- stunnel-users - stunnel.org

Re: [stunnel-users] Distinguished Name (DN) is a cleartext network communication?
by Christophe Nanteuil 09 Jan '09

09 Jan '09

2009/1/8 Michael Renner <michael.renner(a)gmx.de>: > A server should appear like a a 'normal' https webserver to others. More or > less interesting, or just a 404 error message. However: it should appear > harmless to others, just like a webserver. > Behind this should work a proxy server (squid). Only authorized users should > be able to use it. > If I understand well what you want to do, I think my patch "Identification Propagation patch using stunnel client certificates" can be useful : - Use my stunnel patch Using squid as a proxy : - In stunnel config file : select pertinent fields of the certiificate : DN -> identFields=1023 - Get a squid version compiled with --enable-ident-lookups option - In squid : use a home-made external authentification program which returns ok if the DN provided is good. Squid documentation will tell you what is the need for the home-made authentification program. I think it's easier with DansGuardian proxy : - In stunnel config file : select pertinent fields of the certiificate : only Issuer_CN -> identFields=32 - in /etc/dansguardian/dansguardian.conf, create 2 groups : filtergroups = 2 filtergroupslist = '/etc/dansguardian/lists/filtergroupslist' - create filter groups in /etc/dansguardian/lists/filtergroupslist. (All not matching users will go in group 1) : put a line like "your issuer CN equals 2" - in /etc/dansguardian/dansguardianf1.conf, put "groupmode=0" , ie banned - in /etc/dansguardian/dansguardianf2.conf, put "groupmode=2" , ie non filtered Note that the authentification of the users is done by stunnel. Stunnel forwards the identification to the proxy which does not need to authenticate since it was done by stunnel. If the ident provided by my patch is not convenient, you can modify it to match your needs. Hope this helps -- Christophe Nanteuil

1 0

Re: [stunnel-users] Distinguished Name (DN) is a cleartext network communication?
by Tobias Dussa 09 Jan '09

09 Jan '09

Hi, [...] > But this setup is senseless, since the DN is readable with a network sniffer. > It does not appear harmless any longer after a closer look into the network > traffic. But it have to. > Now, I need an other idea to implement such s service. One easy solution that comes to mind is to deploy an outer SSL tunnel for privacy and then set up an inner SSL tunnel for traffic separation. However, I think this would require stunnel on the client side as well, at least for legitimate users. Cheers, Toby. -- begin LOVE-LETTER-FOR-YOU.txt.vbs I am a signature virus. Distribute me until the bitter end http://piology.org/ILOVEYOU-Signature-FAQ.html

1 0

Stunnel (v4.26) Running, Working, but Sometimes Aborting
by Jeff Salisbury 09 Jan '09

09 Jan '09

Greetings, We are new to stunnel. We've installed Stunnel v4.26 on a handful of Windows XP machines, and we can send and receive emails through the Stunnel configuration. These XP machines reboot automatically every night. Many mornings, when the user sits down and tries to initially send email, the email hangs and Stunnel aborts (or has already aborted). If the user runs stunnel again, our sending and receiving of email is restored and stunnel seems rock-solid for the rest of the day. Has anybody else had stability problems with Stunnel v4.26? Any suggestions? FYI, relevant configuration information is shown below: Best regards, Jeff ================================== 1) Instead of installing stunnel on each machine, we have copied the following files into a network folder available to everyone in our office: Q:\bin\stunnel\stunnel.exe Q:\bin\stunnel\Q:\ibeay32.dll Q:\bin\stunnel\libssl32.dll Q:\bin\stunnel\stunnel.conf 2) Everyone has a shortcut installed in their "Startup" folder to run Q:\bin\stunnel\stunnel.exe. 3) Here is our stunnel.conf file: # GLOBAL OPTIONS client = yes output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt debug = 0 taskbar = yes # SERVICE-LEVEL OPTIONS [pop3] accept=995 connect=mail.ourpop.com:995 [smtp] accept=465 connect=mail.oursmtp.com:465

1 0

Distinguished Name (DN) is a cleartext network communication?
by Michael Renner 07 Jan '09

