<div dir="ltr"><div>This is not what I've understood from your first description. You would like to bridge TLSv1 to TLSv1.1 or TLSv1.2 before sending requests to a web proxy.</div><div><br></div><div>This is why I don't think stunnel is intended for that.</div><div><br></div><div>That said, if SSLV3 and TLSv1 have been deprecated, there's a good reason and you should seriously think to update your tools.<br></div><div><br></div><div>Regards,</div><div>Flo<br></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Dec 4, 2018 at 3:18 PM kovacs janos <<a href="mailto:kovacsjanosfasz@gmail.com">kovacsjanosfasz@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">well, it says this on the first line of the website:<br>
"Stunnel is a proxy designed to add TLS encryption functionality to<br>
existing clients and servers without any changes in the programs'<br>
code."<br>
<br>
i just want to add TLS functionality to client browsers which dont<br>
have it. i only need stunnel to decrypt TLS traffic going back to the<br>
browser.<br>
<br>
On 12/4/18, Flo Rance <<a href="mailto:trourance@gmail.com" target="_blank">trourance@gmail.com</a>> wrote:<br>
> Sorry I didn't read it correctly. I don't think this is something stunnel<br>
> can handle.<br>
><br>
> Regards,<br>
> Flo<br>
><br>
> On Mon, Dec 3, 2018 at 9:31 PM kovacs janos <<a href="mailto:kovacsjanosfasz@gmail.com" target="_blank">kovacsjanosfasz@gmail.com</a>><br>
> wrote:<br>
><br>
>> thank you for the reply,<br>
>> its the address and port where privoxy listens for requests.<br>
>> from the config file:<br>
>> "# 4.1. listen-address<br>
>> # ====================<br>
>> #<br>
>> # Specifies:<br>
>> #<br>
>> # The IP address and TCP port on which Privoxy will listen for<br>
>> # client requests."<br>
>> and under it:<br>
>><br>
>> listen-address <a href="http://127.0.0.1:8118" rel="noreferrer" target="_blank">127.0.0.1:8118</a><br>
>><br>
>> On 12/3/18, Flo Rance <<a href="mailto:trourance@gmail.com" target="_blank">trourance@gmail.com</a>> wrote:<br>
>> > Hi,<br>
>> ><br>
>> > It's not clear in your description what is running on 8118 local port.<br>
>> ><br>
>> > Regards,<br>
>> > Flo<br>
>> ><br>
>> > On Mon, Dec 3, 2018 at 2:40 PM kovacs janos <<a href="mailto:kovacsjanosfasz@gmail.com" target="_blank">kovacsjanosfasz@gmail.com</a>><br>
>> > wrote:<br>
>> ><br>
>> >> sorry to bother,<br>
>> >> im trying to make older browsers be able to display TLS 1.1 and TLS<br>
>> >> 1.2<br>
>> >> sites.<br>
>> >> i heard stunnel cant be configured to always forward to the current<br>
>> >> site address dynamically, thats why i would use privoxy.<br>
>> >> the browser is configured to send to:<br>
>> >> 127.0.0.1 443<br>
>> >><br>
>> >> stunnel config has this at the end:<br>
>> >> [Tunnel_in]<br>
>> >> client = yes<br>
>> >> accept = <a href="http://127.0.0.1:443" rel="noreferrer" target="_blank">127.0.0.1:443</a><br>
>> >> connect = <a href="http://127.0.0.1:8118" rel="noreferrer" target="_blank">127.0.0.1:8118</a><br>
>> >> verifyChain = yes<br>
>> >> CAfile = ca-certs.pem<br>
>> >> checkHost = localhost<br>
>> >><br>
>> >> <a href="http://127.0.0.1:8118" rel="noreferrer" target="_blank">127.0.0.1:8118</a> is the privoxy address.<br>
>> >> this is what stunnel writes:<br>
>> >> LOG5[main]: Configuration successful<br>
>> >> LOG5[0]: Service [Tunnel_in] accepted connection from <a href="http://127.0.0.1:3261" rel="noreferrer" target="_blank">127.0.0.1:3261</a><br>
>> >> LOG5[0]: s_connect: connected <a href="http://127.0.0.1:8118" rel="noreferrer" target="_blank">127.0.0.1:8118</a><br>
>> >> LOG5[0]: Service [Tunnel_in] connected remote server from<br>
>> <a href="http://127.0.0.1:3262" rel="noreferrer" target="_blank">127.0.0.1:3262</a><br>
>> >><br>
>> >> and the browser infinitely loads, and never loads anything or leaves<br>
>> >> the<br>
>> >> page.<br>
>> >> if i remove the last 3 lines, its the same just with this line added:<br>
>> >> LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM<br>
>> >> attacks<br>
>> >><br>
>> >> but it doesnt give an error or anything.<br>
>> >><br>
>> >> with a configuration like:<br>
>> >> [Tunnel_out]<br>
>> >> client = no<br>
>> >> accept = <a href="http://127.0.0.1:443" rel="noreferrer" target="_blank">127.0.0.1:443</a><br>
>> >> connect = <a href="http://127.0.0.1:8118" rel="noreferrer" target="_blank">127.0.0.1:8118</a><br>
>> >> cert = stunnel.pem<br>
>> >><br>
>> >> this is what it gives:<br>
>> >> LOG5[3]: Service [Tunnel_out] accepted connection from <a href="http://127.0.0.1:3294" rel="noreferrer" target="_blank">127.0.0.1:3294</a><br>
>> >> LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL<br>
>> >> routines:SSL23_GET_CLIENT_HELLO:https proxy request<br>
>> >> LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to<br>
>> >> socket<br>
>> >><br>
>> >> and browser gives a server not found error immediately. im not even<br>
>> >> sure if i should use client or server configuration in a case like<br>
>> >> this, but none of them works anyway. all i would need is for my<br>
>> >> browser to get the pages decrypted, or at least in less than TLS1.1.<br>
>> >> like how on <a href="http://newipnow.com" rel="noreferrer" target="_blank">newipnow.com</a> i can access sites with any encryption, since<br>
>> >> they are sent to the browser without encryption. the browser just<br>
>> >> gives an "unencrypted tunnel" warning, which is how i found stunnel,<br>
>> >> and which is exactly what i need, just locally.<br>
>> >> _______________________________________________<br>
>> >> stunnel-users mailing list<br>
>> >> <a href="mailto:stunnel-users@stunnel.org" target="_blank">stunnel-users@stunnel.org</a><br>
>> >> <a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" rel="noreferrer" target="_blank">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br>
>> >><br>
>> ><br>
>><br>
><br>
</blockquote></div>