- stunnel-users - stunnel.org

verify =3 error with certificate client
by Humberto Morell 25 Feb '05

25 Feb '05

Hello List I have stunnel 4.7 In the messages of the list I have not seen solution to my problem. This is VERIFY ERROR ONLY MY: no cert stunnel.log in Server ################## 2005.02.25 07:55:07 LOG5[2501:1076546480]: VERIFY OK: depth=1, /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Segurmatica/OU=Agencia de Certificacion/CN=Segurmatica/emailAddress=ca(a)segurmatica.cu 2005.02.25 07:55:07 LOG4[2501:1076546480]: VERIFY ERROR ONLY MY: no cert for /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Ministerio Informatica y Comunicaciones/OU=Segurmatica/CN=Humberto Morell/emailAddress=morell(a)seg.inf.cu 2005.02.25 07:55:07 LOG7[2501:1076546480]: SSL alert (write): fatal: certificate unknown ############# stunnel.conf in Server ############## #chroot = /var/lib/stunnel/ verify = 3 CApath = /etc/stunnel/certdb # or simply use CAfile instead: #CAfile = /etc/stunnel/certs.pem CAfile = /etc/stunnel/acsegurmatica.crt #cert = /etc/stunnel/stunnel.pem cert = /etc/stunnel/certstunnel.pem ################# File in /etc/stunnel ############### certdb morell.pem stunnel.prueba.pem certstunnel.pem stunnel.conf acsegurmatica.crt morell.crt stunnel.log certclient morell.key stunnel.pem ############### Link in /etc/stunnel/certdb ############### drwxr-xr-x 2 root root 176 Feb 25 11:06 . drwx------ 4 root root 472 Feb 25 10:52 .. lrwxrwxrwx 1 root root 24 Feb 25 11:00 2307a3fe.0 -> /etc/stunnel/stunnel.pem lrwxrwxrwx 1 root root 30 Feb 25 11:01 3f5b7ca8.0 -> /etc/stunnel/acsegurmatica.crt lrwxrwxrwx 1 root root 23 Feb 25 11:03 3fb3183e.0 -> /etc/stunnel/morell.pem lrwxrwxrwx 1 root root 28 Feb 25 11:06 d14abd18.0 -> /etc/stunnel/certstunnel.pem ################# client in Windows stunnel.conf ############## client = yes cert = d:\morell.pem debug = 7 output = d:\stunnel.log [lsd] accept = 9595 connect = 10.10.1.83:9500 [ssh] accept = 2222 connect = 10.10.1.83:9522 ##################### Note: I don't use chroot I have try, but idem error with. File morell.pem only client certificate and other time file morell.pem Key private crl Certificate With verify = 2 all is ok Please help Best regards Morell

1 0

openssl - generating stunnel.pem - stunnel.cnf
by k-i-r＠web.de 24 Feb '05

24 Feb '05

Using Stunnel under Windows I want to create a certificate (stunnel.pem) with Openssl. According to FAQ the syntax for creating a certificate with Openssl is openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem I use openssl for windows (as part of apache-windows-http-server) . Where do I get the file stunnel.cnf ? Or is this file not necessary for creating a certificate ? Thanks for help, k.

