stunnel-users May 2016

stunnel-users@stunnel.org

20 participants
33 discussions

SNI support in OpenSSL
by Guillermo Rodriguez Garcia 08 May '16

08 May '16

Hello all, The stunnel documentation says that SNI requires stunnel to be linked with OpenSSL >= 1.0.0. However, SNI is supported in OpenSSL since 0.9.8f (and actually enabled by default since 0.9.8k). For 0.9.8f and later, OPENSSL_NO_TLSEXT will be defined if TLS extension support (including SNI support) is not compiled into OpenSSL. Taking the above into account, the OpenSSL version check in stunnel (src/common.h) could be relaxed a bit. Instead of: #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_TLSEXT #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ this could be: #if OPENSSL_VERSION_NUMBER<0x00908060L #define OPENSSL_NO_TLSEXT #endif /* OpenSSL older than 0.9.8f */ #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ This would enable SNI on systems using 0.9.8 (Mac OS X for example). Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

SSLv3 not working with version 5.06
by Francois Pires 06 May '16

06 May '16

Hi all, We need use of sslv3 but with debian Jessie package version 5.06 this is not working. I have add options -NO_SSLv3 still same. Can you check if my configuration is good and if you have any idea to have sslv3 working with this verison. # stunnel.conf syslog = no cert = /etc/ssl/certs/test.crt.pem key = /etc/ssl/private/test.key.pem CAfile = /etc/ssl/certs/test.ca-bundle # Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = -NO_SSLv3 ciphers = AES256-SHA #ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL # Some debugging stuff useful for troubleshooting debug = 7 output = /stunnel.log # Debian and Ubuntu chroot config chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid # Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 [test] accept = 11443 connect = 127.0.0.1:11444 # stunnel log with openssl test SSL_accept: 14076102: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol openssl s_client -connect 127.0.0.1:11443 -ssl3 CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1462525363 Timeout : 7200 (sec) Verify return code: 0 (ok) -- Cordialement, François PIRES SysAdmin

2 1

how to pass servername openssl parameter
by Dod 04 May '16

04 May '16

Hello, Little question I use openssl s_client mode to call an https with private PKI so private CAFile CERT and also Key, but I also need to use the parameter "servername" but stunnel seems not support it or may be it has an other syntax ? regards.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users May 2016