- stunnel-users - stunnel.org

Getting Stunnel to Work Under Windows 7 64-bit
by Thomas Eifert 03 May '12

03 May '12

For the benefit of the group, I thought I'd share some experiences I had when attempting to get Stunnel to run under Windows 7 SP1 64-bit. I initially installed Stunnel version 4.53 to the default location, which in Windows 7 64-bit is: C:\Program Files (x86)\stunnel\ I installed the service from the start menu option, then rebooted my machine. I have administrator rights, and User Account Control is disabled. My observations included the following: 1. The Stunnel status window displayed only configuration loads. No output from any active connection was ever displayed, despite the fact that Stunnel was passing traffic to/from SSL-enabled servers. 2. Stunnel would not write to the log file. The error message indicated that Stunnel was unable to open stunnel.log. Initially, I thought this might be a factor in the lack of status window connection output, so I commented the log statement out to eliminate it. I then reloaded the configuration. The issue of not seeing any connection info was unaffected. 3. The notification area icon would not appear on Stunnel service load. It would mysteriously appear, then disappear, at seemingly random times. 4. Once the service was installed, it was not possible to stop it or uninstall it from the provided start menu shortcuts. Whenever I attempted to do so, the Stunnel status window would appear. However, I was able to perform these actions successfully by opening a command prompt, then issuing the commands from there. In an effort to unravel these issues, I tried the following workarounds: 1. I re-installed stunnel to a non-system controlled directory. In my case, it was C:\Apps\stunnel\. 2. I attempted to run stunnel in compatibility mode, set for Windows XP SP3. 3. I tried installing 2 previous versions of Stunnel. All combinations produced exactly the same undesired result. Finally, I stopped and uninstalled the service. Instead of using that method, I created a shortcut to stunnel.exe, and placed it in the start menu's startup folder, then rebooted. Stunnel started at boot time, and all of the above issues were resolved. As such, it seems like Stunnel just doesn't like to be run as a service on a Windows 7 64-bit machine; at least not on the one I own. If you're encountering any stability issues with the Stunnel service in the Windows 7 64-bit environment, try my method. It works. I'd like to extend a special thank you to Carter Browne, who provided valuable input throughout the course of my testing. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2

ssl3 handshake error
by Colin Chalmers 27 Apr '12

27 Apr '12

Hi all, I'm pretty new to stunnel but did get this config to work on a linux box - now I am trying the same/similiar config on a win7 box but keep getting the handshake error below. I am using the latest version of stunnel and have tried searching for an answer via google, making the proposed changes as described No matter what settings I use it always seems to use the sslv3 handshake which then goes wrong :-( I'd appreciate any help on this Colin My config is as follows: ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes rndbytes = 256 rndfile = c:\temp\randseed.bin ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Disable FIPS mode to allow non-approved protocols and algorithms fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = CT_20110324.pem ; Disable support for insecure SSLv2 protocol sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 [CT] ; incoming connection from the client application accept = 444 ; outgoing connection connect = remote.server.com:443 TIMEOUTclose = 0 Error in log file 2012.04.11 18:33:54 LOG7[3684:3640]: Remote socket (FD=440) initialized 2012.04.11 18:33:54 LOG3[3684:3640]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2012.04.11 18:33:54 LOG5[3684:3640]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.04.11 18:33:54 LOG7[3684:3640]: Remote socket (FD=440) closed 2012.04.11 18:33:54 LOG7[3684:3640]: Local socket (FD=408) closed 2012.04.11 18:33:54 LOG7[3684:3640]: Service [CT] finished (0 left)

3 2

Using Stunnel client but not Stunnel server with Apache mod_ssl
by Lilienberg, Daniel () 27 Apr '12

27 Apr '12

Hi, My supplier is using a somewhat strange setup looking like this: CLIENT: Stunnel running in client mode accepting incoming requests on port 8080. It will forward it to port to a server, port 443. SERVER: NOT running Stunnel at all, but running Apache with mod_ssl. It also acts as a proxy server, proxying all requests. Can this work, if so, how do I set it up ? [http://www.volvocars.net/support/IT/Services/IT_workplace/Email/outlook/sig…] Daniel Lilienberg Architect Connectivity Foundation Volvo Car Corporation Dept. 61630/PV2A Göteborg Sweden Telephone +46-31-3542317 dlilien2(a)volvocars.com<mailto:dlilien2@volvocars.com> www.volvocars.com<http://www.volvocars.com/> Registered Office Göteborg, Sweden Registration No. 556074-3089

