PostgreSQL protocol has small handshake on connecting before SSL can be initialized. But that means that Stunnel cannot be used by default as it expects the SSL initialization to be the first thing when getting connection.

Attached patch adds PostgreSQL protocol support to Stunnel, so that Stunnel can be used to provide SSL when either client or server is not able to do it natively.

SSL handshake is described here: http://www.postgresql.org/docs/8.3/static/protocol-flow.html#AEN73013

Patch is tested and works, hopefully it can be included in main Stunnel source.