- stunnel-users - stunnel.org

Rare crashes of stunnel
by Don Lee 07 Feb '26

07 Feb '26

Hi guys, I have been running stunnel in production for my email server users. It’s been great. It’s pretty stable, and does all that I ned to allow my users to connect to my ancient mailserver (EIMS) with modern SSL. In fact, it’s been so stable that until recently I had no backup on stunnel It just ran. Unfortunately, I have had some incidents where stunnel just crashes. When it does, it looks like my email facilities are completely down - not good. I now have a script that monitors stunnel, and when stunnel dies, the script re-starts it. Below is a snippet of my stunnel log at the crash point. Does anyone else have this problem? Are the developers interested in my data? I installed it as a pre-built binary package, and this is the most recent version in the packages collection, so I am reluctant to build my own stunnel. Thank you for a great tool. -dgl- 2026.02.06 15:04:25 LOG5[75312]: Connection closed: 784 byte(s) sent to TLS, 224 byte(s) sent to socket 2026.02.06 15:04:25 LOG5[75311]: Connection closed: 2036 byte(s) sent to TLS, 22 9 byte(s) sent to socket 2026.02.06 15:04:25 LOG5[75313]: Service [imaps] accepted connection from 107.12 3.20.177:6908 2026.02.06 15:04:25 LOG5[75314]: Service [imaps] accepted connection from 107.12 3.20.177:9568 2026.02.06 15:04:25 LOG5[75313]: s_connect: connected 71.39.101.34:143 2026.02.06 15:04:25 LOG5[75313]: Service [imaps] connected remote server from 71 .39.101.39:49527 2026.02.06 15:04:25 LOG5[75314]: s_connect: connected 71.39.101.34:143 2026.02.06 15:04:25 LOG5[75314]: Service [imaps] connected remote server from 71 .39.101.39:49526 2026.02.06 15:04:28 LOG3[per-minute]: OCSP: OCSP_check_validity: /usr/src/crypto /external/bsd/openssl/dist/crypto/ocsp/ocsp_cl.c:378: error:2707307D:OCSP routin es:OCSP_check_validity:status expired 2026.02.06 15:04:28 LOG4[per-minute]: OCSP: Unknown verification status INTERNAL ERROR: Memory allocated in a different thread at ocsp.c, line 412 2026.02.06 15:04:41 LOG5[ui]: stunnel 5.73 on x86_64--netbsd platform 2026.02.06 15:04:41 LOG5[ui]: Compiled/running with OpenSSL 1.1.1t 7 Feb 2023 2026.02.06 15:04:41 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCS P,PSK,SNI Auth:LIBWRAP 2026.02.06 15:04:41 LOG5[ui]: Reading configuration from file /usr/pkg/etc/stunn el/stunnel.conf 2026.02.06 15:04:41 LOG5[ui]: UTF-8 byte order mark detected 2026.02.06 15:04:41 LOG5[ui]: OCSP: Connecting the AIA responder "http://status. rapidssl.com"

2 1

CoAP protocol support
by James Hanley 30 Jan '26

30 Jan '26

I’m not sure if this is the right forum but adding CoAP/CoAP support analogous to http/https but for both TCP/TLS & UDP/DTLS would be useful for testing. -Jim

