Hi Shannon,<br><br>After flicking through the OpenSSL documents I&#39;m guessing that from the SSL_CTX_set_options page <a href="http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html">http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html</a> we need to use <strong><a name="item_SSL_OP_CIPHER_SERVER_PREFERENCE">SSL_OP_CIPHER_SERVER_PREFERENCE</a></strong> but if you put that into your config file as:<br>
options = CIPHER_SERVER_PREFERENCE<br>STunnel throws an error about the config file, so at the moment I&#39;m a little stuck.<br><br>~Scott<br><br><br><div class="gmail_quote">On 25 May 2012 15:26, Shannon Carver <span dir="ltr">&lt;<a href="mailto:shannon.carver@gmail.com" target="_blank">shannon.carver@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Scott, <div><br></div><div>Yes, that&#39;s the cipher I&#39;m using which seems to cover everything from a secure ciphers point of view.  Any idea how to disable client renegotiations within Stunnel?</div>
<span class="HOEnZb"><font color="#888888"><div><br></div>

</font></span><div><span class="HOEnZb"><font color="#888888">Shannon</font></span><div><div class="h5"><br><br><div class="gmail_quote">On 25 May 2012 14:39, Scott McKeown <span dir="ltr">&lt;<a href="mailto:scott@loadbalancer.org" target="_blank">scott@loadbalancer.org</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

Hi Shannon,<br><br>From what I understand so far a minimum Cipher list of &#39;RC4:HIGH:!MD5:!aNULL&#39; along with stopping the Client Renegotiating the ciphers seems to resolve the problem.<br><br>In Pound the patch allows for two new options to be set:<br>



SSLHonorCipherOrder &amp; SSLAllowClientRenegotiation<br><br>I&#39;ve looked in the OpenSSL documentation but I don&#39;t seem to be able to find anything that has the same functionality although I&#39;m no expert so I may have just over looked it.<span><font color="#888888"><br>



<br><br>~Scott</font></span><div><div><br><br><br><div class="gmail_quote">On 25 May 2012 14:30, Shannon Carver <span dir="ltr">&lt;<a href="mailto:shannon.carver@gmail.com" target="_blank">shannon.carver@gmail.com</a>&gt;</span> wrote:<br>


<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I posted a similar question a few months back, but didnt&#39; get a reply.  Would love some more info on this!<div><br></div><div>Shannon<br><br><div class="gmail_quote"><div><div>On 25 May 2012 11:50, Scott McKeown <span dir="ltr">&lt;<a href="mailto:scott@loadbalancer.org" target="_blank">scott@loadbalancer.org</a>&gt;</span> wrote:<br>





</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>Hi All,<br><br>Has anyone looked at the current issue with the BEAST Attack.<br><br>I&#39;m looking at <a href="https://www.ssllabs.com/ssltest/index.html" target="_blank">https://www.ssllabs.com/ssltest/index.html</a> which can be used for testing SSL Certificates I also use Pound Proxy which I have now patched and this has removed the threat.<br>






<br>However, I don&#39;t seem to be able to get the same result from a STunnel installation. If anyone can give some advice that would be great.<br><br><br>~Yours,<br>Scott<br>
<br></div></div>_______________________________________________<br>
stunnel-users mailing list<br>
<a href="mailto:stunnel-users@stunnel.org" target="_blank">stunnel-users@stunnel.org</a><br>
<a href="http://stunnel.mirt.net/mailman/listinfo/stunnel-users" target="_blank">http://stunnel.mirt.net/mailman/listinfo/stunnel-users</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br>