- stunnel-users - stunnel.org

disabling compression
by James Bardin 22 Jan '14

22 Jan '14

Hi, The stunnel man page states that compression is off by default, but It seems that is no longer the case. (the changelog states that version 4.5.1 sets compression as "not disabled by default") The config options don't seem to accept any parameters to disable compression. Is there any way to disable it via openssl options? Thanks! -jim

2 2

Question about 'delay = yes' and DNS cache
by John Chow 16 Jan '14

16 Jan '14

Hey Everyone, I have a question about the *delay = yes* config flag and whether or not it caches the resolved IP after the initial connection? To give context, I want my load balancer (Haproxy) to forward requests to an app on Heroku, and I'm using stunnel on my LB box to proxy to Heroku via HTTPS. Since the IP for my app's endpoint could potentially change (60s DNS TTL), stunnel caching resolved IPs would be a problem. Thanks, John -- John Chow Software Engineer Fundly

2 1

Silent install on windows ?
by Brian Ipsen 16 Jan '14

16 Jan '14

Hi I have been searching through google, and from the result there, it should be possible to install stunnel silently on Windows using a /S switch.... I have tried this with the stunnel-4.56-installer.exe package - but it doesn't seem to work..... Can anyone tell me how to install stunnel silently - with no user interaction at all ? Regards /Brian

2 1

Multiple OCPSs
by Ender Erel 16 Jan '14

16 Jan '14

Hi All, We want to use multiple OCSP servers, but the way I see it we can specify only one OCSP server in the configuration file. Is there any other way to do this? Regards, Ender

2 1

Extra listeneres running that loop back to each other.
by Keith Knapp 15 Jan '14

15 Jan '14

Hi, Every time I start stunnel two unexplainable things happen. 1. The settings in my .conf file are not implemented and I have checked them syntactically. 2. I use TCPView and can see two established connections associated with the stunnel process, but they are *not* in my .conf file - Every time I restart the service the two connections reappear but are associated with different ports. - Furthermore the connections loop back on each other; meaning that the remote port of the one connection is the local port of the other connection (and vice-versa). - Are these supposed to be there? I have done a fresh install of the newest version of stunnel. Keith

1 0

Re: connect error 0 running on ARM platform
by FX35 15 Jan '14

15 Jan '14

> Message: 1 > Date: Tue, 14 Jan 2014 12:19:47 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] Fwd: Re: connect error 0 running on ARM > platform > Message-ID: <52D51D53.5030106(a)mirt.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > FWX wrote: >> errno is not updated ... >> >> So errno doen't reflect the real value. >> >> Map file of stunnel programm shows _errno_localion(), as you wrote. >> >> Perhaps is there a bug in uClib ? > > Something like this one: > http://www.mail-archive.com/uclibc@uclibc.org/msg05640.html > http://www.mail-archive.com/uclibc@uclibc.org/msg05641.html > or: > http://www.mail-archive.com/uclibc@uclibc.org/msg09301.html > ? > > It indeed looks like uclibc and stunnel use a different errno... > > Mike > > Thank you, Mike, I think you're right. It's ok using mode fork rather than pthread. Regards, FWX.

1 0

newbie question
by Ted Roeloffzen 15 Jan '14

15 Jan '14

Hello All, I'm new to STunnel and installed and setup STunnel. When someone tried to connect I get the following items in the log. SSL accepted: new session negotiated Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 FD 8 in non-blocking mode SL-test>Instelling connecting 127.0.0.1:8890 connect_wait: waiting 10 seconds connect_wait: connected Remote FD=8 initialized SSL alert (read): warning: close notify SSL closed on SSL_read Socket write shutdown SSL write shutdown SSL alert (write): warning: close notify SSL_shutdown successfully sent close_notify Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket SL-test>Instelling finished (0 left) As I'm reading this, there was an established connection but the connection party disconnected, for some reason or another. There was no data sent, but there also was no real error. Is this assumption correct or am I missing something? kind regards, Ted

