- stunnel-users - stunnel.org

client with two source IPs and one destination
by Brent Kimberley 11 May '20

11 May '20

Hi Daniele.I haven't looked at exact scenario. Have you considered stunnel+HAproxy? Dear group, I've to configure a couple of tunneled connections (call them TC1 and TC2), client side, on a linux system. The target of both such connections is the same (destination ip and port are the same, call it DST). At source side (my server) I have a two IP addresses (call them IP1 and IP2) assigned and currently working to its unique NIC. I normally use iptables SNAT to split the traffic between IP1 and IP2 depending on destination addresses but in this case I've to distinguish it at application level (TC1 and TC2). I'd like to get TC1 to set the outgoing traffic with source address IP1 and TC2 to set outgoing traffic with source address IP2. Tunnel Tunnel Client Server TC1: IP1 --\ >--> DST TC2: IP2 --/ I'm thinking to set one entry in stunnel.conf for each TC1 and TC2 and use *transparent* = source clause to set the source address but it seems my case is not so common and I didn't find documentation. Please could you suggest a solution. Thanks

1 0

iOS 13.4.1 Blue Iris
by John McClymont 11 May '20

11 May '20

Hi I have been using stunnel or a number of years to create a secure connect to CCTV recording software. Today after upgrading to IOS 13.4.1 I can no longer connect I ran generate self signed certificate, still fails. Searching I found others with similar problem, some have created a cert using other providers. I would prefer to generate from stunnel as I have always done config [BlueIris] accept=1440 connect=8080 cert = stunnel.pem I am no expert, basically followed a simple setup read few comments that it maybe due to IOS no longer supporting certain version of ssl Hopefully you can help Log 2020.05.11 22:59:04 LOG5[main]: stunnel 5.56 on x64-pc-mingw32-gnu platform 2020.05.11 22:59:04 LOG5[main]: Compiled/running with OpenSSL 1.1.1c 28 May 2019 2020.05.11 22:59:04 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2020.05.11 22:59:04 LOG5[main]: Reading configuration from file stunnel.conf 2020.05.11 22:59:04 LOG5[main]: UTF-8 byte order mark detected 2020.05.11 22:59:04 LOG6[main]: Initializing service [BlueIris] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: DH initialization not needed 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-pop3] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-imap] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-smtp] 2020.05.11 22:59:04 LOG6[main]: Initializing service [meinberg-smtp] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG4[main]: Service [meinberg-smtp] needs authentication to prevent MITM attacks 2020.05.11 22:59:04 LOG5[main]: Configuration successful 2020.05.11 22:59:04 LOG6[main]: Service [BlueIris] (FD=564) bound to 0.0.0.0:1440 2020.05.11 22:59:04 LOG6[main]: Service [gmail-pop3] (FD=728) bound to 127.0.0.1:110 2020.05.11 22:59:04 LOG6[main]: Service [gmail-imap] (FD=732) bound to 127.0.0.1:143 2020.05.11 22:59:04 LOG6[main]: Service [gmail-smtp] (FD=736) bound to 0.0.0.0:25 2020.05.11 22:59:04 LOG6[main]: Service [meinberg-smtp] (FD=740) bound to 192.168.0.2:2525 2020.05.11 22:59:04 LOG6[cron]: Executing cron jobs 2020.05.11 22:59:04 LOG6[cron]: Cron jobs completed in 0 seconds 2020.05.11 22:59:55 LOG5[0]: Service [BlueIris] accepted connection from 192.168.0.142:58797 2020.05.11 22:59:55 LOG6[0]: Peer certificate not required 2020.05.11 22:59:55 LOG3[0]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[1]: Service [BlueIris] accepted connection from 192.168.0.142:58798 2020.05.11 22:59:55 LOG6[1]: Peer certificate not required 2020.05.11 22:59:55 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[2]: Service [BlueIris] accepted connection from 192.168.0.142:58799 2020.05.11 22:59:55 LOG6[2]: Peer certificate not required 2020.05.11 22:59:55 LOG3[2]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[3]: Service [BlueIris] accepted connection from 192.168.0.142:58800 2020.05.11 22:59:55 LOG6[3]: Peer certificate not required 2020.05.11 22:59:55 LOG3[3]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[4]: Service [BlueIris] accepted connection from 192.168.0.142:58801 2020.05.11 22:59:55 LOG6[4]: Peer certificate not required 2020.05.11 22:59:55 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[5]: Service [BlueIris] accepted connection from 192.168.0.142:58802 2020.05.11 22:59:55 LOG6[5]: Peer certificate not required 2020.05.11 22:59:55 LOG3[5]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[6]: Service [BlueIris] accepted connection from 192.168.0.142:58803 2020.05.11 22:59:55 LOG6[6]: Peer certificate not required 2020.05.11 22:59:55 LOG3[6]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[7]: Service [BlueIris] accepted connection from 192.168.0.142:58804 2020.05.11 22:59:55 LOG6[7]: Peer certificate not required 2020.05.11 22:59:55 LOG3[7]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[8]: Service [BlueIris] accepted connection from 192.168.0.142:58805 2020.05.11 22:59:55 LOG6[8]: Peer certificate not required 2020.05.11 22:59:55 LOG3[8]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[9]: Service [BlueIris] accepted connection from 192.168.0.142:58806 2020.05.11 22:59:55 LOG6[9]: Peer certificate not required 2020.05.11 22:59:55 LOG3[9]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[10]: Service [BlueIris] accepted connection from 192.168.0.142:58807 2020.05.11 22:59:55 LOG6[10]: Peer certificate not required 2020.05.11 22:59:55 LOG3[10]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[11]: