:08:26 LOG7[main]: Service [tinyproxy] accepted (FD=3) from X.X.X.X:42086 2024.06.28 11:08:26 LOG7[3]: Service [tinyproxy] started 2024.06.28 11:08:26 LOG7[3]: Setting local socket options (FD=3) 2024.06.28 11:08:26 LOG7[3]: Option TCP_NODELAY set on local socket 2024.06.28 11:08:26 LOG5[3]: Service [tinyproxy] accepted connection from X.X.X.X:42086 2024.06.28 11:08:26 LOG6[3]: Peer certificate not required 2024.06.28 11:08:26 LOG7[3]: TLS state (accept): before SSL initialization 2024.06.28 11:08:26 LOG3[3]: SSL_accept: ../ssl/record/ssl3_record.c:348: error:0A00009B:SSL routines::https proxy request 2024.06.28 11:08:26 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2024.06.28 11:08:26 LOG7[3]: local_rfd/local_wfd reset (FD=3) 2024.06.28 11:08:26 LOG7[3]: Local descriptor (FD=3) closed 2024.06.28 11:08:26 LOG7[3]: Service [tinyproxy] finished (0 left) on connect, I'm using server with OS Ubuntu16.04 with OpenSSL 1.1.1n 15 Mar 2022 (Library: OpenSSL 1.1.1 11 Sep 2018). using my other server (OS ubuntu 2X.) and my local (Mac OS), I'm able to connect to stunnel + tinyproxy successfully. it seems the issue within the server with Ubuntu16.04 or did I miss other config ?

3 5

Devo Relay(Stunnel) -> Palo Alto Log Ingestion Configuration
by jeykipamca＠hotmail.com 14 Jun '24

14 Jun '24

Hi!, I am trying to ingest Palo Alto Firewall syslogs from Devo SIEM, to do that, I had to implement Stunnel on my relay server but in the installation part, I got this error message (I couldn't start stunnel service and I set all the configs as mentioned below links); devo-relay-server:/etc/stunnel# systemctl status stunnel4.service × stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons) Loaded: loaded (/etc/init.d/stunnel4; generated) Active: failed (Result: exit-code) since Fri 2024-06-14 13:42:04 UTC; 58min ago Docs: man:systemd-sysv-generator(8) CPU: 27ms Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [.] Reading configuration from file /etc/stunnel/stunnel.conf Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [.] UTF-8 byte order mark not detected Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [!] /etc/stunnel/stunnel.conf:6: "setuid = test": Illegal UID Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [!] Configuration failed Jun 14 13:42:04 -devo-relay-server stunnel4[4032]: [ ] Deallocating temporary section defaults Jun 14 13:42:04 -devo-relay-server stunnel4[4018]: failed Jun 14 13:42:04 -devo-relay-server stunnel4[4018]: You should check that you have specified the pid= in you configuration file Jun 14 13:42:04 -devo-relay-server systemd[1]: stunnel4.service: Control process exited, code=exited, status=1/FAILURE Jun 14 13:42:04 -devo-relay-server systemd[1]: stunnel4.service: Failed with result 'exit-code'. Jun 14 13:42:04 -devo-relay-server systemd[1]: Failed to start LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). root@-devo-relay-server:/etc/stunnel# -------------------------------------------------------------- My conf file; /etc/stunnel/stunnel.conf ; ************************************************************************** ; * Global options * ; ************************************************************************** ; It is recommended to drop root privileges if stunnel is started by root setuid = test setgid = test ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes ;debug = debug output = /var/log/stunnel4/stunnel.log [firewall_tunnel] client = no accept = 6515 connect = 127.0.0.1:13005 cert = /etc/pki/stunnel/cert_SyslogCert-Devo.pem verifyChain = yes verifyPeer = yes CAfile = /etc/pki/stunnel/cert_RootCA-Devo.crt -------------------------------------------------------------- /etc/default/stunnel4 file; # /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0 # Change to enable the setting of limits on the stunnel instances # For example, to set a large limit on file descriptors (to enable # more simultaneous client connections), set RLIMITS="-n 4096" # More than one resource limit may be modified at the same time, # e.g. RLIMITS="-n 4096 -d unlimited" RLIMITS="" -------------------------------------------------------------- Does anyone have knowledge about the issue? The links which I got support. https://docs.devo.com/space/latest/94663679/Sending+Palo+Alto+events+to+Dev… https://docs.devo.com/space/latest/96469881/Sending+SSL%2FTLS+encrypted+eve…

