September 2025 - stunnel-users

How to get rid of "No OCSP stapling response received" warning?
by Ian Pilcher 25 Sep '25

25 Sep '25

I use stunnel to connect to my old "smart" switches from modern browsers. Here is a subset of the configuration for one of the switches. [switch1-frontend] sni = frontend:switch1.penurio.us CAfile = /etc/ipa/ca.crt cert = /etc/pki/tls/certs/stunnel/switch1.crt key = /tmp/keys/switch1.key connect = 127.255.255.254:8081 [switch1-backend] client = yes accept = 127.255.255.254:8081 connect = 172.31.4.1:443 verifyChain = yes checkHost = switch1.penurio.us CAfile = /etc/ipa/ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 0 OCSPrequire = no OCSPaia = no Everything works, execept that every connection produces a bright red warning in my log: OCSP: No OCSP stapling response received I've read up on OCSP stapling, that this seems to mean that the switch isn't including an OCSP response in its TLS handshake. (Hardly surprising, given its age.) How can I tell stunnel to not request/expect an OCSP response from the switch (or at least to not log the missing OCSP response as a warning)? -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

4 5

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel, Gmail and Outlook Express
by landjonline＠hotmail.com 01 Sep '25

01 Sep '25

I have Outlook Express and my email addresses are Gmail. Is there a way to get Gmail to work with Outlook Express using Stunnel? Thanks

2 1