1 0

Re: [stunnel-users] connect error 0 running on ARM platform
by FX35 14 Jan '14

14 Jan '14

> Message: 3 > Date: Fri, 10 Jan 2014 15:27:10 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] connect error 0 running on ARM platform > Message-ID: <52D0033E.1060109(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > On 01/09/2014 06:02 PM, FX35 wrote: >> Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux >> 2.6.36.4, I encounter the following error : the call to connect() >> return -1, but errno is set to 0 ! >> >> If stunnel is configured to use fork mode instead of pthread mode, >> the problem disapear. >> >> So it seems there is a problem, cross-compiling the program, with >> errno or __errno_location() in the program generated with pthread. >> >> I add the definition of _REENTRANT, without success ... >> >> (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) >> >> Is somebody meet the same error ? > > The errno definition in the Android framework (as an example of > Linux/ARM platform) is: > > /* internal function returning the address of the thread-specific > errno */ > extern volatile int* __errno(void); > > /* a macro expanding to the errno l-value */ > #define errno (*__errno()) > > > It seems okay. > > How do you reproduce this problem? What are the stunnel debug logs when > it happens? > > Mike Hello Mike, It seems that the errno variable is not correcly set/updated in C library, using pthread mode. Sample: errno = -1; ret = connect(...); if( ret == -1 ) { printf("errno=%d\n",errno); } will displays value -1 for errno, not EINPROGRESS or EWOULDBLOCK ! errno is not updated ... So errno doen't reflect the real value. Map file of stunnel programm shows _errno_localion(), as you wrote. Perhaps is there a bug in uClib ? Here is the result of ldd command: # ldd stunnel libssl.so.1.0.0 => /usr/lib/libssl.so.1.0.0 (0x400f3000) libcrypto.so.1.0.0 => /usr/lib/libcrypto.so.1.0.0 (0x4013d000) libz.so.1 => /usr/lib/libz.so.1 (0x4027c000) libdl.so.0 => /lib/libdl.so.0 (0x4029b000) libutil.so.0 => /lib/libutil.so.0 (0x4009e000) libpthread.so.0 => /lib/libpthread.so.0 (0x400a7000) libc.so.0 => /lib/libc.so.0 (0x402a6000) libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x400c6000) ld-uClibc.so.0 => /lib/ld-uClibc.so.0 (0x4008f000) Thanks for help. Regards, FWX.

2 1

connect error 0 running on ARM platform
by FX35 10 Jan '14

10 Jan '14

Hello, Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux 2.6.36.4, I encounter the following error : the call to connect() return -1, but errno is set to 0 ! If stunnel is configured to use fork mode instead of pthread mode, the problem disapear. So it seems there is a problem, cross-compiling the program, with errno or __errno_location() in the program generated with pthread. I add the definition of _REENTRANT, without success ... (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) Is somebody meet the same error ? Thanks for help. FWX.

2 1

What checks are made for verify=2
by Ender Erel 10 Jan '14

10 Jan '14

Hi All, I have been searching the web for information on what checks are made for verify=2 but I can't find any detailed information. What exactly goes on when I use verify=2 in client mode? Does stunnel only check if the certificate is signed by a valid CA? Or are any other X.509 attributes checked? Does it disallow settings like "CA=true"? I would really appreciate it if someone could point me where I can find about details of various verify levels. Thanks, Ender Erel

1 0

Stunnel cuts off message
by bernabei＠infinito.it 09 Jan '14

09 Jan '14

Hi,     I'd like to know why Stunnel cuts off messages. I use stunnel both the client and server side,the problem is that my client receives only a cutted off responce from the server,whose size turns out to be 18 KB. Hope an answer Thanks Chiara Bernabei

2 1

Error starting STunnel
by Ted Roeloffzen 09 Jan '14

09 Jan '14

Hi All, I've installed and configured my STunnel. But it won't start. The error i'm getting is: PEM_read_bio:no start line I use the certificate isn't valid, but it's a certificate that i received from a third party and should be correct. Do i have to add something to or alter the certificate so that STUnnel can work with it? kind regards, Ted

2 1

Stunnel should allow TLS v1.1, 1.2 in fips mode
by Douglas Harris (M) 07 Jan '14

07 Jan '14

Currently, stunnel only allows "sslVersion = TLSv1" when "fips = yes". TLSv1.1 and TLSv1.2 should also be permissible values for sslVersion in fips mode. -Doug