1 0

Can I use stunnel to create a proxy chain?
by Eugene Bos 11 Jun '24

11 Jun '24

Hello. I have a proxy with http/socks5 support but this configuration doesnt work: client = yes [my-proxy] accept = 127.0.0.1:9666 connect = proxy.com:10000 protocol = connect protocolHost = username__cr.ua:password@proxy.com:10000 I wanted to proxy requests sent to 127.0.0.1:9666 to username__cr.ua:p assword@proxy.com:10000

1 0

help required with stunnel cipher set up
by Glick, Daniel 11 Jun '24

11 Jun '24

Classification: Restricted Dear All, Objective : We have been informed by Euroclear that we must use the following ciphers below with our stunnel connection to them TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 Server details : [cid:image001.png@01DABB28.6D132C70] The required cipher has been defined as being the first in the list. [cid:image002.png@01DABB28.6D132C70] Information security has confirmed that the cipher has been enabled [cid:image006.png@01DABB29.42BE4530] However after rebooting the server and starting stunnel – the old ciphers are still being used [cid:image003.png@01DABB28.6D132C70] Please can anyone point us in the right direction as to what we are doing wrong. Thank you Daniel Glick Application Specialist, Investment Management & Finance Platform Arbuthnot Latham & Co., Limited ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender and delete it from your system. Internet communications are not secure and therefore Arbuthnot Latham & Co., Limited does not accept legal responsibility for the contents of this message or any damage sustained as a result of this email or its attachments. Any views or opinions presented are solely those of the author and do not necessarily represent those of Arbuthnot Latham & Co., Limited or any of its affiliates. Please take some time to read our Privacy Notice, which provides information on what personal data we collect from you, what we do with it and who it might be shared with. *********************************************************************** Arbuthnot Latham & Co., Limited Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Arbuthnot Latham & Co., Limited, DIFC Branch, is regulated by the Dubai Financial Services Authority ("DFSA"). Registered in England and Wales 819519. Registered office: Arbuthnot House 7 Wilson Street London EC2M 2SN Tel : 020 7012 2500 Fax : 020 7012 2501 ************************************************************************

4 4

GRE over Stunnel
by marslogout＠gmail.com 17 May '24

17 May '24

Hello, is it possible to use GRE with Stunnel? I know that GRE is a protocol different from TCP, but I would like to hear your opinion on this matter. If GRE is not supported, would it be correct to replace it with PPTP without encryption?

1 0

Stunnel with no encryption
by Castro, Flavio 16 May '24

16 May '24

Hello, I am trying to configure Stunnel to use the insecure cipher PSK-NULL-SHA@SECLEVEL=0 but am encountering issues where a different cipher appears to be negotiated instead. My goal is to authenticate endpoints without encryption. Here are the details of my setup: Stunnel Version: 5.63 Operating System: Ubuntu Stunnel Configuration: ; Stunnel Configuration ; Global Options fips = no output = /var/log/stunnel.log ; Specify the pre-shared key file PSKsecrets = /etc/stunnel/psk.txt sslVersion = TLSv1.2 ; PSK Server Configuration [PSK server] accept = 192.168.20.11:5074 connect = 192.168.30.11:5074 ciphers = PSK-NULL-SHA ; In OpenSSL, I can achieve my goal using the following command, which works as expected: openssl s_client -port 5074 -cipher "PSK-NULL-SHA@SECLEVEL=0" -psk 4f8583bca4d311ee9fd6034d1fcbd7c3 -tls1 However, with Stunnel, it appears a different cipher is negotiated, and I do not see any error messages in the logs. I tcpdumped the connection and observed the traffic is being encrypt which was not the case when using openssl. In my usecase I need to authenticate endpoints without encryption, hence the use of PSK-NULL-SHA@SECLEVEL=0. Could you please advise on how to properly configure Stunnel to use the PSK-NULL-SHA@SECLEVEL=0 cipher, or if this is supported? Thank you for your assistance. Flavio Castro

1 0

use openvpn service through socks
by Alberto P 27 Apr '24

27 Apr '24

Hi, I have a paying vpn service that offers a few connection modes but no socks or http proxy Is it possible to use stunnel to 1) connect to the vpn service via openvpn (I have server_name, user, pass, config file) 2) make this vpn available through a socks5 proxy on my local network or localhost ? Any help with config files would be greatly appreciated

