- stunnel-users - stunnel.org

TLS alert (write): fatal: decode error (pop3 to office365)
by Martijn Strunk - Mulder Connect 15 Aug '22

15 Aug '22

We now use stunnel as a solution for a pop3 import for Office365. It just stopped working since Wednesday. we have done a new installation on this, only now we run into these problems that it no longer wants to connect. Below you will find our debug list and config list. Do any of you have a solution to this problem? Debug: 2022.07.26 14:34:37 LOG6[service]: Service [POP3 Incoming] (FD=876) bound to 0.0.0.0:110 2022.07.26 14:34:37 LOG6[service]: Service [SMTP Outgoing] (FD=840) bound to 0.0.0.0:25 2022.07.26 14:34:54 LOG5[21]: Service [POP3 Incoming] accepted connection from 192.168.110.11:60494 2022.07.26 14:34:54 LOG6[21]: Peer certificate not required 2022.07.26 14:35:24 LOG3[21]: SSL_accept: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.07.26 14:35:24 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/asn1_lib.c:308: 87315 allocations 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/tasn_new.c:136: 77533 allocations 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/asn1_lib.c:350: 70711 allocations 2022.07.26 14:37:21 LOG6[service]: Initializing inetd mode configuration 2022.07.26 14:37:21 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2022.07.26 14:37:21 LOG5[service]: UTF-8 byte order mark detected 2022.07.26 14:37:21 LOG5[service]: FIPS mode disabled 2022.07.26 14:37:21 LOG6[service]: Compression enabled: 0 methods 2022.07.26 14:37:21 LOG6[service]: Initializing service [POP3 Incoming] 2022.07.26 14:37:21 LOG6[service]: User-specified security level set: 0 2022.07.26 14:37:21 LOG6[service]: Session resumption enabled 2022.07.26 14:37:21 LOG6[service]: Loading certificate from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Certificate loaded from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Loading private key from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Private key loaded from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 1999 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: O=Entrust.net<http://o=entrust.net/>, OU=www.entrust.net/CPS_2048<http://ou=www.entrust.net/CPS_2048> incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net<http://entrust.net/> Limited, CN=Entrust.net<http://cn=entrust.net/> Certification Authority (2048) 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=www.entrust.net/CPS<http://ou=www.entrust.net/CPS> is incorporated by reference, OU="(c) 2006 Entrust, Inc.", CN=Entrust Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O=SECOM Trust.net<http://trust.net/>, OU=Security Communication RootCA1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FI, O=Sonera, CN=Sonera Class2 CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org<http://ou=http//www.chambersign.org>, CN=Chambers of Commerce Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org<http://ou=http//www.chambersign.org>, CN=Global Chambersign Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, OU=www.xrampsecurity.com<http://ou=www.xrampsecurity.com/>, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="The Go Daddy Group, Inc.", OU=Go Daddy Class 2 Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Starfield Technologies, Inc.", OU=Starfield Class 2 Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=Government Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Assured ID Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Global Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert High Assurance EV Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Class 2 Primary CA 2022.07.26 14:37:21 LOG6[service]: Client CA: O=Digital Signature Trust Co., CN=DST Root CA X3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Digital Signature Trust, OU=DST ACES, CN=DST ACES CA X6 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2006 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G5 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=SecureTrust Corporation, CN=SecureTrust CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=SecureTrust Corporation, CN=Secure Global CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security Communication EV RootCA1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Dhimyotis, CN=Certigna 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: O="Cybertrust, Inc", CN=Cybertrust Global Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O="Chunghwa Telecom Co., Ltd.", OU=ePKI Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=RO, O=certSIGN, OU=certSIGN ROOT CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU="(c) 2007 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2008 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., OU=(c) 2007 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2008 VeriSign, Inc. - For authorized use only", CN=VeriSign Universal Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2007 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HU, L=Budapest, O=NetLock Kft., OU=Tanúsítványkiadók (Certification Services), CN=NetLock Arany (Class Gold) Főtanúsítvány 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="Japan Certification Services, Inc.", CN=SecureSign RootCA11 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, emailAddress=info(a)e-szigno.hu 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=IZENPE S.A., CN=Izenpe.com<http://cn=izenpe.com/> 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, L=Madrid (see current address at www.camerfirma.com/address<http://www.camerfirma.com/address>), serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, L=Madrid (see current address at www.camerfirma.com/address<http://www.camerfirma.com/address>), serialNumber=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="GoDaddy.com<http://o="godaddy.com/>y.com, Inc.", CN=Go Daddy Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Services Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Commercial 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Networking 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certinomis, OU=0002 433998903<tel:0002%20433998903>, CN=Certinomis - Autorité Racine 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security Communication RootCA2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu https://www.catcert.net/verarrel (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2011 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, O=Trustis Limited, OU=Trustis FPS Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, emailAddress=pki(a)sk.ee 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı, C=TR, L=Ankara, O=TÜRKTRUST Bilgi İletişim ve Bilişim Güvenliği Hizmetleri A.Ş. (c) Aralık 2007 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009 2022.07.26 14:37:21 LOG6[service]: Client CA: emailAddress=contacto(a)procert.net.ve, L=Chacao, ST=Miranda, OU=Proveedor de Certificados PROCERT, O=Sistema Nacional de Certificacion Electronica, C=VE, CN=PSCProcert 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: O=TeliaSonera, CN=TeliaSonera Root CA v1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Ankara, O=E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., OU=E-Tugra Sertifikasyon Merkezi, CN=E-Tugra Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=Atos TrustedRoot 2011, O=Atos, C=DE 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Assured ID Root G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Assured ID Root G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Global Root G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Global Root G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com<http://ou=www.digicert.com/>, CN=DigiCert Trusted Root G4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=CA 沃通根证书 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign ECC Root CA - R5, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden EV Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms<http://www.entrust.net/legal-terms>, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms<http://www.entrust.net/legal-terms>, OU="(c) 2012 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - EC1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Ankara, O=TÜRKTRUST Bilgi İletişim ve Bilişim Güvenliği Hizmetleri A.Ş., CN=TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certinomis, OU=0002 433998903<tel:0002%20433998903>, CN=Certinomis - Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=WISeKey, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GB CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=CA WoSign ECC Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR ROOT CA2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2015 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions ECC RootCA 2015 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Certplus Root CA G1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Certplus Root CA G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Internet Security Research Group, CN=ISRG Root X1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=LU, O=LuxTrust S.A., CN=LuxTrust Global Root 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Gebze - Kocaeli, O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK, OU=Kamu Sertifikasyon Merkezi - Kamu SM, CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 2022.07.26 14:37:21 LOG6[service]: DH initialization needed for DHE-DSS-AES256-GCM-SHA384 2022.07.26 14:37:21 LOG6[service]: Using dynamic DH parameters 2022.07.26 14:37:21 LOG5[service]: Configuration successful 2022.07.26 14:37:21 LOG7[service]: Deallocating deployed section defaults 2022.07.26 14:37:21 LOG7[service]: Deallocating section [POP3 Incoming] 2022.07.26 14:37:21 LOG7[service]: Deallocating section [SMTP Outgoing] 2022.07.26 14:37:21 LOG7[service]: Binding service [POP3 Incoming] 2022.07.26 14:37:21 LOG7[service]: Listening file descriptor created (FD=840) 2022.07.26 14:37:21 LOG7[service]: Setting accept socket options (FD=840) 2022.07.26 14:37:21 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2022.07.26 14:37:21 LOG6[service]: Service [POP3 Incoming] (FD=840) bound to 0.0.0.0:110 2022.07.26 14:37:29 LOG7[service]: Found 1 ready file descriptor(s) 2022.07.26 14:37:29 LOG7[service]: FD=664 ifds=r-x ofds=--- 2022.07.26 14:37:29 LOG7[service]: FD=840 ifds=r-x ofds=r-- 2022.07.26 14:37:29 LOG7[service]: Service [POP3 Incoming] accepted (FD=740) from 192.168.110.11:60596 2022.07.26 14:37:29 LOG7[service]: Creating a new thread 2022.07.26 14:37:29 LOG7[service]: New thread created 2022.07.26 14:37:29 LOG7[22]: Service [POP3 Incoming] started 2022.07.26 14:37:29 LOG7[22]: Setting local socket options (FD=740) 2022.07.26 14:37:29 LOG7[22]: Option TCP_NODELAY set on local socket 2022.07.26 14:37:29 LOG5[22]: Service [POP3 Incoming] accepted connection from 192.168.110.11:60596 2022.07.26 14:37:29 LOG6[22]: Peer certificate not required 2022.07.26 14:37:29 LOG7[22]: TLS state (accept): before SSL initialization 2022.07.26 14:37:59 LOG7[22]: TLS alert (write): fatal: decode error 2022.07.26 14:37:59 LOG3[22]: SSL_accept: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.07.26 14:37:59 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2022.07.26 14:37:59 LOG7[22]: Local descriptor (FD=740) closed 2022.07.26 14:37:59 LOG7[22]: Service [POP3 Incoming] finished (0 left) Config: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log log = overwrite ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;sslVersion = all sslVersionMax=TLSv1.3 sslVersionMin=TLSv1.2 sslVersion = TLSv1.2 sslVersion = TLSv1.3 ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ciphers = ALL ;ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:AES128-GCM-SHA256 options = CIPHER_SERVER_PREFERENCE cert = stunnel.pem CAfile = ca-certs.pem OCSPaia = no verify = 0 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services ;[POP3 Incoming] ;client = yes ;accept = 110 ;connect = outlook.office365.com:995 ;verifyChain = yes ;CAfile = ca-certs.pem ;checkHost = outlook.office365.com<http://outlook.office365.com/> ;OCSPaia = yes [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 ;[SMTP Outgoing] ;accept = 25 ;connect = smtp.office365.com:587 ;[SMTP Outgoing] ;client = yes ;accept = 25 ;protocol = smtp ;connect = smtp.office365.com:587 ;verifyChain = yes ;CAfile = ca-certs.pem ;checkHost = smtp.office365.com<http://smtp.office365.com/> ;OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini Met vriendelijke groeten, Martijn Strunk Laan van de Ram 59 06 - 13 10 67 62 7324 BW APELDOORN M.Strunk(a)mulderconnect.nl 055 - 303 12 34 www.mulderconnect.nl Mulder Connect is een onderdeel van Mulder Systems, specialist op het gebied van elektrotechniek, data-infra, IT, telecommunicatie, beveiliging en duurzame technieken. Disclaimer Deze E-mail en alle daarbij meegestuurde bijlagen zijn uitsluitend bestemd voor geadresseerde(n). Verstrekking aan en gebruik door anderen is niet toegestaan. Mulder Systems sluit iedere aansprakelijkheid uit die voortvloeit uit elektronische verzending. This E-mail and any attachment sent with it are intended exclusively for the addressee(s), and may not be passed on to, or made available for use by any person other than the addressee(s). Mulder Systems rules out any and every liability resulting from any electronic transmission.

