October 2016 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 17 Oct '20

17 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16

21 Dec '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > > Anyway, my opinion on the patch is that there is no real interest for > "generic/self-expanding" config file , and it is even dangerous : > I would not trust stunnel if, at run time, its config could be modified by > USER envvars... > which difference between %userprofile%/config-file and USER envvars? both are USER owned and USER controlled. certificate and keys also USER private data. and stunnel started by USER owned by USER. if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if needed), certs, keys, etc. global "generic/self-expanding" config file is ADMIN owned. USER has permissions to substitute some values, restricted by ADMIN.

2 10

Use SNI
by Benjamin Hartwich 31 Oct '16

31 Oct '16

Hi, I´ve found the SNI parameter at stunnel, but it doesn´t work at my Ubuntu 16.04. My goal is, to use one dfn cert for the stunnel cert, which has 4 hostnames. This cert is on both servers. At the client server this cert works, because at the cert this is first hostname. At the second server I use the same cert, but it can´t be verified, because stunnel doesn´t recognize the correct hostname from the cert. Can anyone send me an example for a working SNI configuration? My Configs: Server one: client = yes cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log foreground = no sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 CAfile = /etc/ssl/web/chain.pem verify = 2 socket = r:TCP_NODELAY=1 [app1] accept = localhost:8090 connect = 10.1.2.1:8085´ ----- Server 2 (fails): client = no cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 foreground = no CAfile = /etc/ssl/web/chain.pem verify = 2 socket = l:TCP_NODELAY=1 [ajp] accept = 8085 connect = 127.0.0.1:8009 --- Error: 2016.10.31 15:01:40 LOG7[9]: SNI: no virtual services defined 2016.10.31 15:01:40 LOG4[9]: CERT: Pre-verification error: unsupported certificate purpose Regards, Benjamin Hartwich Referat Basisdienste Zentrum für Informationstechnologie und Medienmanagement Universität Passau Innstr. 33, 94032 Passau Telefon +49 (0)851/509-3285, Telefax +49 (0)851/509-1802 E-Mail: benjamin.hartwich(a)uni-passau.de

1 0

Running Stunnel 5.23 as multiple windows services
by David Jones 25 Oct '16

25 Oct '16

Hi, I'm trying to run stunnel as a windows service. I have used the stunnel -install and one service has successfully been setup. We now have a need to run a second instance of stunnel and so that we are able to stop/start this instance and not affect the connectivity of the other one we would like to install it as a separate service. On an older version of stunnel we simply named the stunnel.exe differently and it ran both services separately. But with 5.23 it is not allowing us to do so. Coming up the error "CreateService: error 1073: The specified service already exists". I've tried adding service = into the .conf file and also using service= on the command line for the install but nothing works. So what have I missed? Thanks David Config: Service = Stunnel_TLS_Generic CApath = ./ debug=7 #debug = 1 output = TLS_Generic.log # Use it for client mode client = yes # Service-level configuration [Service_Name] options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 20002 connect = URLtoserver:443

1 0

Re: [stunnel-users] JHH re: Server down? [GishPuppy]
by gmane.bl4＠gishpuppy.com 20 Oct '16

20 Oct '16

John H Hoffmann wrote: > upgraded to latest sTunnel v 5.36. > > In restarting sTunnel I immediately got a > 'server down' error > > [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 > > > [!] bind: Permission denied (WSAEACCES) (10013) > > [!] Error binding service [comcast-pop3] to 127.0.0.1:995 > You probably have in the stunnel.conf something similar to: [pop3s] accept=995 {...} [comcast-pop3] accept=127.0.0.1:995 {...} accept=995 == 0.0.0.0:995 == (all localhost IPv4 addresses):995 Which includes 127.0.0.1:995 When the [comcast-pop3] service tries to bind to port 995 it fails because it is already bound at the [pop3s] service. Gishpuppy | To change the delivery settings for this email, click here: http://www.gishpuppy.com/cgi-bin/edit.py?email=gmane.bl4@gishpuppy.com

2 1

JHH re: Server down?
by John H Hoffmann | 847.998.6198 19 Oct '16

19 Oct '16

Hi .. I have been having spotty access to my main ISP email account the last two days so I upgraded to latest sTunnel v 5.36. I use sTunnel to help get emails from my ISP, Comcast, to load into an older version of GoldMine CRM. sTunnel has worked like a charm since 09/2013. In restarting sTunnel I immediately got a 'server down' error, log included below. Ideas? Suggestions? [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.36 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2i-fips 22 Sep 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [pop3s] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [imaps] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [ssmtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [comcast-pop3] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-pop3] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [comcast-smtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-smtp] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=432) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 [ ] Listening file descriptor created (FD=436) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [imaps] (FD=436) bound to 0.0.0.0:993 [ ] Listening file descriptor created (FD=440) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [ssmtp] (FD=440) bound to 0.0.0.0:465 [ ] Listening file descriptor created (FD=444) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [comcast-pop3] to 127.0.0.1:995 [ ] Closing service [pop3s] [ ] Service [pop3s] closed (FD=432) [ ] Service [pop3s] closed [ ] Closing service [imaps] [ ] Service [imaps] closed (FD=436) [ ] Service [imaps] closed [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=440) [ ] Service [ssmtp] closed [ ] Closing service [comcast-pop3] [ ] Service [comcast-pop3] closed [ ] Closing service [comcast-smtp] [ ] Service [comcast-smtp] closed [!] Server is down Respectfully, John John H Hoffmann

2 1

Stunnel stops on Windows Server 2012
by Sam Ash 03 Oct '16

03 Oct '16

I've upgraded Stunnel from 5.35 to 5.36 on a server running windows server 2012. Since the upgrade it appears to stop running once i log out. I installed it as a service and set the service start to automatic. It has no problems running when someone is logged into the server. I'm not sure what i changed when i updated the version. Thanks

1 0