1 0

Next release of stunnel
by Heyes, Chad (Coral Springs) 25 Apr '24

25 Apr '24

Hello, We have a number of clients currently using stunnel to communicate securely from emulator software to our Unisys host. We have been coordinating with them when stunnel need to be updated. Is there a plan to update stunnel version anytime soon? I understand that it may be a 'last minute' decision based on security vulnerabilities. However, any advance notice would be helpful. Thanks, Chad Heyes Software Architect, Advisory Product Development, Bank Solutions Fiserv www.fiserv.com<http://www.fiserv.com/> Fiserv<http://links.mkt030.com/ctt?kn=3&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Join Our Team<http://links.mkt030.com/ctt?kn=7&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Twitter<http://links.mkt030.com/ctt?kn=1&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | LinkedIn<http://links.mkt030.com/ctt?kn=5&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> | Facebook<http://links.mkt030.com/ctt?kn=9&ms=MjI3MTE3NzAS1&r=MjE1MjQ1MjA0Mjk5S0&b=0&…> FORTUNE Magazine World's Most Admired Companies(r) 2014 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 (c) 2018 Fiserv Inc. or its affiliates. Fiserv is a registered trademark of Fiserv Inc. Privacy Policy

2 1

Re: TLSv1.0 and TLSv1.1 - unable to disable
by Josealf.rm 24 Apr '24

24 Apr '24

1 0

TLSv1.0 and TLSv1.1 - unable to disable
by Alan Flores 23 Apr '24

23 Apr '24

Hello: I have not been able to get STunnel to disable these protocols. In the STunnel.conf file I put in the line sslVersionMin = TLSv1.2 I have disabled these in windows 2019 via reg keys But this has not stopped scans from seeing TLSv1.0 and 1.1 Any help would be appreciated stunnel 5.72 on x64-pc-mingw32-gnu platform Windows server 2019 Compiled/running with OpenSSL 3.2.1 30 Jan 2024 Alan Flores Enterprise Support Specialist Enterprise Application Systems E: Alan.Flores(a)Valpo.edu <http://www.valpo.edu> 1700 Chapel Drive, Valparaiso, IN 46383

1 0

using a socks5 with user/name authentication
by Alberto P 21 Apr '24

21 Apr '24

Hello, I have a vpn service that provides a socks5 proxy using user/pass authentication. Using stunnel would allow me to use the service with other clients that allow for a socks5 proxy but normally no authentication. Could anybody tell me 1) is what I'd like feasible ? 2)How do I provide user/pass to the configuration file ? Your help would be very appreciated ! alberto

1 0

Wondering if process to create the g2.pem file is available?
by Michael D. Setzer II 19 Apr '24

19 Apr '24

Was wondering if the process to create the g2.pem file you shared is available. It does work with changes to the stunnel.conf file for both the smtp1.guam.net and mail.guam.net [guampop] client=yes accept = 127.0.0.1:20996 connect = mail.guam.net:995 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = mail.guam.net OCSPaia = yes [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs CAfile = /etc/stunnel/g2.pem checkHost = smtp1.guam.net OCSPaia = yes Not sure the the g2.pem would work for all time, or has an expiration date. Thanks. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com mailto:msetzerii@gmx.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 19 Apr '24

19 Apr '24

3 2

unknow TCP service 11702
by tomoyalin＠yahoo.co.jp 18 Apr '24

18 Apr '24

how to solve problem from stunnel config file when using port is not 80 or 443. ( our config tcp service port is 11702)

2 1

Having strange issue with newer kernels? 6.8.
by Michael D. Setzer II 18 Apr '24

18 Apr '24

Having issues with stunnel not working with this settings that have work with previous kernels? [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 verifyChain = yes CApath = /etc/ssl/certs checkHost = mail.guam.net OCSPaia = yes But now changing to [guamsmtp] client=yes accept = 127.0.0.1:20466 connect = smtp1.guam.net:465 connect = smtp1.guam.net:465 debug = 7 Seems to work. systemctl status stunnel. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:48:15 ChST; 5s ago Process: 15349 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15352 (stunnel) Tasks: 3 (limit: 18938) Memory: 3.6M CPU: 1.618s CGroup: /system.slice/stunnel.service └─15352 /usr/bin/stunnel Apr 18 14:48:14 setzconote.dyndns.org systemd[1]: Starting stunnel.service - TLS tunnel for network daemons... Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.co> Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: UTF-8 byte order mark not detected Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: FIPS mode disabled Apr 18 14:48:15 setzconote.dyndns.org stunnel[15349]: LOG5[ui]: Configuration successful Apr 18 14:48:15 setzconote.dyndns.org systemd[1]: Started stunnel.service - TLS tunnel for network daemons. Using the longer one gives this after attempting to sent smtp. stunnel.service - TLS tunnel for network daemons Loaded: loaded (/usr/lib/systemd/system/stunnel.service; enabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: active (running) since Thu 2024-04-18 14:57:22 ChST; 1min 15s ago Process: 15616 ExecStart=/usr/bin/stunnel (code=exited, status=0/SUCCESS) Main PID: 15619 (stunnel) Tasks: 3 (limit: 18938) Memory: 4.0M CPU: 1.639s CGroup: /system.slice/stunnel.service └─15619 /usr/bin/stunnel Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: CERT: Pre-verification error: unable to get local issuer> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG4[3]: Rejected by CERT at depth=0: CN=*.guam.net Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: TLS alert (write): fatal: unknown CA Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG3[3]: SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A0000> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG5[3]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Deallocating application specific data for session conne> Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Remote descriptor (FD=16) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: local_rfd/local_wfd reset (FD=3) Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Local descriptor (FD=3) closed Apr 18 14:58:11 setzconote.dyndns.org stunnel[15619]: LOG7[3]: Service [guamsmtp] finished (0 left) lines 1-23/23 (END) Was using the Fedora stunnel the is 5.71, but downloaded the latest 5.72, but seem to get same results. Had some issues with nvidia drives that work fine with 6.7.11 kernels, but fail with the 6.8.x drivers, so not sure if it is linked to that? +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com mailto:msetzerii@gmx.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

