- stunnel-users - stunnel.org

Temporary failure in name resolution
by Phil Wieland 26 Apr '11

26 Apr '11

I think I've done something stupid but I can't work out what. I'm running stunnel4 version 4.29 on an Ubuntu server box, using it to tunnel smtp connections to my ISP's mail server. Everything works perfectly until I reboot the server, when it stops working. In syslog, I get: Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: ssmtp accepted connection from 127.0.0.1:50681 Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: Error resolving 'smtp.blueyonder.co.uk': Temporary failure in name resolution (EAI_AGAIN) Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: No host resolved Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket every time I attempt to send mail. I can ping smtp.blueyonder.co.uk no problem. The problem persists until I restart stunnel4, after which it works perfectly for weeks on end. Looking at syslog for boot time, it looks like stunnel tries to resolve smtp.blueyonder.co.uk as soon as it starts, but dhcp hasn't finished at this time so it fails. It seems to cache something from the failure and not try again? Even though the error is "Temporary". All advice gratefully received. Phil Wieland Liverpool, UK. ###@friedbread:~$ stunnel4 -version stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ###@friedbread:~$ cat /etc/stunnel/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 55899 connect = smtp.blueyonder.co.uk:465 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini ###@friedbread:~$

3 2

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 26 Apr '11

26 Apr '11

Thank you for helping, but both logs r not presented in my var/log/ dir. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 16:25:20 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > Are you sure that's entire log? check /var/log/daemons.log and > syslog.log as well. > > On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > It anyone knows how to fix Stunnel stuck at SSL state (accept): > > before/accept initialization??? > > > > Here is the log: > > ----------------------------------------------------------------------------------------------------------- > > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient > > entropy for the PRNG > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > > /etc/stunnel/CA > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > > /etc/stunnel/CRL > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > > service 3proxy > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > > Sockets:POLL,IPv6 Auth:LIBWRAP > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > > changed with 'ulimit -n') > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > > limit for file descriptors > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > > accept socket > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > > /var/run/stunnel.pid > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > > with code 0 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > > xx.xxx.xxx.xx:41165 permitted by libwrap > > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > > before/accept initialization <-----------------------Stuck here > > forever!!! > > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > > disconnected > > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent > > to SSL, 0 bytes sent to socket > > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating > > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > > /var/run/stunnel.pid > > [root@vps1 ~]# > > ----------------------------------------------------------------------------------------------------------- > > stunnel.conf: > > cert = /etc/stunnel/stunnel.pem > > key = /etc/stunnel/stunnel.pem > > CApath = /etc/stunnel/CA > > CRLpath = /etc/stunnel/CRL > > debug = 7 > > foreground = yes > > verify = 1 > > # > > [3proxy] > > accept = 30001 > > connect = 127.0.0.1:33135 > > ----------------------------------------------------------------------------------------------------------- > > > > I am hosting with CentOS 5.5, and installed Stunnel via yum. > > Planning to use it with 3Proxy. However I experience the problem above, can > > someone please help with that? > > Thank you very much! > > > > > > > > Mr. Jack > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

I installed the 4.35 one into my CentOS, it seems like the same problem still exist. Is there anything I can do to fix it? Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

Thank you! Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 25 Apr '11

25 Apr '11

It anyone knows how to fix Stunnel stuck at SSL state (accept): before/accept initialization??? Here is the log: ----------------------------------------------------------------------------------------------------------- [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient entropy for the PRNG 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to /etc/stunnel/CA 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to /etc/stunnel/CRL 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for service 3proxy 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be changed with 'ulimit -n') 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE limit for file descriptors 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on accept socket 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file /var/run/stunnel.pid 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished with code 0 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from xx.xxx.xxx.xx:41165 permitted by libwrap 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): before/accept initialization <-----------------------Stuck here forever!!! 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly disconnected 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file /var/run/stunnel.pid [root@vps1 ~]# ----------------------------------------------------------------------------------------------------------- stunnel.conf: cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem CApath = /etc/stunnel/CA CRLpath = /etc/stunnel/CRL debug = 7 foreground = yes verify = 1 # [3proxy] accept = 30001 connect = 127.0.0.1:33135 ----------------------------------------------------------------------------------------------------------- I am hosting with CentOS 5.5, and installed Stunnel via yum. Planning to use it with 3Proxy. However I experience the problem above, can someone please help with that? Thank you very much! Mr. Jack

