- stunnel-users - stunnel.org

Problem with openssl-1.0.0
by Carter Browne 30 Mar '10

30 Mar '10

For the Windows version of stunnel-4.31 and 4.32 I tried running stunnel with openssl-1.0.0 compiled for Windows and ssleay32.dll renamed to libssl32.dll. When I make a connection using using stunnel, I get a invalid memory reference to location 0 in libeay32.dll. I have had no problem with this approach with many versions of openssl up through and including openssl-0.9.8n. Any ideas? Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

error:1408F10B
by Greg Groth 29 Mar '10

29 Mar '10

I'm having similar issues recently on two separate machines that are producing similar errors. In both instances, /var/log/messages starts filling up with lines similar to the following: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I can give further details on both systems, as well as the exact issue, if warranted. First off, can anyone explain what a 1408F10B error is? My gut feeling is that in both instances something changed on the client end (in both instances the client is a version of outlook). Any help would be greatly appreciated. Greg Groth

1 0

Re: [stunnel-users] GNU (clarification)
by tony westenhofer 27 Mar '10

27 Mar '10

Mr. Trojnara, That is what I was after: > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. Thank you again for such a wonderful piece of work-- And supporting it!!!!! Best Regards Tony > From: stunnel-users-request(a)mirt.net > Subject: stunnel-users Digest, Vol 68, Issue 9 > To: stunnel-users(a)mirt.net > Date: Sat, 27 Mar 2010 12:00:02 +0100 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: GNU (Michal Trojnara) > 2. Re: auto-disconnecting people when CRL updated (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 26 Mar 2010 22:27:51 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Subject: Re: [stunnel-users] GNU > To: stunnel-users(a)mirt.net > Message-ID: <201003262228.10766.Michal.Trojnara(a)mirt.net> > Content-Type: text/plain; charset="utf-8" > > tony westenhofer wrote: > > I am using stunnel (no code modifications) to encrypt communications > > for some applications to eventually be sold. First off outstanding work, > > stunnel saved hours of work having to figure out how to add the security > > desired. > > Thank you. That's exactly why I wrote it. 8-) > > > Now I am wanting to make sure to comply with licensing. > > Can someone be specific and help on this? > > As the author of stunnel I'll be glad to help. > > > I know we have to post a few things on the website for the > > product. (what? a link, an actually dl > > for stunnel...) > > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. > > > What about paper distribution for the product, what > > about stunnel must be included? > > I'm not sure I understand your question. > Do you distribute your software on paper? > > Do you mean any advertisement or documentation for your product? > The license does not require that you do anything about it, but it would be > nice of you to mention my name. > > Best regards, > Michal Trojnara > the author of stunnel >

1 0

auto-disconnecting people when CRL updated
by David van Zijl 26 Mar '10

26 Mar '10

Hello Is it possible to get stunnel to disconnect people on a graceful restart when a certificate has expired? Stunnel version 4.30 added the graceful reload option which is great because it will allow us to reload the CRLs, keep everybody connected and prevent new people connecting when their certs have expired (tested and working) - however existing connections are not terminated even though they have just expired... I'm not sure if we've missed a configuration option or if this is just not possible. A little background: We host an IRC server listening on localhost:6667, on top of that we have stunnel listening on the external interface port 6697 We're using the CAfile and CRLpath options to ensure that people are connecting with a valid certificate. Every hour a job runs to download the latest CRL files, if there is a change it restarts stunnel and kicks everybody off (we'd like to use a graceful restart instead) We are running stunnel on Red Hat Linux using the following line inside an init script to run it as a daemon: daemon /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Excerpt from stunnel.conf: setuid = daemon setgid = daemon ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [irc-in] CAfile = /etc/ca/our-chains.pem CRLpath = /etc/crl accept = 192.168.0.1:6697setuid = daemon setgid = daemon connect = localhost:6667 verify = 2 Running stunnel -version tells me: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Kind Regards Dave