1 0

Enter-passphrase dialog broken
by Johann Hörmann 15 Aug '22

15 Aug '22

Hi, since stunnel 5.62 it does not take the passphrase for a client key anymore, instead it gives a 'bad decrypt' log at once. It is the same behaviour at Debian/sid Distro as well as with Windows10. Up to stunnel 5.61 the same stunnel.conf is accepted and the key gets loaded. Here is the top of our stunnel.conf: cert = /home/regula/cert.pem key = /home/regula/cert.key client = yes [-- snip --] Calling stunnel at the bash: $ stunnel stunnel.conf [-- snip --] [ ] Loading certificate from file: /home/regula/cert.pem [ ] Certificate loaded from file: /home/regula/cert.pem [ ] Loading private key from file: /home/regula/cert.key [!] error queue: ../ssl/ssl_rsa.c:384: error:0A080009:SSL routines::PEM lib [!] error queue: ../crypto/pkcs12/p12_decr.c:86: error:11800074:PKCS12 routines::pkcs12 cipherfinal error [!] error queue: ../providers/implementations/ciphers/ciphercommon_block.c:124: error:1C800064:Provider routines::bad decrypt [!] error queue: ../crypto/pkcs12/p12_decr.c:86: error:11800074:PKCS12 routines::pkcs12 cipherfinal error [!] SSL_CTX_use_PrivateKey_file: ../providers/implementations/ciphers/ciphercommon_block.c:124: error:1C800064:Provider routines::bad decrypt [!] Service [guacamole]: Failed to initialize TLS context [!] Configuration failed [-- snip --] $ ls -lh *pem *key -r-------- 1 regula regula 3,4K 22. Jun 16:52 cert.key -r-------- 1 regula regula 2,2K 22. Jun 16:45 cert.pem openssl does show the enter passphrase dialog and displays the private key: $ $ openssl rsa -in cert.key Enter pass phrase for cert.key: writing RSA key -----BEGIN PRIVATE KEY----- [-- snip --] -----END PRIVATE KEY----- ~$ dpkg -l|grep openssl ii openssl 3.0.4-2 amd64 Secure Sockets Layer toolkit - cryptographic utility ~$ dpkg -l|grep stunnel ii stunnel4 3:5.63-1+b1 amd64 Universal SSL tunnel for network daemons Why is there a different behaviour between openssl and stunnel > 5.61 in loading a private key file? Regards, Johann -- https://www.hoermann-solutions.com

2 1

RTMP Stream from Milesight Camera to RTMPS server through stunnel
by nxcloudtest2021＠gmail.com 11 Aug '22

11 Aug '22

I am new to Stunnel and I would like to know how to push my RTMP Milesight Camera stream to Stunnel and then push it to my RTMP stream site here: rtmps://stream.mywebsite.com:1936/static/KI I tried modifying the method that would push a stream to nginx, then Stunnel, then Facebook, but it doesn't work for me. May I know what steps I should take to push my RTMP Milesight stream to Stunnel? Would nginx be necessary for this?

1 0

IMAP and SMTP user filtering
by snechiporus＠gmail.com 08 Aug '22

08 Aug '22

Hello all, I rebuilt Stunnel from source (Ubuntu 20.040 and now I am trying to add user filtering for IMAP and SMTP protocols. The purpose is following: I have non-SSL device that does not have permanent IP address (connected to mobile internet and its IP may change any time). This device should connect to Stunnel running on the server in Internet (not local network) to receive email from Gmail account. To prevent abuse I have to allow only one user (let's say, xxxxxx(a)gmail.com) to connect to my Stunnel instance. Is it possible? What part of code should I modify? Thank you

1 0

stunnel to the computer's IP address works, 127.0.0.1 fails
by Alan C. Bonnici 06 Aug '22

06 Aug '22

Hi, I setup a newly installed Windows 10 computer with STunnel. The same exact command using the IP address of the computer (eg 192.168.1.xxx) works while 127.0.0.1 fails. The config is set to listen on port only. What could be the problem? Thanks

1 0

Windows capi engine clarification
by raduci＠gmail.com 04 Aug '22

04 Aug '22

Dear all, I have a question related to capi engine: if stunnel is installed on a windows machine and capi tunnel is selected, which certificate is used to connect to secured server? Stunnel server machine certificate or client's certificate connecting through stunnel server? thank you!

