- stunnel-users - stunnel.org

How to use static DH parameters?
by Ian Pilcher 28 Feb '26

28 Feb '26

I am trying to configure stunnel to use static DH parameters. The man page says: Alternatively, it is possible to specify static DH parameters in the certificate file, which disables generating temporary DH parameters: openssl dhparam 2048 >> stunnel.pem But, I'm not 100% clear on what certificate file it is talking about. My configuration looks like this. [switch2-frontend] accept = 0.0.0.0:8402 CAfile = /etc/ipa/ca.crt cert = /etc/pki/tls/certs/stunnel/switch2.crt key = /tmp/keys/switch2.key connect = 127.255.255.254:8082 [switch2-backend] client = yes accept = 127.255.255.254:8082 connect = 172.31.4.2:443 verifyChain = yes checkHost = switch2.penurio.us CAfile = /etc/pki/tls/certs/stunnel/switch-ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 0 OCSPrequire = no OCSPaia = no Would I add the DH parameters to /etc/pki/tls/certs/stunnel/switch2.crt? Thanks! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

2 1

List server change
by Michał Trojnara 28 Feb '26

28 Feb '26

Dear users, The list address has been changed from stunnel-users(a)stunnel.org to stunnel-users(a)lists.stunnel.org. Please let me know if you experience any issues caused by this change. Best regards, Mike

1 0

Fwd: timegm not supported in AIX
by shubham gupta 26 Feb '26

26 Feb '26

Hi, Sorry for the wrong patch. I have attached the corrected one in this email. Thanks, Shubham ---------- Forwarded message --------- From: shubham gupta <shubham17031994(a)gmail.com> Date: Thu, Feb 26, 2026 at 2:55 PM Subject: timegm not supported in AIX To: <stunnel-users(a)stunnel.org> Hi, I am building the latest stunnel on an AIX machine. However I see build failure due to missing API timegm. Snippet from the error generating file src/oscp.c #ifdef _WIN32 return _mkgmtime(&tm); #else /* defined _WIN32 */ return timegm(&tm); #endif /* defined _WIN32 */ Error log: libtool: link: /opt/freeware/bin/gcc -maix64 -O2 -DOPENSSL_NO_PSK -g -O2 -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-deprecated-declarations -Wno-unused-command-line-argument -fPIE -D_FORTIFY_SOURCE=2 -Wl,-blibpath:/opt/freeware/lib64:/opt/freeware/lib:/usr/lib:/lib -fPIE -pie -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-ocsp.o stunnel-fd.o stunnel-dhparam.o stunnel-cron.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/usr/lib -lssl -lcrypto -L/opt/freeware/lib64 -L/opt/freeware/lib -lpthread ld: 0711-317 ERROR: Undefined symbol: .timegm Please consider the patch attached along with the email for fixing the issue. Thanks, Shubham [image: Mailsuite] Email tracked with Mailsuite · Opt out <https://u.list-prefs.com/en/privacy/opt-out/unsubscribe/906ba64869a1f2284b6…> 26/02/26, 14:51:51

2 2

systemd and stunnel.service
by Mike 25 Feb '26

25 Feb '26

I'm setting up a new ubuntu server and it includes stunnel version 5.74. My ultimate goal is to have the service managed by systemd. Things didn't really work out of the box because of the needed configuration file which I was able to use from an existing didn't have the appropriate information in it. So, even though it would start (using initd), when I would try to stop it, it wouldn't. This turned out to be pretty straightforward solve by adding the following to my one and only conf file: setuid = stunnel4 setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel4.pid While the example file in /usr/share/doc/stunnel4/examples/stunnel.conf-sample had these entries in the file, they were commented out and I wasn't sure if that those were actual defaults, or needed to be uncommented for production. The later seemed to be the case. After fixing that, I was able to use systemctl start/stop as normal, however I noticed that it was being started by the old initd setup. #system status stunnel4 ● stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons) Loaded: loaded (/etc/init.d/stunnel4; generated) Active: active (running) since Tue 2026-02-24 20:35:35 CST; 2s ago Invocation: 343fad33bfb949aa8b48285e37c7f05a Docs: man:systemd-sysv-generator(8) Process: 4754 ExecStart=/etc/init.d/stunnel4 start (code=exited, status=0/SUCCESS) Tasks: 4 (limit: 4367) CPU: 192ms CGroup: /system.slice/stunnel4.service So after further searching I found the following files: /usr/lib/systemd/system/stunnel.target /usr/lib/systemd/system/stunnel@.service I executed the command: systemctl enable stunnel@myconffile When I use this command: systemctl start stunnel@myconffile It definitely executes the correct command, but then the whole service shuts down and I get this: ○ stunnel(a)myconffile.service - TLS tunnel for network daemons - per-config-file service Loaded: loaded (/etc/systemd/system/stunnel@.service; enabled; preset: enabled) Active: inactive (dead) since Tue 2026-02-24 20:44:54 CST; 11s ago Duration: 20.157s Invocation: 46cddb34062b401b87e8516f47b1482b Docs: man:stunnel4(8) Process: 5099 ExecStart=/usr/bin/stunnel4 /etc/stunnel/attuverse.conf (code=exited, status=0/SUCCESS) Main PID: 5099 (code=exited, status=0/SUCCESS) CPU: 128ms No stunnel service is running. There wasn't anything in the log that I could find that would indicate why it stopped. if I execute this command: /usr/bin/stunnel4 /etc/stunnel/myconffile.conf It works how I would expect it to. For now I'm using the initd initialization, but I would love to get the systemd version running. Anyone have some suggestions? Thanks. Mike