Service [BlueIris] accepted connection from 192.168.0.142:58808 2020.05.11 22:59:55 LOG6[11]: Peer certificate not required 2020.05.11 22:59:55 LOG3[11]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[12]: Service [BlueIris] accepted connection from 192.168.0.142:58809 2020.05.11 22:59:55 LOG6[12]: Peer certificate not required 2020.05.11 22:59:55 LOG3[12]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[13]: Service [BlueIris] accepted connection from 192.168.0.142:58810 2020.05.11 22:59:55 LOG6[13]: Peer certificate not required 2020.05.11 22:59:55 LOG3[13]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[14]: Service [BlueIris] accepted connection from 192.168.0.142:58811 2020.05.11 22:59:55 LOG6[14]: Peer certificate not required 2020.05.11 22:59:55 LOG3[14]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[15]: Service [BlueIris] accepted connection from 192.168.0.142:58812 2020.05.11 22:59:56 LOG6[15]: Peer certificate not required 2020.05.11 22:59:56 LOG3[15]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[16]: Service [BlueIris] accepted connection from 192.168.0.142:58813 2020.05.11 22:59:56 LOG6[16]: Peer certificate not required 2020.05.11 22:59:56 LOG3[16]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[17]: Service [BlueIris] accepted connection from 192.168.0.142:58814 2020.05.11 22:59:56 LOG6[17]: Peer certificate not required 2020.05.11 22:59:56 LOG3[17]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:56 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[18]: Service [BlueIris] accepted connection from 192.168.0.142:58815 2020.05.11 23:00:04 LOG6[18]: Peer certificate not required 2020.05.11 23:00:04 LOG3[18]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[19]: Service [BlueIris] accepted connection from 192.168.0.142:58816 2020.05.11 23:00:04 LOG6[19]: Peer certificate not required 2020.05.11 23:00:04 LOG3[19]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[20]: Service [BlueIris] accepted connection from 192.168.0.142:58817 2020.05.11 23:00:04 LOG6[20]: Peer certificate not required 2020.05.11 23:00:04 LOG3[20]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[21]: Service [BlueIris] accepted connection from 192.168.0.142:58818 2020.05.11 23:00:04 LOG6[21]: Peer certificate not required 2020.05.11 23:00:04 LOG3[21]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[22]: Service [BlueIris] accepted connection from 192.168.0.142:58819 2020.05.11 23:00:04 LOG6[22]: Peer certificate not required 2020.05.11 23:00:04 LOG3[22]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[23]: Service [BlueIris] accepted connection from 192.168.0.142:58820 2020.05.11 23:00:04 LOG6[23]: Peer certificate not required 2020.05.11 23:00:04 LOG3[23]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[24]: Service [BlueIris] accepted connection from 192.168.0.142:58821 2020.05.11 23:00:04 LOG6[24]: Peer certificate not required 2020.05.11 23:00:04 LOG3[24]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[25]: Service [BlueIris] accepted connection from 192.168.0.142:58822 2020.05.11 23:00:04 LOG6[25]: Peer certificate not required 2020.05.11 23:00:04 LOG3[25]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[26]: Service [BlueIris] accepted connection from 192.168.0.142:58823 2020.05.11 23:00:04 LOG6[26]: Peer certificate not required 2020.05.11 23:00:04 LOG3[26]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[27]: Service [BlueIris] accepted connection from 192.168.0.142:58824 2020.05.11 23:00:04 LOG6[27]: Peer certificate not required 2020.05.11 23:00:04 LOG3[27]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[28]: Service [BlueIris] accepted connection from 192.168.0.142:58825 2020.05.11 23:00:04 LOG6[28]: Peer certificate not required 2020.05.11 23:00:04 LOG3[28]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[29]: Service [BlueIris] accepted connection from 192.168.0.142:58826 2020.05.11 23:00:04 LOG6[29]: Peer certificate not required 2020.05.11 23:00:04 LOG3[29]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[30]: Service [BlueIris] accepted connection from 192.168.0.142:58827 2020.05.11 23:00:04 LOG6[30]: Peer certificate not required 2020.05.11 23:00:04 LOG3[30]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[31]: Service [BlueIris] accepted connection from 192.168.0.142:58828 2020.05.11 23:00:04 LOG6[31]: Peer certificate not required 2020.05.11 23:00:04 LOG3[31]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[32]: Service [BlueIris] accepted connection from 192.168.0.142:58829 2020.05.11 23:00:04 LOG6[32]: Peer certificate not required 2020.05.11 23:00:04 LOG3[32]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[33]: Service [BlueIris] accepted connection from 192.168.0.142:58830 2020.05.11 23:00:04 LOG6[33]: Peer certificate not required 2020.05.11 23:00:04 LOG3[33]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[33]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[34]: Service [BlueIris] accepted connection from 192.168.0.142:58831 2020.05.11 23:00:04 LOG6[34]: Peer certificate not required 2020.05.11 23:00:04 LOG3[34]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[34]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[35]: Service [BlueIris] accepted connection from 192.168.0.142:58832 2020.05.11 23:00:04 LOG6[35]: Peer certificate not required 2020.05.11 23:00:04 LOG3[35]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[35]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Solution: REDIR not Working in Chrome, Edge (new), Opera
by Joe Sterk 08 May '20

