<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
Hello,<br><br>I have been trying to enable stunnel on a HPUX server, and whilst I thought it was going to be simple, I have not been able to make it work so far. We have a webserver and due to some pages being hardcoded to port 8080 it can't support SSL without a lot of code changes. As a short term workaround I am trying to use stunnel in server mode to provide a HTTPS interface. I expected this to be a very simple matter of accepting connections on port 443 and connecting to port 8080, but it's not working.<br><br>We're using an old version of stunnel (4.04) however this is the version bundled with the HPUX OS we have.<br><br>When stunnel is started there are no errors (log file output below) and netstat shows that a process is listening on port 443, however a browser (tried IE6 and Firefox) doesn't display anything. Connecting to port 8080 shows the application as expected.<br><br>I have run a wireshark trace at the client end, and it seems that the stunnel server is not responding to the initial "Client Hello" message. Only 3 packets are seen:<br><br>C->S SYN<br>S->C SYN,ACK<br>C->S SSL Client Hello<br><br>My guess is that the ssl server is not starting up correctly, however everything looks ok in the logfile, although it might not be completing. Nothing is displayed in the log when I try to connect to port 443.<br><br>Any help would be much appreciated as I am stuck!<br><br>Thanks Craig<br><br><u><b><br>Server</b></u><br><font style="" color="#ff0000" face="Courier New">eSM_CoE# uname -a</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">HP-UX eSM_CoE B.11.23 U ia64 1107767544 unlimited-user license</font><font style="" color="#ff0000"><br></font><font style="" color="#ff0000"><br><font style="" color="#000000"><u><b>Stunnel Version</b></u></font><br></font><font style="" color="#ff0000" face="Courier New">eSM_CoE# ./sbin/stunnel -version</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">Global options</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">cert = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">ciphers = ALL:!ADH:+RC4:@STRENGTH</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">debug = 5</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">key = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">pid = /opt/hpws/apache32/stunnel/var/run/stunnel.pid</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">RNDbytes = 64</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">RNDfile = /dev/urandom</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">RNDoverwrite = yes</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">session = 300 seconds</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">verify = none</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">Service-level options</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">TIMEOUTbusy = 300 seconds</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">TIMEOUTclose = 60 seconds</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">TIMEOUTidle = 43200 seconds</font><br><br><u><b>Conf file</b></u><br><font style="" color="#ff0000" face="Courier New">eSM_CoE# cat stunnel.conf</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Sample stunnel configuration file</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">RNDfile=/opt/hpws/apache32/stunnel/.stunnel.rnd</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Chroot</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">#chroot = /var/chroot/stunnel/</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># PID is created inside chroot jail</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">pid = /opt/hpws/apache32/logs/stunnel.pid</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Workaround for Eudora bug</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">#options = DONT_INSERT_EMPTY_FRAGMENTS</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Client Authentication</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">#verify = 2</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># don't forget about c_rehash CApath</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># it is located inside chroot jail:</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">#CApath = /certs</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># or simply use CAfile instead:</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">#CAfile = /opt/hpws/apache32/conf/certs.pem</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Some debugging stuff</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">debug = 7</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">output = /opt/hpws/apache32/logs/stunnel.log</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Use in client mode</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">client = no</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Run in the background</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">foreground = no</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">socket = l:TCP_NODELAY=1</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">socket = r:TCP_NODELAY=1</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">delay=yes</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"># Service-level configuration</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">[https]</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">accept = 172.20.167.74:443</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">connect = localhost:8080</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">TIMEOUTclose = 10</font><br><br><u><b>Log file output</b></u><br><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG5[4172:1]: stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: Snagged 64 random bytes from /opt/hpws/apache32/stunnel/.stunnel.rnd</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: Wrote 1024 new random bytes to /opt/hpws/apache32/stunnel/.stunnel.rnd</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: RAND_status claims sufficient entropy for the PRNG</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG6[4172:1]: PRNG seeded successfully</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: Certificate: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: Key file: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG5[4172:1]: FD_SETSIZE=60000, file ulimit=4096 -> 2000 clients allowed</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: FD 5 in non-blocking mode</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: SO_REUSEADDR option set on accept socket</font><font style="" color="#ff0000" face="Courier New"><br></font><font style="" color="#ff0000" face="Courier New">2009.10.30 14:32:41 LOG7[4172:1]: https bound to 172.20.167.74:443</font><font style="" color="#ff0000" face="Courier New"><br></font><br><br><br><br> <br /><hr />New Windows 7: Find the right PC for you. <a href='http://www.microsoft.com/uk/windows/buy/' target='_new'>Learn more.</a></body>
</html>