4 13

Question on 5.77 found differences.
by Michael D. Setzer II 18 Feb '26

18 Feb '26

Did the configure and make and then make install, but it didn't work as it had on 5.76 since it was saying stunnel.conf was in wrong place?? Had always had in /etc/stunnel/stunnel.conf with both the fedora version and the 5.76 binary files in ls /usr/local/bin/stunnel* -l 796752 Feb 18 13:20 /usr/local/bin/stunnel 2793 Feb 18 13:20 /usr/local/bin/stunnel3 792448 Feb 18 13:19 /usr/local/bin/stunnel-5.76 For 5.77 had to copy stunnel.conf /usr/local/etc/stunnel/stunnel.conf Had just done ./configure make make install stunnel -version Initializing inetd mode configuration stunnel 5.77 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 3.2.6 30 Sep 2025 Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:FIPS,OCSP,PSK,SNI Global options: fips = no RNDbytes = 1024 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS:!DH:!kDHEPSK (with "fips = yes") ciphers = HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK (with "fips = no") ciphersuites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_C HACHA20_POLY1305_SHA256 (with TLSv1.3) curves = P-256:P-521:P-384 (with "fips = yes") curves = X25519:P-256:X448:P-521:P-384 (with "fips = no") debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 securityLevel = 2 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 131072 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds TIMEOUTocsp = 5 seconds verify = none Ports shows: # lsof -i | grep stunnel stunnel 171807 nobody 9u IPv4 388014 0t0 TCP localhost:20995 (LISTEN) stunnel 171807 nobody 10u IPv4 388015 0t0 TCP localhost:20465 (LISTEN) stunnel 171807 nobody 11u IPv4 388016 0t0 TCP localhost:20993 (LISTEN) stunnel 171807 nobody 12u IPv4 388017 0t0 TCP localhost:20996 (LISTEN) stunnel 171807 nobody 13u IPv4 388018 0t0 TCP localhost:20466 (LISTEN) stunnel 171807 nobody 14u IPv4 388019 0t0 TCP localhost:10995 (LISTEN) stunnel 171807 nobody 15u IPv4 388020 0t0 TCP localhost:10465 (LISTEN) So, all seems fine, but not clear on why location of stunnel.conf changed. Another thing tried to look at donate option and goes to this page https://business.revolut.com/revolutme/mobicompolska But shows. User not found Use for my personal setup with Pegasus Email to 3 ISPs, but was looking to give something. Thanks. Using Fedora 42 and 43 systems, but now using the stunnel.org setup instead of fedora's repos version. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com mailto:msetzerii@gmx.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

1 0

stunnel 5.77 released
by Michał Trojnara 17 Feb '26

17 Feb '26

Dear Users, I have released version 5.77 of stunnel. ### Version 5.77, 2026.02.17, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.5. * Bugfixes - Avoid attempting to fetch OCSP stapling for PSK-only configuration sections. * Features - Merged applicable patches from Fedora and Debian: - Use SOURCE_DATE_EPOCH for reproducible builds. - Skip the OpenSSL version check when AUTOPKGTEST_TMP is set. - Enable PrivateTmp in the stunnel.service template. - Clarify the manual page for the "curves" option. - Log client IP addresses on TLS errors. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ec026f4fae4e0d25b940cc7a9451d925e359e7fd59e9edad20baea66ce45f263 stunnel-5.77.tar.gz 59ba0c5330de85ef474164b40cc559b2eb4e2b8d788c48b564e2257efa236384 stunnel-5.77-win64-installer.exe 718431a1d3c889806b61d6f082bbfaaa29529ce422d8115ad2211574dfb89ec1 stunnel-5.77-android.zip Best regards, Mike

1 0

Question on trying to setup stunnel 5.76 on Fedora 42/43 system.
by Michael D. Setzer II 13 Feb '26