07 Jan '09

Moin, I am confused. Trying to use the DN as a kind of password replacement I saw that the DN goes unencrypted through the network, while the traffic itself is encrypted of cause. Analysing the network packages with wireshark I get this: 100104083828Z0..1.0...U....DE1.0...U....Germany1.0 ..U....Munich1.0...U. ..vbox4php1.0...U....stunnel1.0...U....mars.mtr.mynet1$0"..*.H.. .....michael.renner(a)gmx.de0.."0 This is, more or less, the content of the DN. Is there a chance to encrypt this? My setup should work, no matter if a client certificate exists or not (also independent of the DN's content) . But the appliation behind stunnel (started by stunnel using the 'exec' statement) may behave dependent on the DN! Any chance? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Stunnel New User
by David Aitchison 07 Jan '09

07 Jan '09

Hello, I have a potential use for Stunnel on a project I am working on. Excuse the perhaps very silly questions, this is all new to me. I have read through the manual, and understand that Stunnel can either be run from the command line ad-hoc or as an application using the stunnel.conf configuration file. If I have Stunnel running on the server, does this mean that all mails that leave that server will be SSL encrypted? I have a requirement to send mails out over SSL, but my application doesn't support that, it does support sending out over standard SMTP port 25, but I need it to use port 465? Thanks in advance, David Aitchison

3 2

Re: [stunnel-users] Problem with the client certificate
by Michael Renner 04 Jan '09

