<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:bookman old style, new york, times, serif;font-size:12pt"><DIV>Laurent,</DIV>
<DIV> </DIV>
<DIV>We need to present a client certificate to the server. That's the important part missing. Do that by adding -cert your_cert_filename to the command, like:</DIV>
<DIV> </DIV>
<DIV><FONT face=Times>openssl s_client -ssl3 -state -cert your_client_cert_filename -connect your-stunnel-ip:10443</FONT> <BR></DIV>
<DIV>See <A href="http://www.openssl.org/docs/apps/s_client.html">http://www.openssl.org/docs/apps/s_client.html</A></DIV>
<DIV> </DIV>
<DIV>Regards,</DIV>
<DIV>Jose<BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: bookman old style, new york, times, serif"><BR>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT face=Tahoma size=2>
<HR SIZE=1>
<B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> "laurent.uk@bnpparibas.com" <laurent.uk@bnpparibas.com><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> josealf@rocketmail.com<BR><B><SPAN style="FONT-WEIGHT: bold">Cc:</SPAN></B> stunnel-users@stunnel.org; stunnel-users-bounces@stunnel.org<BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Wed, May 4, 2011 6:55:19 AM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> R�f. : Re: R�f. : Re: R�f. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA<BR></FONT><BR><BR><FONT face=sans-serif size=2>Jose, thanks you for your response, i use the openssl s_client command but i have the following error :</FONT> <BR>
<TABLE width="100%" border=1>
<TBODY>
<TR vAlign=top>
<TD width="100%"><FONT face=sans-serif size=2>1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(<A href="http://libz.so/" target=_blank>libz.so</A>): Could not load module .</FONT> <BR><FONT face=sans-serif size=2>System error: No such file or directory</FONT> <BR><FONT face=sans-serif size=2>1499296:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:</FONT> <BR><FONT face=sans-serif size=2>CONNECTED(00000003)</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:before/connect initialization</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 write client hello A</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 read server hello A</FONT> <BR><FONT face=sans-serif size=2>depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com</FONT> <BR><FONT face=sans-serif size=2>verify error:num=20:unable to get local
issuer certificate</FONT> <BR><FONT face=sans-serif size=2>verify return:1</FONT> <BR><FONT face=sans-serif size=2>depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com</FONT> <BR><FONT face=sans-serif size=2>verify error:num=27:certificate not trusted</FONT> <BR><FONT face=sans-serif size=2>verify return:1</FONT> <BR><FONT face=sans-serif size=2>depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com</FONT> <BR><FONT face=sans-serif size=2>verify error:num=21:unable to verify the first certificate</FONT> <BR><FONT face=sans-serif size=2>verify return:1</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 read server certificate A</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 read server certificate request A</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 read server done A</FONT> <BR><FONT face=sans-serif size=2>SSL3 alert write:warning:no certificate</FONT>
<BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 write client certificate A</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 write client key exchange A</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 write change cipher spec A</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 write finished A</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:SSLv3 flush data</FONT> <BR><FONT face=sans-serif size=2>SSL3 alert read:fatal:handshake failure</FONT> <BR><FONT face=sans-serif size=2>SSL_connect:failed in SSLv3 read finished A</FONT> <BR><FONT face=sans-serif size=2>1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1060:SSL alert number 40</FONT> <BR><FONT face=sans-serif size=2>1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530:</FONT></TD></TR></TBODY></TABLE><BR><BR><FONT face=sans-serif size=2>is it normal?</FONT> <BR><BR><FONT face=sans-serif
size=2>Thanks.</FONT> <BR><BR><FONT face=sans-serif size=2>Regards.<BR><BR>Laurent UK<BR><BR></FONT><BR><BR><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="39%"><FONT face=helv size=4><B>Internet </B></FONT> <BR><FONT face=sans-serif size=1><B>josealf@rocketmail.com</B></FONT>
<P><FONT face=sans-serif size=1>04/05/2011 13:38</FONT> </P>
<TD width="60%">
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>Pour</FONT></DIV>
<TD><FONT face=sans-serif size=1>Laurent UK</FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>cc</FONT></DIV>
<TD><FONT face=sans-serif size=1>stunnel-users@stunnel.org, stunnel-users-bounces@stunnel.org</FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>Objet</FONT></DIV>
<TD><FONT face=sans-serif size=1>Re: R�f. : Re: R�f. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA</FONT></TD></TR></TBODY></TABLE><BR>
<TABLE>
<TBODY>
<TR vAlign=top>
<TD>
<TD></TD></TR></TBODY></TABLE><BR></TD></TR></TBODY></TABLE><BR><BR><BR><FONT face=Times size=3>Laurent,</FONT> <BR><FONT face=Times size=3> </FONT> <BR><FONT face=Times size=3>Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. </FONT><BR><FONT face=Times size=3>Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text?</FONT> <BR><FONT face=Times size=3> </FONT> <BR><FONT face=Times size=3>You can test your connection to stunnel server with <I>openssl s_client</I> command. Example</FONT> <BR><FONT face=Times size=3> </FONT> <BR><FONT face=Times size=3>openssl s_client -ssl3 -state -connect
your-stunnel-ip:10443</FONT> <BR><FONT face=Times size=3>openssl s_client -tls1 -state -connect your-stunnel-ip:10443</FONT> <BR><FONT face=Times size=3> </FONT> <BR><FONT face=Times size=3>if this works, we found the culprit.</FONT> <BR><FONT face=Times size=3> </FONT> <BR><FONT face=Times size=3>Regards</FONT> <BR><FONT face=Times size=3> </FONT> <BR><FONT face=Times size=3>Jose</FONT> <BR>
<HR>
<FONT face=Tahoma size=2><B>From:</B> "laurent.uk@bnpparibas.com" <laurent.uk@bnpparibas.com><B><BR>To:</B> josealf@rocketmail.com<B><BR>Cc:</B> stunnel-users@stunnel.org; stunnel-users-bounces@stunnel.org<B><BR>Sent:</B> Wed, May 4, 2011 2:05:07 AM<B><BR>Subject:</B> R�f. : Re: R�f. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA</FONT><FONT face=Times size=3><BR><BR></FONT><FONT face=sans-serif size=2><BR>Jose,</FONT><FONT face=Times size=3> <BR></FONT><FONT face=sans-serif size=2><BR>I use 2 servers in my configuration:</FONT><FONT face=Times size=3> <BR></FONT><FONT face=sans-serif size=2><BR>the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl)</FONT><FONT face=Times size=3> <BR></FONT><FONT face=sans-serif size=2><BR>and the second one who listenning the port 10016 (where we receive decrypted traffic).</FONT><FONT face=Times size=3>
<BR></FONT><FONT face=sans-serif size=2><BR>The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server.</FONT><FONT face=Times size=3> <BR></FONT><FONT face=sans-serif size=2><BR>Do you think that i also need to change this configuration?</FONT><FONT face=Times size=3> <BR></FONT><FONT face=sans-serif size=2><BR>Cordialement,<BR><BR>Laurent UK<BR></FONT><FONT face=Times size=3><BR><BR><BR></FONT>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="19%"><FONT face=Arial size=4><B>Internet </B></FONT><FONT size=3> </FONT><FONT face=sans-serif size=1><B><BR>josealf@rocketmail.com</B></FONT><FONT size=3> </FONT>
<P><FONT face=sans-serif size=1>03/05/2011 19:18</FONT><FONT size=3> </FONT></P>
<TD width="80%"><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="4%">
<DIV align=right><FONT face=sans-serif size=1>Pour</FONT></DIV>
<TD width="95%"><FONT face=sans-serif size=1>Laurent UK</FONT><FONT size=3> </FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>cc</FONT></DIV>
<TD><FONT face=sans-serif size=1>stunnel-users@stunnel.org, stunnel-users-bounces@stunnel.org</FONT><FONT size=3> </FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>Objet</FONT></DIV>
<TD><FONT face=sans-serif size=1>Re: R�f. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA</FONT></TD></TR></TBODY></TABLE><BR><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="50%">
<TD width="50%"></TD></TR></TBODY></TABLE><BR></TD></TR></TBODY></TABLE><BR><FONT face=Times size=3><BR><BR><BR>Laurent, <BR> <BR>I'm not sure you are connecting the dots right. <BR> <BR>I see an stunnel <I>server</I> configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). <BR> <BR>You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: <BR> <BR>client=yes <BR>[pestip] </FONT><FONT face=sans-serif size=2><BR>accept = 10443</FONT><FONT face=Times size=3> </FONT><FONT face=sans-serif size=2><BR>connect =