13 Feb '26

Run into some issues with trying to upgrade the stunnel to 5.76 version while Fedora repos version is still at 5.75. Found one thing that showed using this configurations options. ./configure \ --sysconfdir=/etc \ --localstatedir=/var \ --enable-systemd \ --with-ssl=/usr But using it, the stunnel 5.76 is still installing in /usr/local/bin? Also, finding the systemctl status stunnel is still showing the /usr/bin/stunnel 5.75 being run? Removed the fedora repo version, and then systemctl no longer shows a service for stunnel, but run it manually at boot, and it works fine. Seems the fedora version has a ENGINE option that the stunnel option doesn't. stunnel -version Initializing inetd mode configuration stunnel 5.76 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 3.2.6 30 Sep 2025 Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:FIPS,OCSP,PSK,SNI Global options: fips = no RNDbytes = 1024 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS:!DH:!kDHEPSK (with "fips = yes") ciphers = HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK (with "fips = no") ciphersuites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_C HACHA20_POLY1305_SHA256 (with TLSv1.3) curves = P-256:P-521:P-384 (with "fips = yes") curves = X25519:P-256:X448:P-521:P-384 (with "fips = no") debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 securityLevel = 2 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 131072 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds TIMEOUTocsp = 5 seconds verify = none Know that sometmes the fedora repo doesn't update each time, or it takes more time? Is there way to install the latest version and have the systemd setup to work. At present, have the Fedora repo version uninstalled, and run the stunnel in rc.local? Thanks. +------------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor (Retired) mailto:mikes@guam.net mailto:msetzerii@gmail.com mailto:msetzerii@gmx.com Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +------------------------------------------------------------+

2 2

Rare crashes of stunnel
by Don Lee 07 Feb '26

07 Feb '26

Hi guys, I have been running stunnel in production for my email server users. It’s been great. It’s pretty stable, and does all that I ned to allow my users to connect to my ancient mailserver (EIMS) with modern SSL. In fact, it’s been so stable that until recently I had no backup on stunnel It just ran. Unfortunately, I have had some incidents where stunnel just crashes. When it does, it looks like my email facilities are completely down - not good. I now have a script that monitors stunnel, and when stunnel dies, the script re-starts it. Below is a snippet of my stunnel log at the crash point. Does anyone else have this problem? Are the developers interested in my data? I installed it as a pre-built binary package, and this is the most recent version in the packages collection, so I am reluctant to build my own stunnel. Thank you for a great tool. -dgl- 2026.02.06 15:04:25 LOG5[75312]: Connection closed: 784 byte(s) sent to TLS, 224 byte(s) sent to socket 2026.02.06 15:04:25 LOG5[75311]: Connection closed: 2036 byte(s) sent to TLS, 22 9 byte(s) sent to socket 2026.02.06 15:04:25 LOG5[75313]: Service [imaps] accepted connection from 107.12 3.20.177:6908 2026.02.06 15:04:25 LOG5[75314]: Service [imaps] accepted connection from 107.12 3.20.177:9568 2026.02.06 15:04:25 LOG5[75313]: s_connect: connected 71.39.101.34:143 2026.02.06 15:04:25 LOG5[75313]: Service [imaps] connected remote server from 71 .39.101.39:49527 2026.02.06 15:04:25 LOG5[75314]: s_connect: connected 71.39.101.34:143 2026.02.06 15:04:25 LOG5[75314]: Service [imaps] connected remote server from 71 .39.101.39:49526 2026.02.06 15:04:28 LOG3[per-minute]: OCSP: OCSP_check_validity: /usr/src/crypto /external/bsd/openssl/dist/crypto/ocsp/ocsp_cl.c:378: error:2707307D:OCSP routin es:OCSP_check_validity:status expired 2026.02.06 15:04:28 LOG4[per-minute]: OCSP: Unknown verification status INTERNAL ERROR: Memory allocated in a different thread at ocsp.c, line 412 2026.02.06 15:04:41 LOG5[ui]: stunnel 5.73 on x86_64--netbsd platform 2026.02.06 15:04:41 LOG5[ui]: Compiled/running with OpenSSL 1.1.1t 7 Feb 2023 2026.02.06 15:04:41 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCS P,PSK,SNI Auth:LIBWRAP 2026.02.06 15:04:41 LOG5[ui]: Reading configuration from file /usr/pkg/etc/stunn el/stunnel.conf 2026.02.06 15:04:41 LOG5[ui]: UTF-8 byte order mark detected 2026.02.06 15:04:41 LOG5[ui]: OCSP: Connecting the AIA responder "http://status. rapidssl.com"

2 1

CoAP protocol support
by James Hanley 30 Jan '26

30 Jan '26

I’m not sure if this is the right forum but adding CoAP/CoAP support analogous to http/https but for both TCP/TLS & UDP/DTLS would be useful for testing. -Jim

