- stunnel-users - stunnel.org

Stunnel - how to make Google App Engine HTTP into HTTPS ?
by Shamun Toha Md 06 Feb '14

06 Feb '14

I have Google App Engine running in HTTP (port tcp 80), which is a daemon based service it execute back-end some python instances. Now all that works over HTTP , TCP 80, and Google App Engine itself do not have any kind of HTTPS setup, it has to be organized externally. Therefore, the biggest problem is now that how can i use stunnel to resolve this problem please? I have already tried following setup and it does not work at all. 1) if the user visit https://www.mysite.com then he hit stunnel accept=443 after that he is connected with connect=80 but user browser change into http:// instead of remaining in https:// . Which make the whole thing not working $ uname -a Linux server2 2.6.32-358.23.2.el6.x86_64 #1 SMP Wed Oct 16 18:37:12 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux $ cat /etc/stunnel/stunnel.conf pid = /stunnel.pid cert=/etc/stunnel/abyhu.crt CAfile=/etc/stunnel/abyhu.ca key=/etc/stunnel/abyhu.key sslVersion = all ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 client=no debug = 7 output = /var/log/stunnel.log [SSL] accept=443 connect=80 TIMEOUTclose = 0 My goal is: when user visit https://www.mysite.com it remain as https not become http:// then it is not solving the problem cause Google app engine do not have HTTPS Thank you. Best regards

3 4

Re: [stunnel-users] cross compiling stunnel-4.21 for ARM
by josealf＠rocketmail.com 03 Feb '14

03 Feb '14

Krinali, Looks like firefox can't connect to port 443 on your target IP. Are you sure there is no firewall enabled on your board? Regards, Jose -----Original Message----- From: Krinali Shah - PES <krinali.shah(a)einfochips.com> Date: Mon, 3 Feb 2014 16:47:39 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] cross compiling stunnel-4.21 for ARM Hi Jose, Thank you so much for your suggestion. Firefox is giving an error like "Problem Loading Page". (Plase find attached snapshot for your reference). Note - I have made sure that there are no proxy settings on firefox. Thanks, Krinali Shah ----- Original Message ----- From: josealf(a)rocketmail.com To: "Krinali Shah - PES" <krinali.shah(a)einfochips.com>, "stunnel-users" <stunnel-users-bounces(a)stunnel.org>, stunnel-users(a)stunnel.org Sent: Monday, February 3, 2014 4:21:49 PM Subject: Re: [stunnel-users] cross compiling stunnel-4.21 for ARM Krimnali, 1. Exactly which error is giving Firefox? It will give you an error if the certificate subject does not match the URL (in this case the IP). And of course, it will also complain if the certificate is self signed and/or the signing CA is unknown. 2. Why are you using such an updated stunnel version? 3. You can use openssl s_client command to troubleshoot. Google for it. Regards, Jose -----Original Message----- From: Krinali Shah - PES <krinali.shah(a)einfochips.com> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> Date: Mon, 3 Feb 2014 15:34:28 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] cross compiling stunnel-4.21 for ARM _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean --------------------------------------------------------------------------------------------- ************************************************************************************************************************************************************* eInfochips Business Disclaimer : This e-mail message and all attachments transmitted with it are intended solely for the use of the addressee and may contain legally privileged and confidential information. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by replying to this message and please delete it from your computer. Any views expressed in this message are those of the individual sender unless otherwise stated. Company has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ************************************************************************************************************************************************************* --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean ---------------------------------------------------------------------------------------------