2 1

Invitation to connect on LinkedIn
by Manjula Hettiarachchi 30 Dec '13

30 Dec '13

LinkedIn ------------ stunnel, I'd like to add you to my professional network on LinkedIn. - Manjula Manjula Hettiarachchi CTO at UGEN Sri Lanka Confirm that you know Manjula Hettiarachchi: https://www.linkedin.com/e/7575ev-hptlhkon-2z/isd/18944228150/nRr0DNUW/?hs=… -- You are receiving Invitation to Connect emails. Click to unsubscribe: http://www.linkedin.com/e/7575ev-hptlhkon-2z/vyS7IfxEDIThLYYA4jSpNuY0D7kTJI… (c) 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

1 0

After upgrading OpenSSL, stunnel times out trying to receive emails
by James Brown 23 Dec '13

23 Dec '13

I've upgraded the OpenSSL on my test mail server, and recompiled Stunnel. Now when Stunnel receives an email it gets stuck on the "SSL state (accept): before/accept initialization" step and times out after a few minutes. Log: 2013.12.24 10:42:58 LOG7[86137:140735299320160]: Service [ssmtp] accepted (FD=3) from 192.168.1.10:54839 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] started 2013.12.24 10:42:58 LOG7[86137:4392841216]: Waiting for a libwrap process 2013.12.24 10:42:58 LOG7[86137:4392841216]: Acquired libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Releasing libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Released libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] permitted by libwrap from 192.168.1.10:54839 2013.12.24 10:42:58 LOG5[86137:4392841216]: Service [ssmtp] accepted connection from 192.168.1.10:54839 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): before/accept initialization 2013.12.24 10:42:58 LOG7[86137:4392841216]: SNI: no virtual services defined 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 read client hello A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write server hello A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write certificate A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write key exchange A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write server done A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 flush data 2013.12.24 10:42:58 LOG3[86137:4392841216]: SSL_accept: Peer suddenly disconnected 2013.12.24 10:42:58 LOG5[86137:4392841216]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.12.24 10:42:58 LOG7[86137:4392841216]: Local socket (FD=3) closed 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] finished (0 left) 2013.12.24 10:42:58 LOG7[86137:140735299320160]: Service [ssmtp] accepted (FD=3) from 192.168.1.10:54840 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] started 2013.12.24 10:42:58 LOG7[86137:4392841216]: Waiting for a libwrap process 2013.12.24 10:42:58 LOG7[86137:4392841216]: Acquired libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Releasing libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Released libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] permitted by libwrap from 192.168.1.10:54840 2013.12.24 10:42:58 LOG5[86137:4392841216]: Service [ssmtp] accepted connection from 192.168.1.10:54840 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): before/accept initialization 2013.12.24 10:47:58 LOG6[86137:4392841216]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.12.24 10:47:58 LOG5[86137:4392841216]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.12.24 10:47:58 LOG7[86137:4392841216]: Local socket (FD=3) closed 2013.12.24 10:47:58 LOG7[86137:4392841216]: Service [ssmtp] finished (0 left) Any suggestions? It was working fine before I upgraded OpenSSL to 1.00e. System is a Mac OS X 10.7.5 box. Thanks, James.

1 0

Error on attempt to launch Stunnel
by Tracy Drake - QI-C 20 Dec '13

20 Dec '13

Hello! I wonder if you can offer insight as to the significance of the following error on attempt to launch the new 4.56 Stunnel... [image: Inline image 1] Perhaps it was simply a botched/incomplete installation but I wanted to reach out before just attempting a reinstall. Thanks in advance! -- Tracy Drake CSM Senior Consultant GSA-FAS FAME Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

2 1

Stunnel client cuts off the responce of the server
by bernabei＠infinito.it 19 Dec '13

19 Dec '13

Hi,  I use stunnel both the client and server side, but I have problem with server responces because my client app receive only a cut off responce from the server,whose size turns out to be 18 KB. I'd like to know if the BUFFSIZE constant is the maximum size of the message that a client can read.  What if the server sends a message that is bigger than the buffer size? the remaining byte are ignored? if so, how can I do?   Waiting for an answer Thanks in advance Chiara Bernabei

