Re: [stunnel-users] Client SSL certificate

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

reg14@rambler.ru wrote:

...

stunnel does not validate common names at all, as, unlike web browsers, it does not allow for dynamic selection of servers.

If I understand the man page properly, in transparent mode stunnel should connect to any server that a non-SSL aware client is going to.

You understand the man page properly, although in transparent destination mode it would not be possible for stunnel to verify the common name against DNS name of the server. Why? Because stunnel does not know the target server's DNS name, only its IP address. Only the original client knows the server name that resolved to this IP address.

Mike