January 2017 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 17 Oct '20

17 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

installation problems
by HOFFMAN, GEOFFREY 31 Jan '17

31 Jan '17

I am having trouble installing stunnel on CentOS 7.3. I was given a directive to "use the latest OpenSSL" so on one target machine, it has 1.0.2k built from source. On the machine with OpenSSL 1.0.2k, when attempting to install stunnel, when I run ./configure, it passes with this info: configure: FIPS support not found Then make fails with: /usr/bin/ld: /usr/local/ssl/lib/libssl.a(s3_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC On another target machine, it has 1.0.1e-fips, installed via yum package. On the machine with OpenSSL 1.0.1e-fips, ./configure fails with: checking for TLS directory... not found configure: error: Could not find your TLS library installation dir Advice on installing with the latest OpenSSL (1.0.2k) would be much appreciated. This e-mail, including any attachments, is meant only for the intended recipient of the transmission, and may be a confidential communication or a communication privileged by law. If you received this e-mail in error, any review, use, dissemination, distribution, or copying of this e-mail is strictly prohibited. Please notify us immediately of the error by return e-mail and please delete this message from your system. Thank you in advance for your cooperation.

1 0

Life cycle information
by Ben Harper 31 Jan '17

31 Jan '17

Greetings, I am trying to confirm some life cycle information, mainly supported version(s) and what versions do not insure backwards compatibility. It would appear that only the latest version is supported, per the first item under 'Before you send your question to stunnel-users' on the Mailing Lists page[0]. Does this project use semantic versioning? Will incompatibilities only come when a 6.x.x version is released? It seems at one point this was the case per the 'Upgrading to stunnel 4' link on the Documentation page[1]. Are my assumptions correct? Thanks, Ben [0]: https://www.stunnel.org/lists.html [1]: https://www.stunnel.org/docs.html

1 0

Proxy one site to HTTPS?
by Jeffrey Walton 30 Jan '17

30 Jan '17

Hi Everyone, I'm having trouble setting up a proxy for one site. The client is MacPorts on OS X 10.5. It makes some requests for files over port 80, but they apparently need to be made over port 443. Also see https://trac.macports.org/ticket/53423 and https://trac.macports.org/ticket/53347. My first question is, is it possible to proxy one site to HTTPS? My second question is, how does one do so if it is possible? The concrete example from the 53423 bug report is, I need to proxy requests from http://distfiles.macports.org/... to https://distfiles.macports.org/... I also need the opposite on the responses. Thanks in advance, Jeff

1 0

Client certificate using CAPI
by stunnel.org＠pepak.net 29 Jan '17

29 Jan '17

Hi! I am trying to use stunnel to connect to my own server using both a server and a client certificate. I got the tunnel to work, provided that the client uses a PEM certificate stored in a file. However, I would like to use CAPI, because that would allow me to use a smart card, which I finally got Windows to recognize (a nightmare of its own). Unfortunately, it seems that the client-side stunnel won't send a client certificate because the server-side stunnel will always close the connection with: SSL_accept: 140890C7: error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate My client-side stunnel log shows that server sent some kind of identification of all the supported client certificates to the client, but that's all - the client stunnel fails to follow through: TLS state (connect): SSLv3 read server key exchange A Client CA: emailAddress=some(a)email.com, O=Some name, CN=Pepak Yubico 4 White Client CA: emailAddress=root(a)email.com, CN=Pepak (root CA) TLS state (connect): SSLv3 read server certificate request A TLS state (connect): SSLv3 read server done A TLS state (connect): SSLv3 write client certificate A TLS state (connect): SSLv3 write client key exchange A TLS state (connect): SSLv3 write change cipher spec A TLS state (connect): SSLv3 write finished A TLS state (connect): SSLv3 flush data SSL_connect: Peer suddenly disconnected As far as I can tell, the CN=Pepak Yubico 4 White matches what my Windows show as the name of the certificate on the smartcard. Following up on https://www.stunnel.org/pipermail/stunnel-users/2016-February/005393.html, I tried to add a "key = Pepak Yubico 4 White" line to the client-side stunnel's config, but it doesn't seem to have any effect. What could be the problem? The client-side config file is: compression = deflate debug = debug fips = no taskbar = no options = NO_SSLv2 engine = capi [echo-client] client = yes accept = 3000 connect = 10.0.0.1:30000 requireCert = yes verifyChain = yes verifyPeer = yes CAfile = desktop.pem engineId = capi key = Pepak Yubico 4 White The only suspicious thing that I see is that my client certificate says that its only purpose is to verify the identity of the remote computer. Could that be the reason the handshake fails? Thanks for any help. Pepak

1 0

SSL errors do not trigger failover?
by Richard Monk 27 Jan '17

27 Jan '17

Hello! We are using stunnel to work around an SSL issue in another service, and set stunnel.conf up to do prio failover. We noticed something unusual. If the TCP session connects, but the SSL negotiation fails, it doesn't fail over to the next server on the list. I looked at the code for the latest version and this doesn't seem to be caught anywhere. What I saw in client.c shows that it only checks failover after trying to establish the TCP session, but then the SSL session happens later and doesn't give any info back to the failover code should something go wrong. Is this expected behavior, or should I look into a bug report / patch? I was thinking maybe a configurable option to allow SSL errors to trigger failover just like TCP errors. -- Richard Monk (rmonk(a)redhat.com) - Senior Principal Security Analyst Red Hat Inc. - Raleigh NC GPG Key ID: 0x942CDB25

1 0

Please Help to configure Stunnel for SHOUTcast
by Frans Rehl 24 Jan '17

24 Jan '17

Hello Stunnel Members I am wondering if any of you can help me to configure stunnel for shoutcast. I have a VPS with Windows Server 2012 R2 and I cannot find the correct configuration for windows server. Can someone help me please? My shoutcast is currently streaming on port 8000 however, I don't understand some part of the configuration, such as; cert -pem and ca-pem Could someone guide me? Best

1 0