Mike:

Here are the configuration and the log files as you requested….

---------------------------------------------BEGIN CONFIG ---------------------------------
# switch-simulator stunnel configuration file
# Copyright by Michal Trojnara 2002
 
# Certs and keys
cert = /etc/certs/demoedge2-cert.pem
key = /etc/keys/demoedge2-key.pem
 
# PID is created inside chroot jail
pid = /var/opt/stunnel/stunnel_server.pid
 
# Authentication stuff
verify = 2
options = NO_SSLv2
 
# don't forget about c_rehash CApath
# it is located inside chroot jail:
 
CApath = /etc/CApath
 
# CRL path or file (inside chroot jail):
CRLpath = /etc/crl
 
 
# Some debugging stuff

debug = local4.5
output = /var/opt/log/pras_test_server.log
 
# Use it for client mode
#client = no
 
# Service-level configuration
 
[APF]
accept  = 10.172.86.128:51101
connect = 127.0.0.1:50111

----------------------------------------------END CONFIG ----------------------------------
--------------------------------------------- BEGIN LOG FILE -------------------------------


2006.06.11 19:27:25 LOG5[8839:7]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun  9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT

2006.06.11 19:27:25 LOG4[8839:7]: Found CRL is expired - revoking all certificates until you get updated CRL
2006.06.11 19:27:25 LOG3[8839:7]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

2006.06.11 19:27:25 LOG5[8839:7]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2006.06.12 17:41:52 LOG5[8839:8]: APF connected from 10.172.86.96:35225
2006.06.12 17:41:52 LOG5[8839:8]: VERIFY OK: depth=2, /C=US/O=VISA/OU=Visa International Service Association/CN=TEST Visa Info Delivery Root CA

2006.06.12 17:41:52 LOG5[8839:8]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, , lastUpdate: Jun  9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT

2006.06.12 17:41:52 LOG4[8839:8]: Found CRL is expired - revoking all certificates until you get updated CRL
2006.06.12 17:41:52 LOG3[8839:8]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

2006.06.12 17:41:52 LOG5[8839:8]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2006.06.12 23:01:08 LOG5[8839:9]: APF connected from 10.172.86.96:35371
2006.06.12 23:01:08 LOG5[8839:9]: VERIFY OK: depth=2, <VISA CA>
2006.06.12 23:01:08 LOG5[8839:9]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun  9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT

2006.06.12 23:01:08 LOG4[8839:9]: Found CRL is expired - revoking all certificates until you get updated CRL
2006.06.12 23:01:08 LOG3[8839:9]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

2006.06.12 23:01:08 LOG5[8839:9]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

------------------------------------------- END LOG FILE --------------------------------------
On 2006-06-12, at 22:17, Nagasundaram, Sekhar wrote:
> We download crls everyday from a CRL server using LDAP and a cronjob.
> These CRLs are stored in the CRLpath directory along with its hash.
> It appears that the stunnel is not refreshing its cache, and it
> still shows "Found CRL is expired - revoking all certificates until
> you get updated CRL" when we try to connect to it even though there is
> a
> New and valid CRL in the CRLPath folder. Is there a special option
> In Stunnel configuration for it to recognize/cache/add the new hash
> file

Just to make sure: the problem disappears after restarting stunnel,
right?

The simple workaround could be disabling all SSL caches:
./configure --with-threads=fork
make clean
make
make install

Can you send your stunnel.conf and debug log?

TIA,
     Mike


Sekhar Nagasundaram
<<Nagasundaram, Sekhar.vcf>>