- stunnel-users - stunnel.org

Error Reading Certificate File
by Ken Davidson 04 Nov '10

04 Nov '10

Hi, I am trying to update my companies Certificate in STunnel and I'm getting the following error messages: Certificate: pass-web_new.pem Error reading certificate file: pass-web_new.pem error queue: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib error queue: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib error queue: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag We are currently using STunnel without issue; but my certificate is due to expire November 15th. I submitted my request via a CSR file created with OPENSSL. I've attempted to put the data into the file pointed at in the stunnel.conf file but this error continues to haunt me. My previous key was 256, but when making this key I created a 1024 key and used that for the CSR file. I've also added the Intermediate certificate information to the file. Any information on what could be the problem is greatly appreciated. Version: 4.34 Thanks, Ken

1 0

FD_SETSIZE still an option in stunnel 4.34?
by Saikat Chakrabarti 04 Nov '10

04 Nov '10

Hi, I am having some issues with my server where connections are getting dropped once I hit a hard limit of around 350 connections. This may or may not be an issue with my stunnel configuration, but I ran across some old posts saying that stunnel by default has a hard limit of around 500 connections and, to get around this, to set FD_SETSIZE at compile time (I found this on the troubleshooting page - http://www.stunnel.org/faq/troubleshooting.html) However, one of the release notes recently also had a comment saying 'no more FD_SETSIZE limit!' - http://www.mail-archive.com/openssl-users@openssl.org/msg38373.html. So my questions are: 1) Does FD_SETSIZE still exist in Stunnel 4.34 and could it be a reason why I am seeing a limit on the number of people that can make a connection? I already tried running stunnel after setting ulimit -Hn and ulimit -Sn to 4096, and it did not seem to make a difference. 2) More noobish question - how do I set the FD_SETSIZE at compile time? I saw in the troubleshooting that it said to do "-DFD_SETSIZE=4096" at compile time. Is this something I should be adding in one of the Makefiles? Some more info about my setup: - I am using stunnel as a layer in front of Node.js to secure websockets and HTTP connections. - I'm running stunnel 4.34 - I am running stunnel from a startup script in /etc/init.d - it runs as a daemon process - I run stunnel with no params, but with this config file - http://pastebin.com/3Yr80ma1 - uname -a output: Linux gomockingbird.com 2.6.18.8-linode22 #1 SMP Tue Nov 10 16:12:12 UTC 2009 i686 GNU/Linux - gcc -v output: Using built-in specs. Target: i486-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.3.3-5ubuntu4' --with-bugurl=file:///usr/share/doc/gcc-4.3/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.3 --program-suffix=-4.3 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-targets=all --with-tune=generic --enable-checking=release --build=i486-linux-gnu --host=i486-linux-gnu --target=i486-linux-gnu Thread model: posix gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) - openssl version output: OpenSSL 0.9.8g 19 Oct 2007 Thanks in advance for any help! -- Saikat

2 3

Many services on the same port (VirtualHost)
by Hugo 01 Nov '10

01 Nov '10

Hello all! Does anyone knows a way to make many services listening on the same port? I've got one stunnel4 server which allows me to crypt two http servers. The first service bind on port 465 and the second on 470. What I will is to let user access on the port 465 using 2 different ServerNames. Thank you in anticipation, and excuse me for my quite bad english =D

