2nd and third lines of the log suggest that the client end could not negotiate a compatible encryption method, and your stunnel config appears to only have GCM ciphers enabled. Do you have a very old client that can only do CBC mode encryption?
-- Mike Spooner