Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We use stunnel configured to provide SSL-tunnel between SERVER A (where we have stunnel configured as client) and many SERVERS B (where we deployed stunnel configured to work in server mode).

We use self-signed certs on both client stunnel and server stunnel. We also have 'verify=3' option in both places. Everything works in this configuration. All servers are running Windows (different flavors - WS2008, WS2003).

Now we are facing issues where we have to put properly signed by CA cert on SOME of SERVER Bs. We also want to minimize changes that we need to do on SERVER A. It means that ideally we will be replacing self-signed cert with valid signed by CA one on servers B one at a time, and we don't want to change server A configuration each time.

Is changing 'verify' option to 2 on the server A correct approach here? We also presumably will have to add Network Solution or other root certs into server A verification chain, right? Or we're missing something here and it will not work this way?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.