2 1

Re: stunnel : SSL_connect: Peer suddenly disconnected
by Jose Alf. 19 Dec '25

19 Dec '25

Hi Souheila, Are you sure that you are running an NFS server in your azure machine that natively supports TLS? If you are not, you must put an stunnel wrapper in front of it. It looks to me that the NFS service exposed at 52.239.241.136:2049 does not support TLS. 2025.12.19 07:53:48 LOG7[0]: Service [52.239.241.136] started 2025.12.19 07:53:48 LOG7[0]: Setting local socket options (FD=584) 2025.12.19 07:53:48 LOG7[0]: Option TCP_NODELAY set on local socket 2025.12.19 07:53:48 LOG5[0]: Service [52.239.241.136] accepted connection from 127.0.0.1:58887 2025.12.19 07:53:48 LOG6[0]: s_connect: connecting 52.239.241.136:2049 2025.12.19 07:53:48 LOG7[0]: s_connect: s_poll_wait 52.239.241.136:2049: waiting 10 seconds 2025.12.19 07:53:48 LOG7[0]: FD=1040 ifds=rwx ofds=--- 2025.12.19 07:53:49 LOG5[0]: s_connect: connected 52.239.241.136:2049 2025.12.19 07:53:49 LOG5[0]: Service [52.239.241.136] connected remote server from 192.168.1.26:58888 2025.12.19 07:53:49 LOG7[0]: Setting remote socket options (FD=1040) 2025.12.19 07:53:49 LOG7[0]: Option TCP_NODELAY set on remote socket 2025.12.19 07:53:49 LOG7[0]: Remote descriptor (FD=1040) initialized 2025.12.19 07:53:49 LOG6[0]: SNI: sending servername: 52.239.241.136 2025.12.19 07:53:49 LOG7[0]: No previous session to resume 2025.12.19 07:53:49 LOG6[0]: Peer certificate not required 2025.12.19 07:53:49 LOG7[0]: TLS state (connect): before SSL initialization 2025.12.19 07:53:49 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2025.12.19 07:53:49 LOG7[0]: TLS alert (write): fatal: decode error 2025.12.19 07:53:49 LOG3[0]: SSL_connect: ssl/record/rec_layer_s3.c:696: error:0A000126:SSL routines::unexpected eof while reading 2025.12.19 07:53:49 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.12.19 07:53:49 LOG7[0]: Remote descriptor (FD=1040) closed 2025.12.19 07:53:49 LOG7[0]: local_rfd/local_wfd reset (FD=584) 2025.12.19 07:53:49 LOG7[0]: Local descriptor (FD=584) closed 2025.12.19 07:53:49 LOG7[0]: Service [52.239.241.136] finished (0 left) Regards,Jose A. Diaz On 18/12/2025, at 11:25 PM, Souheila Hechaichi via stunnel-users <stunnel-users(a)stunnel.org> wrote: Hey, I hope your help.The problem of 403754EAC87F0000:error:0A000126:SSL routines::unexpected eof while reading:../ssl/record/rec_layer_s3.c:696: is a bug in openssl version 3.x.xWhith my configuration OpenSSL 1.1.1f, the connection succeded but Its systematically closes <image.png> And with tcpdump I observe a connection reset<image.png>Best regards;From: Michał Trojnara via stunnel-users <stunnel-users(a)stunnel.org> Sent: Thursday, December 18, 2025 8:24 PM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: stunnel : SSL_connect: Peer suddenly disconnected Hi Souheila, It does not look like your remote machine accepts TLS: $ openssl s_client -connect 52.239.241.136:2049 Connecting to 52.239.241.136 CONNECTED(00000003) 403754EAC87F0000:error:0A000126:SSL routines::unexpected eof while reading:../ssl/record/rec_layer_s3.c:696: Why exactly do you think that stunnel could be used to mount NFS file shares? Stunnel can be a TLS client, but not an NFS client. Those aredifferent protocols. Best regards, Mike On 12/18/25 6:15 PM, Souheila Hechaichi via stunnel-users wrote: I am using stunnel to mount an azure nfs file share. The stunnel process log the following messageDec 18 17:55:20 vmubuntu18 stunnel: LOG3[23840]: SSL_connect: Peer suddenly disconnected The stunnel configure file isverifyChain = nodebug = debugoutput = /etc/stunnel/microsoft/aznfs/nfsv4_fileShare/logs/stunnel_52.239.241.136.logpid = /etc/stunnel/microsoft/aznfs/nfsv4_fileShare/logs/stunnel_52.239.241.136.pidTIMEOUTidle = 61 [52.239.241.136]client = yesaccept = 127.0.0.1:20049connect = 52.239.241.136:2049 A trace with tcpdump display the following logs<image.png> We observe a reset connection between azure server and my machine. Best regardsSouheila _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0

stunnel : SSL_connect: Peer suddenly disconnected
by Souheila Hechaichi 18 Dec '25

