- stunnel-users - stunnel.org

SSL Termination Issue
by Gary Jackson 15 Oct '22

15 Oct '22

We have an STunnel configuration running to take encrypted TLS traffic from customers and pass it to our application unencrypted. We have purchased a CA signed certificate, but we are receiving an error when negotiating. We have tried many searches/configurations with no progress. STunnel General Config ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMin = TLSv1.2 sslVersionMax = TLSv1.2 ; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later ;securityLevel = 0 ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-;RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:AES256-GCM-;SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-;AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:AES128-GCM-SHA256 curves = X25519:P-256:X448:P-521:P-384 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; such as softhsm2-x64.dll or opensc-pkcs11.dll ; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2-x64.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d STunnel Service Specific Config ; TLS front-end to a web server [https] accept = 27015 connect = 172.31.4.10:9000 cert = mycert.pem key = mycert.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 STunnel Debug 2022.10.15 11:16:08 LOG6[769]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.15 11:16:08 LOG3[769]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.15 11:16:08 LOG7[769]: Compression: null, expansion: null 2022.10.15 11:16:08 LOG7[769]: Deallocating application specific data for session connect address 2022.10.15 11:16:08 LOG6[769]: s_connect: connecting x.x.x.x:9000 2022.10.15 11:16:08 LOG7[769]: s_connect: s_poll_wait x.x.x.x:9000: waiting 10 seconds 2022.10.15 11:16:08 LOG7[769]: FD=792 ifds=--- ofds=r-- 2022.10.15 11:16:08 LOG7[769]: FD=888 ifds=rwx ofds=--- 2022.10.15 11:16:08 LOG5[769]: s_connect: connected x.x.x.x:9000 2022.10.15 11:16:08 LOG6[769]: persistence: x.x.x.x:9000 cached 2022.10.15 11:16:08 LOG5[769]: Service [https] connected remote server from x.x.x.x:52720 2022.10.15 11:16:08 LOG7[769]: Setting remote socket options (FD=888) 2022.10.15 11:16:08 LOG7[769]: Option TCP_NODELAY set on remote socket 2022.10.15 11:16:08 LOG7[769]: Remote descriptor (FD=888) initialized 2022.10.15 11:16:09 LOG6[769]: SSL_read: Socket is closed 2022.10.15 11:16:09 LOG6[769]: TLS socket closed (SSL_read) 2022.10.15 11:16:09 LOG7[769]: Sent socket write shutdown Any assistance would be GREATLY appreciated! Thank you. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

2 3

Peer Suddenly Disconnects after Negotiating TLS
by Gary Jackson 13 Oct '22

13 Oct '22

I have a TLS Connection that appears to be established but then is terminating and not sure what would cause this. 2022.10.13 14:56:36 LOG5[12435]: Service [https] accepted connection from 97.72.232.10:62890 2022.10.13 14:56:36 LOG6[12435]: Peer certificate not required 2022.10.13 14:56:36 LOG6[12435]: TLS accepted: new session negotiated 2022.10.13 14:56:36 LOG6[12435]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2022.10.13 14:56:36 LOG3[12435]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2022.10.13 14:56:36 LOG6[12435]: s_connect: connecting 172.31.4.10:9000 2022.10.13 14:56:36 LOG5[12435]: s_connect: connected 172.31.4.10:9000 2022.10.13 14:56:36 LOG6[12435]: persistence: 172.31.4.10:9000 cached 2022.10.13 14:56:36 LOG5[12435]: Service [https] connected remote server from 172.31.4.20:59907 2022.10.13 14:56:36 LOG6[12435]: SSL_read: Socket is closed 2022.10.13 14:56:36 LOG6[12435]: TLS socket closed (SSL_read) 2022.10.13 14:56:36 LOG5[12435]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Thanks in advance. _________________________________ Gary Jackson | Senior Systems Engineer Direct: 502.777.1940 IT GUY NETWORKS LLC | Certified Systems Consultants 14607 Lake Bluff Place Louisville, KY 40245 The information contained in this email, and in any accompanying documents, constitutes confidential information, which belongs to IT Guy Networks. This information is intended for the use of the individual(s) or entity named above. You are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on this information, is strictly prohibited.

1 0

SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading
by carango＠ingeniocarmelita.com 13 Oct '22

13 Oct '22

Hello I have the same problem, any solution? SSL_read: ssl/record/rec_layer_s3.c:308: error:0A000126:SSL routines::unexpected eof while reading

1 0

32-bit windows download
by Ágnes Kakasi 27 Sep '22

27 Sep '22

Hi, I'm looking for help to download and install Stunnel on a laptop with 32-bit Windows 7. I have downloaded the available download file from the website (stunnel-5.66-win64-installer.exe) but the computer indicates it cannot open the file. I tried to find info on this and in the platform sections I found Stunnel can run on 32-bit, as well, but I don't know how to make it work. Can you please advise me on what the correct download file is and how to install it so that it works on this computer? Thank you in advance. Agnes

2 1

error:0A000438:SSL routines::tlsv1 alert internal error
by johannwang＠ami.com 21 Sep '22

