<div>Hello,</div>
<div> </div>
<div>I'm trying to set up sTunnel to use client certificates in the following arrangement:</div>
<div> </div>
<div>Client Java Server (HTTP) --> sTunnel (HTTPS w/client cert) --> Windows IIS SOAP service, requires client cert</div>
<div> </div>
<div>The client certificate was generated from a MS CA cert generation tool, one we use for our internal certificates and our internal CA. The client cert was generated as a .pfx file and I used OpenSSL to convert it to a .pem file with the -nodes option.</div>
<div> </div>
<div>Testing without the client certificates shows that if the IIS hosted SOAP service is set to not require a client certificate, the sTunnel configuration works and we're able to communicate between the HTTP only client and the HTTPS IIS hosted service.</div>
<div> </div>
<div>However, once we add the certificate, the communication stops at the handshake. I'm wondering if I need to change the client .pem cert to have the private key (don't use the -nodes option when converting using OpenSSL).</div>
<div> </div>
<div>Here is the contents of the .conf file:</div>
<div> </div>
<div>; Sample stunnel configuration file by Michal Trojnara 2002-2006<br>; Some options used here may not be adequate for your particular configuration</div>
<div>; Certificate/key is needed in server mode and optional in client mode<br>; The default certificate is provided only for testing and should not<br>; be used in a production environment<br>cert = user_cert.pem<br>key = user_cert.pem</div>
<div>; Some performance tunings<br>socket = l:TCP_NODELAY=1<br>socket = r:TCP_NODELAY=1</div>
<div>; Workaround for Eudora bug<br>;options = DONT_INSERT_EMPTY_FRAGMENTS</div>
<div>; Authentication stuff<br>;verify = 2<br>; Don't forget to c_rehash CApath<br>;CApath = certs<br>; It's often easier to use CAfile<br>;CAfile = certs.pem<br>; Don't forget to c_rehash CRLpath<br>;CRLpath = crls<br>
; Alternatively you can use CRLfile<br>;CRLfile = crls.pem</div>
<div>; Some debugging stuff useful for troubleshooting<br>debug = 7<br>output = c:\temp\stunnel.log</div>
<div>; Use it for client mode<br>client = yes</div>
<div>; Service-level configuration</div>
<div>;[pop3s]<br>;accept = 995<br>;connect = 110</div>
<div>;[imaps]<br>;accept = 993<br>;connect = 143</div>
<div>;[ssmtp]<br>;accept = 465<br>;connect = 25</div>
<div>[http]<br>accept = 8090<br>connect = <a href="http://10.12.32.164:443">10.12.32.164:443</a><br>TIMEOUTclose = 0</div>
<div>; vim:ft=dosini</div>
<div> </div>
<div> </div>
<div> </div>
<div>Here is the output from the log file showing two attempts to hit the service with the client cert, one from a browser and one from a bit of client code:</div>
<div> </div>
<div>2010.03.19 09:58:27 LOG5[5864:4032]: Reading configuration from file stunnel.conf<br>2010.03.19 09:58:27 LOG7[5864:4032]: RAND_status claims sufficient entropy for the PRNG<br>2010.03.19 09:58:27 LOG7[5864:4032]: PRNG seeded successfully<br>
2010.03.19 09:58:27 LOG7[5864:4032]: Certificate: user_cert.pem<br>2010.03.19 09:58:27 LOG7[5864:4032]: Certificate loaded<br>2010.03.19 09:58:27 LOG7[5864:4032]: Key file: user_cert.pem<br>2010.03.19 09:58:27 LOG7[5864:4032]: Private key loaded<br>
2010.03.19 09:58:27 LOG7[5864:4032]: SSL context initialized for service http<br>2010.03.19 09:58:27 LOG5[5864:4032]: Configuration successful<br>2010.03.19 09:58:27 LOG5[5864:4032]: No limit detected for the number of clients<br>
2010.03.19 09:58:27 LOG7[5864:4032]: FD=176 in non-blocking mode<br>2010.03.19 09:58:27 LOG7[5864:4032]: Option SO_REUSEADDR set on accept socket<br>2010.03.19 09:58:27 LOG7[5864:4032]: Service http bound to <a href="http://0.0.0.0:8090">0.0.0.0:8090</a><br>
2010.03.19 09:58:27 LOG7[5864:4032]: Service http opened FD=176<br>2010.03.19 09:58:27 LOG5[5864:4032]: stunnel 4.31 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009<br>2010.03.19 09:58:27 LOG5[5864:4032]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6<br>
2010.03.19 09:59:42 LOG7[5864:3864]: Service http accepted FD=440 from <a href="http://127.0.0.1:49886">127.0.0.1:49886</a><br>2010.03.19 09:59:42 LOG7[5864:3864]: Creating a new thread<br>2010.03.19 09:59:42 LOG7[5864:3864]: New thread created<br>
2010.03.19 09:59:42 LOG7[5864:4328]: Service http started<br>2010.03.19 09:59:42 LOG7[5864:4328]: FD=440 in non-blocking mode<br>2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on local socket<br>2010.03.19 09:59:42 LOG5[5864:4328]: Service http accepted connection from <a href="http://127.0.0.1:49886">127.0.0.1:49886</a><br>
2010.03.19 09:59:42 LOG7[5864:4328]: FD=460 in non-blocking mode<br>2010.03.19 09:59:42 LOG6[5864:4328]: connect_blocking: connecting <a href="http://10.12.32.164:443">10.12.32.164:443</a><br>2010.03.19 09:59:42 LOG7[5864:4328]: connect_blocking: s_poll_wait <a href="http://10.12.32.164:443">10.12.32.164:443</a>: waiting 10 seconds<br>
2010.03.19 09:59:42 LOG5[5864:4328]: connect_blocking: connected <a href="http://10.12.32.164:443">10.12.32.164:443</a><br>2010.03.19 09:59:42 LOG5[5864:4328]: Service http connected remote server from <a href="http://10.12.47.109:49887">10.12.47.109:49887</a><br>
2010.03.19 09:59:42 LOG7[5864:4328]: Remote FD=460 initialized<br>2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on remote socket<br>2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): before/connect initialization<br>