18 Dec '25

I am using stunnel to mount an azure nfs file share. The stunnel process log the following message Dec 18 17:55:20 vmubuntu18 stunnel: LOG3[23840]: SSL_connect: Peer suddenly disconnected The stunnel configure file is verifyChain = no debug = debug output = /etc/stunnel/microsoft/aznfs/nfsv4_fileShare/logs/stunnel_52.239.241.136.log pid = /etc/stunnel/microsoft/aznfs/nfsv4_fileShare/logs/stunnel_52.239.241.136.pid TIMEOUTidle = 61 [52.239.241.136] client = yes accept = 127.0.0.1:20049 connect = 52.239.241.136:2049 A trace with tcpdump display the following logs [cid:defde221-2fed-4b36-9480-0181f6f7d5a9] We observe a reset connection between azure server and my machine. Best regards Souheila

2 2

OCSPflag not processed in ocsp_stapling() ?
by King's Way 01 Dec '25

01 Dec '25

Hi there, I was trying to make stunnel ignore OCSP verification error for local certificates when doing OCSP Stapling. But it seems the flag "OCSPflag = NOVERIFY" is not properly passed to openssl. I have tried to patch it in function ocsp_stapling(), and it worked. But I wonder whether it is a bug or intentionally designed this way? With kind regards！ ------------------------------------------------------------ King's Way <io[AT]stdio.io<http://stdio.io>>

1 0

Getting Started - Unique Situation
by Kevin Morris 21 Nov '25

21 Nov '25

Hi All! About me: I've never heard of stunnel before but it sounds great. I'm not a networking/internet expert. Here is my situation: Platform: Microsoft Windows Server 2016. Two Network Interface Cards. Port 443 on both currently have HTTPS/TCP traffic on them, from two different Web Apps, each with their own domain. Everything is working properly, traffic is very low, only a few (about 20) hits per minute (each port) at max load. Both Web Apps are built using Lazarus, Free Pascal, Brook Framework. The Brook Framework has the built-in ability to handle SSL/TLS encryption. Certs are supplied by Let's Encrypt, and new certs are obtained by a bot. I now have a third and soon a forth Web App built using the same technology, but my only two 443 ports are occupied. Here is my requirement: I need something that will act as a "port splitter". Maybe this is also known as a reverse proxy. Example: Incoming URLs on port 443: https://mywebapp.companyname.com/bob/useraccount?act=login&exp=pg https://mywebapp.companyname.com/betty/useraccount?act=login&exp=pg The port splitter needs to recognize the part in teal green (maybe called an "entry point"?), and pass that unchanged traffic through to (and from) a port that the associated Web App is listening on. WebApp "bob" is listening on local port 449 (not exposed to the internet, only conversing with stunnel) WebApp "betty" is listening on local port 451 (not exposed to the internet, only conversing with stunnel) Both Web Apps will send/receive their own HTTPS traffic, handle their own decryption/encryption, and send it back through their respective listening ports, through the port splitter, back the the requesting user. No load balancing is required. No decryption/encryption/certs is/are required. This needs to happen downstream from our router, without making any changes to OS rules or router settings. I'd like to just shut down the current Web App listening on port 443, reconfig it to a new local port As I looked through the FAQ and manual, I could not determine if stunnel could do this. So my questions are: A) Can stunnel do this? B) If so, is there a "How To" I missed in the manual I can read to do this? C) If ((A = Yes) and B = No)), can you tell me in a couple sentences where to look in the config file to do some reading and get this set up? If we can get this working, there are other Lazarus/Brook developers who could benefit from using stunnel. If stunnel is not the answer, is there another "port splitter" piece of software that you know of that can? (other than IIS with ARR and WAP, I don't want to use those, I'm slowly trying to de-Microsoft my infrastructure.) Thanks in advance!

