- stunnel-users - stunnel.org

certificate unknown - error:14094416
by Ludovic DUFLOT 12 May '06

12 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown The certificate is self-signed. If I use stunnel for establishing connexion with IMAPS server with a self-signed certificate too, all is right but not for LDAP connexion. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0

need HELP!! HELP!! with stunnel compile
by Nadav, Erez 10 May '06

10 May '06

Hi all, Hi all stunnel users. I want to debug and fix some TLS bugs with stunnel. I loaded stunnel 4.14 sources but i failed to compile it with visual studio 6, under windows 2000 environment. 1. Does anybody has the dsp file to be used under VC6++ for proper stunnel compilation ??? 2. Do I need any other libraries beside openssl to link ? I will appreciate any help Regards Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

RE: [stunnel-users] stunnel use with TLS
by Nadav, Erez 10 May '06

10 May '06

I am using simple tcp/ip connection, which fail on the first hello message -----Original Message----- From: Scott Gifford [mailto:sgifford@suspectclass.com] Sent: Wednesday, May 10, 2006 4:46 AM To: Nadav, Erez Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel use with TLS "Nadav, Erez" <Erez.Nadav(a)verint.com> writes: > > > Hi all, > > > > 1. Can I use stunnel as a client which connects in TLS protocol ? Assuming you mean over a channel that starts of plaintext and is later converted to encryption, the command to start TLS is usually specific to the application protocol. What protocol are you using? For example, SMTP, IMAP, ?... ---Scott. __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

problems installing stunnel 4.15
by David Arques Perolada 10 May '06

10 May '06

I get the following message after doing "make" /usr/lib/gcc/i586-suse-linux/4.0.2/../../../../i586-suse-linux/bin/ld: cannot find -lwrap collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/root/Stunnel/stunnel-4.15/src' make: *** [all-recursive] Error 1 All help will be welcome Thanks in advance David Arques i Perolada E-Mail : darques(a)uoc.edu

1 0

stunnel use with TLS
by Nadav, Erez 10 May '06

10 May '06

Hi all, 1. Can I use stunnel as a client which connects in TLS protocol ? 2. I am using Stunnel 4.14 in client mode and trying to connect in TLS protocol to certain server. The connection failed with the following log file: 2006.05.03 10:42:52 LOG7[2388:1756]: connect_wait: waiting 10 seconds 2006.05.03 10:42:52 LOG7[2388:1756]: connect_wait: connected 2006.05.03 10:42:52 LOG7[2388:1756]: Remote FD=244 initialized 2006.05.03 10:42:52 LOG7[2388:1756]: TCP_NODELAY option set on remote socket 2006.05.03 10:42:52 LOG7[2388:1756]: SSL state (connect): before/connect initialization 2006.05.03 10:42:52 LOG7[2388:1756]: SSL state (connect): SSLv3 write client hello A 2006.05.03 10:42:52 LOG7[2388:1756]: SSL alert (write): fatal: handshake failure 2006.05.03 10:42:52 LOG3[2388:1756]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I had tried to configure stunnel configuration file with options = NO_SSLv3, but nothing changed. Did I miss anything ? Can anybody help ? Thanks Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:erez.nadav@erez.nadav@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

2 1

Installing Stunnel on AIX5.3
by Shinoy 09 May '06

09 May '06

Hi, I want to install Stunnel on AIX 5.3 and configure it. I was trying to find some documentation and also know if it will work on AIX 5.3. Any help is greatly appreciated. --------------------------------- Yahoo! India Answers: Share what you know. Learn something new. Click here Send instant messages to your online friends - NOW

2 1

RE: [stunnel-users] Stunnel configuration
by Moehrke, John (GE Healthcare) 09 May '06

09 May '06

I would further like to ask: Is it true that the proper way to get to TLSv1 is to start with SSLv3? Is there a reference that someone can point me at? John _____ From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Nadav, Erez Sent: Monday, May 08, 2006 11:55 AM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel configuration Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:erez.nadav@erez.nadav@verint.com> Web: www.verint.com <http://www.verint.com/> ________________________________________________________________________ __________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Trying to load stunnel sources
by Nadav, Erez 09 May '06

09 May '06

Hi all, I am a programmer and I want to compile the stunnel for windows application in order to try to fix some non working TLS issues. I having problem when accessing http://www.stunnel.org/download/source.html address. I have the following questions: 1. Where and How can I load all stunnel sources ? 2. How should I compile it on windows machine ? 3. How should I use the mentioned PGP key Thanks Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Stunnel configuration
by Nadav, Erez 08 May '06

08 May '06

Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:erez.nadav@erez.nadav@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

client certificate authentication
by Srilalitha Muralidhara(HCL Capital Market Services) 08 May '06

08 May '06

Hi, I am new to stunnel. My application listens on 6 socket ports. External applications either dump data on these socket ports or send requests on these socket ports to receive data. Thus, my application is a server and external applications are clients. We got to authenticate these external applications before accepting the requests/data. So I am planning to use client certificate authentication of stunnel. In this case, should the server have a certificate as well? Will the server be authenticated? Is it necessary for all the external applications to be using the same certificate? Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0