June 2016 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 16 Oct '20

16 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16

21 Dec '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > > Anyway, my opinion on the patch is that there is no real interest for > "generic/self-expanding" config file , and it is even dangerous : > I would not trust stunnel if, at run time, its config could be modified by > USER envvars... > which difference between %userprofile%/config-file and USER envvars? both are USER owned and USER controlled. certificate and keys also USER private data. and stunnel started by USER owned by USER. if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if needed), certs, keys, etc. global "generic/self-expanding" config file is ADMIN owned. USER has permissions to substitute some values, restricted by ADMIN.

2 10

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Another OpenSSL 1.1.x patch - no ssl23.h any more
by Peter Pentchev 27 Jun '16

27 Jun '16

Hi, What do you think about the attached patch that fixes yet another OpenSSL 1.1.x compilation problem: the OpenSSL developers dropped the ssl23.h file altogether? Thanks for your work on stunnel! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Failed to redirect http to https
by Doris Hongmei 27 Jun '16

27 Jun '16

Hi Support, I setup stunnel to a web server with apache Configuration like below, --- /usr/local/etc/stunnel/stunnel.conf ---------- ; It is recommended to drop root privileges if stunnel is started by root setuid = nobody setgid = nobody ; TLS front-end to a web server [https] accept = 443 connect = 127.0.0.1:80 cert = /usr/local/etc/stunnel/stunnel.pem --- end of /usr/local/etc/stunnel/stunnel.conf ---------- After stunnel started, https://xxx/ is working, http://xxx/ is also still working , which doesn't redirect to https://xxx automatically. As my understanding, all the connections from http should redirect to https through stunnel, right? What steps did I miss? I need your help. Thanks. [Ericsson]<http://www.ericsson.com/> DORIS HONGMEI Software Configuration Mgmt Engineer BUSS SA OSS&BSS BL CPM DU SEP GZ RelGrp Ericsson 5&6F, No 44-46 Jianzhong Road 510630,Guangzhou,Tian He Software Park, China Mobile +8613922114721 Office +862085117729 doris.hongmei(a)ericsson.com www.ericsson.com [http://www.ericsson.com/current_campaign]<http://www.ericsson.com/current_campaign> Legal entity: Ericsson, registered office in CGC . This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>

2 2

Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 24 Jun '16

24 Jun '16

Jose, I have discovered what I did wrong. I did the original stunnel installs from the command line and then installed the stunnel service from the command line as well. When I installed the stunnel service it would break the website. So I removed the service (I thought) then I copied a shortcut to stunnel.exe to the Win start up> program folder. Both sites started working on the servers as long as I was logged in through an RDP session. I uninstalled everything and reinstalled. Stunnel 5.32 installs a Windows GUI on Server 2012 as well so I went back and used the Windows server 2012 desktop applications to install the windows service and to stop the GUI application. Everything is now working as expected. It appears that I was running two instances of stunnel at the same time and I didn’t completely remove the original stunnel service. Thanks for all of your help, Cheers, Michael From: Josealf.rm [mailto:josealf@rocketmail.com] Sent: Thursday, June 23, 2016 2:37 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Michael, Did my last suggestions help with your issue? Regards El 20 jun 2016, a las 18:00, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: .Jose, I appreciate your patience. Internet - Clients : 443 -> : https://website.company.com/website/ ________Firewall___________ Web\Presentation Layer 2 Win 2012 Webservers (443) not currently connected to the production LB, application needs to work before connecting to LB. This configuration is first time on 64 bit OS… Win 2012. IIS 8 running Jakarta ISAPI Filter\Stunnel to redirect 9001 to 9009: _________Firewall\App Layer________ Port 9009 Connects to App server running Apache Application is working as expected as long as I am logged in to the IIS 8 server. I can telnet to the APP layer over 9009 and I can reach these websites externally as expected. Firewalls are good. Please let me know any other information you need. Thank you again, Michael From: Jose Alf. [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 4:32 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, Please take this in constructive way. I am trying to help, but it looks like you need to do some reading and homework. Please check http://catb.org/~esr/faqs/smart-questions.html <http://catb.org/%7Eesr/faqs/smart-questions.html> I suggest you draw a picture of your environment and explain well what you're trying to achieve. Show your client, your backend server, your stunnel server, include the IPs and ports they're listening to and everything should be easier. Don't forget any firewalls thay may be in the way. Regards, Jose. _____ From: J. Michael Drew <jmichaeldrew(a)hotmail.com> To: 'Jose Alf.' <josealf(a)rocketmail.com> Sent: Monday, June 20, 2016 1:00 PM Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:jmichaeldrew@hotmail.com] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 22 Jun '16

22 Jun '16

.Jose, I appreciate your patience. Internet - Clients : 443 -> : https://website.company.com/website/ ________Firewall___________ Web\Presentation Layer 2 Win 2012 Webservers (443) not currently connected to the production LB, application needs to work before connecting to LB. This configuration is first time on 64 bit OS… Win 2012. IIS 8 running Jakarta ISAPI Filter\Stunnel to redirect 9001 to 9009: _________Firewall\App Layer________ Port 9009 Connects to App server running Apache Application is working as expected as long as I am logged in to the IIS 8 server. I can telnet to the APP layer over 9009 and I can reach these websites externally as expected. Firewalls are good. Please let me know any other information you need. Thank you again, Michael From: Jose Alf. [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 4:32 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, Please take this in constructive way. I am trying to help, but it looks like you need to do some reading and homework. Please check http://catb.org/~esr/faqs/smart-questions.html <http://catb.org/%7Eesr/faqs/smart-questions.html> I suggest you draw a picture of your environment and explain well what you're trying to achieve. Show your client, your backend server, your stunnel server, include the IPs and ports they're listening to and everything should be easier. Don't forget any firewalls thay may be in the way. Regards, Jose. _____ From: J. Michael Drew <jmichaeldrew(a)hotmail.com> To: 'Jose Alf.' <josealf(a)rocketmail.com> Sent: Monday, June 20, 2016 1:00 PM Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:jmichaeldrew@hotmail.com] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:josealf@rocketmail.com] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1