stunnel doesn't allow two client certificates with the same Subject DN?
by Christopher Schultz 16 Apr '24

16 Apr '24

Hello, I was recently rotating a certificate for a service and I went through my usual procedure: 1. Generate a new client key+cert; don't place them into service, yet 2. Distribute the new certificate to all my stunnel servers that need to trust it by placing it at the end of each of my servers' CAFile files 3. Restart all stunnel services 4. Swap the old key+cert for the client with the new key+cert 5. Test that all is well I've found that if the Distinguished Name of both the old and new certificate are the same, stunnel will only trust the one that is mentioned /first/ in the CAFile. For example, if the CAFile contains: -----BEGIN CERTIFICATE----- certificate A Serial Number: 12345678 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE----- certificate B Serial Number: 87654321 Subject: C=US, OU=Testing, O=Example.com, CN=test -----BEGIN CERTIFICATE----- Certificate A will be trusted but Certificate B will not be trusted. The error shown in the logs is: CERT: Pre-verification error: self signed certificate Apr 15 21:33:06 mirth-pcc.chadis.com stunnel[23421]: Certificate check failed: depth=0, /C=US/OU=Testing/O=Example.com/CN=test While the certificates are both self-signed, that should not cause an error. Removing the old certificate from the CAFile or moving it to the bottom of the file resolves the problem. (But of course then Certificate A is no longer trusted despite it appearing in the CAFile.) Is this expected behavior? It would be very helpful if stunnel could support two different certificates with the same Subject DN for these kinds of cert-rotation processes. The alternatives are to always use a new DN each time or to add/remove at the same time which makes rolling-back more difficult. Note that everything else about these certificates is different: serial number, fingerprint, generating-key, etc. It's only the Subject DN that is the same. This is stunnel 4.56 on x86_64-koji-linux-gnu platform, on Amazon Linux 2. Thanks! -chris

2 1

HELO handshake problem (?)
by Ducale Ducale 10 Apr '24

10 Apr '24

In a Windows 10 machine I'm using a tool (Netwrix Service Monitor) with a SMTP notification feature that doesn't support authentication, so I'm using Stunnel 5.72 as a local relay for SMTP2GO (smtp2go.com), with this configuration: [smtp2go] client = yes accept = 127.0.0.1:25 connect = mail.smtp2go.com:2525 protocol = smtp protocolAuthentication = plain protocolHost = cloud.mydomain.com protocolUsername = smtp2go(a)mydomain.com protocolPassword = P@ssw0rd debug = 7 I try both PLAIN and LOGIN as authentication mode, with this is error: LOGIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH LOGIN <- 503 AUTH command used when not advertised Remote server does not support LOGIN authentication ... " PLAIN: " ... TLS connected: new session negotiated TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) Peer temporary key: X25519, 253 bits Compression: null, expansion: null -> HELO cloud.mydomain.com <- 250 mail.smtp2go.com Hello cloud.mydomain.com [x.x.x.x] -> AUTH PLAIN ******************************************** <- 503 AUTH command used when not advertised PLAIN Authentication Failed Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Deallocating application specific data for session connect address ... " Can anyone help me solve this problem? Thanks!