2 1

GNU
by tony westenhofer 26 Mar '10

26 Mar '10

Hello, I am using stunnel (no code modifications) to encrypt communications for some applications to eventually be sold. First off outstanding work, stunnel saved hours of work having to figure out how to add the security desired. Now I am wanting to make sure to comply with licensing. Can someone be specific and help on this? I know we have to post a few things on the website for the product. (what? a link, an actually dl for stunnel...) What about paper distribution for the product, what about stunnel must be included? Please be as specific as you can or better yet point me to an example of someone else already giving proper credit where due. Again thank you for your hard work (all involved). Second question, any recommendations for securing the stunnel folder without interfering with its functionality on Windows systems. Have not had time to try locking down different ntfs setting yet. Thanks in advance and I do apologies if my questions have already been covered in the past. If so please provide url. Tony _________________________________________________________________ Hotmail is redefining busy with tools for the New Busy. Get more from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID27925::T:WLMTAGL:ON:…

2 1

Re: [stunnel-users] Stunnel 4.32 released
by Jose Alf. 26 Mar '10

26 Mar '10

Hi Michal, Thanks for the new 4.32 version. I tested beta 1 and 2 and everything worked fine on my side. Should have been released a day after because OpenSSL released a new version (0.9.8n) the same day. I compiled mine against it on Windows and it works. regards, Jose.

1 0

Still not working with client certificates
by Ron Cordell 24 Mar '10

24 Mar '10

Hello, I'm hoping that someone can give me a hint of where to look at this issue because I'm totally stuck and have been for a few days. When I attempt to use sTunnel in client mode with client certificates, the SSL seems to negotiate the certs and ciphers and then nothing else happens; the services hang. I'm hoping that someone has some insights about something that I haven't looked at, yet. My setup: Server: Windows Server, IIS 7 running SOAP services set for SSL Required, Client Certificate required (transport level client certificate, not SOAP message level). client: Windows machine, simple web application acting as a test client for the SOAP service. In between: sTunnel v4.32 Testing Scenario #1 -- Client configured to use client certificates directly against the IIS 7 service instance. This works as expected. Testing Scenario #2 -- Server configured to not require client certificates, but require SSL. sTunnel configured to listen on local port 8090 and forward to the IIS 7 server. This works as expected. Testing Scenario #3 -- Server configured to require client certificates. sTunnel configured to use client certificate as issued by a local CA in addition to the setup as before. This does not work, but hangs. sTunnel.conf: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = C:\certs\client-cert-for-internal-environments.pem ;key = c:\certs\test_cert.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [http] accept = 8090 ;connect = 10.12.32.164:443 connect = 10.12.32.68:1443 TIMEOUTclose = 0 ; vim:ft=dosini sTunnel log: 2010.03.24 11:54:31 LOG5[5616:5992]: Reading configuration from file stunnel.conf 2010.03.24 11:54:31 LOG7[5616:5992]: RAND_status claims sufficient entropy for the PRNG 2010.03.24 11:54:31 LOG7[5616:5992]: PRNG seeded successfully 2010.03.24 11:54:31 LOG7[5616:5992]: Certificate: C:\certs\client-cert-for-internal-environments.pem 2010.03.24 11:54:31 LOG7[5616:5992]: Certificate loaded 2010.03.24 11:54:31 LOG7[5616:5992]: Key file: C:\certs\client-cert-for-internal-environments.pem 2010.03.24 11:54:38 LOG7[5616:5992]: Private key loaded 2010.03.24 11:54:38 LOG7[5616:5992]: SSL context initialized for service http 2010.03.24 11:54:38 LOG5[5616:5992]: Configuration successful 2010.03.24 11:54:38 LOG5[5616:5992]: No limit detected for the number of clients 2010.03.24 11:54:38 LOG7[5616:5992]: FD=176 in non-blocking mode 2010.03.24 11:54:38 LOG7[5616:5992]: Option SO_REUSEADDR set on accept socket 2010.03.24 11:54:38 LOG7[5616:5992]: Service http bound to 0.0.0.0:8090 2010.03.24 11:54:38 LOG7[5616:5992]: Service http opened FD=176 2010.03.24 11:54:38 LOG3[5616:5992]: c:\temp\stunnel.log: Input/output error (5) 2010.03.24 11:54:38 LOG3[5616:5992]: Unable to open output file: c:\temp\stunnel.log 2010.03.24 11:54:38 LOG5[5616:5992]: stunnel 4.32 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.03.24 11:54:38 LOG5[5616:5992]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.03.24 11:54:54 LOG7[5616:6192]: Service http accepted FD=436 from 127.0.0.1:56102 2010.03.24 11:54:54 LOG7[5616:6192]: Creating a new thread 2010.03.24 11:54:54 LOG7[5616:6192]: New thread created 2010.03.24 11:54:54 LOG7[5616:6696]: Service http started 2010.03.24 11:54:54 LOG7[5616:6696]: FD=436 in non-blocking mode 2010.03.24 11:54:54 LOG7[5616:6696]: Option TCP_NODELAY set on local socket 2010.03.24 11:54:54 LOG5[5616:6696]: Service http accepted connection from 127.0.0.1:56102 2010.03.24 11:54:54 LOG7[5616:6696]: FD=456 in non-blocking mode 2010.03.24 11:54:54 LOG6[5616:6696]: connect_blocking: connecting 10.12.32.68:1443 2010.03.24 11:54:54 LOG7[5616:6696]: connect_blocking: s_poll_wait 10.12.32.68:1443: waiting 10 seconds 2010.03.24 11:54:54 LOG5[5616:6696]: connect_blocking: connected 10.12.32.68:1443 2010.03.24 11:54:54 LOG5[5616:6696]: Service http connected remote server from 10.12.47.109:56103 2010.03.24 11:54:54 LOG7[5616:6696]: Remote FD=456 initialized 2010.03.24 11:54:54 LOG7[5616:6696]: Option TCP_NODELAY set on remote socket 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): before/connect initialization 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write client hello A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server hello A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server certificate A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server done A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write client key exchange A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write finished A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 flush data 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read finished A 2010.03.24 11:54:54 LOG7[5616:6696]: 1 items in the session cache 2010.03.24 11:54:54 LOG7[5616:6696]: 1 client connects (SSL_connect()) 2010.03.24 11:54:54 LOG7[5616:6696]: 1 client connects that finished 2010.03.24 11:54:54 LOG7[5616:6696]: 0 client renegotiations requested 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server connects (SSL_accept()) 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server connects that finished 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server renegotiations requested 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache hits 2010.03.24 11:54:54 LOG7[5616:6696]: 0 external session cache hits 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache misses 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache timeouts 2010.03.24 11:54:54 LOG6[5616:6696]: SSL connected: new session negotiated 2010.03.24 11:54:54 LOG6[5616:6696]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 This is where things time out; nothing happens beyond this point.

