<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p>Hello, </p><p>I'm encountering an issue while using sTunnel with an Office365 account. </p><p>sTunnel worked properly for a few months, while it gived an error with certificates since yesterday, whilst didn't change anything in the configuration. </p><p>This is our configuration:</p><p>[pop3s]<br>client = yes<br>accept = 127.0.0.1:2001<br>connect = outlook.office365.com:995<br>CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem<br>checkHost = outlook.office365.com<br>verifyChain = yes<br>OCSPaia = yes</p><p>This is what we get in the log:</p><p>2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s)<br>2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=---<br>2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) from 127.0.0.1:49619<br>2018.11.09 11:34:09 LOG7[main]: Creating a new thread<br>2018.11.09 11:34:09 LOG7[main]: New thread created<br>2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started<br>2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672)<br>2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket<br>2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection from 127.0.0.1:49619<br>2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0<br>2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 40.101.9.178:995<br>2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 40.101.9.178:995: waiting 10 seconds<br>2018.11.09 11:34:09 LOG5[30]: s_connect: connected 40.101.9.178:995<br>2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server from 172.31.20.23:49620<br>2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668)<br>2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket<br>2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized<br>2018.11.09 11:34:09 LOG6[30]: SNI: sending servername: outlook.office365.com<br>2018.11.09 11:34:09 LOG6[30]: Peer certificate required<br>2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect initialization<br>2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client hello A<br>2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello A<br>2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA<br>2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded<br>2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate<br>2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA<br>2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1<br>2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded<br>2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocsp.digicert.com"<br>2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80<br>2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds<br>2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80<br>2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocsp.digicert.com:80<br>2018.11.09 11:34:09 LOG7[30]: OCSP: Response received<br>2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good<br>2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT<br>2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT<br>2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted<br>2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1<br>2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com<br>2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded<br>2018.11.09 11:34:09 LOG6[30]: CERT: Host name "outlook.office365.com" matched with "*.office365.com"<br>2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocspx.digicert.com"<br>2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80<br>2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds<br>2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80<br>2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocspx.digicert.com:80<br>2018.11.09 11:34:09 LOG7[30]: OCSP: Response received<br>2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized<br>2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com<br>2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure<br>2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed<br>2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket<br>2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for session connect address<br>2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed<br>2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed<br>2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left)<br></p><p><br></p><p>Can you please help me?<br></p><p>Thanks in advance!</p></body></html>