4 3

Re: [stunnel-users] stunnel-users Digest, Vol 75, Issue 13
by Hugo 31 Oct '10

31 Oct '10

It's what I wanted to do: redirect the public 443 port on the correct local stunnel "accept:" port or service. I'd set 3 services with 3 different certificates on 3 ports. By eg, my first domain is ssl.example.com and the second admin.example.com. These two records point on the same IP. Stunnel has two services on that, so it binds two ports (!=443) (eg, 7100 and 7200) Is there a way to stunnel (or another program) bind on port 443 and, if user connects on ssl.example.com, forward frames/respond using the service/port 7100, and the same for admin.example.com on 7200? https://ssl.example.com ==> https://ssl.example.com:7100 https://admin.example.com ==>https://admin.example.com:7200 ? Thanks Message: 2 Date: Sat, 30 Oct 2010 11:45:19 -0400 (EDT) From: Jon Daley <stunnel(a)jon.limedaley.com> To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Many services on the same port (VirtualHost) Message-ID: <alpine.DEB.2.00.1010301139120.19689(a)orange.limedaley.com> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Sat, 30 Oct 2010, Hugo wrote: > Does anyone knows a way to make many services listening on the same port? > I've got one stunnel4 server which allows me to crypt two http servers. > The first service bind on port 465 and the second on 470. > What I will is to let user access on the port 465 using 2 different > ServerNames. I am not sure what you are trying to do. You want clients to connect via https to ports 465 on two different IPs and then stunnel to forward them to the appropriate http daemon? I am not sure if stunnel works in that method - that is the reverse of what I use stunnel for - I connect via an unencrypted connection, and forward via stunnel to an encrypted daemon. And if you are talking about virtually hosting https connections, that will work, as long as the certificate contains both servernames - you can't use two different certificates, because you don't know which certificate to serve until after the connection is encrypted.

2 2

Re: [stunnel-users] Many services on the same port (VirtualHost)
by Hugo 30 Oct '10

30 Oct '10

Thanks for the answer, but it seems I haven't got access to IPTables (my stunnel is on a remote shell service) and I think using a webserver is not a good solution for that case. So does anyone knows a program able to bind on a single port, and redirect requests on another depending on the domain name? Thanks you in anticipation Hugo On 30/10/2010 17:02, Pierre DELAAGE wrote: > Hello, > The answer is simply NO in stunnel, > but yes in Apache. > If you are joining one "http server", hosting many virtual hosts, > it should be "trivial". > I recommend using IP based hosting. > > I guess you want to act as a transparent gateway/proxy to https servers : > there is another way to proceed if you have a linux PC on your network > that can act as a routing/gateway: > with iptables you can do redirection to stunnel and get what you want. > Sorry but it is a little bit complicated to develop more now. > > Hope this helps, > Pierre Delaage > > > Le 30/10/2010 17:12, Hugo a écrit : >> Hello all! >> >> Does anyone knows a way to make many services listening on the same port? >> I've got one stunnel4 server which allows me to crypt two http servers. >> The first service bind on port 465 and the second on 470. >> What I will is to let user access on the port 465 using 2 different >> ServerNames. >> >> Thank you in anticipation, and excuse me for my quite bad english =D >> >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 30 Oct '10

30 Oct '10

On Wed, 27 Oct 2010, Jon Daley wrote: > On Wed, 27 Oct 2010, Michal Trojnara wrote: >> Jon Daley wrote: >>>> 3. Cross-compile OpenSSL: >>>> ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared >>>> zlib-dynamic >>>> make >>> And you end up with 3 dlls in the openssl directory? >> >> Not really. Just 2 of them. Zlib is produced in step 2. > Hrm. I wasn't talking about the zlib1.dll. I meant: > ssleay32.dll, libssl32.dll and libeay32.dll. Maybe I got mixed up the names, > and am using one that I don't need. I thought I put them in one at a time, > and waited for Windows to ask me for them, but I'll check again. Ah, yes. I am dumb. I can compile and run it without problems with just the two *eay32 dlls. And we've finally figured out the other bug, where it works on my computer, and not on someone else's. It has to do with ipv6 support, and it didn't go away even after I ./config --disable-ipv6, which that flag is (mostly?) ignored in the windows builds, due to the dynamic LoadLibrary calls. On one computer, stunnel connects on the ipv6 port, but then when running "telnet localhost 7000", it connects via the ipv4 port, and so fails. If we force stunnel to use ipv4 by using 127.0.0.1 instead of localhost, everything works fine. My guess is that his computer is partially/incorrectly configured for ipv6, and so that is the reason for the failure. I'm planning on removing the LoadLibrary calls to force ipv6 to be off, though it'd be nice to not do that, since someday, there will be an ipv6-only network that we'll have to deal with presumably. -- Jon Daley http://jon.limedaley.com ~~ For many people, one of the most frustrating aspects of life is not being to understand other people's behavior. We see them as "guilty" instead of "innocent." -- Unknown

