2

I've got a remote machine I need to connect to that uses HTTPS and a client I need to connect to it with that doesn't support HTTPS. Enter stunnel. I'm running it as follows, then connecting with the client from another machine:

$ stunnel -c -f -d local:4434 -D 7 -r remote:443
LOG7[569514:1]: Service name to be used: remote.443
LOG5[569514:1]: stunnel 3.8 on rs6000-ibm-aix PTHREAD
LOG7[569514:1]: remote.443 bound to localip:4434
LOG7[569514:258]: remote.443 started
LOG5[569514:258]: remote.443 connected from localclient:65065
LOG7[569514:258]: remote.443 connecting remoteip:443
LOG7[569514:258]: Remote host connected
LOG7[569514:258]: before/connect initialization
LOG7[569514:258]: before/connect initialization
LOG7[569514:258]: SSLv3 write client hello A
LOG7[569514:258]: SSLv3 read server hello A
LOG3[569514:258]: SSL_connect: error:00000000:lib(0):func(0):reason(0)
LOG7[569514:258]: remote.443 finished (0 left)
LOG3[569514:1]: Received signal 2; terminating.

According to the stunnel faq, that means:

That error means that your client has closed the connection before SSL was negotiated. That probably means that you're trying to connect to your Stunnel daemon with a non-SSL client. Make sure you are using SSL on your client.

Well, of course my client doesn't support SSL, that's why I'm using stunnel! Anybody know what I'm doing wrong? For what it's worth, the remote machine is Windows of some sort, stunnel is running on an AIX 5.3 server, and I'm connecting to the AIX stunnel with my Windows Vista desktop. Also, I'm also obviously removing the ip addresses and domain names from that output. Thanks.

1 Answer 1

1

Have you seen the section in the stunnel FAQ "I'm trying to use Stunnel as a pipe, but it doesn't seem to work!" - http://www.stunnel.org/faq/troubleshooting.html which suggests upgrading to stunnel 3.16 or newer?

I hesitate to suggest that, since 3.16 is from 2001, but after puzzling over the stunnel examples, docs and FAQ it does look like your command should work.

My only guess at the moment is - does it do any kind of automagic configuration guesswork? It sounds like you're running stunnel on the AIX box, yes? What if it has a heuristic like:

if a connection is from or to the local machine, it's unencrypted
if a connection is from or to a remote machine, use SSL

Then it would see your remote connection from Vista and try to answer it with SSL, and fail, and also try and feed unencrypted traffic into the local AIX SSL service and also fail. Try the Windows stunnel client, or test from a remote *nix box if you can.

but I'm clutching at straws here, and unwilling to try digging into the source code tonight.

If you do find an answer, please post it here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .