Thanks for the help guys... but its still acting a little weird

So i tried using CApath and it seems to be working... i tried to generate a new key on the remote box restarted stunnel there and was not able to connect.

After copying the remote cert over to the local box, doing the hash, and adding it to the CApath, stunnel then  recognized the new cert without a restart of stunnel.

However, i tried  removing the cert from the CApath directory on the sensor side and it seems as though stunnel caches that cert it had read in until its restarted.  After restarting stunnel, it realizes the cert is no longer in the directory and would then deny connections from the remote box.  Until the restart, it allowed connecting from the remote box even though the cert file had been deleted from the CApath.

Is that normal behavior? 

Also, another question... i tried commenting out the CAfile portion on my stunnel server and then none of my remote clients could connect.  It said there the remote client was error was a self signed certificate or something like that.

the part that gets me is this...

Whats is the purpose of the value in the CAfile is none of the certificates generated on the remote clients use that cert authority?  i don't get how having a ranodm value in there is actually validating anything.  I can stick any valid cert in there and it works for any remote client.

As always, thanks for the help.



On 11/14/06, Carter Browne <cbrowne@cbcs-usa.com> wrote:
If you use the CApath option rather than the CAfile, you can avoid this problem.  The certificates in the CApath
directory have to be renamed to the hashcode.0 (on linked to hashcode.0).  There is a comment about the need to c_rehash
CApath in the configuration file, but I have not had any trouble just adding new certificates to the directory and
having them recognized for both Linux and Windows systems.

Carter

Rami Michael wrote:
> Hello everyone,
>
> My stunnel setup is working fine, got mysql being hit from a couple of
> boxes but my question is this...
> I have stunnel setup so i copy the cert created from the remote client
> over to the local server so remote connections are authenticated.
> Now that works fine and dandy, the issue is, if i am adding a new remote
> client, i add the cert from the client to my certs.pem locally but i
> need to restart the stunnel process before stunnel will "read in" the
> new cert.
> I know this does not sound like a big deal, but if i have 20 machines
> connected through stunnel to this local box and i need to restart
> stunnel whenever i need to add a new box or take off an old one, i don't
> think its good.
>
> I use stunnel for mysql so i got these guys doing inserts and a broken
> connection would really mess things up for me... i think maybe there is
> a flag i can set?  or maybe send the process some type of command to
> reload the certs?
>
> Any help would be appreciated... all relevant info included below.
>
> All requested info for posts to the group are found below
>
> Here is my stunnel.conf
>
> verify = 3
> CAfile = /etc/stunnel/certs.pem
> cert = /etc/stunnel/stunnel.pem
> setuid = nobody
> setgid = nobody
> pid = /tmp/stunnel.pid
> debug = 7
> output = /var/log/stunnel.log
> client = no
> [mysqls]
> accept  = 3309
> connect = 3306
>
> Some output from the stunnel.log at high debug level
>
> 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on
> i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from
> /dev/urandom
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims
> sufficient entropy for the PRNG
> 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate:
> /etc/stunnel/stunnel.pem
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file:
> /etc/stunnel/stunnel.pem
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates
> from /etc/stunnel/certs.pem
> 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file
> ulimit=1024 -> 500 clients allowed
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on
> accept socket
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309
> < http://0.0.0.0:3309/>
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode
> 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file
> /tmp/stunnel.pid
>
> stunnel -V
> 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or
> directory (2)
>
> Syntax:
> stunnel [filename] | -fd [n] | -help | -version | -sockets
>     filename    - use specified config file instead of
> /etc/stunnel/stunnel.conf
>     -fd n       - read the config file from specified file descriptor
>     -help       - get config file help
>     -version    - display version and defaults
>     -sockets    - display default socket options
>
> uname -a
> Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686
> i386 GNU/Linux
>
> gcc -v
> Reading specs from /usr/lib/gcc/i386-redhat-linux
> /3.4.6/specs
> Configured with: ../configure --prefix=/usr --mandir=/usr/share/man
> --infodir=/usr/share/info --enable-shared --enable-threads=posix
> --disable-checking --with-system-zlib --enable-__cxa_atexit
> --disable-libunwind-exceptions --enable-java-awt=gtk
> --host=i386-redhat-linux
> Thread model: posix
> gcc version 3.4.6 20060404 (Red Hat 3.4.6-3)
>
> openssl version
> OpenSSL 0.9.7a Feb 19 2003
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> stunnel-users mailing list
> stunnel-users@mirt.net
> http://stunnel.mirt.net/mailman/listinfo/stunnel-users