2 2

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

On Wed, 27 Oct 2010, Michal Trojnara wrote: > 1. Install mingw32 tools: > apt-get install mingw32 Yes, I did that. > 2. Cross-compile and install zlib > (see the zlib documentation for details) Yes, I was doing that, but then was leaving it out since I don't need it (AFAIK). > 3. Cross-compile OpenSSL: > ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared > zlib-dynamic > make And you end up with 3 dlls in the openssl directory? > 4. Cross-compile stunnel: > cd src > make stunnel.exe I can compile stunnel.exe fine, I just can't run it, because I don't have all three of the dlls. -- Jon Daley http://jon.limedaley.com ~~ If you do a job too well, you will get stuck with it. -- Slous

2 1

openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

I am trying to compile openssl and stunnel for Win32, using my Debian host. openssl compilation: ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared no-zlib && make The only problem I'm having is that libssl32.dll is not being created. I have the other libssl* files: libssl.a libssl.dll.a libssl.pc So, then I download the precompiled dlls of openssl from here: http://www.slproweb.com/products/Win32OpenSSL.html But, they require an additional vc redistributable, and since it seems like I'm so close, it'd be nice to finish it off the rest of the way. stunnel compiles fine pointing it at the openssl directory, but on run-time, it complains that libssl32.dll can't be found. Thanks. -- Jon Daley http://jon.limedaley.com ~~ There are no traffic jams when you go the extra mile. -- Anonymous

2 1

Stunnel dropping data on binary uploads from most browsers.
by Bill Crowell 16 Oct '10