Your-Stunnel-server-IP:10443</FONT><FONT face=Times size=3> <BR> <BR>In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. <BR> <BR><BR>Regards, <BR> <BR>Jose <BR> <BR><BR></FONT>
<HR>
<FONT face=Tahoma size=2><B>From:</B> "laurent.uk@bnpparibas.com" <laurent.uk@bnpparibas.com><B><BR>To:</B> josealf@rocketmail.com<B><BR>Cc:</B> stunnel-users@stunnel.org; stunnel-users-bounces@stunnel.org<B><BR>Sent:</B> Tue, May 3, 2011 10:48:11 AM<B><BR>Subject:</B> R�f. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA</FONT><FONT face=Times size=3><BR></FONT><FONT face=sans-serif size=2><BR><BR>Dear Jose,</FONT><FONT face=Times size=3> </FONT><FONT face=sans-serif size=2><BR><BR>here is the configuration file of my stunnel :</FONT><FONT face=Times size=3> </FONT>
<TABLE width="100%" border=4>
<TBODY>
<TR vAlign=top>
<TD width="100%"><FONT face=sans-serif size=2>; Sample stunnel configuration file by Michal Trojnara 2002-2006</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Some options used here may not be adequate for your particular configuration</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Please make sure you understand them (especially the effect of chroot jail)</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR><BR>; Certificate/key is needed in server mode and optional in client mode</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>cert = /opt/freeware/etc/stunnel/ca_nopass.pem</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>foreground = yes</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>syslog = yes</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Protocol version (all, SSLv2, SSLv3, TLSv1)</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;sslVersion =
SSLv2</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>sslVersion = all</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;ciphers = DES-CBC-SHA</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Some security enhancements for UNIX systems - comment them out on Win32</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;chroot = /usr/local/stunnel/var/lib/stunnel</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;chroot = /tmp/</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;setuid = root</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;setgid = other</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; PID is created inside chroot jail</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>pid = /var/adm/stunnel_server_level1.pid</FONT><FONT size=3> </FONT><FONT
face=sans-serif size=2><BR><BR>; Some performance tunings</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>socket = l:TCP_NODELAY=1</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>socket = r:TCP_NODELAY=1</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;compression = rle</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR><BR>; Workaround for Eudora bug</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;options = DONT_INSERT_EMPTY_FRAGMENTS</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;options = Options_SSL</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Authentication stuff</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>verify = 3</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Don't forget to c_rehash CApath</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; CApath is located inside chroot jail</FONT><FONT size=3> </FONT><FONT
face=sans-serif size=2><BR>CApath = /opt/freeware/etc/stunnel/CA_files/</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; It's often easier to use CAfile</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;CAfile = /opt/freeware/etc/stunnel/ca.pem</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Don't forget to c_rehash CRLpath</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; CRLpath is located inside chroot jail</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;CRLpath = /crls</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Alternatively you can use CRLfile</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR><BR>; Some debugging stuff useful for troubleshooting</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>debug = 7</FONT><FONT size=3> </FONT><FONT
