- stunnel-users - stunnel.org

Was LOG3[per-minute]: OCSP: SSL_get_certificate for a shared secret, PSK, configuration fixed with 5.76?
by u34＠net9.cf 01 Nov '25

01 Nov '25

Hello, At [stunnel 5.76 released](https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@st… - Missing OCSP stapling is no longer logged as an error. was mentioned in Bugfixes. My understanding is [LOG3[per-minute]: OCSP: SSL_get_certificate](https://www.stunnel.org/mailman3/hyperkitty/list/stunn… is fixed. But it isn't.

1 0

Should remote host IPs recorded at lower debug levels too?
by u34＠net9.cf 21 Oct '25

21 Oct '25

Does recording the IPs of the remote host depends on other configuration directives, other then the debug directive? Is it correct that at LOG5, IPs of the remote host are recorded at the log file? Is it correct that at LOG3, no IPs are recorded even when other information for a particular connection is considered worth recording? Aren't IPs considered important information worth recording when error conditions are recorded?

1 0

stunnel 5.76 released
by Michał Trojnara 18 Oct '25

18 Oct '25

Dear Users, I have released version 5.76 of stunnel. ### Version 5.76, 2025.10.18, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.4. - Service-level multivalued options now override (rather than append to) global defaults, preventing unintended configurations. * Bugfixes - Fixed enabling/disabling of the default fips=yes property. - Missing OCSP stapling is no longer logged as an error. - Fixed a crash when a PIN was required due to the PKCS#11 CKA_ALWAYS_AUTHENTICATE attribute. * Features - Quantum-resistant hybrid key agreement X25519+ML-KEM-768 (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3. - Multiple cert sources are supported, allowing a certificate to be fetched from a provider while loading the chain from a file. - Android build switched to a 16 KB page size. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: cda37eb4d0fb1e129718ed27ad77b5735e899394ce040bb2be28bbb937fd79e1 stunnel-5.76.tar.gz d93c7c01366d38ebd27689d606e45197ba8e2e2a32d1a186a81d2b01186bfb56 stunnel-5.76-win64-installer.exe f081281c92f6dc245e23d57930f3963d0155a9fc4a707b7414c941e8e60a1957 stunnel-5.76-android.zip Best regards, Mike

1 0

LOG3[per-minute]: OCSP: SSL_get_certificate
by u34＠net9.cf 15 Oct '25

15 Oct '25

With stunnel version 5.74 and debug = 3 foreground = yes setgid = abcde setuid = abcde output = /path/to/log/file [service] PSKsecrets = /path/to/secretfile accept = ip1:port1 connect = ip2:port1 debug = 3 setgid = abcde setuid = abcde This configuration looks to me similar to the [shell] option from the configuration examples. There is a 1 per minute LOG3[per-minute]: OCSP: SSL_get_certificate line at the log file. Does it a bug? This wasn't discussed 3 weeks ago at [How to get rid of "No OCSP stapling response received" warning?](https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@st…, was it?

1 0

Client mode certificate pinning
by Ian Pilcher 11 Oct '25

11 Oct '25

Is $SUBJECT possible? I use stunnel to connect to my old "smart" switches that don't support modern TLS protocols, ciphers, etc. Recently, their existing certificates all expired, and I tried to install new certificates on all of them, only to discover that they won't accept my new CA certificate, because it was signed with a 3072-bit key. I could go through the trouble of generating a separate CA certificate with a 2048-bit key, sign new certificates with that key, etc., etc., but it starts to seem a bit silly at that point. Far better to simply generate a self-signed certificate for each switch and configure stunnel to only accept that particular certificate (i.e. "pin" it). Is this possible with stunnel? If so, how would I go about configuring it to do this? (Search engines are telling me to use "verify = 4", but stunnel(8) says that option is obsolete.) TIA! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

2 1

+=item B<requireCert> = yes | no ignored when client = yes
by u34＠net9.cf 07 Oct '25

07 Oct '25

In my opinion, the following emphasis worth including: --- stunnel.pod.in.orig 2025-10-07 19:50:30.097392645 +0000 +++ stunnel.pod.in.new 2025-10-07 20:25:54.448391940 +0000 @@ -1065,6 +1065,8 @@ =item B<requireCert> = yes | no +Ignored when client = yes. + require a client certificate for I<verifyChain> or I<verifyPeer> With I<requireCert> set to I<no>, the B<stunnel> server accepts client

1 0

How to get rid of "No OCSP stapling response received" warning?
by Ian Pilcher 25 Sep '25