16 Oct '10

All, I'm hoping that someone can assist with this. I'm using Stunnel on 2 different systems: Mac and FC 13 to front-end my web server for a custom database system. It works flawlessly except for uploading large binary files. The problem comes when trying to upload say a 2.5MB image file. The number of bytes actually transferred to the exec program is usually under 1K or right at about 33K. Using Firefox on Windows works all the time. I can observe the transfer by watching the stunnel.log file. When the data is piped into the openSSL engine, the number of bytes written to socket is being picked up by the exec program and processed so the loss is between the browser and the output side of Stunnel. The message itself is a multi-part message that is not mime-encoded. The part with the image is set in the boundary properly and contains the JPEG binary. (Thanks to HTTPwatch!) My Stunnel Version is: [root@linux log]# stunnel -version stunnel 4.33 on i386-redhat-linux-gnu with OpenSSL 1.0.0a-fips 1 Jun 2010 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My configuration file on the Linux box is: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key debug = 7 output = /var/log/stunnel.log ;socket = l:SO_LINGER=1:60 ;socket = r:TCP_NODELAY=1 client = no sslVersion = SSLv3 [https] libwrap = no accept = 443 exec = /usr/qmsys/bin/qm execargs = /usr/qmsys/bin/qm -b7 -quiet -aPAVUK "P.HTTP" options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTidle = 30 TIMEOUTbusy = 5 TIMEOUTclose = 0 *** A RANDOM SUCCESSFUL TRANSFER *** 2010.10.15 10:03:12 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: Service https started 2010.10.15 10:03:12 LOG7[946:3078241136]: FD=0 in non-blocking mode 2010.10.15 10:03:12 LOG5[946:3078241136]: Service https accepted connection from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): before accept initialization 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 flush data 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: 8 items in the session cache 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects (SSL_connect()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects (SSL_accept()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 server renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 27 session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 external session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache misses 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache timeouts 2010.10.15 10:03:12 LOG6[946:3078241136]: SSL accepted: previous session reused 2010.10.15 10:03:12 LOG6[946:3078241136]: Local mode child started (PID=1179) 2010.10.15 10:03:12 LOG7[946:3078241136]: Remote FD=13 initialized 2010.10.15 10:03:13 LOG7[946:3078241136]: Socket closed on read 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL write shutdown 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL alert (write): warning: close notify 2010.10.15 10:03:13 LOG6[946:3078241136]: SSL_shutdown successfully sent close_notify 2010.10.15 10:03:13 LOG6[946:3078241136]: s_poll_wait timeout: connection close 2010.10.15 10:03:13 LOG5[946:3078241136]: Connection closed: 2895 bytes sent to SSL, 2469539 bytes sent to socket 2010.10.15 10:03:13 LOG7[946:3078241136]: Service https finished (0 left) 2010.10.15 10:03:13 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:03:13 LOG6[946:3078133552]: Child process 1179 finished with code 0 2010.10.15 10:03:13 LOG7[946:3078133552]: Signal pipe is empty *** MOST OF THE TIME - AN UNSUCCESSFUL TRANSFER *** 2010.10.15 10:05:01 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: Service https started 2010.10.15 10:05:01 LOG7[946:3077921648]: FD=0 in non-blocking mode 2010.10.15 10:05:01 LOG5[946:3077921648]: Service https accepted connection from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): before/ accept initialization 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 flush data 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: 9 items in the session cache 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects (SSL_connect()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects (SSL_accept()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 server renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 35 session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 external session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache misses 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache timeouts 2010.10.15 10:05:01 LOG6[946:3077921648]: SSL accepted: previous session reused 2010.10.15 10:05:01 LOG6[946:3077921648]: Local mode child started (PID=1213) 2010.10.15 10:05:01 LOG7[946:3077921648]: Remote FD=13 initialized 2010.10.15 10:05:04 LOG7[946:3077921648]: Socket closed on read 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL write shutdown 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL alert (write): warning: close notify 2010.10.15 10:05:04 LOG6[946:3077921648]: SSL_shutdown successfully sent close_notify 2010.10.15 10:05:04 LOG6[946:3077921648]: s_poll_wait timeout: connection close 2010.10.15 10:05:04 LOG5[946:3077921648]: Connection closed: 2895 bytes sent to SSL, 66703 bytes sent to socket 2010.10.15 10:05:04 LOG7[946:3077921648]: Service https finished (0 left) 2010.10.15 10:05:04 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:05:04 LOG6[946:3078133552]: Child process 1213 finished with code 0 2010.10.15 10:05:04 LOG7[946:3078133552]: Signal pipe is empty *** All test cases are the same upload of the same image file. In all tests the number of bytes sent to socket matches what the exec program is receiving in its pipe. My feeling is that there is a connection issue between the browser and Stunnel. The successful upload of the test occurs sometimes with all browsers and appears to always work with Firefox for Windows. It has a 90% failure rate on Safari for Windows, Safari for Mac, Opera for Windows, Opera for Mac, etc. In all cases of testing, the number of bytes "sent to socket" is received by my exec program and consists of a truncated message from the browser. It appears that the data is simply being truncated somewhere in the Stunnel process. Any help is always appreciated! If there are more tests to be run to track down the problem, please advise and I will run them. Regards, Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

2 1

Recompiling Stunnel at version 4.34 appears to fix dropped data problem
by Bill Crowell 15 Oct '10

15 Oct '10

I reported a consistent data loss from most browsers when transferring large files. Compiling version 4.34 on Mac OS X 10.6.4 with the latest Xcode toolkit has resolved the connection problem for all browsers that I have tested except for Safari 5.0 on both Windows and Mac. It has also fixed a connection problem with IE 6 which was not accepting any connection to Stunnel prior to this installation. *** This problem still persists on my linux box running 4.33 installed from FC13. I will attempt a compile of 4.34 and see if this fixes the problem there as well. Fedora does not yet have a package for 4.34. Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

1 0