1 0

Stunnel 4.32 released
by Michal Trojnara 24 Mar '10

24 Mar '10

Dear Users, I'm glad to announce a new version of stunnel. The ChangeLog entry: Version 4.32, 2010.03.24, urgency: MEDIUM: * New features - New service-level "libwrap" option for run-time control whether /etc/hosts.allow and /etc/hosts.deny are used for access control. Disabling libwrap significantly increases performance of stunnel. - Win32 DLLs for OpenSSL 0.9.8m. * Bugfixes - Fixed a transfer() loop issue with SSLv2 connections. - Fixed a "setsockopt IP_TRANSPARENT" warning with "local" option. - Logging subsystem bugfixes and cleanup. - Installer bugfixes for Vista and later versions of Windows. - FIPS mode can be enabled/disabled at runtime. SHA-1 value for stunnel-4.32.tar.gz: e9be8b9150d1c901a7c37b58494e351815147a79 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Trying to use client certificates but no success so far
by Ron Cordell 19 Mar '10

19 Mar '10

Hello, I'm trying to set up sTunnel to use client certificates in the following arrangement: Client Java Server (HTTP) --> sTunnel (HTTPS w/client cert) --> Windows IIS SOAP service, requires client cert The client certificate was generated from a MS CA cert generation tool, one we use for our internal certificates and our internal CA. The client cert was generated as a .pfx file and I used OpenSSL to convert it to a .pem file with the -nodes option. Testing without the client certificates shows that if the IIS hosted SOAP service is set to not require a client certificate, the sTunnel configuration works and we're able to communicate between the HTTP only client and the HTTPS IIS hosted service. However, once we add the certificate, the communication stops at the handshake. I'm wondering if I need to change the client .pem cert to have the private key (don't use the -nodes option when converting using OpenSSL). Here is the contents of the .conf file: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = user_cert.pem key = user_cert.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [http] accept = 8090 connect = 10.12.32.164:443 TIMEOUTclose = 0 ; vim:ft=dosini Here is the output from the log file showing two attempts to hit the service with the client cert, one from a browser and one from a bit of client code: 2010.03.19 09:58:27 LOG5[5864:4032]: Reading configuration from file stunnel.conf 2010.03.19 09:58:27 LOG7[5864:4032]: RAND_status claims sufficient entropy for the PRNG 2010.03.19 09:58:27 LOG7[5864:4032]: PRNG seeded successfully 2010.03.19 09:58:27 LOG7[5864:4032]: Certificate: user_cert.pem 2010.03.19 09:58:27 LOG7[5864:4032]: Certificate loaded 2010.03.19 09:58:27 LOG7[5864:4032]: Key file: user_cert.pem 2010.03.19 09:58:27 LOG7[5864:4032]: Private key loaded 2010.03.19 09:58:27 LOG7[5864:4032]: SSL context initialized for service http 2010.03.19 09:58:27 LOG5[5864:4032]: Configuration successful 2010.03.19 09:58:27 LOG5[5864:4032]: No limit detected for the number of clients 2010.03.19 09:58:27 LOG7[5864:4032]: FD=176 in non-blocking mode 2010.03.19 09:58:27 LOG7[5864:4032]: Option SO_REUSEADDR set on accept socket 2010.03.19 09:58:27 LOG7[5864:4032]: Service http bound to 0.0.0.0:8090 2010.03.19 09:58:27 LOG7[5864:4032]: Service http opened FD=176 2010.03.19 09:58:27 LOG5[5864:4032]: stunnel 4.31 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.03.19 09:58:27 LOG5[5864:4032]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.03.19 09:59:42 LOG7[5864:3864]: Service http accepted FD=440 from 127.0.0.1:49886 2010.03.19 09:59:42 LOG7[5864:3864]: Creating a new thread 2010.03.19 09:59:42 LOG7[5864:3864]: New thread created 2010.03.19 09:59:42 LOG7[5864:4328]: Service http started 2010.03.19 09:59:42 LOG7[5864:4328]: FD=440 in non-blocking mode 2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on local socket 2010.03.19 09:59:42 LOG5[5864:4328]: Service http accepted connection from 127.0.0.1:49886 2010.03.19 09:59:42 LOG7[5864:4328]: FD=460 in non-blocking mode 2010.03.19 09:59:42 LOG6[5864:4328]: connect_blocking: connecting 10.12.32.164:443 2010.03.19 09:59:42 LOG7[5864:4328]: connect_blocking: s_poll_wait 10.12.32.164:443: waiting 10 seconds 2010.03.19 09:59:42 LOG5[5864:4328]: connect_blocking: connected 10.12.32.164:443 2010.03.19 09:59:42 LOG5[5864:4328]: Service http connected remote server from 10.12.47.109:49887 2010.03.19 09:59:42 LOG7[5864:4328]: Remote FD=460 initialized 2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on remote socket 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): before/connect initialization 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client hello A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server hello A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server certificate A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server done A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client key exchange A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write finished A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 flush data 