stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

bind error when specifying hostname
by Andrew Farmer 13 Oct '09

13 Oct '09

Hi! I'm not sure if this message was sent to the mailing list the first time... I was not subscribed before but I am now. I'm trying to configure stunnel to use a different CERT depending upon the hostname that my server is accessed on. (Same server has multiple hostnames) Is this feature supported? I didn't get very far before running into issues. This configuration works: (so I know nothing else is bound on port 443) [https] accept = 443 ... etc ... This configuration fails: [https] accept = nmw3.com:443 ... etc ... with this error: 2009.10.09 14:49:18 LOG3[31137:3086100144]: Error binding https to 75.101.155.94:443 2009.10.09 14:49:18 LOG3[31137:3086100144]: bind: Cannot assign requested address (99) So I tried a simpler configuration: [https] accept = 127.0.0.1:443 ... etc ... and that fails with this error: 2009.10.09 14:56:28 LOG3[31222:3086722736]: Error binding https to 127.0.0.1:443 2009.10.09 14:56:28 LOG3[31222:3086722736]: bind: Address already in use (98) Appreciate all your help! Andrew -- View this message in context: http://www.nabble.com/bind-error-when-specifying-hostname-tp25828605p258286… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Unable to create connection on SSL with FIX Server
by ch.asad＠gmail.com 13 Oct '09

13 Oct '09

Hi, i am using Stunnel to send quickfix messages on SSL to FIX server. I am struck with some errors. In the STUNNEL log i am getting the follow error: 2009.10.13 08:57:05 LOG3[4028:2532]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_ HELLO:unknown protocol And in the Quickfix Logs are also shown below: 20091013-02:57:01 : Created session 20091013-02:57:05 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:05 : Initiated logon request 20091013-02:57:05 : Socket Error: An existing connection was forcibly closed by the remote host. 20091013-02:57:05 : Disconnecting 20091013-02:57:06 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:06 : Initiated logon request 20091013-02:57:06 : Socket Error: An existing connection was forcibly closed by the remote host. 20091013-02:57:06 : Disconnecting 20091013-02:57:26 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:26 : Initiated logon request 20091013-02:57:26 : Socket Error: An existing connection was forcibly closed by the remote host. Can any one Guide me what is causing porblem in this?? -- View this message in context: http://www.nabble.com/Unable-to-create-connection-on-SSL-with-FIX-Server-tp… Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 1

Re: [stunnel-users] rewrite Destination: when rewriting Host:
by Brian Hatch 07 Oct '09

07 Oct '09

Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted: > Researching online one can see that WebDAV's spec requires that they > check both src and dest URLs for protocol & port. But with some proxies or > SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as > http and the other as https. Here's one person explaining it, much better > than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml Stunnel doesn't currently have the ability to scan and re-write the plaintext. For HTTP redirects it could possibly be implemented (re-write only the response before ^$, and redirects aren't chunked and don't have content lengths to work with, etc) but you'd still need enough HTTP logic to handle keepalives and such. It's not trivial and not likely. Another option would be to have something already HTTP aware doing the rewriting in between stunnel and subversion. A re-writing proxy. Another option would be to use mod_rewrite in apache to rewrite the urls. But the best way would be to just use SSL inside apache and drop stunnel entirely. -- Brian Hatch The best way to accelerate Systems and a Windows machine is at Security Engineer 9.8 meters per second http://www.ifokr.org/bri/ squared. Every message PGP signed