1 0

Reload configuration file in Windows service
by David O'Riva 17 Dec '13

17 Dec '13

Hi, Is there a command line method for instructing stunnel to reload its configuration file when running as a Windows service? I'm trying to use stunnel to replace MySQL's abysmal SSL support on a box that has no GUI interface at all (it will never be logged into interactively). I've poked through the source, and on Windows it looks like the only way to pass signals to it is through a private pipe that is created by and for the stunnel process. Also, does anyone know offhand if existing connections are left unmolested when a configuration reload happens? For production use, I really need to be able to update certs and add and remove components (stunnel services, I guess) without disturbing connections that are in progress. Thanks! -Dave

1 0

Re: [stunnel-users] stunnel and Pegasus Mail
by sawbona＠flashmail.com 16 Dec '13

16 Dec '13

Hello: Thanks to all for your input. Much appreciated. On 15 Dec 2013 at 11:03, you wrote: To: sawbona(a)flashmail.com, Subject: Re: [stunnel-users] stunnel and Pegasus Mail > Just an added note. You need to restart the stunnel ... Yes. I was aware of that. > ... load it as part of the startup process. I have installed it to run as a service so that's what it does. > I would assume you are using windows ... Yes. =-/ > ... so would have to use the task manager to end the task ... Not needed. I have a taskbar icon that on left-click brings up a menu which, among other options, has one to edit and another one to reload the *.conf file. > You need to use a different set of ports for the gmx setup. That did it. =-) I have changed the configuration and it's working perfectly. I did not see the need to do this (maybe not read the manual often enough) but as the log file did not indicate any problems ... LOG5[1796:1960]: Reading configuration from file stunnel.conf LOG5[1796:1960]: FIPS mode is enabled LOG5[1796:1960]: Configuration successful ... I guessed it was something more complex. It would be nice if stunnel had the capability of showing (via the log file) an essential configuration mistake such as two POP3, SMTP or IMAP servers listening on the same ports. Once again, thanks for your input. Cheers, CIV PD: I am able to download mail from gmx.net serves via POP3 using Pegasus Mail and stunnel with no problems whatsoever. Sending mail requires the use of the POP3 userID/PW.

1 0

stunnel and Calypso and GMX: Anyone out there where stunnel works with Calypso?
by greeksalad 16 Dec '13

16 Dec '13

Hallo Everybody! Thanks for 2 replies, which replied, that mail.gmx.net:465 is not a propper ssl server: well, i tried with another email client (Opera), sending AUTH PLAIN and AUTH LOGIN and both worked. So I tried all possible configs in Calypso to get a successful smtp login, but it fails everytime with the same err.msg(see below) The funny thing is, the getting mail, login pop.gmx.net:995 works perfect via stunnel, but smtp fails.... So I want to ask, if there is anyone out there, who works successully with CALYPSO, stunnel and GMX-Provider?? In case, please tell me your settings - would be great! Thanks Johann my last question: ------ trying hard to get stunnel worked with Calypso email client! When I only check emails, it works via stunnel at ssl port 995. But sending email fails with following message from Calypso: *** Sending pending mail from account xyz(a)gmx.net' @ 13.12.2013 01:54 *** Connecting to: '127.0.0.1' -> Successful Logging into the SMTP server as: "xxx" The server does not support any secure password authentication providers Disconnecting -> Successful Failed to send one or more pending messages. Smtp.c[287] Smtp.dll the config file via stunnel looks so: cert = stunnel.pem [gmx-pop3] client = yes accept = 127.0.0.1:108 connect = pop.gmx.net:995 [gmx-smtp] client = yes accept = 127.0.0.1:107 connect = mail.gmx.net:465 the mailserver- config of Calypso is so: pop3: 127.0.0.1 port 108 smtp: 127.0.0.1 port 107 smtp authentication method: user pop account.... So, I am really out of ideas to get the very best email client of the world - CALYPSO - running to send emails via ssl connection, wich my provider forces me to send via ssl from 1.jan.2014... Anyone can help? thanks allot! johann