1 0

cross compiling stunnel-4.21 for ARM
by Krinali Shah - PES 03 Feb '14

03 Feb '14

----- Forwarded Message ----- From: "Krinali Shah - PES" <krinali.shah(a)einfochips.com> To: stunnel-users(a)stunnel.org Sent: Monday, February 3, 2014 3:04:44 PM Subject: cross compiling stunnel-4.21 for ARM Hi All, I have thttpd server cross-compiled for my ARM based embedded board. Now I want to add the support for https services on my board, so I think of using stunnel with openssl. I have already download source code of openssl and cross compiled it, for linux-arm. I have downloaded stunnel-4.21 and followed the steps as mentioned below. 1. create stunnel.pem file inside /etc/ssl/certs/stunnel.pem 2. create stunnel.conf file inside /etc/stunnel/stunnel.conf with following parameters. cert = /etc/ssl/certs/stunnel.pem key = /etc/ssl/certs/stunnel.pem chroot = /var/run/stunnel setuid = stunnel4 setgid = stunnel4 debug = 7 pid = /stunnel.pid setuid = stunnel setgid = stunnel socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = rle output = /var/log/stunnel4/stunnel.log client = no [https] accept = 10.103.2.104:443 connect = 127.0.0.1:8080 TIMEOUTclose = 0 2. ./configure --prefix=/home/stunnel --host=arm-linux --enable-shared --with-ssl=/home 3. changed CC, RANLIB and STRIP environment variables for cross compilation in Makefile. 4. make 5. sudo make install The cross-compiled binary stunnel is installed. When I run the binary on board, it does not show any error. Following debug messages are seen on screen. 1969.12.31 21:19:54 LOG6[1154:1073842296]: Compression enabled using rle method 1969.12.31 21:19:54 LOG7[1154:1073842296]: RAND_status claims sufficient entropG 1969.12.31 21:19:54 LOG7[1154:1073842296]: PRNG seeded successfully 1969.12.31 21:19:54 LOG7[1154:1073842296]: Certificate: /etc/ssl/certs/stunnel.m 1969.12.31 21:19:54 LOG7[1154:1073842296]: Certificate loaded 1969.12.31 21:19:54 LOG7[1154:1073842296]: Key file: /etc/ssl/certs/stunnel.pem 1969.12.31 21:19:54 LOG7[1154:1073842296]: Private key loaded 1969.12.31 21:19:54 LOG7[1154:1073842296]: SSL context initialized for service s But, If I try to request https service from web browser (Firefox) ie, https://server_ip it gives me error. Meaning https server is not started correctly, still something is missing. Please guide me if you have any clues. Any help would be highly appreciated. Thanks, Krinali Shah ************************************************************************************************************************************************************* eInfochips Business Disclaimer : This e-mail message and all attachments transmitted with it are intended solely for the use of the addressee and may contain legally privileged and confidential information. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by replying to this message and please delete it from your computer. Any views expressed in this message are those of the individual sender unless otherwise stated. Company has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ************************************************************************************************************************************************************* --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean ---------------------------------------------------------------------------------------------

2 1

Connect to Outlook.com SMTP with stunnel
by Tenhult Server 30 Jan '14

30 Jan '14

Hi, i'm trying to send mail with the help of stunnel but i get STARTTLS expected, what is wrong with my setup? File: stunnel.conf [outlook-smtp] protocol = smtp accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 Log 2014.01.26 13:59:03 LOG5[1536]: stunnel 5.00 on x86-pc-msvc-1500 platform 2014.01.26 13:59:03 LOG5[1536]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 ... ... 2014.01.26 13:59:16 LOG6[2428]: Server-mode smtp protocol negotiations started 2014.01.26 13:59:16 LOG7[2428]: RFC 2487 detected 2014.01.26 13:59:16 LOG7[2428]: <- 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 2014.01.26 13:59:16 LOG7[2428]: -> 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 + stunnel 2014.01.26 13:59:16 LOG7[2428]: <- EHLO Fredrik-Laptop 2014.01.26 13:59:16 LOG7[2428]: -> 250-EHLO Fredrik-Laptop Welcome 2014.01.26 13:59:16 LOG7[2428]: -> 250 STARTTLS 2014.01.26 13:59:16 LOG7[2428]: <- MAIL FROM: <mymail(a)live.com> 2014.01.26 13:59:16 LOG3[2428]: STARTTLS expected 2014.01.26 13:59:16 LOG5[2428]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.26 13:59:16 LOG7[2428]: Remote socket (FD=520) closed 2014.01.26 13:59:16 LOG7[2428]: Local socket (FD=540) closed 2014.01.26 13:59:16 LOG7[2428]: Service [outlook-smtp] finished (0 left) Fredrik

2 1

Specifying a username and password
by Allen Crist 30 Jan '14

30 Jan '14

I have a scanner that only has an smtp address and port #. There is no option to specify a username and password. Is there a way to configure STunnel to assist with this? Regards, Allen -- Allen Crist, Owner A+ | Network+ | Security+ | MCITP/MCSA: Windows Server 2008 *CCW Technology Computer Repair*Serving Home & Small Business Customers since 2008 (801)410-0203 http://www.ccwtech.com http://www.facebook.com/CCWTechnology

1 0

Filename is not cached for later editing
by Javier 25 Jan '14

25 Jan '14

Hi, Scenario in Windows. I found today that, when you specify a configuration file different from the standard file name, you can't edit it through "Configuration>Edit stunnel.conf". Stunnel tries to edit stunnel.conf, and, if not found, creates a new one through notepad. This doesn't affect to the reload function, where the configuration file specified is used for reload. Also, this is not important, because in most cases is used the default file name, but maybe could be implemented the ability to change those menu options to display the current configuration file name used instead the standard. Let's say we use a configuration file named xxx.conf. The menu may change to "Edit xxx.conf" and "Reload xxx.conf" instead "Edit stunnel.conf" and "Reload stunnel.conf". This may be interesting for when we have several services installed and identify them better. Regards.