25 Sep '25

I use stunnel to connect to my old "smart" switches from modern browsers. Here is a subset of the configuration for one of the switches. [switch1-frontend] sni = frontend:switch1.penurio.us CAfile = /etc/ipa/ca.crt cert = /etc/pki/tls/certs/stunnel/switch1.crt key = /tmp/keys/switch1.key connect = 127.255.255.254:8081 [switch1-backend] client = yes accept = 127.255.255.254:8081 connect = 172.31.4.1:443 verifyChain = yes checkHost = switch1.penurio.us CAfile = /etc/ipa/ca.crt sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA options = ALLOW_UNSAFE_LEGACY_RENEGOTIATION securityLevel = 0 OCSPrequire = no OCSPaia = no Everything works, execept that every connection produces a bright red warning in my log: OCSP: No OCSP stapling response received I've read up on OCSP stapling, that this seems to mean that the switch isn't including an OCSP response in its TLS handshake. (Hardly surprising, given its age.) How can I tell stunnel to not request/expect an OCSP response from the switch (or at least to not log the missing OCSP response as a warning)? -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

4 5

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Stunnel, Gmail and Outlook Express
by landjonline＠hotmail.com 01 Sep '25

01 Sep '25

I have Outlook Express and my email addresses are Gmail. Is there a way to get Gmail to work with Outlook Express using Stunnel? Thanks

2 1

Using CAStore on Android (stunnel.conf)
by smf.forum1＠ntlworld.com 31 Jul '25

31 Jul '25

I have build stunnel with a few changes to run in a QThread (Qt 6.9.1) for Android. My Qt App starts stunnel at the start of execution and stops it when my Qt application exits. This all works fine (I need to review and clean up my stunnel changes before I use my solution for real) but I cannot get certification to work, here are two test runs one with verify set to 0 (works) and verify set to 2 (fails). What needs to change in my stunnel.conf file ? Thanks. (obfuscated details) stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 0 Works: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b640 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] needs authentication to prevent MITM attacks I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=117) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:36802 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:58660 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate not required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: CERT: Certificate verification disabled I/stunnel : LOG6[0]: OCSP: Certificate chain verification disabled I/stunnel : LOG6[0]: TLS connected: new session negotiated I/stunnel : LOG6[0]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) I/stunnel : LOG6[0]: Peer temporary key: X25519, 253 bits I/stunnel : LOG6[0]: Session id: 90DD6325CCBC47C3F8F560C36F76755B4959E6A8421DD97B751E37FDD1DCCAC7 I/stunnel : LOG6[0]: Session id: 24345E21753FE3B254CA089FB7621C1481B523E72EB9571DDF7A366B5E89E834 stunnel.conf foreground = yes debug = 6 [mariadb] CAstore = /data/misc/user/0/cacerts-added CApath = /data/misc/user/0/cacerts-added client = yes accept = 127.0.0.1:3307 connect = remote_server:3307 verify = 2 Fails: I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: stunnel 5.75 on android-mobile-device platform I/stunnel : LOG5[ui]: Compiled/running with OpenSSL 3.1.1 30 May 2023 I/stunnel : LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv4 TLS:ENGINE,OCSP,PSK,SNI I/stunnel : LOG6[ui]: Initializing inetd mode configuration I/stunnel : LOG5[ui]: Reading configuration from buffer 0x7280e409b0a0 I/stunnel : LOG5[ui]: UTF-8 byte order mark not detected I/stunnel : LOG6[ui]: Compression disabled I/stunnel : LOG6[ui]: Initializing service [mariadb] I/stunnel : LOG6[ui]: stunnel default security level set: 2 I/stunnel : LOG6[ui]: Session resumption enabled I/stunnel : LOG6[ui]: Configured trusted server CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[ui]: Service [mariadb] uses "verifyChain" without subject checks W/stunnel : LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates I/stunnel : LOG6[ui]: DH initialization skipped: client section I/stunnel : LOG5[ui]: Configuration successful I/stunnel : LOG6[ui]: Service [mariadb] (FD=114) bound to 127.0.0.1:3307 I/stunnel : LOG6[ui]: Accepting new connections I/stunnel : LOG6[per-day]: Executing per-day jobs I/stunnel : LOG6[per-day]: Per-day jobs completed in 0 seconds I/stunnel : LOG5[0]: Service [mariadb] accepted connection from 127.0.0.1:39238 I/stunnel : LOG6[0]: s_connect: connecting 192.168.0.1:3307 I/stunnel : LOG5[0]: s_connect: connected 192.168.0.1:3307 I/stunnel : LOG5[0]: Service [mariadb] connected remote server from 10.0.2.16:59154 I/stunnel : LOG6[0]: SNI: sending servername: remote_server I/stunnel : LOG6[0]: Peer certificate required I/stunnel : LOG6[0]: Received trusted client CA: C=AU, ST=Florida, L=York, O=Home, OU=Whiskey, CN=Michael, emailAddress=eric.admin(a)intheether.com W/stunnel : LOG4[0]: CERT: Pre-verification error: certificate not found in local repository: self-signed certificate W/stunnel : LOG4[0]: Rejected by CERT at depth=0: C=PL, ST=Mazovia Province, L=Warsaw, O=Stunnel Developers, OU=Provisional CA, CN=localhost E/stunnel : LOG3[0]: SSL_connect: tls_post_process_server_certificate@ssl/statem/statem_clnt.c:1890: error:0A000086:SSL routines::certificate verify failed I/stunnel : LOG5[0]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket I/stunnel : LOG6[ui]: Child process 17669 finished with code 0

1 0