3 2

Stunnel and configuration
by Bohdan Linda 22 Feb '05

22 Feb '05

Hi all, I have configured stunnel to do the client authetication, but I have some question. I have used following config: cert = /etc/certificates/server.pem - file with signed server cert and key (passwordless) chroot = /var/run/stunnel/ CAfile = /etc/certificates/certs -file where first item is my CA certificate followed by list of all client certificates sgined by my CA. setuid = nobody setgid = nogroup pid = /stunnel.pid verify = 3 This setup is working, but this seems to me very "unlogical". If I create for me "more logic" setup: cert = /etc/certificates/server.pem chroot = /var/run/stunnel/ CAfile = /etc/certificates/CA/cacert.pem - only certificate of my CA CRLfile = /etc/certificates/crls - only certificates signed by my CA I get the following error: 2005.02.22 15:15:10 LOG5[22418:81926]: VERIFY OK: depth=1, /C= ..... 2005.02.22 15:15:10 LOG4[22418:81926]: VERIFY ERROR ONLY MY: no cert for /C= The question is ... why? Why CAfile has to contain all client certificates, when clients certs are not CA? Why I cannot have separate file for CA and separate file for certificates that I want accept? If I do the similar setup in mod_ssl, the configuration works as expected. Anyway, I'am newbie to deploy stunnel, thus I would like to ask you for giving me you opinion of this configuration, caveats and possible enhancements. Thanks for any comments, Bohdan Linda

3 4

SSL_read (ERROR_SYSCALL)
by Passreality 16 Feb '05

16 Feb '05

Hi Im trying to connect using mysql, there are no fw between the 2 boxes. I tested with stunnel 3.x and 4.x but when i use the 4.0.23 mysldb it just wount work. When i use the older db it works. Any ideas on how to solve this error ? /Christian Stunnel 4.07 Kernel 2.4.18 gcc version 3.3.5 (Debian 1:3.3.5-8) mysql Ver 12.22 Distrib 4.0.23 Dist Debian Testing Im using stunnel.pem (default one) Client Log 2005.02.16 15:04:19 LOG7[2147:16384]: mysql accepted FD=10 from 217.212.4.33:40797 2005.02.16 15:04:19 LOG7[2147:16384]: FD 10 in non-blocking mode 2005.02.16 15:04:19 LOG7[2322:49154]: mysql started 2005.02.16 15:04:19 LOG7[2322:49154]: TCP_NODELAY option set on local socket 2005.02.16 15:04:19 LOG5[2322:49154]: mysql connected from 217.212.4.33:40797 2005.02.16 15:04:19 LOG7[2322:49154]: FD 13 in non-blocking mode 2005.02.16 15:04:19 LOG7[2322:49154]: mysql connecting 217.212.4.198:3307 2005.02.16 15:04:19 LOG7[2322:49154]: connect_wait: waiting 10 seconds 2005.02.16 15:04:19 LOG7[2322:49154]: connect_wait: connected 2005.02.16 15:04:19 LOG7[2322:49154]: Remote FD=13 initialized 2005.02.16 15:04:19 LOG7[2322:49154]: TCP_NODELAY option set on remote socket 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): before/connect initialization 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write client hello A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server hello A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server certificate A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server done A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write client key exchange A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write change cipher spec A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write finished A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 flush data 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read finished A 2005.02.16 15:04:19 LOG7[2322:49154]: 2 items in the session cache 2005.02.16 15:04:19 LOG7[2322:49154]: 3 client connects (SSL_connect()) 2005.02.16 15:04:19 LOG7[2322:49154]: 3 client connects that finished 2005.02.16 15:04:19 LOG7[2322:49154]: 0 client renegotiatations requested 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server connects (SSL_accept()) 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server connects that finished 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server renegotiatiations requested 2005.02.16 15:04:19 LOG7[2322:49154]: 1 session cache hits 2005.02.16 15:04:19 LOG7[2322:49154]: 0 session cache misses 2005.02.16 15:04:19 LOG7[2322:49154]: 0 session cache timeouts 2005.02.16 15:04:19 LOG6[2322:49154]: SSL connected: new session negotiated 2005.02.16 15:04:19 LOG6[2322:49154]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.02.16 15:04:19 LOG3[2322:49154]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2005.02.16 15:04:19 LOG5[2322:49154]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2005.02.16 15:04:19 LOG7[2322:49154]: mysql finished (0 left) Server Log 2005.02.16 15:04:51 LOG7[29786:16384]: mysql accepted FD=10 from 217.212.4.33:40798 2005.02.16 15:04:51 LOG7[29786:16384]: FD 10 in non-blocking mode 2005.02.16 15:04:51 LOG7[29814:49154]: mysql started 2005.02.16 15:04:51 LOG7[29814:49154]: TCP_NODELAY option set on local socket 2005.02.16 15:04:51 LOG5[29814:49154]: mysql connected from 217.212.4.33:40798 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): before/accept initialization 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read client hello A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write server hello A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write certificate A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write server done A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 flush data 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read client key exchange A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read finished A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write change cipher spec A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write finished A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 flush data 2005.02.16 15:04:51 LOG7[29814:49154]: 1 items in the session cache 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client connects (SSL_connect()) 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client connects that finished 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client renegotiatations requested 2005.02.16 15:04:51 LOG7[29814:49154]: 3 server connects (SSL_accept()) 2005.02.16 15:04:51 LOG7[29814:49154]: 3 server connects that finished 2005.02.16 15:04:51 LOG7[29814:49154]: 0 server renegotiatiations requested 2005.02.16 15:04:51 LOG7[29814:49154]: 1 session cache hits 2005.02.16 15:04:51 LOG7[29814:49154]: 0 session cache misses 2005.02.16 15:04:51 LOG7[29814:49154]: 1 session cache timeouts 2005.02.16 15:04:51 LOG6[29814:49154]: SSL accepted: new session negotiated 2005.02.16 15:04:51 LOG6[29814:49154]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.02.16 15:04:51 LOG7[29814:49154]: FD 13 in non-blocking mode 2005.02.16 15:04:51 LOG7[29814:49154]: mysql connecting 127.0.0.1:3306 2005.02.16 15:04:51 LOG7[29814:49154]: connect_wait: waiting 10 seconds 2005.02.16 15:04:51 LOG3[29814:49154]: connect_wait: getsockopt: Connection refused (111) 2005.02.16 15:04:51 LOG3[29814:49154]: Failed to initialize remote connection 2005.02.16 15:04:51 LOG7[29814:49154]: mysql finished (0 left) __________________________________ Do you Yahoo!? The all-new My Yahoo! - What will yours do? http://my.yahoo.com