3 2

stunnel and Pegasus Mail
by sawbona＠flashmail.com 15 Dec '13

15 Dec '13

Hello: I recently came across stunnel as a solution (THE solution) to Pegasus Mail 4.63 having some sort of incompatibility with SSL versions in use at gmx.de and xsmail.com mail services. As I was absolutely unwilling to let go of my trusty PMailo, stunnel proved to be a godsend. =-) At first the problem was with xsmail only and after setting up stunnel everything went along perfectly well, no problems whatsoever. Now, gmx.de is enforcing the use of SSL on ports 993, 995 and 465 instead of 110, 25 and 143 so I edited my stunnel.conf accordingly. --- ;*********************************************************************** ;Configured service ;*********************************************************************** ;Pegasus Mail ;SSL connections to XSMail's servers ;Reason: there's some incompat between PMail 4.63 and SSL - 01/11/2013 [xsmail-POP3-SSL] client = yes accept = 10995 connect = mail.messagingengine.com:995 [xsmail-smtp-SSL] client = yes accept = 10465 connect = mail.messagingengine.com:465 [xsmail-IMAP-SSL] client = yes accept = 10993 connect = mail.messagingengine.com:993 ;Pegasus Mail ;SSL connections to GMX's servers ;Reason: there's some incompat between PMail 4.63 and SSL - 01/11/2013 [gmx-POP3-SSL] client = yes accept = 10995 connect = pop.gmx.net:995 [gmx-smtp-SSL] client = yes accept = 10465 connect = mail.gmx.net:465 [gmx-IMAP-SSL] client = yes accept = 10993 connect = imap.gmx.net:993 --- The issue at hand is that stunnel in not working properly now. This is the log file for a successful connection to xsmail: --- 2013.12.14 17:15:08 LOG5[500:284]: Service [xsmail-POP3-SSL] accepted connection from 127.0.0.1:1182 2013.12.14 17:15:08 LOG5[500:284]: connect_blocking: connected 66.111.4.51:995 2013.12.14 17:15:08 LOG5[500:284]: Service [xsmail-POP3-SSL] connected remote server from 192.168.1.102:1183 2013.12.14 17:15:10 LOG5[500:284]: Connection closed: 58 byte(s) sent to SSL, 112 byte(s) sent to socket --- And this is the log file for a (failed) connection to gmx: --- 2013.12.14 17:17:15 LOG5[500:452]: Service [xsmail-POP3-SSL] accepted connection from 127.0.0.1:1184 2013.12.14 17:17:15 LOG5[500:452]: connect_blocking: connected 66.111.4.52:995 2013.12.14 17:17:15 LOG5[500:452]: Service [xsmail-POP3-SSL] connected remote server from 192.168.1.102:1185 2013.12.14 17:17:21 LOG5[500:452]: Connection closed: 36 byte(s) sent to SSL, 126 byte(s) sent to socket --- The PMail trace is this as follows: [*] Connection established to 127.0.0.1 >> 0016 +OK POP3 ready << 0015 USER 14067985 >> 0005 +OK << 0015 PASS XXXXXXXX >> 0083 -ERR You must use your full username of the form yourusername(a)domain.tld to login Figures ... It is attempting to connect to gmx with xsmail credentials. As youcan see, for some strange reason it is connecting to gmx with xsmail settings. Must be a *.conf file problem but I am at a loss as to what is gong on Any ideas? Thanks in advance, CIV

2 2

stunnel and Calypso: pop3 works, smtp error!
by greeksalad 13 Dec '13

13 Dec '13

Hallo Everybody! trying hard to get stunnel worked with Calypso email client! When I only check emails, it works via stunnel at ssl port 995. But sending email fails with following message from Calypso: *** Sending pending mail from account xyz(a)gmx.net' @ 13.12.2013 01:54 *** Connecting to: '127.0.0.1' -> Successful Logging into the SMTP server as: "xxx" The server does not support any secure password authentication providers Disconnecting -> Successful Failed to send one or more pending messages. Smtp.c[287] Smtp.dll the config file via stunnel looks so: cert = stunnel.pem [gmx-pop3] client = yes accept = 127.0.0.1:108 connect = pop.gmx.net:995 [gmx-smtp] client = yes accept = 127.0.0.1:107 connect = mail.gmx.net:465 the mailserver- config of Calypso is so: pop3: 127.0.0.1 port 108 smtp: 127.0.0.1 port 107 smtp authentication method: user pop account.... So, I am really out of ideas to get the very best email client of the world - CALYPSO - running to send emails via ssl connection, wich my provider forces me to send via ssl from 1.jan.2014... Anyone can help? thanks allot! johann