21 Sep '22

Hello, I am trying to use the xvncviewer on Ubuntu by VNC over stunnel, it will connect failed and print "xvncviewer: read: Connection reset by peer". The LOG on VNC server is here: 2012.01.01 00:21:58 LOG7[1]: Initializing application specific data for session authenticated 2012.01.01 00:21:58 LOG7[1]: SNI: no virtual services defined 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS read client hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server hello 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write key exchange 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write certificate request 2012.01.01 00:21:58 LOG7[1]: TLS state (accept): SSLv3/TLS write server done 2012.01.01 00:21:58 LOG7[1]: TLS alert (read): fatal: internal error 2012.01.01 00:21:58 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1584: error:0A000438:SSL routines::tlsv1 alert internal error 2012.01.01 00:21:58 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2012.01.01 00:21:58 LOG7[1]: Deallocating application specific data for session connect address 2012.01.01 00:21:58 LOG7[1]: Local descriptor (FD=3) closed 2012.01.01 00:21:58 LOG7[1]: Service [vnc] finished (0 left) I am running Stunnel 5.63 Here is the configuration currently: stunnel.conf on VNC client: cert = /home/server.pem key = /home/privkey.pem [VNC] client = yes accept = 127.0.0.1:5901 connect = 172.31.100.121:5901 sslVersion = all verifyChain = yes CAfile = /home/server.pem checkIP = 172.31.100.121 stunnel.conf on VNC server: cert = /conf/server.pem ;key = /conf/certs/privkey.pem setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:TCP_NODELAY=1 debug = 7 foreground = yes client = no ciphers=AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM sslVersion = TLSv1.2 [vnc] accept = :::5901 connect = 5900 verify = 3 CAfile = /conf/server.pem Is this something I can remedy from the configuration, or is this something that requires modification? Thank you Johan

1 0

v5.66: failing test 081
by Andreas Vetter 20 Sep '22

20 Sep '22

Hi, in open build system I get the following failing test, when building and testing stunnel 5.66: [ 45s] 081. Test IPv6 support [ 45s] [client] Read '2022.09.15 21:17:15 LOG6[0]: TLS fd: Connection reset by peer (104)' [ 45s] ...................................................................... failed Is this a stunnel problem or a problem with logging inside the build system? What can I do to get more verbose information during build? The test is working for a similar target OS (openSUSE_Tumbleweed) and not for this one (openSUSE:Factory). The difference is small, but sometimes not neglectible: openSUSE:Factory is the to be tested submissions, always in the flow. openSUSE_Tumbleweed is a tested working snapshot of Factory. Best regards, Andreas

1 1

stunnel 5.66 released
by Michał Trojnara 11 Sep '22

11 Sep '22

Dear Users, I have released version 5.66 of stunnel. ### Version 5.66, 2022.09.11, urgency: MEDIUM * New features - OpenSSL 3.0 FIPS Provider support for Windows. * Bugfixes - Fixed building on machines without pkg-config. - Added the missing "environ" declaration for BSD-based operating systems. - Fixed the passphrase dialog with OpenSSL 3.0. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 558178704d1aa5f6883aac6cc5d6bbf2a5714c8a0d2e91da0392468cee9f579c stunnel-5.66.tar.gz 5fccb2e4db0d2e3c1adb26c3906585ac545baf88226f4f539b2dc43fe418a3ef stunnel-5.66-win64-installer.exe 3b1e30e060e16f6aa9a8ad1b1a6ba1210c165bf76bd01e4734cb4537e0717c09 stunnel-5.66-android.zip Best regards, Mike

1 0

Stunnel Consulting
by Gary Jackson 10 Sep '22

10 Sep '22

I am looking for someone to assist with an stunnel configuration on windows that will accept TLS1.2 connections and then send them unencrypted to an IP and port. I would need to get it working within the next week or so and am available most times if scheduled. Thank you. Gary Jackson Sent from my mobile

2 1

TLS 1.2 traffic on STunnel
by Gary Jackson 08 Sep '22

08 Sep '22

Good afternoon, I am trying to use Stunnel to accept traffic from a custom application using TLS 1.2 and a self signed cert and then send it to a back end application unencrypted. I want the configuration to only affect one listener on Stunnel and not all incoming ports. I am using Stunnel v.5.6 I am confused with all the documentation and what needs to be set in the config file for this use case. The config file currently has connections where it accepts traffic on one port and then directs it to another port internally but not with TLS 1.2. Thank you for all your knowledge and insight! _________________________________ Gary Jackson | Senior Systems Engineer

2 1

Certificate Request's "Distinguished Names" list is empty when using CAPath (but not when using CAFile)
by david.rundqvist＠gmail.com 26 Aug '22

26 Aug '22

Hi, If I hash the client certificates and put them in a folder (with file names <hash>.0), and use the CAPath parameter on the server, together with verify=3, the server's Certificate Request message contains an empty list of "Distinguished Names". However, if I put the client certificates concatenated in a .pem file, and use the CAFile parameter on the server, the Certificate Request message does contain the Distinguished Names. Is this the correct behavior? I thought CAFile and CAPath worked more or less in the same way, but perhaps the Certificate Request message is implemented differently, depending on if you use CAFile or CAPath? My preferred way is to use CAPath: Is there some way I can get the Distinguished Names not to be empty, when using CAPath? I'm on Windows, using stunnel version 5.49, currently. Thanks in advance! Kind regards, /David

2 1