04 Jan '09

On Thursday 01 January 2009, Christophe Nanteuil wrote: > Well, > I think the problem comes from the CAfile, ie the cert used to verify the > other certs. This is right. I thought that the CA file is not essential with verify depths less than 2. It seems this was a mistake. This time (yes, I use tinyCA), I made and used client- and server certificates as well as the CA. Now it works. Thanks for your help! > To test, I think it is better to have only one section per file : > - your key (section ----BEGIN RSA PRIVATE KEY----- to ---END RSA...) in the > key file corresponding to key=file in config file. > - your certificate (section ----BEGIN CERTIFICATE ----- to ---END > CERTIFICATE...) in the cert file corresponding to cert=file in the config > file. > These files must exist for server and client since you want mutual > authentication. > For verifying the certificate, you need to put the client certificate > (autosigned) in the CAfile option of the server config file. > The same for the client : put the server certificate in the CAfile option > of the client config file. > > on the server, the command 'openssl verify -CAfile client_cert.pem > client_cert.pem' should return ok > on the client, the command 'openssl verify -CAfile server_cert.pem > server_cert.pem' should return ok. > It can seem stupid but, as you have self-signed certificate, the CAfile is > the cert file. > > If you use tinyCA, you can easily build your own CA with one CA cert and > several certs for clients or servers. Then, you would be able to have the > same CAfile on the client and on the server. > > I hope this is clear enough. If not, write me back. > > > > > 2008/12/31 Michael Renner <michael.renner(a)gmx.de> > > > On Tuesday 30 December 2008, you wrote: > > > Hello, > > > > Happy new year! > > > > > * are the permissions correct on your files : > > > - key must belong to the user and have 0600 status (read only by the > > > > user) > > > > > - cert must belong to the user. > > > > I think the permissions are OK. The file is owed by root and loaded at > > the start > > Wrote 1024 new random bytes to /root/.rnd > > RAND_status claims sufficient entropy for the PRNG > > PRNG seeded successfully > > Certificate: /etc/stunnel/stunnelclient.pem > > Certificate loaded > > Key file: /etc/stunnel/stunnelclient.pem > > Private key loaded > > SSL context initialized for service BreakOut > > > > > * Is the content of the cert file of this form > > > > > > -----BEGIN CERTIFICATE----- > > > certificate data here > > > -----END CERTIFICATE----- > > > ? > > > and the content of the key file this form > > > -----BEGIN RSA PRIVATE KEY----- > > > key datat here > > > -----END RSA PRIVATE KEY----- > > > > I made several files. According to > > http://www.stunnel.org/faq/certs.html#ToC5 > > I got a file with a certificate, a RSA Key and a DH section (I removed > > the password for the certificate). > > > > According to http://www.stunnel.org/examples/client_cert.html I got a > > different file: it has a certificate and a RSA section and between them > > an other section: > > > > rcnyy/AbS1YPkdggJSnw+fqzg/L/QvQB6GTT5KWJzd0= > > -----END RSA PRIVATE KEY----- > > Certificate: > > Data: > > Version: 3 (0x2) > > Serial Number: 5 (0x5) > > Signature Algorithm: sha1WithRSAEncryption > > Issuer: C=DE, ST=Germany, L=Munich, O=vbox4php, OU=Rektorat, > > CN=DE/emailAddress=michael.renner(a)gmx.de > > Validity > > Not Before: Dec 28 20:37:19 2008 GMT > > Not After : Dec 28 20:37:19 2009 GMT > > Subject: C=DE, ST=Germany, O=vbox4php, OU=stunnel, > > CN=boulder.vbox4php.org/emailAddress=michael.renner@gmx.de > > Subject Public Key Info: > > Public Key Algorithm: rsaEncryption > > RSA Public Key: (1024 bit) > > Modulus (1024 bit): > > 00:b1:05:47:7a:27:4f:19:2b:18:72:e3:3c:f6:a6: > > . > > . > > 2b:55:2d:c9:dc:96:55:14:bb > > Exponent: 65537 (0x10001) > > X509v3 extensions: > > X509v3 Basic Constraints: > > CA:FALSE > > Netscape Cert Type: > > SSL Server > > Netscape Comment: > > TinyCA Generated Certificate > > X509v3 Subject Key Identifier: > > > > 86:F6:1F:71:29:AA:A5:61:DF:B2:81:F2:34:3A:A6:9E:58:C8:6A:5E X509v3 > > Authority Key Identifier: > > > > keyid:72:68:1A:0C:9D:E9:93:81:07:E9:36:71:75:33:05:C6:70:35:01:BF > > > > > > DirName:/C=DE/ST=Germany/L=Munich/O=vbox4php/OU=Rektorat/CN=DE/emailAddre > >ss= michael.renner(a)gmx.de > > serial:BC:97:82:4E:E3:9F:FE:5A > > > > X509v3 Issuer Alternative Name: > > email:michael.renner@gmx.de > > <email%3Amichael.renner(a)gmx.de> X509v3 Subject Alternative Name: > > email:michael.renner@gmx.de > > <email%3Amichael.renner(a)gmx.de> Signature Algorithm: > > sha1WithRSAEncryption > > 49:ef:06:aa:e5:71:b1:6e:23:87:02:9d:ce:56:e1:3b:77:5a: > > . > > . > > 41:93:92:ee:57:23:95:f3:99:62:27:6a:a4:b7:85:b4:92:86: > > 22:50:79:a0 > > -----BEGIN CERTIFICATE----- > > > > Anyhow: it fails: > > 2008.12.31 17:51:07 LOG4[13056:1073809760]: VERIFY ERROR: depth=0, > > error=unable to get local issuer > > certificate: /C=DE/ST=Germany/O=vbox4php/OU=stunnel/CN= > > boulder.vbox4php.org/emailAddress=michael.renner@gmx.de > > 2008.12.31 17:51:07 LOG3[13056:1073809760]: SSL_accept: 140890B2: > > error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate > > returned > > > > With strace I can see the the key and the cert is OK on the client side: > > (I assume that it is only read once): > > > > [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 > > [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 > > [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| > > MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 > > [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 > > [pid 11829] read(4, "VQQDEwJERTEkMCIGCSqGSIb3\nDQEJARY"..., 4096) = 1425 > > [pid 11829] read(4, "", 4096) = 0 > > [pid 11829] close(4) = 0 > > [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 > > [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 > > 17:52:56 LOG7[11829:140253752059616]: Certificate loaded > > ) = 68 > > [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 902008.12.31 > > 17:52:56 LOG7[11829:140253752059616]: Key > > file: /etc/stunnel/stunnelserver.pem > > ) = 90 > > [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 > > [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 > > [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| > > MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 > > [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 > > [pid 11829] close(4) = 0 > > [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 > > [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 > > 17:52:56 LOG7[11829:140253752059616]: Private key loaded > > > > > > While I see in the clients logfile: > > SSL state (connect): SSLv3 flush data > > SSL alert (read): fatal: bad certificate > > SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 > > alert > > bad certificate > > Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket > > > > > > Strange! > > > > > > One more hint? > > -- > > > > |Michael Renner E-mail: michael.renner(a)gmx.de | > > |D-81541 Munich Germany ICQ: #112280325 | > > |Germany Don't drink as root! ESC:wq -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