08 May '20

I found the solution to the REDIR issue posted in April. You can find more information at https://support.google.com/chrome/forum/AAAAP1KN0B02tttvx4VCDQ/?hl=en&gpf=%…. The issue is going from https --> http or https. Our software company added an additional CRLR at the end so it looks like this now: "HTTP/1.1 301 Moved Permanently\r\n" + "Location: https://www.abc.com<https://www.abc.com/>" + http.req.url.path_and_query.http_url_safe + "\r\n\r\n". Joe Sterk

1 0

Stunnel 4 with Shoutcast 2.6
by Ali 02 May '20

02 May '20

I am trying to add ssl to my shoutcast stream. I get the messages below when I try to start or restart shoutcast. I have purchased an ssl cert and key for this and it did not work via the shoutcast config, so I gave this a shot. The key and certs with combined into the stunnel.pem. See below and thanks for the help. I also added the stunnel config below. client=no [shoutcast] accept=8002 (I also tried 443) connect=localhost:8000 cert = /etc/stunnel/stunnel.pem pid=/etc/stunnel/stunnel.pid -permissions are set to chmod 600 Stunnel Dir root@kwaxstreamserver:/etc/stunnel# l cert.pem key.pem README stunnel.conf stunnel.pem Stunnel on START Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1063 data byte(s), 406 control byte(s) Stunnel on RESTART root@kwaxstreamserver:/etc/stunnel# /etc/init.d/stunnel4 restart Restarting SSL tunnels: Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file /etc/stunnel/stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1076 data byte(s), 406 control byte(s) [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file