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

Possible leak in client.c:init_ssl()
by Sven Ulland 16 Apr '11

16 Apr '11

Quick summary: Stunnel 4.35 configured with four services. As clients connect, the main stunnel process grows a lot in vsz/rss memory. With a lot of clients connecting, it quickly grows to several gigabytes rss. The use case is quite special: The multithreaded download accelerator 'axel' is used to download large files using 800 simultaneous threads. The downloads are from China, so the network performance is horrible, and connections are reset/broken all the time, so there is lots of new connections created constantly. Up to four axel instances run at the same time, so we're talking 3200 simultaneous connections. Over a short 2h timespan, nearly 30000 connections have been set up (ref attached stunnel.log). The memory use increases over time, often in very large steps. As connections finish and the transfers stop (i.e. no active connections at all), the memory is not released. A similar issue was reported in 2008 [1]. Attached are the following files: stunnel.conf: Four services, no special config. Debug level 5. massif.out.excerpt.txt: Valgrind Massif output. The Massif log indicates that most of the memory is allocated through client.c:init_ssl(), by libssl and zlib. I haven't looked too much at the code yet, but could this be related to the high rate of connection resets/timeouts, combined with connection/session reuse? sven [1]: possible stunnel memory leak Message-ID: <47E8E0AD.8010709(a)eu.citrix.com> http://www.stunnel.org/pipermail/stunnel-users/2008-March/001903.html

4 5

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Leandro Avila 12 Apr '11

12 Apr '11

The problem seems to be the key size If you use a 512 key for stunnel it works However, when the key used by stunnel is 1024 and you try to use the EXP-RC4-MD5 cipher, a temporary 512 key is generated BUT that fails. So I tested: Stunnel 4.35 and OpenSSL 1.0.0d Using a 512 RSA key and EXP-RC4-MD5 works Using a 1025 RSA key and EXP-RC4-MD5 fails Looks more like an OpenSSL thing. I'm uncertain about how this situation is handled in the protocol spec. When the server has a 1024 key but the client wants to negotiate with a smaller key. Cheers ----------------- Leandro Avila ----- Original Message ----- From:Outofwall.com <root(a)outofwall.com> To:stunnel-users-bounces@stunnel.org; stunnel-users(a)stunnel.org Cc: Sent:Monday, April 11, 2011 10:39 PM Subject:Re: [stunnel-users] Weird error when trying to use 512bit RSA key In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Outofwall.com 12 Apr '11

12 Apr '11

In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers.

1 0

The verify=3 option in client mode
by Philipp Hartwig 09 Apr '11

09 Apr '11

Hello, I'm using stunnel in client mode to provide an SSL connection for offlineimap[1] which does not support verification of SSL certificates. As I've read stunnel does not compare the name of the server offering the certificate to the server name mentioned in the certificate (in the CN field for example). So if I used the following section in my stunnel.conf client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt verify = 2 stunnel would happily accept any certificate signed by Equifax for an arbitrary website. Is this correct? So I've switched to using the verify=3 option and I just want to make sure I configured it correctly. I'm now using the following section client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile= /home/ph/.certs/imaps.pem verify = 3 imaps.pem is a file containing two certificates, namely the first and the last certificate in the certificate chain of imap.gmail.com, that is the Equifax CA certificate and the server certificate itself. I then use offlineimap to establish an unencrypted connection to 127.0.0.1:4322. My understanding is that stunnel will now exclusively accept the server certificate stored in the imaps.pem file rendering all MITM attacks impossible. I'd be grateful if someone could confirm that this setup makes sense. Is this the way the verify=3 option is supposed to use? First I thought that it should be enough to just provide the server certificate in the imaps.pem file, but then openssl would complain about a self-signed certificate, so I included the CA certificate as well. Regards, Philipp [1] https://github.com/jgoerzen/offlineimap/wiki/

2 3