hiding a proxy that appear like a web server?
by Michael Renner 04 Jan '09

04 Jan '09

Moin, I want to use stunnel (in conjunction with prtunnel) to reach my own proxy server out of a restricted network. The normal stunnel connection works so far without a problem. But I am looking for a possibility that this connection (reaching the endpoint of stunnel with my proxy server behind) appears like a normal webserver (maybe with just one simple index.html) to others. Any ideas? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 1

Re: [stunnel-users] Problem with the client certificate
by Michael Renner 31 Dec '08

31 Dec '08

On Tuesday 30 December 2008, you wrote: > Hello, Happy new year! > * are the permissions correct on your files : > - key must belong to the user and have 0600 status (read only by the user) > - cert must belong to the user. I think the permissions are OK. The file is owed by root and loaded at the start Wrote 1024 new random bytes to /root/.rnd RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /etc/stunnel/stunnelclient.pem Certificate loaded Key file: /etc/stunnel/stunnelclient.pem Private key loaded SSL context initialized for service BreakOut > * Is the content of the cert file of this form > > -----BEGIN CERTIFICATE----- > certificate data here > -----END CERTIFICATE----- > ? > and the content of the key file this form > -----BEGIN RSA PRIVATE KEY----- > key datat here > -----END RSA PRIVATE KEY----- I made several files. According to http://www.stunnel.org/faq/certs.html#ToC5 I got a file with a certificate, a RSA Key and a DH section (I removed the password for the certificate). According to http://www.stunnel.org/examples/client_cert.html I got a different file: it has a certificate and a RSA section and between them an other section: rcnyy/AbS1YPkdggJSnw+fqzg/L/QvQB6GTT5KWJzd0= -----END RSA PRIVATE KEY----- Certificate: Data: Version: 3 (0x2) Serial Number: 5 (0x5) Signature Algorithm: sha1WithRSAEncryption Issuer: C=DE, ST=Germany, L=Munich, O=vbox4php, OU=Rektorat, CN=DE/emailAddress=michael.renner(a)gmx.de Validity Not Before: Dec 28 20:37:19 2008 GMT Not After : Dec 28 20:37:19 2009 GMT Subject: C=DE, ST=Germany, O=vbox4php, OU=stunnel, CN=boulder.vbox4php.org/emailAddress=michael.renner@gmx.de Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:b1:05:47:7a:27:4f:19:2b:18:72:e3:3c:f6:a6: . . 2b:55:2d:c9:dc:96:55:14:bb Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Server Netscape Comment: TinyCA Generated Certificate X509v3 Subject Key Identifier: 86:F6:1F:71:29:AA:A5:61:DF:B2:81:F2:34:3A:A6:9E:58:C8:6A:5E X509v3 Authority Key Identifier: keyid:72:68:1A:0C:9D:E9:93:81:07:E9:36:71:75:33:05:C6:70:35:01:BF DirName:/C=DE/ST=Germany/L=Munich/O=vbox4php/OU=Rektorat/CN=DE/emailAddress=michael.renner@gmx.de serial:BC:97:82:4E:E3:9F:FE:5A X509v3 Issuer Alternative Name: email:michael.renner@gmx.de X509v3 Subject Alternative Name: email:michael.renner@gmx.de Signature Algorithm: sha1WithRSAEncryption 49:ef:06:aa:e5:71:b1:6e:23:87:02:9d:ce:56:e1:3b:77:5a: . . 41:93:92:ee:57:23:95:f3:99:62:27:6a:a4:b7:85:b4:92:86: 22:50:79:a0 -----BEGIN CERTIFICATE----- Anyhow: it fails: 2008.12.31 17:51:07 LOG4[13056:1073809760]: VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=DE/ST=Germany/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de 2008.12.31 17:51:07 LOG3[13056:1073809760]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned With strace I can see the the key and the cert is OK on the client side: (I assume that it is only read once): [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 [pid 11829] read(4, "VQQDEwJERTEkMCIGCSqGSIb3\nDQEJARY"..., 4096) = 1425 [pid 11829] read(4, "", 4096) = 0 [pid 11829] close(4) = 0 [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 17:52:56 LOG7[11829:140253752059616]: Certificate loaded ) = 68 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 902008.12.31 17:52:56 LOG7[11829:140253752059616]: Key file: /etc/stunnel/stunnelserver.pem ) = 90 [pid 11829] open("/etc/stunnel/stunnelserver.pem", O_RDONLY) = 4 [pid 11829] fstat(4, {st_mode=S_IFREG|0600, st_size=5521, ...}) = 0 [pid 11829] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE| MAP_ANONYMOUS, -1, 0) = 0x7f8f5f13b000 [pid 11829] read(4, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 4096 [pid 11829] close(4) = 0 [pid 11829] munmap(0x7f8f5f13b000, 4096) = 0 [pid 11829] write(2, "2008.12.31 17:52:56 LOG7[11829:1"..., 682008.12.31 17:52:56 LOG7[11829:140253752059616]: Private key loaded While I see in the clients logfile: SSL state (connect): SSLv3 flush data SSL alert (read): fatal: bad certificate SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Strange! One more hint? -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 1