2 1

REDIR not Working in Chrome, Edge (new), Opera
by Joe Sterk 30 Apr '20

30 Apr '20

We are running stunnel on a windows 2019 server. When running Chrome/Opera/Edge(new), on our redirect we get the following: Hmmm... can't reach this page It looks like the webpage at https://xx.xxxxxxxx.com/xap/tqv000?NAME=&domain=xxxxxxxx might be having issues, or it may have moved permanently to a new web address. ERR_RESPONSE_HEADERS_TRUNCATED The code that is being called is: !************************************************************************ B$='REDIR https://' + STRIP(HOST$) + '/mainlobby.aspx' We even tried to redirect to www.google.com<http://www.google.com/appserve/mkt/p/AM7kBiVHeOrDhOeWlVMENmuUHTN9kHtm1C15sn…> and got the same error. Our log files shows the following: [04/23/20 14:25:39 409 ]Q.BUTTON1 = Ok [04/23/20 14:25:39 409 ]REDIR http://www.google.com [04/23/20 14:25:39 409 ]Result=+OK REDIR [04/23/20 14:25:42 ]GET /xap/tqv001 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, */* The stunnel.conf file has the following connection information: sslVersion = all options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 ;header always set x-xss-protection "1; mode=block" ;ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ;options = CIPHER_SERVER_PREFERENCE TIMEOUTclose = 0 [https] accept = 443 connect = 8080 I don't see any error messages but the redirect is not working. It still works in IE and Firefox (for now). Joe Sterk CIO (Chief Information Officer) [Description: Description: cid:image004.jpg@01CD22BD.40F8C160] Insurance Services Corp. ? (972) 896-0384 (Mobile) * (707) 303-8105 (Work) * joes(a)QuieTrack.com<mailto:joes@QuieTrack.com>

1 0

Stunnel Cleanup on Uninstall
by Thomas Eifert 21 Apr '20

21 Apr '20

I've recently removed Stunnel 5.56 from several machines running Windows 10 x64. In every case, the uninstaller leaves behind the stunnel directory, bin subdirectory, and the file libssp-0.dll. Easy enough to remove manually, but I seem to recall in previous versions that the uninstaller managed to get everything. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

port ? and password
by Coviello, Paul 21 Apr '20

21 Apr '20

It's been awhile since I've played with this and now there is a need to bring it back online. Can I designate any port numbers? I have an application that requires 'a' on the client and 'b' on the server Also is there a way to change the password in the startup of stunnell on VMS? Thanks Paul

1 0

stunnel ignoring config file for port binding
by Tim Turner 18 Apr '20

18 Apr '20

Config and logs below but redacted, this is running on 2016 server, if it matters I am starting it over an RDP session I find that the port is ignored in the config file and it always binds to ports in the 23*** range ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /stunnel.log ; Use it for client mode client = yes ; Service-level configuration [Service Config] accept=127.0.0.1:40001 connect = redacted:443 log file 2020.04.18 10:08:18 LOG7[main]: Dispatching a signal from the signal pipe 2020.04.18 10:08:18 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2020.04.18 10:08:18 LOG7[main]: Running on Windows 6.2 2020.04.18 10:08:18 LOG5[main]: Reading configuration from file stunnel.conf 2020.04.18 10:08:18 LOG5[main]: UTF-8 byte order mark detected 2020.04.18 10:08:18 LOG7[main]: Compression disabled 2020.04.18 10:08:18 LOG7[main]: No PRNG seeding was required 2020.04.18 10:08:18 LOG6[main]: Initializing service [Service Config] 2020.04.18 10:08:18 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.04.18 10:08:18 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 2020.04.18 10:08:18 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2020.04.18 10:08:18 LOG7[main]: No certificate or private key specified 2020.04.18 10:08:18 LOG4[main]: Service [Digital-Prod-MTF-FIX-MD] needs authentication to prevent MITM attacks 2020.04.18 10:08:18 LOG5[main]: Configuration successful 2020.04.18 10:08:18 LOG7[main]: Deallocating section defaults 2020.04.18 10:08:18 LOG5[main]: Logging to C:\Users\turnert\AppData\Local\/stunnel.log 2020.04.18 10:08:18 LOG7[main]: Binding service [New Broker FIX Demo-Trading] 2020.04.18 10:08:18 LOG7[main]: Listening file descriptor created (FD=1296) 2020.04.18 10:08:18 LOG7[main]: Setting accept socket options (FD=1296) 2020.04.18 10:08:18 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.04.18 10:08:18 LOG6[main]: Service [New Broker FIX Demo-Trading] (FD=1296) bound to 127.0.0.1:23471 2020.04.18 10:08:18 LOG7[main]: Binding service [Service Config] This message and its attachments are confidential, may not be disclosed or used by any person other than the addressee and are intended only for the named recipient(s). If you are not the intended recipient, please notify the sender immediately and delete any copies of this message. LMAX Group is the holding company of LMAX Exchange, LMAX Global and LMAX Digital. Our registered address is Yellow Building, 1A Nicholas Road, London W11 4AN.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 189, Issue 3
by Brent Kimberley 10 Apr '20