2 1

+=item B<requireCert> = yes | no ignored when client = yes
by u34＠net9.cf 13 Nov '25

13 Nov '25

In my opinion, the following emphasis worth including: --- stunnel.pod.in.orig 2025-10-07 19:50:30.097392645 +0000 +++ stunnel.pod.in.new 2025-10-07 20:25:54.448391940 +0000 @@ -1065,6 +1065,8 @@ =item B<requireCert> = yes | no +Ignored when client = yes. + require a client certificate for I<verifyChain> or I<verifyPeer> With I<requireCert> set to I<no>, the B<stunnel> server accepts client

2 1

stunnel 5.76 core dumped
by Bogdan Siara 02 Nov '25

02 Nov '25

Hi, I try to run stunnel with certs from hardware token and I get error: root@c6b200207f1a:/stunnel-5.76# stunnel free(): invalid pointer Aborted (core dumped) This is my configuration: engine = pkcs11 engineCtrl = MODULE_PATH:/usr/lib/libeToken.so engineCtrl = PIN:pin output = /var/log/stunnel.log debug=debug [in-hdt] client=no accept = 172.18.1.2:443 connect=127.0.0.1:8080 cert = /etc/stunnel/certs/hdt.pem key = /etc/stunnel/certs/hdt.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [in-vpc] client=no accept = 172.18.2.2:443 connect=127.0.0.1:8081 cert = /etc/stunnel/certs/vpc.pem key = /etc/stunnel/certs/vpc.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [in-iam] client=no accept = 172.18.3.2:443 connect=127.0.0.1:8082 cert = /etc/stunnel/certs/iam.pem key = /etc/stunnel/certs/iam.key sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-hdt] client=yes accept=8080 connect=ip1:443 engineId=pkcs11 sni = hdt cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-vpc] client=yes accept=8081 connect=ip2:443 engineId=pkcs11 sni = vpc cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug [out-iam] client=yes accept=8082 connect=ip3:443 engineId=pkcs11 sni = iam cert=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=cert key=pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=...;token=eToken;id=...;object=...;type=private;pin-value=pin sessionResume = no options = NO_TICKET retry=yes TIMEOUTclose = 0 debug=debug When I try run in gdb: root@c6b200207f1a:/stunnel-5.76# gdb stunnel GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from stunnel... (gdb) r Starting program: /usr/local/bin/stunnel [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [New Thread 0x7ffff789f640 (LWP 4875)] [Thread 0x7ffff789f640 (LWP 4875) exited] [New Thread 0x7ffff789f640 (LWP 4876)] [New Thread 0x7ffff6c78640 (LWP 4878)] free(): invalid pointer Thread 1 "stunnel" received signal SIGABRT, Aborted. __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737346406208) at ./nptl/pthread_kill.c:44 44 ./nptl/pthread_kill.c: No such file or directory. (gdb) stunnel is running in docker container ubuntu:22.04 Can someone tell where is the problem? Regards BS

1 0

Was LOG3[per-minute]: OCSP: SSL_get_certificate for a shared secret, PSK, configuration fixed with 5.76?
by u34＠net9.cf 01 Nov '25

01 Nov '25

Hello, At [stunnel 5.76 released](https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@st… - Missing OCSP stapling is no longer logged as an error. was mentioned in Bugfixes. My understanding is [LOG3[per-minute]: OCSP: SSL_get_certificate](https://www.stunnel.org/mailman3/hyperkitty/list/stunn… is fixed. But it isn't.

1 0

Should remote host IPs recorded at lower debug levels too?
by u34＠net9.cf 21 Oct '25

21 Oct '25

Does recording the IPs of the remote host depends on other configuration directives, other then the debug directive? Is it correct that at LOG5, IPs of the remote host are recorded at the log file? Is it correct that at LOG3, no IPs are recorded even when other information for a particular connection is considered worth recording? Aren't IPs considered important information worth recording when error conditions are recorded?

1 0