January 2023 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

Cannot establish tunnel
by andrew.haworth＠roche.com 11 Feb '23

11 Feb '23

Hi, I am new to stunnel on a MAC. When I run stunnel with the enabled configuration [mllp-to-dip], I am prompted for a local password and then for my certificate passphrase. I am not able to establish a tunnel. See logs: Initializing service [mllp-to-dip] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Certificate loaded from file: /opt/homebrew/etc/stunnel/test_client.cert.pem [ ] Loading private key from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [:] Insecure file permissions on /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key loaded from file: /opt/homebrew/etc/stunnel/test_client_cert.pem [ ] Private key check succeeded [:] Service [mllp-to-dip] needs authentication to prevent MITM attacks [ ] DH initialization skipped: client section [ ] ECDH initialization [ ] ECDH initialized with curves X25519:P-256:X448:P-521:P-384 [.] Configuration successful [ ] Deallocating deployed section defaults [ ] Binding service [mllp-to-dip] [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to :::6661: Address already in use (48) [ ] Listening file descriptor created (FD=9) [ ] Setting accept socket options (FD=9) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [mllp-to-dip] to 0.0.0.0:6661: Address already in use (48) [!] Binding service [mllp-to-dip] failed [ ] Unbinding service [mllp-to-dip] [ ] Service [mllp-to-dip] closed [ ] Deallocating deployed section defaults [ ] Deallocating section [mllp-to-dip] Can someone help with my troubleshooting steps?

4 5

Setup Error
by Paul Gabriel 11 Feb '23

11 Feb '23

Hi, I am attempting to setup stunnel 5.67 in Windows Server 2022 core. I believe I have enabled TLS 1.2. Here is the output of stunnel starting up: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.67 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.0.7 1 Nov 2022 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [.] Reading configuration from file C:\Program Files (x86)\stunnel\config\stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [Integration Profile 1] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x2100000 (+0x0, -0x0) [ ] Session resumption enabled [ ] Loading certificate from file: art&music.pem [!] error queue: ssl/ssl_rsa.c:448: error:0A080002:SSL routines::system lib [!] error queue: crypto/bio/bss_file.c:300: error:10080002:BIO routines::system lib [!] SSL_CTX_use_certificate_chain_file: crypto/bio/bss_file.c:297: error:80000002:system library::No such file or directory [!] Service [Integration Profile 1]: Failed to initialize TLS context [!] Configuration failed [ ] Deallocating temporary section defaults [ ] Deallocating section [Integration Profile 1] Any suggestions on what is wrong? Thanks, Paul

2 1

help
by Gurjit Singh Jhutti 27 Jan '23

27 Jan '23

Is it possible to configure username and password for SMTP connection on Windows Server, did try this with any success in stunnel.conf [client] username = user password = password error: LOG6[main]: Initializing service [client] LOG3[main]: ....\stunnel.conf:73: "username = user": Specified option name is not valid here LOG3[main]: Configuration failed

1 0

Odd stunnel problem
by Phil Smith III 26 Jan '23

26 Jan '23

Well, odd to me. I use K9, a free Bayesian spam proxy I've used for ~20 years. It doesn't do TLS. So I have: Outlook <-> K9 <-> stunnel <-> Internet for email connections. This morning I wasn't getting anything on my dozen or so POP connections that go through that (Exchange email was fine). Restarted Outlook (making sure it had really closed), no joy. Then I noticed that while doing a mail check, K9 was throbbing for long periods. There's not much to do with K9, so next I looked at stunnel, whose log was full of: 2023.01.26 09:39:26 LOG3[18110]: No more addresses to connect 2023.01.26 09:39:36 LOG3[18111]: s_connect: s_poll_wait 146.20.147.244:995: TIMEOUTconnect exceeded Reloaded stunnel config and all is well. So, not a big deal, but.any guesses what was going on here? stunnel 5.57, Windows 10.