10 Apr '20

Hi Andre. Can you please post your template? Salut, Brent Friday, April 10, 2020, 6:00:08 a.m. EDT, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. CERT: Pre-verification error: unsupported certificate purpose (Andr? L?onard) ---------------------------------------------------------------------- Message: 1 Date: Fri, 10 Apr 2020 09:46:29 +0200 From: Andr? L?onard <andre.leonard(a)celotoise.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CERT: Pre-verification error: unsupported certificate purpose Message-ID: <1a2bba7f82b899d6e208303bc3a8ad6d(a)celotoise.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi, I upgraded stunnel from version 5.44 to 5.56. But now I'm getting the following error : CERT: Pre-verification error: unsupported certificate purpose Rejected by CERT Setting verifiy to 0 slove temporary the issue but is not secure at all. As testing pupose, I recreated new certificate with the following command but ending with the same issue: openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem How to fix this ? Thanks for you help, Andr?.

1 0

CERT: Pre-verification error: unsupported certificate purpose
by André Léonard 10 Apr '20

10 Apr '20

Hi, I upgraded stunnel from version 5.44 to 5.56. But now I'm getting the following error : CERT: Pre-verification error: unsupported certificate purpose Rejected by CERT Setting verifiy to 0 slove temporary the issue but is not secure at all. As testing pupose, I recreated new certificate with the following command but ending with the same issue: openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem How to fix this ? Thanks for you help, André.

1 0

Stunnel to accept SSL and connect SSL
by Ray 08 Apr '20

08 Apr '20

Hi everyone, Simple question - How can I configure Stunnel to accept SSL from downlinks and connect to an SSL uplink? Thanks Ray

1 0

Stunnel API hooks
by Ray 31 Mar '20

31 Mar '20

Hi everyone, I want to do some processing over the incoming connection before forwarding the payload to the uplinks. ie. Listen <-> customized processing <-> connect Is there any API/hook structure to write my logic in a clean fashion? Or need to add/integrate my codes to the Stunnel codes? P.S I want this processing to be done in Stunnel and not by adding a 2nd application to achieve the job. Thanks Ray

1 0

Stunnel binary for macOS?
by Shrinidhi Rao 22 Mar '20

22 Mar '20

Greetings! I tried building stunnel in my mac and it was successful since I have all the developer tools installed. What about for those who do not have an 8GB size tool? Is there a way I can simply build a binary that can work in a wide range of macOS versions (including older ones)? Is there someone who has already done this? Any pointers in this regard would be greatly appreciated! -- Shrinidhi S Rao

2 1

stunnel squid proxy without client side stunnel
by claudiu vasadi 13 Mar '20

13 Mar '20

Hello list, I've successfully managed to setup the following: client -> stunnel (local on client) -> stunnel (on server) -> squid (same server) I was wondering however if it would be possible to NOT use stunnel on the client side and connect directly to the server side one. My current, working configs are below. simplified server side stunnel.conf: cert = /etc/stunnel/stunnel.pem debug = 7 output = /var/log/stunnel.log client = no [squid] accept = 3128 connect = 127.0.0.1:3129 client side config: cert = /etc/stunnel/stunnel.pem client = yes [squid] accept = 127.0.0.1:8080 connect = server:3128 On the server side, I've tried specifying: client = yes protocol = connect protocolHost = 127.0.0.1:3129 #SSL terminates on the stunnel server (still unsure about this) but because the proxy needs authentication (it used LDAP), I'm hitting what seems to be stunnel not returning the HTTP407 back to the client. 2020.03.13 20:18:34 LOG6[12306:140677061584640]: Client-mode connect protocol negotiations started 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> CONNECT 127.0.0.1:3129 HTTP/1.1 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> Host: 127.0.0.1:3129 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- HTTP/1.1 407 Proxy Authentication Required 2020.03.13 20:18:34 LOG3[12306:140677061584640]: CONNECT request rejected 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Server: squid/3.5.20 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Mime-Version: 1.0 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Date: Fri, 13 Mar 2020 20:18:34 GMT 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Type: text/html;charset=utf-8 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Length: 3431 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Vary: Accept-Language 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Language: en 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Proxy-Authenticate: Basic realm="myproxy" 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache: MISS from myproxy 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache-Lookup: NONE from myproxy:3129 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Via: 1.1 myproxy (squid/3.5.20) 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Connection: keep-alive 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- 2020.03.13 20:18:34 LOG5[12306:140677061584640]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket I'm testing with the following command from the client side: curl -U mysuer -x http://myproxy:3128 https://www.google.com Any help would be greatly appreciated.