face=sans-serif size=2><BR><BR>; Use it for client mode</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>client = no</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>; Service-level configuration</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR><BR>[pesitip]</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>accept = 10443</FONT><FONT size=3> </FONT><FONT face=sans-serif size=2><BR>connect = XXXXXXX:10016</FONT></TD></TR></TBODY></TABLE><BR><FONT face=Times size=3><BR></FONT><FONT face=sans-serif size=2><BR><BR>Thanks for your help.</FONT><FONT face=Times size=3> </FONT><FONT face=sans-serif size=2><BR><BR>Regards.<BR><BR>Laurent UK</FONT><FONT face=Times size=3><BR><BR><BR></FONT>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="20%"><FONT face=Arial size=4><B>Internet </B></FONT><FONT size=3> </FONT><FONT face=sans-serif size=1><B><BR>josealf@rocketmail.com</B></FONT><FONT size=3> </FONT>
<P><FONT face=sans-serif size=1>03/05/2011 14:52</FONT><FONT size=3> </FONT><BR>
<TABLE width="100%" border=4>
<TBODY>
<TR vAlign=top>
<TD width="100%" bgColor=white>
<DIV align=center><FONT face=sans-serif size=1>Veuillez r�pondre �<BR>josealf@rocketmail.com</FONT></DIV></TD></TR></TBODY></TABLE><BR></P>
<TD width="79%"><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="5%">
<DIV align=right><FONT face=sans-serif size=1>Pour</FONT></DIV>
<TD width="94%"><FONT face=sans-serif size=1>Laurent UK, stunnel-users-bounces@stunnel.org, stunnel-users@stunnel.org</FONT><FONT size=3> </FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>cc</FONT></DIV>
<TD>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>Objet</FONT></DIV>
<TD><FONT face=sans-serif size=1>Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA</FONT></TD></TR></TBODY></TABLE><BR><FONT size=3><BR></FONT><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="50%">
<TD width="50%"></TD></TR></TBODY></TABLE><BR></TD></TR></TBODY></TABLE><BR><FONT face=Times size=3><BR><BR></FONT><FONT face=Times size=2><BR><BR>Laurent,<BR><BR>Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting.<BR><BR>You can check:<BR><BR>1. Does your stunnel client config has client=yes?<BR>2. Does your stunnel server config has client=no<BR>3. Check your packet flow, that is: your accept/connect settings.<BR><BR>Regards<BR>Jose<BR>-----Original Message-----<BR>From: laurent.uk@bnpparibas.com<BR>Sender: stunnel-users-bounces@stunnel.org<BR>Date: Tue, 3 May 2011 14:16:09 <BR>To: <stunnel-users@stunnel.org><BR>Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version<BR> number with cipher DES-CBC-SHA<BR><BR>_______________________________________________<BR>stunnel-users mailing
list<BR>stunnel-users@stunnel.org<BR>http://stunnel.mirt.net/mailman/listinfo/stunnel-users<BR><BR></FONT><FONT face=Times size=3><BR><BR><BR><BR><BR><BR><BR>This message and any attachments (the "message") is<BR>intended solely for the addressees and is confidential. <BR>If you receive this message in error, please delete it and <BR>immediately notify the sender. Any use not in accord with <BR>its purpose, any dissemination or disclosure, either whole <BR>or partial, is prohibited except formal approval. The internet<BR>can not guarantee the integrity of this message. <BR>BNP PARIBAS (and its subsidiaries) shall (will) not <BR>therefore be liable for the message if modified. <BR>Do not print this message unless it is necessary,<BR>consider the environment.<BR><BR> ---------------------------------------------<BR><BR>Ce message et toutes les pieces jointes (ci-apres le <BR>"message") sont etablis a
l'intention exclusive de ses <BR>destinataires et sont confidentiels. Si vous recevez ce <BR>message par erreur, merci de le detruire et d'en avertir <BR>immediatement l'expediteur. Toute utilisation de ce <BR>message non conforme a sa destination, toute diffusion <BR>ou toute publication, totale ou partielle, est interdite, sauf <BR>autorisation expresse. L'internet ne permettant pas <BR>d'assurer l'integrite de ce message, BNP PARIBAS (et ses<BR>filiales) decline(nt) toute responsabilite au titre de ce <BR>message, dans l'hypothese ou il aurait ete modifie.<BR>N'imprimez ce message que si necessaire,<BR>pensez a l'environnement. </FONT><BR></DIV></DIV></div></body></html>