1 0

Re: stunnel 5.65 released
by Jeff WIeland 02 Aug '22

02 Aug '22

Dennis Preiser wrote: > > On Mon, Jul 18, 2022 at 09:09:54AM +0200, Dennis Preiser wrote: >> On Sun, Jul 17, 2022 at 09:55:05PM +0200, Michał Trojnara via stunnel-users wrote: >>> I have released version 5.65 of stunnel. >> Unfortunately, it does not build here: >> >> | client.c:1514:11: error: use of undeclared identifier 'environ' >> >> I think this is caused by the following change in src/client.c (5.64 -> >> 5.65): >> >> | @@ -1396,7 +1399,9 @@ NOEXPORT SOCKET connect_local(CLI *c) { >> | >> | #else /* standard Unix version */ >> | >> | +#ifndef HAVE_UNISTD_H >> | extern char **environ; >> | +#endif >> | >> | NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ >> | int fd[2], pid; >> >> unistd.h is present on the system and thus HAVE_UNISTD_H is defined: >> >> | % grep 'HAVE_UNISTD_H' src/config.h >> | #define HAVE_UNISTD_H 1 >> >> My system: >> >> | % sw_vers >> | ProductName: macOS >> | ProductVersion: 12.4 >> | BuildVersion: 21F79 > Is there any chance this will be fixed? > > Dennis > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org I have the same problem with Solaris 10 on SPARC. -- Jeff Wieland, UNIX Systems Administrator Purdue University IT Infrastructure Services UNIX Platforms

1 0

TLS alert (write): fatal: decode error (pop3 to office365)
by m.strunk＠mulderconnect.nl 26 Jul '22

26 Jul '22

We now use stunnel as a solution for a pop3 import for Office365. It just stopped working since Wednesday. we have done a new installation on this, only now we run into these problems that it no longer wants to connect. Below you will find our debug list and config list. Do any of you have a solution to this problem? Debug: 2022.07.26 14:34:37 LOG6[service]: Service [POP3 Incoming] (FD=876) bound to 0.0.0.0:110 2022.07.26 14:34:37 LOG6[service]: Service [SMTP Outgoing] (FD=840) bound to 0.0.0.0:25 2022.07.26 14:34:54 LOG5[21]: Service [POP3 Incoming] accepted connection from 192.168.110.11:60494 2022.07.26 14:34:54 LOG6[21]: Peer certificate not required 2022.07.26 14:35:24 LOG3[21]: SSL_accept: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.07.26 14:35:24 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/asn1_lib.c:308: 87315 allocations 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/tasn_new.c:136: 77533 allocations 2022.07.26 14:35:24 LOG4[21]: Possible memory leak at crypto/asn1/asn1_lib.c:350: 70711 allocations 2022.07.26 14:37:21 LOG6[service]: Initializing inetd mode configuration 2022.07.26 14:37:21 LOG5[service]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2022.07.26 14:37:21 LOG5[service]: UTF-8 byte order mark detected 2022.07.26 14:37:21 LOG5[service]: FIPS mode disabled 2022.07.26 14:37:21 LOG6[service]: Compression enabled: 0 methods 2022.07.26 14:37:21 LOG6[service]: Initializing service [POP3 Incoming] 2022.07.26 14:37:21 LOG6[service]: User-specified security level set: 0 2022.07.26 14:37:21 LOG6[service]: Session resumption enabled 2022.07.26 14:37:21 LOG6[service]: Loading certificate from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Certificate loaded from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Loading private key from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Private key loaded from file: stunnel.pem 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 1999 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=www.entrust.net/CPS is incorporated by reference, OU="(c) 2006 Entrust, Inc.", CN=Entrust Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Universal CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=VISA, OU=Visa International Service Association, CN=Visa eCommerce Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FI, O=Sonera, CN=Sonera Class2 CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Chambers of Commerce Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, O=AC Camerfirma SA CIF A82743287, OU=http://www.chambersign.org, CN=Global Chambersign Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="The Go Daddy Group, Inc.", OU=Go Daddy Class 2 Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Starfield Technologies, Inc.", OU=Starfield Class 2 Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=Government Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Class 2 Primary CA 2022.07.26 14:37:21 LOG6[service]: Client CA: O=Digital Signature Trust Co., CN=DST Root CA X3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Digital Signature Trust, OU=DST ACES, CN=DST ACES CA X6 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=SwissSign AG, CN=SwissSign Silver CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2006 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G5 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=SecureTrust Corporation, CN=SecureTrust CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=SecureTrust Corporation, CN=Secure Global CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security Communication EV RootCA1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Dhimyotis, CN=Certigna 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: O="Cybertrust, Inc", CN=Cybertrust Global Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O="Chunghwa Telecom Co., Ltd.", OU=ePKI Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=RO, O=certSIGN, OU=certSIGN ROOT CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., OU=(c) 2008 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU="(c) 2007 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2008 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=GeoTrust Inc., OU=(c) 2007 GeoTrust Inc. - For authorized use only, CN=GeoTrust Primary Certification Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2008 VeriSign, Inc. - For authorized use only", CN=VeriSign Universal Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network, OU="(c) 2007 VeriSign, Inc. - For authorized use only", CN=VeriSign Class 3 Public Primary Certification Authority - G4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HU, L=Budapest, O=NetLock Kft., OU=Tanúsítványkiadók (Certification Services), CN=NetLock Arany (Class Gold) Főtanúsítvány 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="Japan Certification Services, Inc.", CN=SecureSign RootCA11 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES 2022.07.26 14:37:21 LOG6[service]: Client CA: C=HU, L=Budapest, O=Microsec Ltd., CN=Microsec e-Szigno Root CA 2009, emailAddress=info(a)e-szigno.hu 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=IZENPE S.A., CN=Izenpe.com 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, L=Madrid (see current address at www.camerfirma.com/address), serialNumber=A82743287, O=AC Camerfirma S.A., CN=Chambers of Commerce Root - 2008 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EU, L=Madrid (see current address at www.camerfirma.com/address), serialNumber=A82743287, O=AC Camerfirma S.A., CN=Global Chambersign Root - 2008 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="GoDaddy.com, Inc.", CN=Go Daddy Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=Arizona, L=Scottsdale, O="Starfield Technologies, Inc.", CN=Starfield Services Root Certificate Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Commercial 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Networking 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Autorité Racine 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Root Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security Communication RootCA2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=Agencia Catalana de Certificacio (NIF Q-0801176-I), OU=Serveis Publics de Certificacio, OU=Vegeu https://www.catcert.net/verarrel (c)03, OU=Jerarquia Entitats de Certificacio Catalanes, CN=EC-ACC 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2011 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, O=Trustis Limited, OU=Trustis FPS Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=IL, O=StartCom Ltd., CN=StartCom Certification Authority G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NO, O=Buypass AS-983163327, CN=Buypass Class 3 Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, emailAddress=pki(a)sk.ee 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı, C=TR, L=Ankara, O=TÜRKTRUST Bilgi İletişim ve Bilişim Güvenliği Hizmetleri A.Ş. (c) Aralık 2007 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 2009 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV 2009 2022.07.26 14:37:21 LOG6[service]: Client CA: emailAddress=contacto(a)procert.net.ve, L=Chacao, ST=Miranda, OU=Proveedor de Certificados PROCERT, O=Sistema Nacional de Certificacion Electronica, C=VE, CN=PSCProcert 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R2 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=ACCVRAIZ1, OU=PKIACCV, O=ACCV, C=ES 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TW, O=TAIWAN-CA, OU=Root CA, CN=TWCA Global Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: O=TeliaSonera, CN=TeliaSonera Root CA v1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Ankara, O=E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., OU=E-Tugra Sertifikasyon Merkezi, CN=E-Tugra Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=DE, O=T-Systems Enterprise Services GmbH, OU=T-Systems Trust Center, CN=T-TeleSec GlobalRoot Class 2 2022.07.26 14:37:21 LOG6[service]: Client CA: CN=Atos TrustedRoot 2011, O=Atos, C=DE 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=CA 沃通根证书 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign ECC Root CA - R4, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: OU=GlobalSign ECC Root CA - R5, O=GlobalSign, CN=GlobalSign 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden Root CA - G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=NL, O=Staat der Nederlanden, CN=Staat der Nederlanden EV Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2009 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O="Entrust, Inc.", OU=See www.entrust.net/legal-terms, OU="(c) 2012 Entrust, Inc. - for authorized use only", CN=Entrust Root Certification Authority - EC1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=China Financial Certification Authority, CN=CFCA EV ROOT 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Ankara, O=TÜRKTRUST Bilgi İletişim ve Bilişim Güvenliği Hizmetleri A.Ş., CN=TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Root CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CH, O=WISeKey, OU=OISTE Foundation Endorsed, CN=OISTE WISeKey Global Root GB CA 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=Certification Authority of WoSign G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=CN, O=WoSign CA Limited, CN=CA WoSign ECC Root 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR ROOT CA2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=PL, O=Unizeto Technologies S.A., OU=Certum Certification Authority, CN=Certum Trusted Network CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions RootCA 2015 2022.07.26 14:37:21 LOG6[service]: Client CA: C=GR, L=Athens, O=Hellenic Academic and Research Institutions Cert. Authority, CN=Hellenic Academic and Research Institutions ECC RootCA 2015 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Certplus Root CA G1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=Certplus, CN=Certplus Root CA G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=FR, O=OpenTrust, CN=OpenTrust Root CA G3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Internet Security Research Group, CN=ISRG Root X1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 1 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 3 2022.07.26 14:37:21 LOG6[service]: Client CA: C=US, O=Amazon, CN=Amazon Root CA 4 2022.07.26 14:37:21 LOG6[service]: Client CA: C=LU, O=LuxTrust S.A., CN=LuxTrust Global Root 2 2022.07.26 14:37:21 LOG6[service]: Client CA: C=TR, L=Gebze - Kocaeli, O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK, OU=Kamu Sertifikasyon Merkezi - Kamu SM, CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 2022.07.26 14:37:21 LOG6[service]: DH initialization needed for DHE-DSS-AES256-GCM-SHA384 2022.07.26 14:37:21 LOG6[service]: Using dynamic DH parameters 2022.07.26 14:37:21 LOG5[service]: Configuration successful 2022.07.26 14:37:21 LOG7[service]: Deallocating deployed section defaults 2022.07.26 14:37:21 LOG7[service]: Deallocating section [POP3 Incoming] 2022.07.26 14:37:21 LOG7[service]: Deallocating section [SMTP Outgoing] 2022.07.26 14:37:21 LOG7[service]: Binding service [POP3 Incoming] 2022.07.26 14:37:21 LOG7[service]: Listening file descriptor created (FD=840) 2022.07.26 14:37:21 LOG7[service]: Setting accept socket options (FD=840) 2022.07.26 14:37:21 LOG7[service]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2022.07.26 14:37:21 LOG6[service]: Service [POP3 Incoming] (FD=840) bound to 0.0.0.0:110 2022.07.26 14:37:29 LOG7[service]: Found 1 ready file descriptor(s) 2022.07.26 14:37:29 LOG7[service]: FD=664 ifds=r-x ofds=--- 2022.07.26 14:37:29 LOG7[service]: FD=840 ifds=r-x ofds=r-- 2022.07.26 14:37:29 LOG7[service]: Service [POP3 Incoming] accepted (FD=740) from 192.168.110.11:60596 2022.07.26 14:37:29 LOG7[service]: Creating a new thread 2022.07.26 14:37:29 LOG7[service]: New thread created 2022.07.26 14:37:29 LOG7[22]: Service [POP3 Incoming] started 2022.07.26 14:37:29 LOG7[22]: Setting local socket options (FD=740) 2022.07.26 14:37:29 LOG7[22]: Option TCP_NODELAY set on local socket 2022.07.26 14:37:29 LOG5[22]: Service [POP3 Incoming] accepted connection from 192.168.110.11:60596 2022.07.26 14:37:29 LOG6[22]: Peer certificate not required 2022.07.26 14:37:29 LOG7[22]: TLS state (accept): before SSL initialization 2022.07.26 14:37:59 LOG7[22]: TLS alert (write): fatal: decode error 2022.07.26 14:37:59 LOG3[22]: SSL_accept: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.07.26 14:37:59 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2022.07.26 14:37:59 LOG7[22]: Local descriptor (FD=740) closed 2022.07.26 14:37:59 LOG7[22]: Service [POP3 Incoming] finished (0 left) Config: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log log = overwrite ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;sslVersion = all sslVersionMax=TLSv1.3 sslVersionMin=TLSv1.2 sslVersion = TLSv1.2 sslVersion = TLSv1.3 ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ciphers = ALL ;ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:AES128-GCM-SHA256 options = CIPHER_SERVER_PREFERENCE cert = stunnel.pem CAfile = ca-certs.pem OCSPaia = no verify = 0 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services ;[POP3 Incoming] ;client = yes ;accept = 110 ;connect = outlook.office365.com:995 ;verifyChain = yes ;CAfile = ca-certs.pem ;checkHost = outlook.office365.com ;OCSPaia = yes [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 ;[SMTP Outgoing] ;accept = 25 ;connect = smtp.office365.com:587 ;[SMTP Outgoing] ;client = yes ;accept = 25 ;protocol = smtp ;connect = smtp.office365.com:587 ;verifyChain = yes ;CAfile = ca-certs.pem ;checkHost = smtp.office365.com ;OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini

1 0

CERT: Subject checks failed
by wkwok＠crestron.com 25 Jul '22

25 Jul '22

I'm new to stunnel and think it may be easier to use this in our environment. Any help would be appreciated! Here is my setup. Source and Destination OS: Windows 2022 Data Center VMs I copied the stunnel.pem from SERVER to CLIENT and named it stunnel_client.pem. I get the following error when connecting from CLIENT -> SERVER. 2022.07.23 17:30:28 LOG6[3]: SNI: sending servername: x.x.x.x 2022.07.23 17:30:28 LOG6[3]: Peer certificate required 2022.07.23 17:30:28 LOG4[3]: CERT: Subject checks failed 2022.07.23 17:30:28 LOG4[3]: Rejected by CERT at depth=0: C=US, ST=New Jersey, L=Edison, O=Crestron, OU=ProPortal, CN=vmsql-edatahub-.crestron.com 2022.07.23 17:30:28 LOG3[3]: SSL_connect: ssl/statem/statem_clnt.c:1887: error:0A000086:SSL routines::certificate verify failed 2022.07.23 17:30:28 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket *****STUNNEL.CONF***** SERVER: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 sslVersion = TLSv1.2 [ncatListener] accept = 8443 connect = 4489 cert = stunnel.pem CLIENT: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 sslVersion = TLSv1.2 [ncatSender] client = yes accept = 127.0.0.1:4488 connect = <x.x.x.x>:8443 verifyPeer = yes CAfile = stunnel_client.pem checkIP = <x.x.x.x> OCSPaia = yes

2 2

stunnel 5.65 released
by Michał Trojnara 22 Jul '22

22 Jul '22

Dear Users, I have released version 5.65 of stunnel. On Windows, this release fixes a high severity OpenSSL vulnerability: https://www.openssl.org/news/secadv/20220705.txt ### Version 5.65, 2022.07.17, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.5. * Bugfixes - Fixed handling globally enabled FIPS. - Fixed openssl.cnf processing in WIN32 GUI. - Fixed a number of compiler warnings. - Fixed tests on older versions of OpenSSL. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 60c500063bd1feff2877f5726e38278c086f96c178f03f09d264a2012d6bf7fc stunnel-5.65.tar.gz ca88e65888102f7526cab4edad7b30e8d1e82d428c34d5b5f00513dff9ed2288 stunnel-5.65-win64-installer.exe 9dadaa8622e1c1955728cbd8d49e1a6b5eae77bfa5340f7a1f82451121aee740 stunnel-5.65-android.zip Best regards, Mike

2 2

Using stunnel with Outlook for Mac 2011
by glow＠mrbike.com 14 Jul '22

14 Jul '22

I wonder if I can use stunnel to keep using Outlook for Mac 2011. I have Outlook running on a Macbook with Mac OS 10.9.5 (the latest version possible). I can use Outlook in this way because my ISP currently supports TLS 1.0--but that support will soon end, when my ISP migrates its mail servers to TLS 1.2. At that point, my Macbook no longer use Outlook or any similar e-mail client. Is it possible for me to use stunnel so that my Macbook's old Outlook client will work with TLS 1.2?

1 0

stunnel with Winxp
by russell.jim＠rogers.com 13 Jul '22

13 Jul '22

i've used stunnel (v5.35) for many years, always working great. my 3rd party app running on WinXP computer was always able to send emails to gmail account. last month my app on this machine failed to send emails. changing to another (non-gmail) email account did not help. i am assuming issue is something to do with tls 1.0/1.1 on Winxp machine? do i need to do something to get this WinXP app to be able to send emails (outgoing only) again? thanks so much for any advice. /jim

1 0

Memory usage in stunnel-5.63
by roie rachamim 28 Jun '22

28 Jun '22

Hi, I'm running stunnel 5.63 compiled in debian-bullseye inside docker, and i'm trying to understand the allocated memory behavior In a test i'm conducting i'm creating a load towards the stunnel server And the process CPU + memory consumption rises. Once i stop the traffic the CPU goes down but the memory doesn't. Is this expected ? Many Thanks, Roie

2 1

Stunnel's Windows client stopped working in Iran
by landateta＠yahoo.com 26 Jun '22

26 Jun '22

I have a Stunnel server that users connect to from Iran, to circumvent internet censorship. It was working for years but in recent days Stunnel's Windows client has stopped working (maybe due to censorship), but the Android clients like (SSLSocks and SSL Encryptor) do work. So do you have any idea what would be the difference between Windows and Android clients which can help me fix the problem? Any help appreciated.