1 0

S-tunnel will not send TLS
by Jan Falk 13 Mar '20

13 Mar '20

Hi. Can someone tell me why Stunnel stops at wating 10s? Log: 2020.03.12 09:43:36 LOG6[main]: Initializing service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.03.12 09:43:36 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 2020.03.12 09:43:36 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2020.03.12 09:43:36 LOG6[main]: Loading certificate from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Certificate loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Loading private key from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Private key loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG7[main]: Private key check succeeded 2020.03.12 09:43:36 LOG4[main]: Service [x3_x4_DICOM_BFT_client] uses "verifyChain" without subject checks 2020.03.12 09:43:36 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2020.03.12 09:43:36 LOG5[main]: Configuration successful 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_HL7_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=380) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=380) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_HL7_BFT_client] (FD=380) bound to 127.0.0.1:46161 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=492) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=492) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_DICOM_BFT_client] (FD=492) bound to 127.0.0.1:46162 2020.03.12 09:43:36 LOG7[cron]: Cron thread initialized 2020.03.12 09:43:36 LOG6[cron]: Executing cron jobs 2020.03.12 09:43:36 LOG6[cron]: Cron jobs completed in 0 seconds 2020.03.12 09:43:36 LOG7[cron]: Waiting 86400 seconds 2020.03.12 09:44:37 LOG7[main]: Found 1 ready file descriptor(s) 2020.03.12 09:44:37 LOG7[main]: FD=380 ifds=r-x ofds=r-- 2020.03.12 09:44:37 LOG7[main]: FD=388 ifds=r-x ofds=--- 2020.03.12 09:44:37 LOG7[main]: Service [SOS_SYNGO_HL7_BFT_client] accepted (FD=508) from 127.0.0.1:50299 2020.03.12 09:44:37 LOG7[main]: Creating a new thread 2020.03.12 09:44:37 LOG7[main]: New thread created 2020.03.12 09:44:37 LOG7[0]: Service [x3_x4_HL7_BFT_client] started 2020.03.12 09:44:37 LOG7[0]: Setting local socket options (FD=508) 2020.03.12 09:44:37 LOG7[0]: Option TCP_NODELAY set on local socket 2020.03.12 09:44:37 LOG5[0]: Service [x3_x4_HL7_BFT_client] accepted connection from 127.0.0.1:50299 2020.03.12 09:44:37 LOG6[0]: s_connect: connecting 10.67.6.106:6161 2020.03.12 09:44:37 LOG7[0]: s_connect: s_poll_wait 10.67.6.106:6161: waiting 10 seconds Thanks in advance //Janne

2 5

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 4
by Brent Kimberley 11 Mar '20

11 Mar '20

Hi Kelly. >>Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Generic: The following layers maybe helpful: Cost / People / Process / Infrastructure / Application / Data / Interface ... Specific: Data layer (metadata &/| configuration): Can you please verify that 127.0.01:1194 is present? e.g. netstat -ano | egrep -e Proto -e Active -e 1194 Message: 1 Date: Tue, 10 Mar 2020 13:25:33 +0800 From: Kelly Trinh <kelly(a)trinhonline.com> To: "stunnel-users" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] behaviour when using 127.0.0.1 in the 'connect' field Message-ID: <170c2e7c29d.e9c53ed9127299.5279211261811289922(a)trinhonline.com> Content-Type: text/plain; charset="utf-8" Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious.? Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS.? OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script.? I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated).? If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works!? The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443? # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

1 0

behaviour when using 127.0.0.1 in the 'connect' field
by Kelly Trinh 10 Mar '20

10 Mar '20

Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious. Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS. OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script. I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated). If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works! The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443 # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194 #<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

