<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Mike,<br>
<br>
I tried your config. I had to comment out the foreground and pid
statements, as they produced<br>
error messages (I'm running under Win 7). I also had to change the
server address to a valid one, <br>
but in any case I'm it's producing the same error. Here's the log:<br>
<br>
2013.10.24 17:23:28 LOG7[2824:2876]: Service [test_cli] accepted
(FD=436) from 127.0.0.1:49487<br>
2013.10.24 17:23:28 LOG7[2824:2876]: Creating a new thread<br>
2013.10.24 17:23:28 LOG7[2824:2876]: New thread created<br>
2013.10.24 17:23:28 LOG7[2824:3420]: Service [test_cli] started<br>
2013.10.24 17:23:28 LOG5[2824:3420]: Service [test_cli] accepted
connection from 127.0.0.1:49487<br>
2013.10.24 17:23:28 LOG6[2824:3420]: connect_blocking: connecting
69.16.186.7:443<br>
2013.10.24 17:23:28 LOG7[2824:3420]: connect_blocking: s_poll_wait
69.16.186.7:443: waiting 10 seconds<br>
2013.10.24 17:23:28 LOG5[2824:3420]: connect_blocking: connected
69.16.186.7:443<br>
2013.10.24 17:23:28 LOG5[2824:3420]: Service [test_cli] connected
remote server from 192.168.5.9:49488<br>
2013.10.24 17:23:28 LOG7[2824:3420]: Remote socket (FD=608)
initialized<br>
2013.10.24 17:23:28 LOG7[2824:3420]: SNI: sending servername:
news80.forteinc.com<br>
2013.10.24 17:23:28 LOG7[2824:3420]: SSL state (connect):
before/connect initialization<br>
2013.10.24 17:23:28 LOG7[2824:3420]: SSL state (connect): SSLv3
write client hello A<br>
2013.10.24 17:23:29 LOG7[2824:3420]: SSL state (connect): SSLv3 read
server hello A<br>
2013.10.24 17:23:29 LOG7[2824:3420]: Starting certificate
verification: depth=0, /C=US/ST=California/L=Escondido/O=Forte
Internet Software, Inc./OU=IT/CN=*.forteinc.com<br>
2013.10.24 17:23:29 LOG4[2824:3420]: CERT: Verification error:
unable to get local issuer certificate<br>
2013.10.24 17:23:29 LOG4[2824:3420]: Certificate check failed:
depth=0, /C=US/ST=California/L=Escondido/O=Forte Internet Software,
Inc./OU=IT/CN=*.forteinc.com<br>
2013.10.24 17:23:29 LOG7[2824:3420]: SSL alert (write): fatal:
unknown CA<br>
2013.10.24 17:23:29 LOG3[2824:3420]: SSL_connect: 14090086:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate
verify failed<br>
2013.10.24 17:23:29 LOG5[2824:3420]: Connection reset: 0 byte(s)
sent to SSL, 0 byte(s) sent to socket<br>
2013.10.24 17:23:29 LOG7[2824:3420]: Remote socket (FD=608) closed<br>
2013.10.24 17:23:29 LOG7[2824:3420]: Local socket (FD=436) closed<br>
2013.10.24 17:23:29 LOG7[2824:3420]: Service [test_cli] finished (1
left)<br>
<div class="moz-cite-prefix"><br>
<br>
Here's my own test configuration:<br>
<br>
debug = 7<br>
fips = no<br>
delay = yes<br>
output = stunnel.log<br>
<br>
[nntps.6]<br>
client = yes<br>
cafile = peer-nntps.6.pem<br>
verify = 4<br>
accept = 127.0.0.1:119<br>
connect = news80.forteinc.com:443<br>
<br>
Regards,<br>
<br>
Thomas<br>
<br>
<br>
On 10/24/2013 4:19 PM, Michal Trojnara wrote:<br>
</div>
<blockquote cite="mid:52698EE5.9090801@mirt.net" type="cite">
<pre wrap="">On 2013-10-24 23:07, Thomas Eifert wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I'm not having your luck. Out of ten services, I have eight verfiy =
4's that work as they should, and
two that need the CA certificate to be added.
</pre>
</blockquote>
<pre wrap="">I don't think it's about luck. I'm pretty sure there is something wrong
with your configuration. The one I sent you works fine. I won't be
able to diagnose yours, because you didn't send it. Please try to
reproduce my setup first. If it doesn't help solve the problem
immediately, send me your setup so I can reproduce your error.
BTW: I highly recommend reading:
<a class="moz-txt-link-freetext" href="http://www.chiark.greenend.org.uk/~sgtatham/bugs.html">http://www.chiark.greenend.org.uk/~sgtatham/bugs.html</a>
<a class="moz-txt-link-rfc2396E" href="http://www.chiark.greenend.org.uk/%7Esgtatham/bugs.html"><http://www.chiark.greenend.org.uk/%7Esgtatham/bugs.html></a>
Mike
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
stunnel-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a>
<a class="moz-txt-link-freetext" href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.</pre>
</body>
</html>