1 0

Stunnel on Open-WRT..
by Andrew Frazer 16 Feb '05

16 Feb '05

I have got Stunnel running under Open-wrt, on a Linksys WRT54GS. However I don't seem to be able to get it to run the transparent mode.. (a) is it possible? (b) If the answer is no, would be possible to modifty either open-wrt or stunnel to make it work? Regards A.

1 0

Re: [stunnel-users] read sock return size 0 situation( it cause http web server to wait timeout for long time)
by Michal Trojnara 15 Feb '05

15 Feb '05

On 2005-01-18, at 02:43, Stanley wrote: > 1.In our case, the web server sent TCP fin,ack to stunnel > but the stunnel just sent TCP ack, so it is TCP half close. > 2.The stunnel use read() function that try to read more data from > sock_fd > but return 0(EOF) because TCP half close. > 3.At this moment, the stunnel call SSL_shutdown() function > that sent close_notify alert but a broswer(IE6 or firefox1.0) return > no message. > > I just modify stunnel 4.07 client.c to set sock_wr=0 > that will close TCP connection from stunnel to web server when read() > EOF. I'm NOT going to break SSL protocol in stunnel to support broken SSL clients. Use: TIMEOUTclose = 0 configuration option instead. Best regards, Mike

1 0

multiple stunnel client
by Manila, Dinesh - Contractor 15 Feb '05

15 Feb '05

Hi, I am working in a project, whereas the EMS application need to be secured while communicating with NE. To make it secure, we have decided to go with stunnel and openSSL. I have following questions while using stunnel in my application: 1. I read that stunnel limits the number of clients to be connected to 125. Can I increase this number. If so, by increasing this number, what is the implication in performance of stuunel. 2. Since my EMS is capable of managing more than 1000 NEs, I would want to have multiple stunnel client running on the same workstation. Is this possible to have multiple stuunel process running on the same server. if so, how should my stunnle.conf file look like. I appreciate greatly, If I could get the answers for the above queries. Thanks and Regards, Dinesh Wipro Technologies. Bangalore.