1 0

Windows 7 64-Bit
by Thomas Eifert 22 Apr '12

22 Apr '12

Has anyone attempted to install and run Stunnel on Windows 7 64-bit? If so, which version did you use, and were any issues experienced? Regards. Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Possible error in stunnel 4.20
by Andreea Ion 20 Apr '12

20 Apr '12

Hi, I am running stunnel 4.2 on windows and I get the following log. I don't know if it's ok, if the problem is at the stunnel lovel or at the application level. SSL state (connect): before/connect initialization 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write client hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read server hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write change cipher spec A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 flush data 2012.04.20 11:46:09 LOG7[5684:4492]: 2 items in the session cache 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects (SSL_connect()) 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 client renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects (SSL_accept()) 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 3 session cache hits 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache misses 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache timeouts 2012.04.20 11:46:09 LOG6[5684:4492]: SSL connected: previous session reused 2012.04.20 11:46:54 LOG3[5684:4492]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2012.04.20 11:46:54 LOG5[5684:4492]: Connection reset: 154 bytes sent to SSL, 0 bytes sent to socket 2012.04.20 11:46:54 LOG7[5684:4492]: Session finished (0 left) The last 3 lines are those that interests me most. Is this ok ? Regards, Andreea

1 0

(no subject)
by Guylhem 18 Apr '12

18 Apr '12

Hello With verify=3 and the certs loaded in the conf file with CAfile=startssl-chain.pem cert=mycert.pem, I get : CERT: Certificate not found in local repository Using the latest stunnel recompiled on a debian squeeze, the best I can get is: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line However, if I put these very same pem files in a directory as a CApath option instead (c_rehash applied) everything works fine. But The pem files are identical ! I've read http://stunnel.mirt.net/pipermail/stunnel-users/2010-November/002854.html but it seems a bit different The startssl-chain.pem was created with: wget http://www.startssl.com/certs/ca.pem wget http://www.startssl.com/certs/startssl.ca.pem cat sub.class1.server.ca.pem ca.pem > startssl-chain.pem I guess that may be the cause of the problem? What should I do to pass these pem files as stunnel.conf options instead of using the CApath? Guylhem

1 0

(no subject)
by Marco Tulio Jimenez Abrego 18 Apr '12

18 Apr '12

Buenos días El mensaje de error es: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME). Gracias por su atención. -- Saludos. Att. Marco T. Jiménez ================ Tel. 6619-6782

3 2

Stunnel compiled with openssl 1.0.1 local binaries are 0.9.8k
by Michael Curran 11 Apr '12

11 Apr '12

Are there any potential known issues with stunnel being compiled using openssl 1.0.1 build and leaving the local system binaries at 0.9.8k Do you know of any way to test this for any incompatibilities? This was not my design, Im just being asked to support it and Im looking to make sure this method is not going to cause anything unusual.

2 1

PPID of child process
by Philip Wong 11 Apr '12

11 Apr '12

Hi, I’m trying to setup stunnel listening to multiple ports. The PPID of processes created are always root. Can we change that to the right PPID? Here I can see all the processes by killing 10764 and I expect this is the PPID. But all the children PPID are still 1; UID PID PPID C STIME TTY TIME CMD philwong 10759 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10760 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10761 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10762 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10763 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10764 1 0 16:27 ? 00:00:00 stunnel self.conf Regards, Philip

3 6

the connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues :(
by Thomas Manson 10 Apr '12

10 Apr '12

Hi, while I'm trying to get stunnel working for more than a few hours, I've also notice this warning in google chrome : the connection had to be retried using SSL 3.0. This typically means that > the server is using very old software and may have other security issues. [image: Inline image 1] gmail for example has AES_128_CBC for crypting, can we get that without much effort? What should be set to get rid of this warning ? I thought SSL v3 was the best (quickly pick acrross several example on the net) what is the best setting for this ? Thanks for your help, Thomas. My config : debug = 7 output = /var/log/stunnel4/extranet.service.com_stunnel.log setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/extranet.service.com.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [extranet.service.com] key = /etc/stunnel/sites/extranet.service.com/extranet.service.com.key cert = /etc/stunnel/sites/extranet.service.com/extranet.service.com.crt accept = 8.90.17.4:443 connect = 127.0.0.1:82 sslVersion = SSLv3 TIMEOUTclose = 0

3 4