Hi, All When we try to start stunnel(stunnel 5.67, wolfSSL5.6.4 on linux), there is an error randomly happened like following, anybody knows why this happen and how to fix this? Thanks
May 9 09:09:01 [ ] Initializing inetd mode configuration May 9 09:09:01 [ ] Clients allowed=500 May 9 09:09:01 [.] stunnel 5.67 on arm-oe-linux-gnueabi platform May 9 09:09:01 [.] Compiled/running with wolfSSL 5.6.4 May 9 09:09:01 [.] Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:OCSP,PSK,SNI May 9 09:09:01 [ ] errno: (*__errno_location ()) May 9 09:09:01 [ ] Initializing inetd mode configuration May 9 09:09:01 [.] Reading configuration from file /opt/config/stunnel.conf May 9 09:09:01 [.] UTF-8 byte order mark not detected May 9 09:09:01 [ ] No PRNG seeding was required May 9 09:09:01 [ ] Initializing service [xxxHost] May 9 09:09:01 [ ] stunnel default security level set: 2 May 9 09:09:01 [ ] Ciphers: TLS_AES_256_GCM_SHA384 May 9 09:09:01 [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 May 9 09:09:01 [ ] TLS options: 0x4D474C4C003000 (+0x0, -0x0) May 9 09:09:01 [ ] Session resumption enabled May 9 09:09:01 [ ] Loading certificate from file: ./config/client.pem May 9 09:09:01 [ ] Certificate loaded from file: ./config/client.pem May 9 09:09:01 [ ] Loading private key from file: ./config/client.key May 9 09:09:01 [:] Insecure file permissions on ./config/client.key May 9 09:09:01 [ ] Private key loaded from file: ./config/client.key May 9 09:09:01 [ ] Private key check succeeded May 9 09:09:01 [!] SSL_CTX_load_verify_locations: Peer suddenly disconnected May 9 09:09:01 [!] Service [xxxHost]: Failed to initialize TLS context May 9 09:09:01 [!] Configuration failed May 9 09:09:01 [ ] Deallocating temporary section defaults May 9 09:09:01 [ ] Deallocating section [xxxHost]
On Sun, May 11, 2025 at 09:02:15PM -0000, lynn9a--- via stunnel-users wrote:
Hi, All When we try to start stunnel(stunnel 5.67, wolfSSL5.6.4 on linux), there is an error randomly happened like following, anybody knows why this happen and how to fix this? Thanks
The "peer suddenly disconnected" message most probably means that: - something established a connection to your stunnel service - stunnel started preparing to process that connection - the other side disconnected immediately, before sending or receiving any data
IMHO, these are the two most probable reasons for that to happen: - if it is indeed random, perhaps it is the result of somebody (or many somebodies) running port scans either on your server specifically, or on a whole range of IP addresses and ports, and recording somewhere what is running on which host and which port - if it is more or less periodical, it might be some monitoring system somewhere that is set up to check whether there is anything listening on that address and port; for more of my thoughts on this, of which I'm sure some people on this list have had enough, see my answer in this thread: https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@stunnel.org/t... (TL;DR: merely checking whether something accepts a TCP connection is not enough for a health check on the service itsef, and it can lead to confusion for people looking at the logs, as in your case)
Hope that helps at least a bit!
G'luck, Peter
Thanks Pete. It turns out that CA certificate is wrong file which caused verification failed.
On Monday, May 12, 2025 at 03:39:46 AM EDT, Peter Pentchev roam@ringlet.net wrote:
On Sun, May 11, 2025 at 09:02:15PM -0000, lynn9a--- via stunnel-users wrote:
Hi, All When we try to start stunnel(stunnel 5.67, wolfSSL5.6.4 on linux), there is an error randomly happened like following, anybody knows why this happen and how to fix this? Thanks
The "peer suddenly disconnected" message most probably means that: - something established a connection to your stunnel service - stunnel started preparing to process that connection - the other side disconnected immediately, before sending or receiving any data
IMHO, these are the two most probable reasons for that to happen: - if it is indeed random, perhaps it is the result of somebody (or many somebodies) running port scans either on your server specifically, or on a whole range of IP addresses and ports, and recording somewhere what is running on which host and which port - if it is more or less periodical, it might be some monitoring system somewhere that is set up to check whether there is anything listening on that address and port; for more of my thoughts on this, of which I'm sure some people on this list have had enough, see my answer in this thread: https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@stunnel.org/t... (TL;DR: merely checking whether something accepts a TCP connection is not enough for a health check on the service itsef, and it can lead to confusion for people looking at the logs, as in your case)
Hope that helps at least a bit!
G'luck, Peter
-
Lynn -
lynn9a＠yahoo.com
-
Peter Pentchev