1 0

Stunnel5.64 Failed to initialize TLS on Windows 7
by White Louis 23 Jun '22

23 Jun '22

Hi All I upgraded Stunnel 5.64, but it got an error about "Failed to initialize TLS." But It works on Windows10/Windows server 2012 with the Stunnel 5.64 and the same configuration Note: The same configuration works with Stunnel5.63 and earlier version on Windows 7. Below is my configuration sslVersion = TLSv1.2 ciphers=HIGH options = NO_SSLv3 [HOST] client = yes accept = 127.0.0.1:59379 connect = remoteIP:Port verify = 3 CAfile = xxx.crt Logs are below: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.64 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.3 3 May 2022 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.1 [.] Reading configuration from file C:\Users\vm\AppData\Local\Temp\0660770671653983902255\stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression enabled: 0 methods [!] PRNG seeded with 0 bytes total [!] PRNG was not seeded with enough random bytes [!] Global options: Failed to initialize TLS [!] Configuration failed [ ] Deallocating temporary section defaults Server is down

1 0

Connection to Outlook O365 owa
by raduci＠gmail.com 09 Jun '22

09 Jun '22

Dear all, I am trying to connect via stunnel to O365 OWA. Configuration file is below: ; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2022 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later securityLevel = 0 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store [O365] client = yes accept = 192.168.0.225:443 connect = outlook.office.com:443 engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini In the browser (Firefox) I get the below error: Secure Connection Failed An error occurred during a connection to 192.168.0.225. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website owners to inform them of this problem. Chrome says: 192.168.0.225 sent an invalid response. Try running Windows Network Diagnostics. ERR_SSL_PROTOCOL_ERROR Logs are below: Found 1 ready file descriptor(s) 2022.06.09 15:46:32 LOG7[main]: FD=604 ifds=r-x ofds=r-- 2022.06.09 15:46:32 LOG7[main]: FD=908 ifds=r-x ofds=--- 2022.06.09 15:46:32 LOG7[main]: Dispatching a signal from the signal pipe 2022.06.09 15:46:32 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2022.06.09 15:46:33 LOG6[main]: Initializing inetd mode configuration 2022.06.09 15:46:33 LOG7[main]: Running on Windows 6.2 2022.06.09 15:46:33 LOG5[main]: Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf 2022.06.09 15:46:33 LOG5[main]: UTF-8 byte order mark detected 2022.06.09 15:46:33 LOG7[main]: Enabling support for engine "capi" 2022.06.09 15:46:33 LOG6[main]: UI not supported by engine #1 (capi) 2022.06.09 15:46:33 LOG7[main]: Initializing engine #1 (capi) 2022.06.09 15:46:33 LOG6[main]: Engine #1 (capi) initialized 2022.06.09 15:46:33 LOG5[main]: FIPS mode disabled 2022.06.09 15:46:33 LOG6[main]: Compression enabled: 0 methods 2022.06.09 15:46:33 LOG7[main]: No PRNG seeding was required 2022.06.09 15:46:33 LOG6[main]: Initializing service [O365] 2022.06.09 15:46:33 LOG6[main]: User-specified security level set: 0 2022.06.09 15:46:33 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2022.06.09 15:46:33 LOG7[main]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2022.06.09 15:46:33 LOG7[main]: TLS options: 0x2100000 (+0x0, -0x0) 2022.06.09 15:46:33 LOG6[main]: Session resumption enabled 2022.06.09 15:46:33 LOG6[main]: Client certificate engine (capi) enabled 2022.06.09 15:46:33 LOG7[main]: No certificate or private key specified 2022.06.09 15:46:33 LOG4[main]: Service [O365] needs authentication to prevent MITM attacks 2022.06.09 15:46:33 LOG6[main]: DH initialization skipped: client section 2022.06.09 15:46:33 LOG7[main]: ECDH initialization 2022.06.09 15:46:33 LOG7[main]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2022.06.09 15:46:33 LOG5[main]: Configuration successful 2022.06.09 15:46:33 LOG7[main]: Unbinding service [O365] 2022.06.09 15:46:33 LOG7[main]: Service [O365] closed (FD=908) 2022.06.09 15:46:33 LOG7[main]: Service [O365] closed 2022.06.09 15:46:33 LOG7[main]: Deallocating deployed section defaults 2022.06.09 15:46:33 LOG7[main]: Deallocating section [O365] 2022.06.09 15:46:33 LOG5[main]: Logging to C:\Users\radc\AppData\Local\stunnel.log 2022.06.09 15:46:33 LOG7[main]: Binding service [O365] 2022.06.09 15:46:33 LOG7[main]: Listening file descriptor created (FD=1580) 2022.06.09 15:46:33 LOG7[main]: Setting accept socket options (FD=1580) 2022.06.09 15:46:33 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2022.06.09 15:46:33 LOG6[main]: Service [O365] (FD=1580) bound to 192.168.0.225:443 2022.06.09 15:47:19 LOG7[17]: Service [O365] started 2022.06.09 15:47:19 LOG7[17]: Setting local socket options (FD=1624) 2022.06.09 15:47:19 LOG7[main]: FD=604 ifds=r-x ofds=--- 2022.06.09 15:47:19 LOG7[17]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:19 LOG5[17]: Service [O365] accepted connection from 192.168.0.200:55381 2022.06.09 15:47:19 LOG7[main]: FD=1580 ifds=r-x ofds=r-- 2022.06.09 15:47:19 LOG6[17]: failover: priority, starting at entry #0 2022.06.09 15:47:19 LOG7[main]: Service [O365] accepted (FD=1608) from 192.168.0.200:55382 2022.06.09 15:47:19 LOG6[17]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:19 LOG7[main]: Creating a new thread 2022.06.09 15:47:19 LOG7[main]: New thread created 2022.06.09 15:47:19 LOG7[18]: Service [O365] started 2022.06.09 15:47:19 LOG7[18]: Setting local socket options (FD=1608) 2022.06.09 15:47:19 LOG7[18]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:19 LOG5[18]: Service [O365] accepted connection from 192.168.0.200:55382 2022.06.09 15:47:19 LOG6[18]: failover: priority, starting at entry #0 2022.06.09 15:47:19 LOG6[18]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:19 LOG7[17]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:19 LOG7[17]: FD=1596 ifds=rwx ofds=--- 2022.06.09 15:47:19 LOG7[18]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:19 LOG7[18]: FD=1204 ifds=rwx ofds=--- 2022.06.09 15:47:19 LOG5[17]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:19 LOG5[17]: Service [O365] connected remote server from 10.57.2.17:57847 2022.06.09 15:47:19 LOG7[17]: Setting remote socket options (FD=1596) 2022.06.09 15:47:19 LOG7[17]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:19 LOG7[17]: Remote descriptor (FD=1596) initialized 2022.06.09 15:47:19 LOG6[17]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:19 LOG6[17]: Peer certificate not required 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): before SSL initialization 2022.06.09 15:47:19 LOG7[17]: Initializing application specific data for session authenticated 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG5[18]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:19 LOG5[18]: Service [O365] connected remote server from 10.57.2.17:57848 2022.06.09 15:47:19 LOG7[18]: Setting remote socket options (FD=1204) 2022.06.09 15:47:19 LOG7[18]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:19 LOG7[18]: Remote descriptor (FD=1204) initialized 2022.06.09 15:47:19 LOG6[18]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:19 LOG6[18]: Peer certificate not required 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): before SSL initialization 2022.06.09 15:47:19 LOG7[18]: Initializing application specific data for session authenticated 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:19 LOG6[17]: Certificate verification disabled 2022.06.09 15:47:19 LOG6[17]: Certificate verification disabled 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:19 LOG7[17]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:19 LOG7[17]: 2 client connect(s) requested 2022.06.09 15:47:19 LOG7[17]: 1 client connect(s) succeeded 2022.06.09 15:47:19 LOG7[17]: 0 client renegotiation(s) requested 2022.06.09 15:47:19 LOG7[17]: 0 session reuse(s) 2022.06.09 15:47:19 LOG6[17]: TLS connected: new session negotiated 2022.06.09 15:47:19 LOG6[17]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:19 LOG6[17]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:19 LOG7[17]: Compression: null, expansion: null 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:19 LOG6[18]: Certificate verification disabled 2022.06.09 15:47:19 LOG6[18]: Certificate verification disabled 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:19 LOG7[18]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:19 LOG7[18]: 2 client connect(s) requested 2022.06.09 15:47:19 LOG7[18]: 2 client connect(s) succeeded 2022.06.09 15:47:19 LOG7[18]: 0 client renegotiation(s) requested 2022.06.09 15:47:19 LOG7[18]: 0 session reuse(s) 2022.06.09 15:47:19 LOG6[18]: TLS connected: new session negotiated 2022.06.09 15:47:19 LOG6[18]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:19 LOG6[18]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:19 