4 9

Additional certificate (like openssl s_server -dkey/-dcert)
by Lapo Luchini 25 Jan '14

25 Jan '14

Is it possible to configure STunnel to support "additional" certificate like OpenSSL s_Server's -dkey/-dcert parameters, in order to support ECDSA in addition to RSA on the same connection? -- Lapo Luchini - http://lapo.it/ “Two can keep a secret if one is dead.” (anonymous)

2 1

SSL communication is unestablishable by stunnel.
by take＠kasaneiro.jp 24 Jan '14

24 Jan '14

stunnel is used in order to use SMTPs/POPs, when using the e-mail software Mew. However, the following logs come out, emacs solidifies and communication is impossible. How is it repaired if it carries out? Please let me know if you please. Computer environment Apple MacBook Pro (Mid 2012), Mac OS X 10.9.2 GNU (Cocoa)Emacs 24.3.50.1 (x86_64-apple-darwin13.0.0, NS apple-appkit- 1265.00) Mew 6.5 Stunnel 4.56 --- <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Clients allowed=125 2014.01.23 23:30:26 LOG5[15311:140735163843344]: stunnel 4.56 on x86_64- apple-darwin13.0.0 platform 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Reading configuration from file /var/folders/tc/0dm70kl977x3_rcfkldrzz3h0000gn/T/take15307AeS/ mew1530708i 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Compression not enabled 2014.01.23 23:30:26 LOG7[15311:140735163843344]: PRNG seeded successfully 2014.01.23 23:30:26 LOG6[15311:140735163843344]: Initializing service [ 8840] 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Verify directory set to /Users/take/.certs 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Added /Users/take/. certs revocation lookup directory 2014.01.23 23:30:26 LOG7[15311:140735163843344]: SSL options set: 0x00000004 2014. <SSL/TLS: > 01.23 23:30:26 LOG5[15311:140735163843344]: Configuration successful 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] (FD=7) bound to 127.0.0.1:8840 2014.01.23 23:30:26 LOG7[15311:140735163843344]: No pid file being created <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] accepted (FD=3) from 127.0.0.1:56364 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] started 2014.01.23 23:30:26 LOG5[15311:4558856192]: Service [8840] accepted connection from 127.0.0.1:56364 2014.01.23 23:30:26 LOG6[15311:4558856192]: connect_blocking: connecting 127.0.0.1:99 2014.01.23 23:30:26 LOG7[15311:4558856192]: connect_blocking: s_poll_ wait 127.0.0.1:995: waiting 10 seconds 2014.01.23 23:30:26 LOG3[15311:4558856192]: connect_blocking: connect 127.0.0.1:995: Connection refused (61) 2014.01.23 23:30:26 LOG5[15311:4558856192]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.23 23:30:26 LOG7[15311:4558856192]: Local socket (FD=3) closed 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] finished (0 left)

2 1

OCSP Responders in AIA extension
by Ender Erel 22 Jan '14

22 Jan '14

Hi All, Does stunnel check the OCSP responders found in a certificate's AIA field? I am asking this because in the following e-mail from back 2008, the sender mentions a patch that implements this functionality. The patch is included with the mail but I don't think it is included in the later versions of stunnel. Does this mean OCSP responders inside a certificate are ignored? I also want to ask another thing. When using verify = 3 in client mode, which file is used to check the received certificate? Is it the CAfile? If so, would it work like this: - I manually opened a connection to a server outside stunnel, downloaded the server's certificate, and closed the connection. - I saved this certificate to a file, and wrote the path of this file in the stunnel configuration file (CAfile = /mycerts/tmpcert.pem,verify=3). - I started stunnel and initiated a connection to the server. Would the connection be successful? Would it be the right way to use verify=3? Kind Regards, Ender Erel

2 3

disabling compression
by James Bardin 22 Jan '14

22 Jan '14

Hi, The stunnel man page states that compression is off by default, but It seems that is no longer the case. (the changelog states that version 4.5.1 sets compression as "not disabled by default") The config options don't seem to accept any parameters to disable compression. Is there any way to disable it via openssl options? Thanks! -jim

2 2