1 0

Stunnel activity issue
by Денис Голубятников 26 Jan '23

26 Jan '23

I have problems with stunnel on OS Windows. After a successful connection with stunnel, the connection drops after approximately 9 minutes of inactivity. On Linux, this problem was solved by changing this parametrs: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 I don't have access to the server side router, so I can't change anything. Stunnel log: 2023.01.25 17:18:10 LOG7[1]: Service [test] started 2023.01.25 17:18:10 LOG7[1]: Setting local socket options (FD=964) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on local socket 2023.01.25 17:18:10 LOG5[1]: Service [test] accepted connection from 127.0.0.1:50145 2023.01.25 17:18:10 LOG6[1]: s_connect: connecting 225.179.85.93:18572 2023.01.25 17:18:10 LOG7[1]: s_connect: s_poll_wait 225.179.85.93:18572: waiting 10 seconds 2023.01.25 17:18:10 LOG7[1]: FD=716 ifds=rwx ofds=--- 2023.01.25 17:18:10 LOG5[1]: s_connect: connected 225.179.85.93:18572 2023.01.25 17:18:10 LOG5[1]: Service [onegomed] connected remote server from 192.168.1.84:50146 2023.01.25 17:18:10 LOG7[1]: Setting remote socket options (FD=716) 2023.01.25 17:18:10 LOG7[1]: Option TCP_NODELAY set on remote socket 2023.01.25 17:18:10 LOG7[1]: Remote descriptor (FD=716) initialized 2023.01.25 17:18:10 LOG6[1]: SNI: sending servername: 225.179.85.93 2023.01.25 17:18:10 LOG6[1]: Peer certificate not required 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): before SSL initialization 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write client hello 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server hello 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read encrypted extensions 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG6[1]: Certificate verification disabled 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server certificate 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): TLSv1.3 read server certificate verify 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read finished 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write change cipher spec 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS write finished 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) requested 2023.01.25 17:18:10 LOG7[1]: 2 client connect(s) succeeded 2023.01.25 17:18:10 LOG7[1]: 0 client renegotiation(s) requested 2023.01.25 17:18:10 LOG7[1]: 0 session reuse(s) 2023.01.25 17:18:10 LOG6[1]: TLS connected: new session negotiated 2023.01.25 17:18:10 LOG6[1]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2023.01.25 17:18:10 LOG6[1]: Peer temporary key: X25519, 253 bits 2023.01.25 17:18:10 LOG7[1]: Compression: null, expansion: null 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 8E91DBE369D9E16221CCA288A7C1F652AB045BAE96C19B4240B1B7F710069CCE 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSL negotiation finished successfully 2023.01.25 17:18:10 LOG7[1]: Initializing application specific data for session authenticated 2023.01.25 17:18:10 LOG7[1]: New session callback 2023.01.25 17:18:10 LOG7[1]: Deallocating application specific data for session connect address 2023.01.25 17:18:10 LOG6[1]: Session id: 6UIA254BF9D027B3D4BE5F966BDE9DE2058CF167C4EF0CD5A460958B698DF322 2023.01.25 17:18:10 LOG7[1]: TLS state (connect): SSLv3/TLS read server session ticket 2023.01.25 17:33:25 LOG3[1]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2023.01.25 17:33:25 LOG5[1]: Connection reset: 5184 byte(s) sent to TLS, 10344 byte(s) sent to socket 2023.01.25 17:33:25 LOG7[1]: Remote descriptor (FD=716) closed 2023.01.25 17:33:25 LOG7[1]: Local descriptor (FD=964) closed 2023.01.25 17:33:25 LOG7[1]: Service [test] finished (0 left)` I tried: * changing the windows registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveInterval HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissions HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TdxPrematureConnectIndDisabled HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\KeepAliveTimeout HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSetting\ServerInfoTimeout * changing stunnel config on client side: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 * changing parametrs on linux server side: net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 20 * add server cert on stunnel client config; * downgrade and update stunnel. -- Gordon Stevenson Отправлено из Почты Mail.ru

1 0