LOG7[18]: Compression: null, expansion: null 2022.06.09 15:47:20 LOG7[17]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[17]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[17]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[17]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[17]: New session callback 2022.06.09 15:47:20 LOG7[17]: Peer certificate was cached (4822 bytes) 2022.06.09 15:47:20 LOG6[17]: Session id: 8C30BA078B16527A627B472B16BD94469EF8EF2C2B3DC4DE83C9E9DD0454AE89 2022.06.09 15:47:20 LOG7[17]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[17]: Remove session callback 2022.06.09 15:47:20 LOG7[17]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[17]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[17]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[17]: Remote descriptor (FD=1596) closed 2022.06.09 15:47:20 LOG7[17]: Local descriptor (FD=1624) closed 2022.06.09 15:47:20 LOG7[17]: Service [O365] finished (1 left) 2022.06.09 15:47:20 LOG7[main]: Found 1 ready file descriptor(s) 2022.06.09 15:47:20 LOG7[main]: FD=604 ifds=r-x ofds=--- 2022.06.09 15:47:20 LOG7[main]: FD=1580 ifds=r-x ofds=r-- 2022.06.09 15:47:20 LOG7[main]: Service [O365] accepted (FD=1132) from 192.168.0.200:55383 2022.06.09 15:47:20 LOG7[main]: Creating a new thread 2022.06.09 15:47:20 LOG7[main]: New thread created 2022.06.09 15:47:20 LOG7[19]: Service [O365] started 2022.06.09 15:47:20 LOG7[19]: Setting local socket options (FD=1132) 2022.06.09 15:47:20 LOG7[19]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:20 LOG5[19]: Service [O365] accepted connection from 192.168.0.200:55383 2022.06.09 15:47:20 LOG6[19]: failover: priority, starting at entry #0 2022.06.09 15:47:20 LOG6[19]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:20 LOG7[19]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:20 LOG7[19]: FD=848 ifds=rwx ofds=--- 2022.06.09 15:47:20 LOG7[18]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[18]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[18]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[18]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[18]: New session callback 2022.06.09 15:47:20 LOG7[18]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG6[18]: Session id: 052BDBEAEF57DAF30820ADD1223A0C800EC7C7FBEFC8D6ECAAA50A67383A26F8 2022.06.09 15:47:20 LOG7[18]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[18]: Remove session callback 2022.06.09 15:47:20 LOG7[18]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[18]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[18]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[18]: Remote descriptor (FD=1204) closed 2022.06.09 15:47:20 LOG7[18]: Local descriptor (FD=1608) closed 2022.06.09 15:47:20 LOG7[18]: Service [O365] finished (1 left) 2022.06.09 15:47:20 LOG7[main]: Found 1 ready file descriptor(s) 2022.06.09 15:47:20 LOG7[main]: FD=604 ifds=r-x ofds=--- 2022.06.09 15:47:20 LOG7[main]: FD=1580 ifds=r-x ofds=r-- 2022.06.09 15:47:20 LOG7[main]: Service [O365] accepted (FD=844) from 192.168.0.200:55384 2022.06.09 15:47:20 LOG7[main]: Creating a new thread 2022.06.09 15:47:20 LOG7[main]: New thread created 2022.06.09 15:47:20 LOG7[20]: Service [O365] started 2022.06.09 15:47:20 LOG7[20]: Setting local socket options (FD=844) 2022.06.09 15:47:20 LOG7[20]: Option TCP_NODELAY set on local socket 2022.06.09 15:47:20 LOG5[20]: Service [O365] accepted connection from 192.168.0.200:55384 2022.06.09 15:47:20 LOG6[20]: failover: priority, starting at entry #0 2022.06.09 15:47:20 LOG6[20]: s_connect: connecting 52.98.152.162:443 2022.06.09 15:47:20 LOG7[20]: s_connect: s_poll_wait 52.98.152.162:443: waiting 10 seconds 2022.06.09 15:47:20 LOG7[20]: FD=1120 ifds=rwx ofds=--- 2022.06.09 15:47:20 LOG5[19]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:20 LOG5[19]: Service [O365] connected remote server from 10.57.2.17:57849 2022.06.09 15:47:20 LOG7[19]: Setting remote socket options (FD=848) 2022.06.09 15:47:20 LOG7[19]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:20 LOG7[19]: Remote descriptor (FD=848) initialized 2022.06.09 15:47:20 LOG6[19]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:20 LOG6[19]: Peer certificate not required 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): before SSL initialization 2022.06.09 15:47:20 LOG7[19]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG5[20]: s_connect: connected 52.98.152.162:443 2022.06.09 15:47:20 LOG5[20]: Service [O365] connected remote server from 10.57.2.17:57850 2022.06.09 15:47:20 LOG7[20]: Setting remote socket options (FD=1120) 2022.06.09 15:47:20 LOG7[20]: Option TCP_NODELAY set on remote socket 2022.06.09 15:47:20 LOG7[20]: Remote descriptor (FD=1120) initialized 2022.06.09 15:47:20 LOG6[20]: SNI: sending servername: outlook.office.com 2022.06.09 15:47:20 LOG6[20]: Peer certificate not required 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): before SSL initialization 2022.06.09 15:47:20 LOG7[20]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write change cipher spec 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write client hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:20 LOG6[19]: Certificate verification disabled 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server hello 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): TLSv1.3 read encrypted extensions 2022.06.09 15:47:20 LOG6[19]: Certificate verification disabled 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:20 LOG7[19]: 4 client connect(s) requested 2022.06.09 15:47:20 LOG7[19]: 3 client connect(s) succeeded 2022.06.09 15:47:20 LOG7[19]: 0 client renegotiation(s) requested 2022.06.09 15:47:20 LOG7[19]: 0 session reuse(s) 2022.06.09 15:47:20 LOG6[19]: TLS connected: new session negotiated 2022.06.09 15:47:20 LOG6[19]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:20 LOG6[19]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:20 LOG7[19]: Compression: null, expansion: null 2022.06.09 15:47:20 LOG6[20]: Certificate verification disabled 2022.06.09 15:47:20 LOG6[20]: Certificate verification disabled 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server certificate 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): TLSv1.3 read server certificate verify 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read finished 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS write finished 2022.06.09 15:47:20 LOG7[20]: 4 client connect(s) requested 2022.06.09 15:47:20 LOG7[20]: 4 client connect(s) succeeded 2022.06.09 15:47:20 LOG7[20]: 0 client renegotiation(s) requested 2022.06.09 15:47:20 LOG7[20]: 0 session reuse(s) 2022.06.09 15:47:20 LOG6[20]: TLS connected: new session negotiated 2022.06.09 15:47:20 LOG6[20]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2022.06.09 15:47:20 LOG6[20]: Peer temporary key: ECDH, P-384, 384 bits 2022.06.09 15:47:20 LOG7[20]: Compression: null, expansion: null 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[19]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[19]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[19]: New session callback 2022.06.09 15:47:20 LOG7[19]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG6[19]: Session id: 3E857D78696F2321EDEE2F622CDB1A050B70B915FB7A6DD37C5DE86EC311534F 2022.06.09 15:47:20 LOG7[19]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[19]: Remove session callback 2022.06.09 15:47:20 LOG7[19]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[19]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[19]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[19]: Remote descriptor (FD=848) closed 2022.06.09 15:47:20 LOG7[19]: Local descriptor (FD=1132) closed 2022.06.09 15:47:20 LOG7[19]: Service [O365] finished (1 left) 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSL negotiation finished successfully 2022.06.09 15:47:20 LOG7[20]: Initializing application specific data for session authenticated 2022.06.09 15:47:20 LOG7[20]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG7[20]: New session callback 2022.06.09 15:47:20 LOG7[20]: Deallocating application specific data for session connect address 2022.06.09 15:47:20 LOG6[20]: Session id: E65F2E71C3EF8E156FA8FAEB5AD445887573D80ED9889F65524514A6ABC02D99 2022.06.09 15:47:20 LOG7[20]: TLS state (connect): SSLv3/TLS read server session ticket 2022.06.09 15:47:20 LOG7[20]: Remove session callback 2022.06.09 15:47:20 LOG7[20]: TLS alert (write): fatal: decode error 2022.06.09 15:47:20 LOG3[20]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.06.09 15:47:20 LOG5[20]: Connection reset: 517 byte(s) sent to TLS, 505 byte(s) sent to socket 2022.06.09 15:47:20 LOG7[20]: Remote descriptor (FD=1120) closed 2022.06.09 15:47:20 LOG7[20]: Local descriptor (FD=844) closed 2022.06.09 15:47:20 LOG7[20]: Service [O365] finished (0 left) Do you have any ideas?

