Hello

Is it possible to get stunnel to disconnect people on a graceful restart when a certificate has expired? Stunnel version 4.30 added the graceful reload option which is great because it will allow us to reload the CRLs, keep everybody connected and prevent new people connecting when their certs have expired (tested and working) - however existing connections are not terminated even though they have just expired... I'm not sure if we've missed a configuration option or if this is just not possible.

A little background:
We host an IRC server listening on localhost:6667, on top of that we have stunnel listening on the external interface port 6697
We're using the CAfile and CRLpath options to ensure that people are connecting with a valid certificate.
Every hour a job runs to download the latest CRL files, if there is a change it restarts stunnel and kicks everybody off (we'd like to use a graceful restart instead)

We are running stunnel on Red Hat Linux using the following line inside an init script to run it as a daemon: daemon /usr/local/bin/stunnel /etc/stunnel/stunnel.conf

Excerpt from stunnel.conf:
setuid = daemon
setgid = daemon
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

[irc-in]
CAfile = /etc/ca/our-chains.pem
CRLpath = /etc/crl
accept = 192.168.0.1:6697setuid = daemon
setgid = daemon

connect = localhost:6667
verify = 2

Running stunnel -version tells me:
Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP

Global options
debug           = daemon.notice
pid             = /var/run/stunnel.pid
RNDbytes        = 64
RNDfile         = /dev/urandom
RNDoverwrite    = yes

Service-level options
cert            = /etc/stunnel/stunnel.pem
ciphers         = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH
session         = 300 seconds
stack           = 65536 bytes
sslVersion      = SSLv3 for client, all for server
TIMEOUTbusy     = 300 seconds
TIMEOUTclose    = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle     = 43200 seconds
verify          = none

Kind Regards
Dave