July 2025 - stunnel-users

Using CAStore on Android (stunnel.conf)
by smf.forum1＠ntlworld.com 31 Jul '25

31 Jul '25

I have build stunnel with a few changes to run in a QThread (Qt 6.9.1) for Android. My Qt App starts stunnel at the start of execution and stops it when my Qt application exits. This all works fine (I need to review and clean up my stunnel changes before I use my solution for real) but I cannot get certification to work, here are two test runs one with verify set to 0 (works) and verify set to 2 (fails). What needs to change in my stunnel.conf file ? Thanks. (obfuscated details) stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 0 Works: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b640 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] needs authentication to prevent MITM attacks I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=117) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:36802 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:58660 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate not required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: OCSP: Certificate chain verification disabled I/stunnel : LOG6[0]: TLS connected: new session negotiated I/stunnel : LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) I/stunnel : LOG6[0]: Peer temporary key: X25519, 253 bits I/stunnel : LOG6[0]: Session id: 90DD6325CCBC47C3F8F560C36F76755B4959E6A8421DD97B751E37FDD1DCCAC7 I/stunnel : LOG6[0]: Session id: 24345E21753FE3B254CA089FB7621C1481B523E72EB9571DDF7A366B5E89E834 stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 2 Fails: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b0a0 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] uses "verifyChain" without subject checks W/stunnel : LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=114) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:39238 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:59154 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[0]: CERT: Pre-verification error: certificate not found in local repository: self-signed certificate W/stunnel : LOG4[0]: Rejected by CERT at depth=0: C=PL, ST=Mazovia Province, L=Warsaw, O=Stunnel Developers, OU=Provisional CA, CN=localhost E/stunnel : LOG3[0]: SSL_connect: tls_post_process_server_certificate@ssl/statem/statem_clnt.c:1890: error:0A000086:SSL routines::certificate verify failed I/stunnel : LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket I/stunnel : LOG6[ui]: Child process 17669 finished with code 0

1 0

Android Stunnel 64bit version
by emxacademy＠gmail.com 18 Jul '25

18 Jul '25

Hello everyone, I've been searching online but still haven’t found a clear or working method to build a 64-bit version of the Android stunnel executable. Since most Android devices now run on 64-bit architecture, the 32-bit version available on the official website no longer works on many phones. If anyone has experience with this or can guide me through the proper way to compile a 64-bit version, I’d really appreciate your help. Thanks in advance!

1 0

Error message when trying to set Stunnel as a start up app
by Edward Smithson 18 Jul '25

18 Jul '25

Hello Stunnel mailing list, We are trying to set Stunnel (5.75) to automatically open as a start up app on Windows 11. When the PC powers up, it gives this error message: stunnel.exe - System Error The code execution cannot proceed because libcrypto-3-x64.dll was not found. Reinstalling the program may fix this problem. We have tried reinstalling, but to no avail. NB, Stunnel works fine if opened manually. This was not an issue with Windows 10. Has anyone else had this problem (and solved it)? Many thanks, Ed Smithson Ed Smithson Reader Services Librarian Nuffield College, Oxford, OX1 1NF +44(0) 1865 278551 [cid:image001.jpg@01DBF637.F9083360]<https://bsky.app/profile/nuffieldlibrary.bsky.social>[cid:image002.png@01DBF637.F9083360]<https://www.facebook.com/NuffieldCollegeLibrary>[cid:image003.png@01DBF637.F9083360]<https://www.instagram.com/nuffieldlibrary/> [cid:image004.png@01DBF637.F9083360]<https://www.nuffield.ox.ac.uk/>

5 6