2 1

Re: stunnel : SSL_connect: Peer suddenly disconnected
by Jose Alf. 19 Dec '25

19 Dec '25

Hi Souheila, Are you sure that you are running an NFS server in your azure machine that natively supports TLS? If you are not, you must put an stunnel wrapper in front of it. It looks to me that the NFS service exposed at 52.239.241.136:2049 does not support TLS. 2025.12.19 07:53:48 LOG7[0]: Service [52.239.241.136] started 2025.12.19 07:53:48 LOG7[0]: Setting local socket options (FD=584) 2025.12.19 07:53:48 LOG7[0]: Option TCP_NODELAY set on local socket 2025.12.19 07:53:48 LOG5[0]: Service [52.239.241.136] accepted connection from 127.0.0.1:58887 2025.12.19 07:53:48 LOG6[0]: s_connect: connecting 52.239.241.136:2049 2025.12.19 07:53:48 LOG7[0]: s_connect: s_poll_wait 52.239.241.136:2049: waiting 10 seconds 2025.12.19 07:53:48 LOG7[0]: FD=1040 ifds=rwx ofds=--- 2025.12.19 07:53:49 LOG5[0]: s_connect: connected 52.239.241.136:2049 2025.12.19 07:53:49 LOG5[0]: Service [52.239.241.136] connected remote server from 192.168.1.26:58888 2025.12.19 07:53:49 LOG7[0]: Setting remote socket options (FD=1040) 2025.12.19 07:53:49 LOG7[0]: Option TCP_NODELAY set on remote socket 2025.12.19 07:53:49 LOG7[0]: Remote descriptor (FD=1040) initialized 2025.12.19 07:53:49 LOG6[0]: SNI: sending servername: 52.239.241.136 2025.12.19 07:53:49 LOG7[0]: No previous session to resume 2025.12.19 07:53:49 LOG6[0]: Peer certificate not required 2025.12.19 07:53:49 LOG7[0]: TLS state (connect): before SSL initialization 2025.12.19 07:53:49 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2025.12.19 07:53:49 LOG7[0]: TLS alert (write): fatal: decode error 2025.12.19 07:53:49 LOG3[0]: SSL_connect: ssl/record/rec_layer_s3.c:696: error:0A000126:SSL routines::unexpected eof while reading 2025.12.19 07:53:49 LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2025.12.19 07:53:49 LOG7[0]: Remote descriptor (FD=1040) closed 2025.12.19 07:53:49 LOG7[0]: local_rfd/local_wfd reset (FD=584) 2025.12.19 07:53:49 LOG7[0]: Local descriptor (FD=584) closed 2025.12.19 07:53:49 LOG7[0]: Service [52.239.241.136] finished (0 left) Regards,Jose A. Diaz On 18/12/2025, at 11:25 PM, Souheila Hechaichi via stunnel-users <stunnel-users(a)stunnel.org> wrote: Hey, I hope your help.The problem of 403754EAC87F0000:error:0A000126:SSL routines::unexpected eof while reading:../ssl/record/rec_layer_s3.c:696: is a bug in openssl version 3.x.xWhith my configuration OpenSSL 1.1.1f, the connection succeded but Its systematically closes <image.png> And with tcpdump I observe a connection reset<image.png>Best regards;From: Michał Trojnara via stunnel-users <stunnel-users(a)stunnel.org> Sent: Thursday, December 18, 2025 8:24 PM To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Re: stunnel : SSL_connect: Peer suddenly disconnected Hi Souheila, It does not look like your remote machine accepts TLS: $ openssl s_client -connect 52.239.241.136:2049 Connecting to 52.239.241.136 CONNECTED(00000003) 403754EAC87F0000:error:0A000126:SSL routines::unexpected eof while reading:../ssl/record/rec_layer_s3.c:696: Why exactly do you think that stunnel could be used to mount NFS file shares? Stunnel can be a TLS client, but not an NFS client. Those aredifferent protocols. Best regards, Mike On 12/18/25 6:15 PM, Souheila Hechaichi via stunnel-users wrote: I am using stunnel to mount an azure nfs file share. The stunnel process log the following messageDec 18 17:55:20 vmubuntu18 stunnel: LOG3[23840]: SSL_connect: Peer suddenly disconnected The stunnel configure file isverifyChain = nodebug = debugoutput = /etc/stunnel/microsoft/aznfs/nfsv4_fileShare/logs/stunnel_52.239.241.136.logpid = /etc/stunnel/microsoft/aznfs/nfsv4_fileShare/logs/stunnel_52.239.241.136.pidTIMEOUTidle = 61 [52.239.241.136]client = yesaccept = 127.0.0.1:20049connect = 52.239.241.136:2049 A trace with tcpdump display the following logs<image.png> We observe a reset connection between azure server and my machine. Best regardsSouheila _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0