3 3

Re: [stunnel-users] (no subject)
by flash＠vicsmba.com 06 Mar '20

06 Mar '20

This can be O/S dependent – some O/S have limits on file descriptors, pipes, etc. I would check that. Second, broken pipes happen when one side closes when there is still action. In Unix C it is easy to do – if you use a piped open but you only want to get the first line of data so your read from the pipe and close … you get a broken pipe every time. This is harmless if that is what you want. Death if not. You might check your Oracle code for premature closing as I doubt it is stunnel. Can you trap the error and resume and see if it works? It well could. Essentially what I am saying is this is not directly a stunnel problem, more likely it is an implementation error. Which could be in the Oracle code as I have had problems with it in the past. More information on the O/S and the Oracle code would help. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Jose Alf. Sent: Wednesday, March 4, 2020 11:09 AM To: stunnel-users(a)stunnel.org; simona vittori <svittori(a)gmail.com> Subject: Re: [stunnel-users] (no subject) Simona, You are not giving enough information for anyone in this list to help you. Please review and apply How To Ask Questions The Smart Way <http://catb.org/~esr/faqs/smart-questions.html> How To Ask Questions The Smart Way and/or How to Report Bugs Effectively <https://www.chiark.greenend.org.uk/~sgtatham/bugs.html> How to Report Bugs Effectively Regards, Jose On Wednesday, March 4, 2020, 4:22:26 AM GMT-5, simona vittori <svittori(a)gmail.com <mailto:svittori@gmail.com> > wrote: Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 1
by Brent Kimberley 05 Mar '20

05 Mar '20

You might need to review the documentation for your thin driver. https://www.oracle.com/database/technologies/appdev/jdbc-ucp-19c-downloads.… On Wednesday, March 4, 2020, 6:00:07 a.m. EST, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. (no subject) (simona vittori) ---------------------------------------------------------------------- Message: 1 Date: Wed, 4 Mar 2020 10:21:56 +0100 From: simona vittori <svittori(a)gmail.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] (no subject) Message-ID: <CAMt_Qybr5aASRw-NokkhiQhe0dALW8kPEV+zCjU_dB7tz=FcYA(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

1 0

(no subject)
by simona vittori 04 Mar '20

04 Mar '20

Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

3 2

Windows Server 2003 issues with stunnel, TLS 1.2 on website(s)
by Sean Kelley 27 Feb '20

27 Feb '20

*Issue:* Old Windows Server cannot be upgraded, but needs TLS 1.2 encryption. Stunnel looks like a solution, but I'm having issues configuring it to work (It is "running" successfully with a pem file and port 442). In IIS Manager btw, the website SSL Port is set to 443. I've tried searching (i.e. google "site: https://www.stunnel.org/pipermail/stunnel-users/ server 2003") and have found a few leads, but nothing that addresses my issues in a way I understand. My ignorance I'm sure. *Server details:* * Windows Server 2003, Standard Edition, Service Pack 2 * IIS web server running 3 websites (ASP, PHP mix) * Valid Certificates from Lets Encrypt in Certificate Store * stunnel 5.49 (latest version I could find that works on 32bit OS's) sorry it's not the latest :( *Working Log with Port 442:* 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG7[main]: No limit detected for the number of clients 2020.02.24 15:24:37 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2020.02.24 15:24:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2020.02.24 15:24:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2020.02.24 15:24:37 LOG7[main]: errno: (*_errno()) 2020.02.24 15:24:37 LOG7[ui]: GUI message loop initialized 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG5[main]: Reading configuration from file stunnel.conf 2020.02.24 15:24:37 LOG5[main]: UTF-8 byte order mark detected 2020.02.24 15:24:37 LOG5[main]: FIPS mode disabled 2020.02.24 15:24:37 LOG7[main]: Compression disabled 2020.02.24 15:24:37 LOG7[main]: No PRNG seeding was required 2020.02.24 15:24:37 LOG6[main]: Initializing service [https] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03004004 (+0x00004000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG6[main]: Initializing service [domain] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03014004 (+0x00014000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG5[main]: Configuration successful 2020.02.24 15:24:37 LOG7[main]: Binding service [https] 2020.02.24 15:24:37 LOG7[main]: Listening file descriptor created (FD=292) 2020.02.24 15:24:38 LOG7[main]: Setting accept socket options (FD=292) 2020.02.24 15:24:38 LOG6[main]: Service [https] (FD=292) bound to 10.0.1.11:442 2020.02.24 15:24:38 LOG7[main]: Skipped SNI slave service [domain] 2020.02.24 15:24:38 LOG7[cron]: Cron thread initialized 2020.02.24 15:25:38 LOG6[cron]: Executing cron jobs 2020.02.24 15:25:38 LOG6[cron]: Cron jobs completed in 0 seconds 2020.02.24 15:25:38 LOG7[cron]: Waiting 86400 seconds *Log Error with port 443:* Binding service [https] to 10.0.1.11:443: Permission denied (WSAEACCES) (10013)* * *Conf:* ; Debugging stuff (may be useful for troubleshooting) debug = 7 ;output = stunnel.log ; TLS front-end to a web server [https] ; doesn't work with 443 below, works with 442 accept = 10.0.1.11:442 connect = 80 cert = C:\Program Files\stunnel\config\mywebsite.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 [domain] sni = https:mywebsite.com sni = https:www.mywebsite.com cert = C:\Program Files\stunnel\config\mywebsite.pem ; connect = 80 connect = localhost:80 client = no sslVersion = TLSv1.2 -------------- Thanks, Sean