2 1

stunnel started to core dump
by itdo＠cndag.onmicrosoft.com 08 Jun '22

08 Jun '22

Hello all About half a year ago, we started using stunnel on Solaris to secure NFS. The latest available pkg was 5.59 at that time. After a couple of months, stunnel started to core dump on several systems. We updated to the then latest version 5.63. It took again some time until core dumps occurred with 5.63 (still same stack traces). I am aware, that in the meantime 5.64 is out. We are in the process of updating it but it will take some time. Could you please have a look at the below mdb output and tell me if you need any further information to find the root cause? # mdb core.stunnel.339.60001 Loading modules: [ libc.so.1 ld.so.1 ] > ::status debugging core file of stunnel (32-bit) from xxxxxxx file: /opt/csw/bin/stunnel initial argv: /opt/csw/bin/stunnel /etc/opt/csw/stunnel/stunnel.conf start threading model: multi-threaded status: process terminated by SIGSEGV (Segmentation Fault) > $c libssl.so.1.0.0`freelist_extract+0x57(0, 2000000, 14, 42e4db16, 9bd6f8a0, eaf57a5d) > $q In the other dumps, libssl was involved as well. This is the stunnel config: setuid = nobody setgid = nogroup debug = info output = /var/adm/stunnel syslog = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 sslVersion=TLSv1.2 renegotiation=no options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = aes192-ctr:aes256-ctr socket = a:TCP_NODELAY=1 socket = a:SO_KEEPALIVE=1 TIMEOUTidle = 300 pid = /tmp/stunnel.pid ;include = /etc/opt/csw/stunnel/conf.d [tls-nfs-srv] accept = 31039 connect = localhost:2049 ciphers = PSK PSKsecrets = /etc/opt/csw/stunnel/psk-s.keys libwrap = yes [tls-nfs-client-1] client = yes accept = localhost:31701 connect = yyyyyy:31039 ciphers = PSK PSKsecrets = /etc/opt/csw/stunnel/psk-c.key libwrap = yes ; vim:ft=dosini Kind regards Sasha This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

1 0

stunnel log
by Phillip Parker 29 May '22

29 May '22

I just installed the latest version of stunnel (5.64) but there is no log file. Log file is enabled in .conf but when I run a program I don't get any log output. Help

1 0

recent Problem sending email via Blat
by Phillip Parker 25 May '22

25 May '22

I have been using stunnel and Blat for several years to send emails. Recently all the emails stopped. Interestingly I also use PowerShell to send emails and they all stopped as well. That would seem to point to something external but I have no clue what that might be. I have searched the web and have found several posts talking about (Error: Not a Socket) from Blat log but I have been unable to find a solution. In any event for stunnel I have added below the config file and the log file with debug = 7 enabled and a screen shot of netstat -an. I also believe I am running the latest version of Stunnel and Blat. Just for additional info I have attached my powershell program and the resultant error. Any help on this issue would be greatly appreciated. Incidentally I am not a stunnel or Blat person I just want things to work like they were. ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration sslversion = all ;[Protocol] protocol = smtp [ssmtp] accept = 127.0.0.1:25 connect = smtp.live.com:587 =============================================== 2022.05.21 15:03:04 LOG5[5916:5920]: Reading configuration from file stunnel.conf 2022.05.21 15:03:04 LOG7[5916:5920]: PRNG seeded successfully 2022.05.21 15:03:05 LOG7[5916:5920]: SSL context initialized for service ssmtp 2022.05.21 15:03:05 LOG5[5916:5920]: Configuration successful 2022.05.21 15:03:05 LOG5[5916:5920]: No limit detected for the number of clients 2022.05.21 15:03:05 LOG7[5916:5920]: accept socket: FD=700 allocated (non-blocking mode) 2022.05.21 15:03:05 LOG7[5916:5920]: Option SO_REUSEADDR set on accept socket 2022.05.21 15:03:05 LOG7[5916:5920]: Service ssmtp bound to 127.0.0.1:25 2022.05.21 15:03:05 LOG7[5916:5920]: Service ssmtp opened FD=700 2022.05.21 15:03:05 LOG5[5916:5920]: stunnel 4.36 on x86-pc-mingw32-gnu with OpenSSL 1.0.0d 8 Feb 2 2022.05.21 15:03:05 LOG5[5916:5920]: Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT, IPv6 2022.05.21 15:39:56 LOG7[5916:7748]: local socket: FD=692 allocated (non-blocking mode) 2022.05.21 15:39:56 LOG7[5916:7748]: Service ssmtp accepted FD=692 from 127.0.0.1:62680 2022.05.21 15:39:56 LOG7[5916:7748]: Creating a new thread 2022.05.21 15:39:56 LOG7[5916:7748]: New thread created 2022.05.21 15:39:56 LOG7[5916:11272]: Service ssmtp started 2022.05.21 15:39:56 LOG7[5916:11272]: Option TCP_NODELAY set on local socket 2022.05.21 15:39:56 LOG5[5916:11272]: Service ssmtp accepted connection from 127.0.0.1:62680 2022.05.21 15:39:56 LOG7[5916:11272]: remote socket: FD=740 allocated (non-blocking mode) 2022.05.21 15:39:56 LOG6[5916:11272]: connect_blocking: connecting 204.79.197.212:587 2022.05.21 15:39:56 LOG7[5916:11272]: connect_blocking: s_poll_wait 204.79.197.212:587: waiting 10 seconds 2022.05.21 15:40:06 LOG3[5916:11272]: connect_blocking: s_poll_wait 204.79.197.212:587: TIMEOUTconnect exceeded 2022.05.21 15:40:06 LOG5[5916:11272]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Partial screen shot of netstat -an TCP 127.0.0.1:25 0.0.0.0:0 LISTENING TCP 127.0.0.1:4444 0.0.0.0:0 LISTENING TCP 127.0.0.1:5354 0.0.0.0:0 LISTENING TCP 127.0.0.1:5354 127.0.0.1:53941 ESTABLISHED TCP 127.0.0.1:5354 127.0.0.1:58943 ESTABLISHED TCP 127.0.0.1:8884 0.0.0.0:0 LISTENING TCP 127.0.0.1:9012 0.0.0.0:0 LISTENING TCP 127.0.0.1:27015 0.0.0.0:0 LISTENING TCP 127.0.0.1:33555 0.0.0.0:0 LISTENING TCP 127.0.0.1:42424 0.0.0.0:0 LISTENING TCP 127.0.0.1:53941 127.0.0.1:5354 ESTABLISHED TCP 127.0.0.1:58943 127.0.0.1:5354 ESTABLISHED TCP 127.0.0.1:60485 0.0.0.0:0 LISTENING TCP 127.0.0.1:60961 0.0.0.0:0 LISTENING TCP 127.0.0.1:62433 0.0.0.0:0 LISTENING 2022.05.21 15:40:06 LOG7[5916:11272]: Service ssmtp finished (0 left) 2022.05.21 15:40:06 LOG7[5916:11272]: str_stats: 0 blocks, 0 bytes Blat Log 2022.05.21 15:39:56 (Sat)------------Start of Session----------------- Blat v3.2.19 (build : Nov 18 2017 03:14:35) 32-bit Windows, Full, Unicode Error: Connection to server was dropped. *** Error *** SMTP server error Error: Not a socket. Error: Not a socket. 2022.05.21 15:40:06 (Sat)-------------End of Session------------------