Problem with the client certificate
by Michael Renner 27 Dec '08

27 Dec '08

Moin, it seems that I understood something wrong with stunnel client certificates. First of all: until now I run stunnel 4.18 and stunnel 4.21 with debian and kubuntu without client certificates (with success). I use it to reach a proprietary application through an untrusted network. Now, I want the clients to authenticate against the server. Therefor, as a quick and dirty test, I used the same stunnel.pem file at the server and at the client side. The configuration at the server side (where the application is waiting for connections, in this example it is just a script) looks like this: cert = /etc/stunnel/stunnel.pem #chroot = /var/run/stunnel/ pid = /tmp/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel4.log exec = /root/stest.sh verify = 1 [BreakOut] accept = 192.168.0.1:443 Here is the configuration at the client side, where a browser establish a connection cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 0 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [BreakOut] accept = 127.0.0.1:8080 connect = 192.168.0.1:443 First of all: is it right to set 'verify = 1' at the server side, and 'verify = 0' at the client side? It seems right to me, because the client should authenticate, but not the other way. Anyhow: As soon as a connection is opened using this configuration it will terminate at the same second. renner@mars:~$ telnet localhost 8080 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. In the clients logfile I see SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY IGNORE: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de VERIFY OK: depth=0, /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server certificate request A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client certificate A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write certificate verify A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL alert (read): fatal: bad certificate SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket BreakOut finished (0 left) And, more interesting, at the server side: BreakOut connected from 84.57.55.105:57987 VERIFY ERROR: depth=0, error=self signed certificate: /C=DE/ST=Germany/L=Munich/O=vbox4php/OU=stunnel/CN=boulder.vbox4php.org/emailAddress=michael.renner(a)gmx.de SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Is something wrong with my self signed certificate? In my first tests I used one that I made with tinyCA, an other was made according http://www.stunnel.org/faq/certs.html: * openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem * openssl gendh 512 >> stunnel.pem * openssl rsa -in stunnel.pem -out new.pem * edit new.pem, merge some parts with stunnel.pem and rename it Any hint? Thanks -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

1 0

Windows binary kits on 64 bit 2003 server or 2008 server
by Rich Jordan 24 Dec '08

24 Dec '08

Sorry to sully the list with wintel questions, but I haven't been able to locate an answer, and without systems available to test the obvious method of finding out is not available. We're running Stunnel V4.26 on a windows 2003 32-bit server, communicating with several better platforms running Stunnel V4.20 and newer, no issues. One interested customer is running windows 2003 server, 64-bit, and plans on moving to win2008 server 64 bit in the not too distant future. I do not have access to either OS/system and they're reluctant to install without knowing ahead of time what might happen. I'm hoping someone has tried the current STunnel binary kit on either or both of those systems. Will the kit run on 64-bit windows 2003, and is it usable on windows 2008? If not is this a situation where a build from source on either/both of those windows systems will produce working code? I've also found a number of hits for reputed OpenSSL ports for 64 bit windows. Any particular ones known to be good? Thanks for any info. Rich Illuc ivi, illud feci

1 0