3 3

TLS connection not successful
by maktoob bareed 25 Feb '20

25 Feb '20

Hi I am trying to make TLS connection with a server that supports TLSv1.2. but each time I receive the following error: SSL_connect: ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number Here is my service configuration: sslVersion = TLSv1.2 options = NO_SSLv2 options = -NO_SSLv3 accept = 5512 connect = XXXXXXXXX client = yes

1 0

How to use SNI
by Paul Coshott 17 Feb '20

17 Feb '20

Hi Everyone, I have a single domain on my internet server, but it has 3 sub-domains. A separate web app runs off each one, but I need all 3 to be secured with https. I have the ssl certificates I need, but I don't know how to format the SNI section for all 3 sub-domains. The 3 domains and ports I need are : app1.pcapps.one:449 -> 127.0.0.1:8080 app2.pcapps.one:450 -> 127.0.0.1:81 app3.pcapps.one:451 -> 127.0.0.1:82 each domain has a certificate such as : cert = C:\httpscert\app1.pcapps.one.pfx Can anyone tell me how to write out the SNI section to get this working? Thanks, Paul

2 1

HTTP 404 if I don't add 127.0.0.1 in my /etc/hosts
by Masih Tavassoli 16 Feb '20

16 Feb '20

Hi Experts: I am trying to do http->https proxy for one site only: [example-proxy] client = yes accept = 127.0.0.1:5000 sni =integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com checkHost = integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com verifyPeer = yes verifyChain = yes connect = 147.154.19.235:443 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem If I add the following in /etc/hosts all works ok 127.0.0.1 integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com And then I have to use http://integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com… However, I just want this address to work: http://10.0.0.33:5000/ic/ws/integration/v1/flows/soap/SM_INT10_CREAT_EBS_GT… : isn’t the whole point of setting SNI to send servername on your behalf: 2020.02.15 00:46:59 LOG6[46]: SNI: sending servername: integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com 2020.02.15 00:46:59 LOG6[46]: Peer certificate required 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): before SSL initialization 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read server hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read finished 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write finished 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) requested 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) succeeded 2020.02.15 00:46:59 LOG7[46]: 0 client renegotiation(s) requested 2020.02.15 00:46:59 LOG7[46]: 2 session reuse(s) 2020.02.15 00:46:59 LOG6[46]: TLS connected: previous session reused 2020.02.15 00:46:59 LOG6[46]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.02.15 00:46:59 LOG7[46]: Compression: null, expansion: null 2020.02.15 00:46:59 LOG6[46]: Session id: E003BBF100FA809D616B2F69E08BAF0119EA856FCEE6AD209BE95F7C5815380B 2020.02.15 00:48:05 LOG7[46]: TLS alert (read): warning: close notify 2020.02.15 00:48:05 LOG6[46]: TLS closed (SSL_read) What am I missing? Thanks Masi

1 0

How to pass URL parameters in connect to
by Shashank Shekhar 14 Feb '20

14 Feb '20

Hi, I am evaluating stunnel for a project. I want to translate a HTTP call to HTTPS. When I specify the URL to send to in the config file, I get error ""Unknown TCP service "443/api/path""". My config is as below: [https] client = yes accept = 4433 connect = myurl.com:443/api/path When I try the same thing without the sub-paths "/api/path" the connection works, but of course it doesn't hit the URL I want to hit. How do I achieve this? I tried going through the documentation, but couldn't figure it out. Any help will be greatly appreciated. Thank you, Shashank

2 1