Stunnel - how to make Google App Engine HTTP into HTTPS ?
I have Google App Engine running in HTTP (port tcp 80), which is a daemon based service it execute back-end some python instances. Now all that works over HTTP , TCP 80, and Google App Engine itself do not have any kind of HTTPS setup, it has to be organized externally. Therefore, the biggest problem is now that how can i use stunnel to resolve this problem please? I have already tried following setup and it does not work at all. 1) if the user visit https://www.mysite.com then he hit stunnel accept=443 after that he is connected with connect=80 but user browser change into http:// instead of remaining in https:// . Which make the whole thing not working $ uname -a Linux server2 2.6.32-358.23.2.el6.x86_64 #1 SMP Wed Oct 16 18:37:12 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux $ cat /etc/stunnel/stunnel.conf pid = /stunnel.pid cert=/etc/stunnel/abyhu.crt CAfile=/etc/stunnel/abyhu.ca key=/etc/stunnel/abyhu.key sslVersion = all ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 client=no debug = 7 output = /var/log/stunnel.log [SSL] accept=443 connect=80 TIMEOUTclose = 0 My goal is: when user visit https://www.mysite.com it remain as https not become http:// then it is not solving the problem cause Google app engine do not have HTTPS Thank you. Best regards
Hi Shamun, As per my knowledge, U should mention the service https instead of SSL ,as you want to add the support for HTTPS. Just make the following change in your stunnel.conf file. pid = /stunnel.pid cert=/etc/stunnel/abyhu.crt CAfile=/etc/stunnel/ abyhu.ca key=/etc/stunnel/abyhu.key sslVersion = all ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 client=no debug = 7 output = /var/log/stunnel.log [https] accept=443 connect=80 TIMEOUTclose = 0 Thanks, Krinali Shah ----- Original Message ----- From: "Shamun Toha Md" <shamun@companysocia.com> To: stunnel-users@stunnel.org Sent: Thursday, February 6, 2014 12:52:18 PM Subject: [stunnel-users] Stunnel - how to make Google App Engine HTTP into HTTPS ? I have Google App Engine running in HTTP (port tcp 80), which is a daemon based service it execute back-end some python instances. Now all that works over HTTP , TCP 80, and Google App Engine itself do not have any kind of HTTPS setup, it has to be organized externally. Therefore, the biggest problem is now that how can i use stunnel to resolve this problem please? I have already tried following setup and it does not work at all. 1) if the user visit https://www.mysite.com then he hit stunnel accept=443 after that he is connected with connect=80 but user browser change into http:// instead of remaining in https:// . Which make the whole thing not working $ uname -a Linux server2 2.6.32-358.23.2.el6.x86_64 #1 SMP Wed Oct 16 18:37:12 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux $ cat /etc/stunnel/stunnel.conf pid = /stunnel.pid cert=/etc/stunnel/abyhu.crt CAfile=/etc/stunnel/ abyhu.ca key=/etc/stunnel/abyhu.key sslVersion = all ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 client=no debug = 7 output = /var/log/stunnel.log [SSL] accept=443 connect=80 TIMEOUTclose = 0 My goal is: when user visit https://www.mysite.com it remain as https not become http:// then it is not solving the problem cause Google app engine do not have HTTPS Thank you. Best regards --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean --------------------------------------------------------------------------------------------- _______________________________________________ stunnel-users mailing list stunnel-users@stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ************************************************************************************************************************************************************* eInfochips Business Disclaimer : This e-mail message and all attachments transmitted with it are intended solely for the use of the addressee and may contain legally privileged and confidential information. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by replying to this message and please delete it from your computer. Any views expressed in this message are those of the individual sender unless otherwise stated. Company has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ************************************************************************************************************************************************************* --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean ---------------------------------------------------------------------------------------------
Hello Krinali Shah, Thank you for the reply.
i have changed the SSH into https , killed stunnel, restarted stunnel visited as https://site and same thing it moves into http://site
Its still no success. Any other advise please? Best regards /Sham
On Thu, Feb 06, 2014 at 08:22:18AM +0100, Shamun Toha Md wrote:
I have Google App Engine running in HTTP (port tcp 80), which is a daemon based service it execute back-end some python instances. Now all that works over HTTP , TCP 80, and Google App Engine itself do not have any kind of HTTPS setup, it has to be organized externally.
Therefore, the biggest problem is now that how can i use stunnel to resolve this problem please? I have already tried following setup and it does not work at all.
1) if the user visit https://www.mysite.com then he hit stunnel accept=443 after that he is connected with connect=80 but user browser change into http:// instead of remaining in https:// . Which make the whole thing not working
Is it possible that the site itself has some kind of redirections or links that actually specify http://servername/path? If so, stunnel cannot do anything about it - stunnel does not (and *should* not!) even try to modify the actual data stream that flows through it after the initial connection is established. G'luck, Peter -- Peter Pentchev roam@ringlet.net roam@FreeBSD.org p.penchev@storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13 If wishes were fishes, the antecedent of this conditional would be true.
SOLVED. Found the problem. Step 1: make a web server $ echo "complex world" | nc -l 80 # run a webserver Step 2: make a https server connects to step 1 $ cat /etc/stunnel/stunnel.conf pid = /stunnel.pid cert=/etc/stunnel/a.crt CAfile=/etc/stunnel/a.ca key=/etc/stunnel/a.key sslVersion = all client=no debug = 7 output = /var/log/stunnel.log [https] accept=443 connect=80 TIMEOUTclose = 0 $ pgrep -f stunnel | xargs kill -9; stunnel Step 3: verify SSL is working of step 2 $ openssl s_client -ssl3 -connect server1.com:443 lot of data.. and SSL handshake has read 3029 bytes and written 354 bytes means successfully installed Step 4: final $ curl -v "https://server1.com" or $ google-chrome "https://server1.com" i get the output from webserver and the url stays in https:// *Summary: Google App Engine is pain (someone please fix it or report Google, cause Google App engine is now became very popular but its pain when you use it with stunnel + apache).* They have a redirect which cause the SSL/HTTPS not working it was confusing if stunnel issue or apache issue. In apache you can do the same by following this which proves that Google App Engine is EVIL for https. Apache2, in CentOS 6.4: Step 2: same as above stunnel but if you want without stunnel and use apache then you need as below: $ cat /etc/httpd/conf.d/ssl.conf LoadModule ssl_module modules/mod_ssl.so Listen 443 SSLPassPhraseDialog builtin SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000) SSLSessionCacheTimeout 300 SSLMutex default SSLRandomSeed startup file:/dev/urandom 256 SSLRandomSeed connect builtin #SSLRandomSeed startup file:/dev/random 512 #SSLRandomSeed connect file:/dev/random 512 #SSLRandomSeed connect file:/dev/urandom 512 SSLCryptoDevice builtin #SSLCryptoDevice ubsec NameVirtualHost SERVER1:443 <VirtualHost SERVER1:443> SSLEngine on SSLProxyEngine On ProxyPreserveHost On #ProxyRequests Off SSLProtocol all -SSLv2 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW SSLCertificateFile /etc/stunnel/a.crt SSLCertificateKeyFile /etc/stunnel/a.key SSLCertificateChainFile /etc/stunnel/a.ca ServerName SERVER1 ProxyPass / http://SERVER1 ProxyPassReverse / http://SERVER1 #ProxyPassReverseCookiePath /MYSITE/ / CacheDisable * </VirtualHost> $ service httpd restart
participants (3)
-
Krinali Shah - PES -
Peter Pentchev -
Shamun Toha Md