2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client hello A<br>2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server hello A<br>2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server certificate A<br>
2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server done A<br>2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client key exchange A<br>2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write change cipher spec A<br>
2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write finished A<br>2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 flush data<br>2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read finished A<br>
2010.03.19 09:59:42 LOG7[5864:4328]: 1 items in the session cache<br>2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects (SSL_connect())<br>2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects that finished<br>
2010.03.19 09:59:42 LOG7[5864:4328]: 0 client renegotiations requested<br>2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects (SSL_accept())<br>2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects that finished<br>
2010.03.19 09:59:42 LOG7[5864:4328]: 0 server renegotiations requested<br>2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache hits<br>2010.03.19 09:59:42 LOG7[5864:4328]: 0 external session cache hits<br>2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache misses<br>
2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache timeouts<br>2010.03.19 09:59:42 LOG6[5864:4328]: SSL connected: new session negotiated<br>2010.03.19 09:59:42 LOG6[5864:4328]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1<br>
2010.03.19 10:01:54 LOG3[5864:4328]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054)<br>2010.03.19 10:01:54 LOG5[5864:4328]: Connection reset: 568 bytes sent to SSL, 0 bytes sent to socket<br>2010.03.19 10:01:54 LOG7[5864:4328]: Service http finished (0 left)<br>
2010.03.19 10:03:28 LOG7[5864:3864]: Service http accepted FD=476 from <a href="http://127.0.0.1:50155">127.0.0.1:50155</a><br>2010.03.19 10:03:28 LOG7[5864:3864]: Creating a new thread<br>2010.03.19 10:03:28 LOG7[5864:3864]: New thread created<br>
2010.03.19 10:03:28 LOG7[5864:1216]: Service http started<br>2010.03.19 10:03:28 LOG7[5864:1216]: FD=476 in non-blocking mode<br>2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on local socket<br>2010.03.19 10:03:28 LOG5[5864:1216]: Service http accepted connection from <a href="http://127.0.0.1:50155">127.0.0.1:50155</a><br>
2010.03.19 10:03:28 LOG7[5864:1216]: FD=440 in non-blocking mode<br>2010.03.19 10:03:28 LOG6[5864:1216]: connect_blocking: connecting <a href="http://10.12.32.164:443">10.12.32.164:443</a><br>2010.03.19 10:03:28 LOG7[5864:1216]: connect_blocking: s_poll_wait <a href="http://10.12.32.164:443">10.12.32.164:443</a>: waiting 10 seconds<br>
2010.03.19 10:03:28 LOG5[5864:1216]: connect_blocking: connected <a href="http://10.12.32.164:443">10.12.32.164:443</a><br>2010.03.19 10:03:28 LOG5[5864:1216]: Service http connected remote server from <a href="http://10.12.47.109:50156">10.12.47.109:50156</a><br>
2010.03.19 10:03:28 LOG7[5864:1216]: Remote FD=440 initialized<br>2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on remote socket<br>2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): before/connect initialization<br>
2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write client hello A<br>2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read server hello A<br>2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read finished A<br>
2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write change cipher spec A<br>2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write finished A<br>2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 flush data<br>
2010.03.19 10:03:28 LOG7[5864:1216]: 1 items in the session cache<br>2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects (SSL_connect())<br>2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects that finished<br>
2010.03.19 10:03:28 LOG7[5864:1216]: 0 client renegotiations requested<br>2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects (SSL_accept())<br>2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects that finished<br>
2010.03.19 10:03:29 LOG7[5864:1216]: 0 server renegotiations requested<br>2010.03.19 10:03:29 LOG7[5864:1216]: 1 session cache hits<br>2010.03.19 10:03:29 LOG7[5864:1216]: 0 external session cache hits<br>2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache misses<br>
2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache timeouts<br>2010.03.19 10:03:29 LOG6[5864:1216]: SSL connected: previous session reused<br>2010.03.19 10:04:28 LOG7[5864:1216]: Socket closed on read<br>2010.03.19 10:04:28 LOG7[5864:1216]: SSL write shutdown<br>
2010.03.19 10:04:28 LOG7[5864:1216]: SSL alert (write): warning: close notify<br>2010.03.19 10:04:28 LOG6[5864:1216]: SSL_shutdown successfully sent close_notify<br>2010.03.19 10:04:28 LOG6[5864:1216]: s_poll_wait timeout: connection close<br>
2010.03.19 10:04:28 LOG5[5864:1216]: Connection closed: 1541 bytes sent to SSL, 25 bytes sent to socket<br>2010.03.19 10:04:28 LOG7[5864:1216]: Service http finished (0 left)</div>
<div> </div>
<div> </div>
<div>Any hints would be appreciated!</div>
<div> </div>