I've another issue, it's quite close to be fully working.
I've the base.conf and mansonthomas.com.conf and extranet.oneothersite.com.conf
when all 3 config file are activated (ie ends with .conf), then I only see
- base.conf (123monsite.com in the logs) - extranet.othersite.conf running,
- mansonthomas.conf seems to be skipped
Couples of questions (before detailed config/output etc...) :
- Is there something particular to do in the config file to have multiple domain running with stunnel ? - How can I set debug/pid file on other domain ?
I've tryed to put debug & output config properties inside mansonthomas.com and extranet.othersite.com, but with I start it says it's not allowed here. (i've putted it after the [mansonthomas.com] line)
find below all the details!
Regards, Thomas.
If I disable extranet.oneothersite.com (move extranet.oneothersite.com.conf to extranet.oneothersite.com.conf_) and start stunnel I see :
root@ns0:/etc/stunnel# service stunnel4 start Starting SSL tunnels: [Started: /etc/stunnel/base.conf] [Started: /etc/stunnel/mansonthomas.com.conf] stunnel.
ps excerpt :
1 12950 12925 1305 pts/0 12956 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 12951 12925 1305 pts/0 12956 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 12952 12925 1305 pts/0 12956 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 12953 12925 1305 pts/0 12956 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 12954 12925 1305 pts/0 12956 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 12955 12955 12955 ? -1 Ss 0 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/
And I can successfully connect with HTTPS on https://mansonthomas.com with no SSL error ! (youpi ! ;))
If I enable extranet.oneothersite.com.conf configuration by renaming extranet.oneothersite.com.conf_ to extranet.oneothersite.com.conf
and I stop and start here is what I get :
root@ns0:/etc/stunnel# service stunnel4 start Starting SSL tunnels: [Started: /etc/stunnel/base.conf] [Started: /etc/stunnel/extranet.othersite.com.conf] [Already running: /etc/stunnel/mansonthomas.com.conf] stunnel.
while it's not running. the previous service stunnel4 stop kill all the process, no one left in memory.
a ps output after restart :
1 12377 12377 12377 ? -1 Ss 110 0:00 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -D -p /var/run/haproxy.pid TERM=screen-bce PATH=/sbin:/usr/sbin:/bin:/usr/bin LANG=en_US.UTF-8 PWD=/ 1 14055 14044 1305 pts/0 14085 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 14056 14044 1305 pts/0 14085 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 14057 14044 1305 pts/0 14085 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 14058 14044 1305 pts/0 14085 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 14059 14044 1305 pts/0 14085 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 14060 14060 14060 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 14069 14044 1305 pts/0 14085 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.othersite.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 14070 14044 1305 pts/0 14085 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.othersite.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 14071 14044 1305 pts/0 14085 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.othersite.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 14072 14044 1305 pts/0 14085 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.othersite.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 14073 14044 1305 pts/0 14085 S 0 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.othersite.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 14074 14074 14074 ? -1 Ss 0 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.othersite.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P
can't see mansonthomas.com And if I try to reach https://mansonthomas.com it fails.
