[stunnel-users] must restart stunnel to add a new cert before it recognized it...

[Carter Browne]

If you use the CApath option rather than the CAfile, you can avoid this problem.  The certificates in the CApath 
directory have to be renamed to the hashcode.0 (on linked to hashcode.0).  There is a comment about the need to c_rehash 
CApath in the configuration file, but I have not had any trouble just adding new certificates to the directory and 
having them recognized for both Linux and Windows systems.

Carter

Rami Michael wrote:
> Hello everyone,
> 
> My stunnel setup is working fine, got mysql being hit from a couple of 
> boxes but my question is this...
> I have stunnel setup so i copy the cert created from the remote client 
> over to the local server so remote connections are authenticated.
> Now that works fine and dandy, the issue is, if i am adding a new remote 
> client, i add the cert from the client to my certs.pem locally but i 
> need to restart the stunnel process before stunnel will "read in" the 
> new cert.
> I know this does not sound like a big deal, but if i have 20 machines 
> connected through stunnel to this local box and i need to restart 
> stunnel whenever i need to add a new box or take off an old one, i don't 
> think its good.
> 
> I use stunnel for mysql so i got these guys doing inserts and a broken 
> connection would really mess things up for me... i think maybe there is 
> a flag i can set?  or maybe send the process some type of command to 
> reload the certs?
> 
> Any help would be appreciated... all relevant info included below.
> 
> All requested info for posts to the group are found below
> 
> Here is my stunnel.conf
> 
> verify = 3
> CAfile = /etc/stunnel/certs.pem
> cert = /etc/stunnel/stunnel.pem
> setuid = nobody
> setgid = nobody
> pid = /tmp/stunnel.pid
> debug = 7
> output = /var/log/stunnel.log
> client = no
> [mysqls]
> accept  = 3309
> connect = 3306
> 
> Some output from the stunnel.log at high debug level
> 
> 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on 
> i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from 
> /dev/urandom
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims 
> sufficient entropy for the PRNG
> 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: 
> /etc/stunnel/stunnel.pem
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: 
> /etc/stunnel/stunnel.pem
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates 
> from /etc/stunnel/certs.pem
> 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file 
> ulimit=1024 -> 500 clients allowed
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on 
> accept socket
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 
> <http://0.0.0.0:3309/>
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode
> 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode
> 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file 
> /tmp/stunnel.pid
> 
> stunnel -V
> 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or 
> directory (2)
> 
> Syntax:
> stunnel [filename] | -fd [n] | -help | -version | -sockets
>     filename    - use specified config file instead of 
> /etc/stunnel/stunnel.conf
>     -fd n       - read the config file from specified file descriptor
>     -help       - get config file help
>     -version    - display version and defaults
>     -sockets    - display default socket options
> 
> uname -a
> Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 
> i386 GNU/Linux
> 
> gcc -v
> Reading specs from /usr/lib/gcc/i386-redhat-linux
> /3.4.6/specs
> Configured with: ../configure --prefix=/usr --mandir=/usr/share/man 
> --infodir=/usr/share/info --enable-shared --enable-threads=posix 
> --disable-checking --with-system-zlib --enable-__cxa_atexit 
> --disable-libunwind-exceptions --enable-java-awt=gtk 
> --host=i386-redhat-linux
> Thread model: posix
> gcc version 3.4.6 20060404 (Red Hat 3.4.6-3)
> 
> openssl version
> OpenSSL 0.9.7a Feb 19 2003
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> stunnel-users mailing list
> stunnel-users at mirt.net
> http://stunnel.mirt.net/mailman/listinfo/stunnel-users
-------------- next part --------------
A non-text attachment was scrubbed...
Name: cbrowne.vcf
Type: text/x-vcard
Size: 220 bytes
Desc: not available
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20061114/e55ca086/attachment.vcf>