3 2

Client Authentication - Configuring Service Definition
by j nasty 10 Dec '13

10 Dec '13

Hello Everyone, I’m attempting to consume a web service that requires I authenticate the client using certificates. I was given a (.pfx) certificate locked with a password by the 3rd party vendor. I know I need to convert the current certificate I have into a (.pem) certificate, which I’ll use the openssl tools to accomplish this. I’m a bit new to SSL and network security, thus I’m not entirely sure if I should only be creating a client certificate from the original (.pfx) file or if a server certificate will also need to get created. I used the command: “pkcs12 –in certificate.pfx –out certificate.pem –nodes (–clcerts/-cacerts)” to create my pem certificate. Here is my current configuration: [SSLconnection] debug = 7 CAfile = certificate.pem client = yes verify = 2 accept = 127.0.0.1:9001 connect = web.service.com:443 And the log: (I obscured some information identity information) 2013.12.10 09:36:41 LOG5[9776:8488]: stunnel 4.56 on x86-pc-msvc-1500 platform 2013.12.10 09:36:41 LOG5[9776:8488]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2013.12.10 09:36:41 LOG5[9776:8488]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2013.12.10 09:36:41 LOG5[9776:8488]: Reading configuration from file stunnel.conf 2013.12.10 09:36:41 LOG5[9776:8488]: FIPS mode is enabled 2013.12.10 09:36:41 LOG5[9776:8488]: Configuration successful 2013.12.10 09:36:44 LOG5[9776:9024]: Service [SSLconnection] accepted connection from 127.0.0.1:60659 2013.12.10 09:36:44 LOG5[9776:9024]: connect_blocking: connected web.service.com:443 2013.12.10 09:36:44 LOG5[9776:9024]: Service [SSLconnection] connected remote server from 192.168.50.211:60660 2013.12.10 09:36:44 LOG5[9776:9024]: Certificate accepted: depth=1, /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C 2013.12.10 09:36:44 LOG5[9776:9024]: Certificate accepted: depth=1, /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C 2013.12.10 09:36:44 LOG4[9776:9024]: CERT: Certificate not found in local repository 2013.12.10 09:36:44 LOG4[9776:9024]: Certificate check failed: depth=0, /C=US/ST=Texas/L=Austin/O=OName/CN=web.service.com 2013.12.10 09:36:44 LOG3[9776:9024]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2013.12.10 09:36:44 LOG5[9776:9024]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Looks like my problem is stemming from "Certificate not found in local repository"? Thank you in advance for any assistance, Jake

1 0

connect error 0 running on ARM platform
by FX35 10 Dec '13

10 Dec '13

Hello, Running stunnel 4?56 on an ARM platform (ARM926EJ) with Linux 2.6.36.4, I encounter the following error : the call to connect() return -1, but errno is set to 0 ! Is somebody meet the same error ? Is the problem in stunnel program ? An other application, using non blocking call to connect() run correctly. Thanks for help. FWX.

1 0

newbie - sTunnel examples and users archive searching
by Attila Horvath 10 Dec '13

10 Dec '13

All I'm new to sTunnel and tunneling in general. Have a couple of quick questions... [1] It's been *many* years since I've used or subscribed to mailman. Is there a way of searching the mail archives online for specific topics and/or keywords without downloading everything so previously asked questions aren't repeated ad nauseam? [2] I have a specific need which I believe sTunnel will solve but not sure how to go about it. I want to access a machine that is behind a restrictive firewall from outside the network to perform perform remote desktop control. The firewall permits HTTP, HTTPS protocols and some similar common protocols. However, I do not have access to the firewall server ergo have no control/say over which ports are blocked or forwarded. I have heard about HTTP hole punching via ssl and http-tunnel - eg: http://sebsauvage.net/punching/. It sounds like sTunnel is similar/identical. Can someone point me to specific examples on how to use sTunnel as well as any examples that might satisfy my need? Is proxy server necessary to accomplish this? To date I've been using Teamviewer to access/control my machine(s) in conjunction with things like AdVOR, TOR, or UltraSurf. While these are excellent applications and their free use are limited, I do not expect this will last forever. I prefer to use and trust 'open source' applications where/when I can. Much appreciated and thank you in advance. Attila

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users