here is my current configuration :
root@ns0:/etc/stunnel# cat *base.conf* ============================================================================ debug = 7
sslVersion = SSLv3 cert=/etc/stunnel/sites/123monsite.com/123monsite.com.crt key=/etc/stunnel/sites/123monsite.com/123monsite.com.key
; security enhancements for UNIX systems ; for chroot a copy of some devices and files is needed within the jail ;chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /var/run/stunnel4/stunnel4.pid
socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel4/stunnel.log
[https-123monsite.com] accept=88.190.17.222:443 connect=127.0.0.1:82 root@ns0:/etc/stunnel# ============================================================================
root@ns0:/etc/stunnel# cat* mansonthomas.com.conf* ============================================================================ [mansonthomas.com] key = /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.key cert = /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.crt accept = 88.190.217.117:443 connect = 127.0.0.1:82
sslVersion = SSLv3 TIMEOUTclose = 0 ============================================================================ root@ns0:/etc/stunnel#
root@ns0:/etc/stunnel# cat *extranet.othersite.com.conf* ============================================================================ [extranet.othersite.com] key = /etc/stunnel/sites/ extranet.othersite.com/extranet.othersite.com.key cert = /etc/stunnel/sites/ extranet.othersite.com/extranet.othersite.com.crt accept = 88.190.100.100:443 connect = 127.0.0.1:82
sslVersion = SSLv3 TIMEOUTclose = 0 ============================================================================ root@ns0:/etc/stunnel#
here is the log file :
root@ns0:/var/log/stunnel4# cat stunnel.log 2012.02.23 13:47:05 LOG5[14241:140531800237856]: Reading configuration from file /etc/stunnel/base.conf 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Snagged 64 random bytes from /dev/urandom 2012.02.23 13:47:05 LOG7[14241:140531800237856]: PRNG seeded successfully 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Using DH parameters from /etc/stunnel/sites/123monsite.com/123monsite.com.crt 2012.02.23 13:47:05 LOG6[14241:140531800237856]: DH initialized with 2048 bit key 2012.02.23 13:47:05 LOG7[14241:140531800237856]: ECDH initialized 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Certificate: /etc/stunnel/sites/123monsite.com/123monsite.com.crt 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Certificate loaded 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Key file: /etc/stunnel/sites/123monsite.com/123monsite.com.key 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Private key loaded 2012.02.23 13:47:05 LOG7[14241:140531800237856]: SSL context initialized for service https-123monsite.com 2012.02.23 13:47:05 LOG5[14241:140531800237856]: Configuration successful 2012.02.23 13:47:05 LOG5[14241:140531800237856]: No limit detected for the number of clients 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=3 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=4 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=4 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=5 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=5 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=6 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=6 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=7 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=7 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: libwrap_init: FD=8 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: signal_pipe: FD=9 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: signal_pipe: FD=10 allocated (blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: accept socket: FD=11 allocated (non-blocking mode) 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Option SO_REUSEADDR set on accept socket 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Service https-123monsite.com bound to 88.190.17.222:443 2012.02.23 13:47:05 LOG7[14241:140531800237856]: Service https-123monsite.com opened FD=11 2012.02.23 13:47:05 LOG7[14247:140531800237856]: Created pid file /var/run/stunnel4/stunnel4.pid 2012.02.23 13:47:05 LOG5[14247:140531800237856]: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 2012.02.23 13:47:05 LOG5[14247:140531800237856]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
On Thu, Feb 23, 2012 at 11:14, Thomas Manson dev.mansonthomas@gmail.comwrote:
root@ns0:/etc/stunnel# service stunnel4 start Starting SSL tunnels: [Started: /etc/stunnel/base.conf] [Started: /etc/stunnel/mansonthomas.com.conf] stunnel.
Yes !
In fact, my config file was missing the private key :
[mansonthomas.com] cert = /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.crt accept = 88.190.217.117:443 connect = 127.0.0.1:82
TIMEOUTclose = 0
I've added the key, and now it starts ;)
Thanks for your help !
Regards, Thomas.
On Thu, Feb 23, 2012 at 09:39, Ludolf Holzheid < lholzheid@bihl-wiedemann.de> wrote:
On Wed, 2012-02-22 23:38:53 +0000, Thomas Manson wrote:
[..]
the CRT file is generated by my registrar. If it's in the wrong format, How can I convert it?
[..]
Key file: /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.crt error queue: 140B0009 : error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line [..]
root@ns0:/etc/stunnel/sites/mansonthomas.com# cat mansonthomas.com.crt -----BEGIN CERTIFICATE----- [..] -----END CERTIFICATE----- -----BEGIN DH PARAMETERS----- ..... -----END DH PARAMETERS-----
Thomas,
If there is no "-----BEGIN RSA PRIVATE KEY-----" in mansonthomas.com.crt, then there is no key in.
You should be provided with a file containing the key.
If this is in DER format (*.pfx or *.p12), you'll have to convert it first:
openssl pkcs12 -in <der file> -out <pem file>
HTH,
Ludolf
--
Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid@bihl-wiedemann.de D-68199 Mannheim, Germany