We’ve been using stunnel as part of a vendor supplied product for some time to connect a large application running in an application server on Windows to Active Directory for authentication via LDAPS (for some reason, it only natively supports LDAP!).

Anyway, it’s been working fine until a couple of weeks ago when we started getting intermittent failures against all of our configured Domain Controllers (the upstream LDAPS servers).

With no change in STunnel or DC config, some connections would abort with the following log:

SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

… while others worked fine.

The error is not limited to any one of the upstream DCs nor does it occur for every request.

We’ve updated STunnel to the latest version (5.31) and the problem remains running on Windows 2008 R2 SP1.

Below are two transactions from the same instance of STunnel connecting to the same DC one which works and one which doesn’t (IP addresses obfuscated).

Config in use:

{{{

}}}

Any thoughts gratefully received!

Thanks,

Matthew

Fails

====