2 1

Unexpected EOF while Reading
by Joe Sterk 24 May '22

24 May '22

Stunnel User, When we upgrade from 5.60 to 5.63 or 5.64 we start to get the unexpected eof while reading on the SSL_accept log. I re-loaded 5.60 and the error went away. Does anyone have any ideas on what to review to solve this issue? [cid:image001.png@01D86ECE.E6D97940] Joe Sterk CIO (Chief Information Officer) [Description: Description: cid:image004.jpg@01CD22BD.40F8C160] Insurance Services Corp. ? (972) 896-0384 (Mobile) * (707) 303-8105 (Work) * joes(a)QuieTrack.com<mailto:joes@QuieTrack.com>

1 0

Stunnel - TLS error unexpected eof while reading
by rick.gregson＠gmail.com 19 May '22

19 May '22

Hi All, I have recently configured stunnel on a Windows Server, it has been configured using a certificate from our internal CA and appears to be functioning ok. However we have a load balancer that is doing a health check against the service and is polling S-Tunnel availability every 5 seconds each time a poll occurs I am seeing the error posted below in the logs. 2022.05.12 10:22:55 LOG3[4113]: SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading 2022.05.12 10:22:55 LOG5[4113]: Connection reset: 217 byte(s) sent to TLS, 49 byte(s) sent to socket Can I please have some advice on how to stop this error? Thank you Rick

2 3

Getting error "CERT: Pre-verification error: self signed certificate"
by Christopher Schultz 14 May '22

14 May '22

All, I'm running stunnel 4.56 as a server on Linux, as I have been doing for a while. I require clients to connect using their own client certs and yesterday one of them expired. The client generated a new certificate and sent it to me to install, and I'm getting the error in the subject. Version details: $ sudo stunnel -help stunnel 4.56 on x86_64-koji-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP I have set verify=4 because I expect to place the exact certificate for every client into my CAFile. This has been working for years, and when I connect using openssl s_client, I can see which client certificates the server advertises it will allow to connect, and they reflect what I expect. The server certificate is also self-signed, so I copied that into the CAFile and I'm able to connect with openssl s_client using that certificate. So I think the problem can't be that the client's certificate is self-signed. So, to recap: 1. stunnel in server mode 2. CAFile points to a collection of PEM certs 3. verify=4 4. I can connect with my own valid, trusted, self-signed certificate 5. Client cannot connect with their valid, trusted, self-signed cert Any ideas? (Note: the client DOES appear to be using their new certificate, though I can only see the subject text which could be the same, yet with a different actual certificate.) Here is the debug(7) output from an attempted connection: : Starting certificate verification: depth=0, [subject] : CERT: Pre-verification error: self signed certificate : Certificate check failed: depth=0, [subject] : SSL alert (write): fatal: unknown CA : SSL_accept: 14089086: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed : Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Thanks, -chris

1 1

Is stunnel really compliant with RFC 2487 / RFC 3207 ?
by Javier 13 May '22

13 May '22

Hi, first of all, I still use a 32-bit release (the latest, I think), so maybe things have changed on Stunnel since. But the statement that the protocol smtp option for a service is compliant with RFC 2487, should be 3207 (it is from 2002!), has been in the docs for ages, even in the latest version, 5.64: *** smtp Based on RFC 2487 - SMTP Service Extension for Secure SMTP over TLS *** Long ago I tested the protocol=smtp options as both, clients and server service, and I noticed that, and I think I told here to the list confirming it (maybe for some user using it on client mode), the option implied STARTTLS. Back then I didn't pay much attention to it. BUT the other day I was re-testing for a server service (own mail server sometimes I run) and... I said to my self that this shouldn't be like it was and well, I read the RFC and what tells is the following: *** A publicly-referenced SMTP server MUST NOT require use of the STARTTLS extension in order to deliver mail locally. This rule prevents the STARTTLS extension from damaging the interoperability of the Internet's SMTP infrastructure. A publicly-referenced SMTP server is an SMTP server which runs on port 25 of an Internet host listed in the MX record (or A record if an MX record is not present) for the domain name on the right hand side of an Internet mail address. *** https://datatracker.ietf.org/doc/html/rfc3207#section-4 So, if we use Stunnel to provide THE OPTION of secure TLS connections to other MTAs (MTA to MTA, or server to server) we are against the RFC itself as every connection to port 25 must be encrypted, or nothing, because, as Stunnel is the door to the port and only accepts the STARTTLS command, without redirecting any data to the mail server, no traffic on plain text reaches the server. Acting as a MSA (users - servers) there is no problem because, even if it hadn't/hasn't been widely supported, there are two ports 587 for plain text and 465 for TLS. So Stunnel could be set up to listen on 465 port only, directly accepting TLS sessions or after STARTTLS command (rejecting, in this case, those that don't want a secure channel). We have told several times, specially to newcomers (asking for http proxy, basically), that Stunnel isn't proxy, and it isn't, but in the case of a mail server it should act as is if we use it for a MTA mail server. It acts as is sending the welcome message from the mail server to the other MTA, but once the other MTA doesn't send a STARTTLS command, it closes the connection when, actually, what should do is pass all the dialog between MTAs. I think that is what Stunnel should do. And when just passing messages from mail server to the other MTA, just disable the logging for that connection. After all, the mail severs have already their own logs and there is no reason to log it on Stunnel, nor on the log screen/Stunnel window. Maybe just a line like "redirecting connection to the mail server". Said all the above, do latest versions behave differently? Do you think is a change that should be made to Stunnel to comply with the RFC, if on latest versions don't do yet, or am I wrong somewhere in my statement? Regards. P.S.: MTA: Mail Transfer Agent MSA: Mail Submission Agent MUA: Mail User Agent

3 5

GMail and OAuth 2.0
by Colin Knight 12 May '22

12 May '22

I’ve received an email from Google advising that it will no longer be able to login to Gmail with older third party apps using just username/password. Minimum login security requirements for software are now OAuth 2.0 or similar. I’m using an iPhone to post this which won’t be affected but my laptop uses POP3 collection via Foxmail and Stunnel. I must have continued access to mail on my laptop so will I have to dump Gmail or does Stunnel use OAuth 2.0 (it’s not in my config file.) Advice appreciated.

2 1

stunnel 5.64 released
by Michał Trojnara 06 May '22

06 May '22

Dear Users, I have released version 5.64 of stunnel. This release only includes Windows fixes and improvements. ### Version 5.64, 2022.05.06, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.0.3. * New features - Updated the pkcs11 engine for Windows. * Bugfixes - Removed the SERVICE_INTERACTIVE_PROCESS flag in "stunnel -install". Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: eebe53ed116ba43b2e786762b0c2b91511e7b74857ad4765824e7199e6faf883 stunnel-5.64.tar.gz 600e76b52a86b21f97a1af13734fdd2226c26646bb77f5f9f074ba3d5755f024 stunnel-5.64-win64-installer.exe 391db6166b22a6648fd1f1df584c13ade61c93f620e46b12ebb30b643e61d2d3 stunnel-5.64-android.zip Best regards, Mike

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users