3 2

Weird verify behaviour using intermediate CAs
by Simon Vallet 05 Oct '09

05 Oct '09

Hi, we're trying to make use of stunnel here for proxy purposes : any certificate-authenticated SSL client connection from the Internet would be forwarded to some internal server. This works fine, but I found some surprising behaviour when verifying client certificates. Consider the following setup, using an intermediate client CA : * RootCA ** UserCA1 *** UserCert1 ** UserCA2 *** UserCert2 To make this work, it seems I only have to include the Root CA certificate in either a CAfile or a directory of trusted certificates. I would have expected to have to include the intermediate CA (which is signing the user certificate), but it seems it is not the case. What worries me is that now *any* end-entity certificate which has been issued by *other* intermediate CAs is accepted as valid, i.e. UserCert2 is accepted as valid, even if I don't include UserCA2 anywhere in the configuration. Is this really the intended behaviour ? If not, what would I be missing ? Simon stunnel.conf ----------------------------------------------------------- connect = 127.0.0.1:25 CApath = /etc/stunnel/certs cert = /etc/stunnel/apollon.genoscope.cns.fr-RevChain.pem key = /etc/stunnel/apollon.genoscope.cns.fr-Key.pem verify = 2 debug = 7 ------------------------------------------------------------------------ [root@apollon certs]# ls -l /etc/stunnel/certs/ total 4 lrwxrwxrwx 1 root root 28 sep 30 11:01 9a5490ff.0 -> GenoscopeACRacine.cacert.pem -rw-r--r-- 1 root root 2269 sep 15 11:47 GenoscopeACRacine.cacert.pem [root@apollon certs]#

2 6

Looking for someone to install Stunnel on my server
by Nathan Mueller 02 Oct '09

02 Oct '09

I am looking to hire someone to install Stunnel (and openSSL) on my Media Temple DV account. Please send hourly rate and how long you think it would take to: nmueller(a)g.risd.edu Thank you for your time, Nate

1 0

Advanced Config Question-
by Dave Fazio 01 Oct '09

01 Oct '09

Group, Need help confirming Stunnel can be configured the following way: I have a server that has 5 local IPs, mapping to 5 public IPs on the outside. For example purposes, my local IPs are "A", "B", "C", "D", and "E"... If I connect to a stunnel port configured to "C", will Stunnel route the request outbound on "C" or will it use "A" outbound? The way I have it configured, it's using "A" apparently, no matter what local stunnel IP I bind my connection to. And help will be greatly appreciated. - Dave Windows Server 2003 64-bit Stunnel as a Service Example Config: [Connection-A] accept = 10.5.12.57:9000 connect = outbound.example.server:145 TIMEOUTidle = 4 [Connection-B] accept = 10.5.12.58:9005 connect = outbound.example.server:145 TIMEOUTidle = 4

2 2

SMTP AUTH with stunnel?
by conover＠rahul.net 30 Sep '09

30 Sep '09

Can stunnel be used for a local smtp server, that does not support upstream SMTP AUTH, to connect to an smtp server that requires it? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

2 1

Problems implementing certificate
by Marcelo Iturbe 15 Sep '09

15 Sep '09

Hello, I am using Stunnel 4.27 binary version on Windows 2003 server. In the stunnel.pam file I did the following: In the -----BEGIN RSA PRIVATE KEY----- section, I placed the same text that appeared in the -----BEGIN NEW CERTIFICATE REQUEST----- when I purchased the certificate In the -----BEGIN CERTIFICATE----- section I placed what verisign returned to me. When I try to load Stunnel I get the following error messages: : RAND_status claims sufficient entropy for the PRNG : PRNG seeded successfully : SSL context initialized for service gmail-pop3s : Certificate: stunnel.pem : Error reading certificate file: stunnel.pem : error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib : error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib : error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error : error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error : SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag : Server is down Any thoughts as to where I went wrong? Thanks for your help

1 0

Re: [stunnel-users] Stunnel Certificate generation
by Alaric Dailey 10 Sep '09

10 Sep '09

You can modify your stunnel.conf, there are lots of examples on the web to do that. Please don't use self-signed certs, you will have no end of issues, and there is NO reason to. StartCom offers free certificates, is in most browsers now, and will be included in IE by the end of September. http://blog.startcom.org/?p=205 So why would you create the headaches of using self-signed certs? Original Message ----------------------- Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Stunnel Certificate generation
by Matty Ronald 09 Sep '09

09 Sep '09

Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users