[stunnel-users] stunnel client mode and CA chains

[Domenico Andreoli]

Hi,

  I have always successfully used openssl/stunnel but now I am facing
a new problem, a variation of the usual client-side authentication
documentented everywhere.

I have a root CA and child CA which is signed by the root one. I have
also a client certificate that is signed only by the child CA.

In order to verify the certificate signature using openssl I need to
specify both the CA certificates, this works as expected.

What I would like to achieve is to authenticate the clients using a
stunnel server having only the root CA certificate. Is there some stunnel
client configuration switch that allows to push the child CA certificate?

One looking interesting is (from the manpage):

  cert = pemfile
    certificate chain PEM file name

    A PEM is always needed in server mode.  Specifying this flag in client mode will use this certificate chain as a client side certificate
    chain.  Using client side certs is optional.  The certificates must be in PEM format and must be sorted starting with the certificate to the
    highest level (root CA).

in particular "The certificates must be in PEM format and must be
sorted starting with the certificate to the highest level (root CA)"
lets me hope but I am not able to understand how it works.

I made many tries but on server side I always get a "VERIFY ERROR:
depth=1, error=invalid CA certificate:" referring to the child CA
certificate and then a "SSL3_GET_CLIENT_CERTIFICATE:no certificate
returned" followed by connection shutdown.

Supposing the client private key is in a separate file, if I put
the certificates in the order specified by the manpage I get a key
mismatching error upon stunnel startup. If instead I put the client
certificate as first, then server do not authenticate it. Where am
I wrong?

I cannot change the server configuration, it must work as it is. I have
hundreds of them and I can update them only using the SSL connection.

Thanks for any help.

Regards,
Domenico

-----[ Domenico Andreoli, aka cavok
 --[ http://www.dandreoli.com/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50