2 1

Multiple listeners with just one instance of Stunnel?
by Michael Zarlenga 15 Feb '05

15 Feb '05

It doesn't seem possible to start 1 instance of Stunnel for multiple accept ports. Judging by the format of the Stunnel configuration file, it seems that I need to 1 instance of Stunnel for each port that accepts connections from the outside world. Is this true?

3 6

HELP!!! Problem uploading files
by Bhavesh Patel 14 Feb '05

14 Feb '05

Hi all, I'm using stunnel verstion 4.05 and openssl 0.9.7d. When trying to upload a large file say 1Meg I always get the following: 2005.01.27 14:30:40 LOG7[72667165:0]: stunnel accepted FD=0 from 136.157.232.120:3372 2005.01.27 14:30:40 LOG7[72667165:0]: FD 0 in non-blocking mode 2005.01.27 14:30:40 LOG7[79306780:0]: stunnel started 2005.01.27 14:30:40 LOG5[79306780:0]: stunnel connected from 136.157.232.120:3372 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): before/accept initialization 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client hello A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server hello A 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=0, DIR=read 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client master key A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 server start encryption 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server verify A 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=0, DIR=read 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client finished A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write request certificate A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server finished A 2005.01.27 14:30:40 LOG7[79306780:0]: 1 items in the session cache 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client connects (SSL_connect()) 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client connects that finished 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client renegotiatations requested 2005.01.27 14:30:40 LOG7[79306780:0]: 1 server connects (SSL_accept()) 2005.01.27 14:30:40 LOG7[79306780:0]: 1 server connects that finished 2005.01.27 14:30:40 LOG7[79306780:0]: 0 server renegotiatiations requested 2005.01.27 14:30:40 LOG7[79306780:0]: 0 session cache hits 2005.01.27 14:30:40 LOG7[79306780:0]: 1 session cache misses 2005.01.27 14:30:40 LOG7[79306780:0]: 0 session cache timeouts 2005.01.27 14:30:40 LOG6[79306780:0]: Negotiated ciphers: DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168 ) Mac=MD5 2005.01.27 14:30:40 LOG7[79306780:0]: FD 1 in non-blocking mode 2005.01.27 14:30:40 LOG7[79306780:0]: stunnel connecting 127.0.0.1:80 2005.01.27 14:30:40 LOG7[79306780:0]: remote connect #1: EINPROGRESS: retrying 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=1, DIR=write 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: Remote FD=1 initialized 2005.01.27 14:30:40 LOG7[79306780:0]: SSL_read returned WANT_: retrying 2005.01.27 14:30:40 LOG7[79306780:0]: SSL closed on SSL_write 2005.01.27 14:30:40 LOG5[79306780:0]: Connection closed: 0 bytes sent to SSL, 668 bytes sent to socket 2005.01.27 14:30:40 LOG7[79306780:0]: removing pid file /usr/local/var/run/stunnel.pid 2005.01.27 14:30:40 LOG7[72667165:0]: Process 79306780 finished with code 0 (0 left) Specifically: I get SSL_read returned WANT_: retrying I am using sslv2 because sslV3 does not work with windows explorer. Any help would be appreciated. __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail

2 1

using no certificate
by Zohar 14 Feb '05

14 Feb '05

Hi, I'm very new to all this issue of SSL, so I apologize if this question sounds stupid. I currently have a server that listens to connections on a TCP port. Clients that connect to it may do so using SSL v3 (mobile clients, which use their own SSL packages, so I have very little control over it). I want to add stunnel to my server's setting, to enable SSL communication. I have no need for the client to authenticate the server, I am only interested in the data being encrypted. I tried setting this up, but the client complains that my server certificate cannot be authenticated (I produced it using http://www.stunnel.org/pem/) Any pointers on how to set such a thing up (even for the time being, while I develop), without having to pay lots of money to a CA ?

3 2