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read finished A 2010.03.19 09:59:42 LOG7[5864:4328]: 1 items in the session cache 2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects (SSL_connect()) 2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects that finished 2010.03.19 09:59:42 LOG7[5864:4328]: 0 client renegotiations requested 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects (SSL_accept()) 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects that finished 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server renegotiations requested 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache hits 2010.03.19 09:59:42 LOG7[5864:4328]: 0 external session cache hits 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache misses 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache timeouts 2010.03.19 09:59:42 LOG6[5864:4328]: SSL connected: new session negotiated 2010.03.19 09:59:42 LOG6[5864:4328]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2010.03.19 10:01:54 LOG3[5864:4328]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2010.03.19 10:01:54 LOG5[5864:4328]: Connection reset: 568 bytes sent to SSL, 0 bytes sent to socket 2010.03.19 10:01:54 LOG7[5864:4328]: Service http finished (0 left) 2010.03.19 10:03:28 LOG7[5864:3864]: Service http accepted FD=476 from 127.0.0.1:50155 2010.03.19 10:03:28 LOG7[5864:3864]: Creating a new thread 2010.03.19 10:03:28 LOG7[5864:3864]: New thread created 2010.03.19 10:03:28 LOG7[5864:1216]: Service http started 2010.03.19 10:03:28 LOG7[5864:1216]: FD=476 in non-blocking mode 2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on local socket 2010.03.19 10:03:28 LOG5[5864:1216]: Service http accepted connection from 127.0.0.1:50155 2010.03.19 10:03:28 LOG7[5864:1216]: FD=440 in non-blocking mode 2010.03.19 10:03:28 LOG6[5864:1216]: connect_blocking: connecting 10.12.32.164:443 2010.03.19 10:03:28 LOG7[5864:1216]: connect_blocking: s_poll_wait 10.12.32.164:443: waiting 10 seconds 2010.03.19 10:03:28 LOG5[5864:1216]: connect_blocking: connected 10.12.32.164:443 2010.03.19 10:03:28 LOG5[5864:1216]: Service http connected remote server from 10.12.47.109:50156 2010.03.19 10:03:28 LOG7[5864:1216]: Remote FD=440 initialized 2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on remote socket 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): before/connect initialization 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write client hello A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read server hello A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read finished A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write finished A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 flush data 2010.03.19 10:03:28 LOG7[5864:1216]: 1 items in the session cache 2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects (SSL_connect()) 2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects that finished 2010.03.19 10:03:28 LOG7[5864:1216]: 0 client renegotiations requested 2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects (SSL_accept()) 2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects that finished 2010.03.19 10:03:29 LOG7[5864:1216]: 0 server renegotiations requested 2010.03.19 10:03:29 LOG7[5864:1216]: 1 session cache hits 2010.03.19 10:03:29 LOG7[5864:1216]: 0 external session cache hits 2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache misses 2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache timeouts 2010.03.19 10:03:29 LOG6[5864:1216]: SSL connected: previous session reused 2010.03.19 10:04:28 LOG7[5864:1216]: Socket closed on read 2010.03.19 10:04:28 LOG7[5864:1216]: SSL write shutdown 2010.03.19 10:04:28 LOG7[5864:1216]: SSL alert (write): warning: close notify 2010.03.19 10:04:28 LOG6[5864:1216]: SSL_shutdown successfully sent close_notify 2010.03.19 10:04:28 LOG6[5864:1216]: s_poll_wait timeout: connection close 2010.03.19 10:04:28 LOG5[5864:1216]: Connection closed: 1541 bytes sent to SSL, 25 bytes sent to socket 2010.03.19 10:04:28 LOG7[5864:1216]: Service http finished (0 left) Any hints would be appreciated!

1 0

How to have multiple HTTPS connection with different PEM file
by Andrew Culross 18 Mar '10

18 Mar '10

We are running sTunnel 4.2 and want to have two HTTPS connection that use different PEM certs and are having difficulty doing this - how do you set this up? We have something like ---- Cert = cert1.pem [https] connect = xxx.xxx.xxx.xxx:442 connect = yyy.yyy.yyy.yyy:443 accept = 9876 ------ and we need something like this? -------- [https] connect = xxx.xxx.xxx.xxx:442 cert = cert1.pem accept = 9876 [https] connect = yyy.yyy.yyy.yyy:443 cert = cert2.pem accept = 9877 ----- Can we do that in the config file? If not, how does one specify ? Thanks! Andrew Culross TwoFour Systems 445 Hamilton Ave White Plains, NY 10601 Direct +1 (914) 220-8849 Main +1 (914) 220-8800 Fax +1 (914) 220-8899 <http://www.twofour.com/> www.TwoFour.com <http://www.twofour.com/emaildisclaimer.aspx> http://www.twofour.com/emaildisclaimer.aspx

2 1