3 3

help configuration for socks5 nordvpn requiring authentication
by Alberto P 10 Apr '24

10 Apr '24

Hello, I would like to use stunnel to use a socks5 server requiring user/pass authentication (nordvpn) with different clients that allow for a socks5 proxy but no authentication. Could someone help me with the configuration (linux or windows is good). In detail, I don't know how to provide user/pass to the configuration, and if it is actually feasible. Any help will be very appreciated !

1 1

Stunnel - Silent switch to change the install directory
by Meena Prabhakaran 27 Mar '24

27 Mar '24

Hi Team, We are 3rd party patch provider like PatchMyPC or ManageEngine. We are providing similar services to our customers. For more details, please have a look at Autonomous Patching for Every Third-Party Windows App (adaptiva.com) (https://adaptiva.com/products/autonomous-patch) We are willing to add the latest stable version of Stunnel product to our catalogue. Downloaded https://www.stunnel.org/downloads/stunnel-5.72-win64-installer.exe We are testing this app on Windows 10 64Bit VM. Please help us on below points: 1. Is there any switch/parameter which can be passed along with "stunnel-5.72-win64-installer.exe" for changing the "Install directory" silently? Tried these switches - /D, /DIR, /APPDIR, /INSTALLDIR, /TARGETDIR, /INSTALLLOCATION Thanks & Regards, Meena Prabhakaran Application Packager, Adaptiva M +91 9080759487 meena.prabhakaran(a)adaptiva.com<mailto:meena.prabhakaran@adaptiva.com> www.adaptiva.com<http://www.adaptiva.com/> Data Protection and Privacy: Your privacy is important to us. We are committed to protecting your personal information and handling it responsibly. For more information on how we process and protect your data, please review our Privacy Policy (https://adaptiva.com/privacy). Confidentiality Notice: Information in this email and any attachments is confidential and intended solely for the use of the individual(s) to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Adaptiva. The recipient should check for the presence of viruses, as Adaptiva accepts no liability for any virus transmitted by this email.

3 3

Received trusted client CA list not found
by allmail 16 Mar '24

16 Mar '24

I see this message in the Stunnel (client) logs during SSL handshake with the server The server requires a client certificate which has been configured in the stunnel configuration. The handshake is working fine but I was wondering what exactly does this line mean. From what I found so far, seems like there is a way for the server to specify which CA's it will accept for the client certificate and it can specify them in the ClientCertificate request that it sends This server doesnt send anything like that, so I am guessing that is the reason for this log line? Can someone please confirm? Btw, I see this line only when using TLSv1.3. When I restrict the client to TLSv1.2, I dont see this line. thanks LOG Peer certificate required TLS state (connect): before SSL initialization Initializing application specific data for session authenticated TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS write client hello TLS state (connect): SSLv3/TLS read server hello TLS state (connect): TLSv1.3 read encrypted extensions Received trusted client CA list not found TLS state (connect): SSLv3/TLS read server certificate request

1 0

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by docfxit＠theoffice.la 12 Mar '24

12 Mar '24

This is my log: [code] stunnel 5.72 on x64-pc-mingw32-gnu platform 2024.03.10 10:19:49 LOG5[main]: Compiled/running with OpenSSL 3.2.1 30 Jan 2024 2024.03.10 10:19:49 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.03.10 10:19:49 LOG7[main]: errno: (*_errno()) 2024.03.10 10:19:49 LOG6[main]: Initializing inetd mode configuration 2024.03.10 10:19:49 LOG7[main]: Running on Windows 6.2 Windows 10 2024.03.10 10:19:49 LOG5[main]: Reading configuration from file C:\Programs\stunnel\config\stunnel.conf 2024.03.10 10:19:49 LOG5[main]: UTF-8 byte order mark not detected 2024.03.10 10:19:49 LOG5[main]: FIPS mode disabled 2024.03.10 10:19:49 LOG6[main]: Compression disabled 2024.03.10 10:19:49 LOG7[main]: No PRNG seeding was required 2024.03.10 10:19:49 LOG6[main]: Initializing service [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG7[main]: Initializing context [pop3_DocfxitGmail] 2024.03.10 10:19:49 LOG6[main]: OpenSSL security level is used: 2 2024.03.10 10:19:49 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2024.03.10 10:19:49 LOG7[main]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2024.03.10 10:19:49 LOG7[main]: TLS options: 0x2100000 (+0x0, -0x0) 2024.03.10 10:19:49 LOG6[main]: Session resumption enabled 2024.03.10 10:19:49 LOG7[main]: No certificate or private key specified 2024.03.10 10:19:49 LOG6[main]: No trusted certificates found [/code] I copied a working config from Windows 7 64bit. Running stunnel 5.50

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users