1
vote
1answer
62 views

Using multiple SSL certificates with Stunnel

I have a HAProxy + stunnel setup, I would like to have different certificates for my domain and submdomain. Certificate 1 - example.com Certificate 2 - foo.example.com How do I configure Stunnel to do ...
1
vote
1answer
30 views

How to best encrypt http traffic between frontent (VPS/AWS) and remote backend?

I have a couple of frontend servers running on AWS (running pound for SSL termination and Varnish for caching). My backend is at a remote location (not on AWS). I am looking for the best/fastest way ...
0
votes
0answers
21 views

Why does stunnel keep on reading the old pem file?

I've updated the pem file using the rekeyed certificate. But upon checking the certificate information through various SSL checkers, the old certificate was being read. I tried reloading the stunnel ...
1
vote
0answers
30 views

How can I update rekeyed certificates on stunnel?

I have configured stunnel using GoDaddy certificate and it was working fine. Due to some circumstances, I need to rekey the certificate and update the pem file on the load balancer. Upon updating the ...
0
votes
0answers
53 views

Stunnel only for specific domain

I'm configuring stunnel to encapsulate SSL petitions to Haproxy. Haproxy serves several sites in the same IP address: domain.com - Website app.domain.com - Node.js webserver I acquired an SSL ...
0
votes
1answer
367 views

stunnel error when connecting from a news reader: SSL3_READ_BYTES:tlsv1 alert unknown ca

I'm trying to set up stunnel to provide secure access to an nntp server. Following the instructions here I created a self-signed key and certificate. The commands I ran were: openssl genrsa -des3 ...
0
votes
1answer
759 views

why is stunnel doing this

I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following: Remote ...
4
votes
3answers
2k views

Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access: 2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160 ...
0
votes
2answers
280 views

End to end encryption with CQ5 and Dispatcher

I am currently working on an Adobe CQ5 (CMS) application that will be serving sensitive information, so communications should be encrypted using SSL end-to-end. The problem is that it is not ...
2
votes
1answer
1k views

Multiple SSL certs with Stunnel

I have purchased two PositiveSSL certs (seperately), one for manager.domain.com and another for domain.com. Originally I only needed manager.domain.com using SSL, but than I needed to use SSL on ...
2
votes
2answers
639 views

Should I use an ssl terminator or just haproxy?

I'm trying to figure out how to set up my architecture for a socket.io app that will require both https and wss connections. I've found many tutorials on the web suggesting that you use something like ...
0
votes
3answers
1k views

STunnel Not Reading Configuration File

I generated an SSL certificate as specified on the answer to stunnel: SSL-to-SSL? (for smtp/imap) And have the following configuation file: cert = /home/marshall/stunnels/certs/umistunnel.keys ; ...
3
votes
4answers
208 views

Is there an SSL equivelent to an ssh agent?

Here is my situation: There are a number of developers who all need to have access to be able to install ruby gems and python eggs from a remote source. Currently, we have a server inside our firewall ...
1
vote
1answer
903 views

stunnel version 4.53 says SSL server needs a certificate on Windows 7

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a ...
1
vote
1answer
422 views

SSL, Front-end caches, and web servers

I'm looking to add SSL to some sites. My current setup is varnish -> nginx -> python wsgi server. The varnish sits at the front and caches both static and dynamic content. The nginx server serves ...
0
votes
2answers
566 views

SSH over stunnel with secret public (client) ssl certificate

I am in a situation where I cannot have passwordless login for ssh and ssh server could not be run over any other port other than the default port. So, I have chosen to use stunnel to tunnel ssh. On ...
0
votes
2answers
982 views

Stunnel Error binding pop3s to 0.0.0.0:110

I'm setting up stunnel so a non SSL enabled app can access a Gmail / Google Apps account. Here's the config I'm using: CLIENT=YES [pop3s] accept = 110 connect = pop.gmail.com:995 [imaps] accept = ...
3
votes
1answer
428 views

HAProxy and Stunnel PCI Compliance

I am setting up HAProxy to load balance between two web servers. Some of the pages on the site require SSL. Stunnel is handling the https connections and passing them off to haproxy (Stunnel ...
0
votes
0answers
350 views

stunnel SSL3 error

I have to use stunnel to connect to a remote mysql database. Setting up stunnel on Win 7 succeeded and I am also able to load the custom configuration file from the provider. (More can be found here ...
5
votes
2answers
9k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
8
votes
4answers
5k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
0
votes
3answers
558 views

Architecture question: adding SSL into the mix

Currently we have a configuration that at the highest level looks like this: [Traffic] -> Varnish (caching) -> HaProxy (load balancing) -> Apache (content and services) There are (obviously?) ...
0
votes
2answers
648 views

Cannot find ssl libraries when configuring stunnel

I am using RHEL 5.6 and trying to install stunnel with the 'xforwardfor' patch from haproxy to get a setup similar to this (older) post: ...
2
votes
1answer
650 views

HTTPS Stunnel and Haproxy

I am trying to use stunnel infront of Haproxy for SSL support. SSL certificates are located according to stunnel configuration. I am also able to get the https connection, but every time I use https, ...
7
votes
1answer
1k views

Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling

We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database. At peak times, the web servers make many ...
1
vote
3answers
2k views

OpenSource (Layer 4) Load Balancer that can pass through original client IP?

I am setting up a web application which uses SSL for all requests. It needs to have room for scaling and also be highly available. It seems that the "recommended" way to handle this is to setup a pair ...
8
votes
2answers
4k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
1
vote
1answer
996 views

stunnel: SSL-to-SSL? (for smtp/imap)

How can I configure stunnel to accpet SSL connections, and connect then to an SSL port on a different server? Here is my setup: Our ISP's server, "Mail Server", supports smtp/imap over SSL. (Not ...
0
votes
1answer
647 views

stunnel in client mode as proxy for sendmail

I'm configuring an internal mail network that is supposed to do all the transmission using ssl and I want to have all the encryption done by stunnel. So far I have pop3s, imaps and sendmail in server ...
2
votes
1answer
941 views

Stunnel too many clients

I'm trying to hook up stunnel and haproxy to forward https connections through to some backend servers. I've got haproxy setup right, and I seem to have stunnel set up right. Trouble is that when I ...