Stunnel is a small tool that can wrap the connection of other protocols with SSL/TLS.

learn more… | top users | synonyms

0
votes
0answers
27 views

stunnel won't verify client certificate as expected

I'm trying to set up stunnel to provide a TLS wrapper to an HTTP service that doesn't natively support TLS. I have this working well without using TLS client certificates. When adding the client ...
0
votes
0answers
10 views

System.Net.Mail, stunnel and SDE interoperability

We have a third party product, SDE, which we are trying to attach to an stunnel to support our modern email servers. This product, I believe, internally uses System.Net.Mail or System.Web.Mail, given ...
0
votes
0answers
19 views

stunnel keeps stopping with WSAECONNREFUSED given

Right so bit of background to start with I've got 2 stunnel installs on 2 different servers and basically using ensemble and stunnel to bounce a message around with ssl cert. Here is the flow. Where ...
0
votes
0answers
33 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
1
vote
1answer
55 views

Stunnel “wrong version number” error with TLS-PSK

I've got Stunnel running on a Raspberry Pi which is acting as a TLS wrapper for an apache2 server. I've configured it to use TLS-PSK (correctly, I think), but the logs show the following when I try to ...
2
votes
0answers
13 views

stunnel TIMEOUTconnect on Ubuntu 15.10

We use stunnel extensively for LDAP proxying. We recently set up a Ubuntu 15.10 server to migrate some of the tunnels to and are unable to get it to work. We've scraped through the logs, configs, ...
2
votes
1answer
132 views

Stunnel TLS authentication with multiple Authorities

I am trying to secure a rethinkdb cluster behind stunnel. The service needs to support multiple Certificate Authorities (CA). Currently I concat the accepted CAs into one file (/certs/ca.pem) but it ...
2
votes
0answers
84 views

iptables configuations for stunnel+squid

I'm building a highly anonymous proxy server with squid and stunnel, and I'm facing a configurations problem on iptables. The server should act like this: browser <-> client stunnel <=> ...
1
vote
0answers
14 views

stunnel does not handle SNI correctly

I am trying to get stunnel-4.53-1.1 in Debian Wheezy running. The important parts of my configuration (/etc/stunnel/stunnel.conf) look like that: [https] cert = /etc/ssl/certs/mydomain.pem key = /etc/...
0
votes
0answers
97 views

stunnel with ntlm Proxy-Authenticate: NTLM authorization request rejected

My stunnel setup doesn't work through a http proxy with ntlm authentication, the stunnel returns an error message: Proxy-Authenticate: NTLM authorization request rejected Whereas the wireshark ...
2
votes
2answers
120 views

Stunnel: ssl to ssl

I have a little service which listen only on https://localhost:41952 and checks source hostname (it must be localhost). I want to connect on "listen:1988" and redirect requests with stunnel to "...
2
votes
0answers
311 views

HTTP to HTTPS local proxy that can do the HTTPS connection over a proxy

Here's the deal: Our client software can only connect using http protocol, it can not do https. However, security requirements dictate end-to-end security, so we need to use https when talking to ...
1
vote
0answers
115 views

How to log/see the traffic going through stunnel before/after encryption?

So I am using stunnel to talk to a SSL server. I would like to see the messages I am sending before they get encrypted and more importantly the messages I am receiving after they get decrypted. I ...
5
votes
1answer
364 views

How does stunnel redirect traffic?

I am familiar with the stunnel.conf and I know how to specify which unencrypted ports it listens to and to which encrypted ports it redirects, but I would like to understand how it gets the power to "...
3
votes
0answers
69 views

Why is the loopback device needed on a client side of Stunnel?

This SANS Institute guide states that "On the client side, a port listening on the loopback interface of the local system would send/receive data on the clear-text protocol and tunnel out on ...
0
votes
3answers
105 views

Did I install stunnel correctly?

Running Ubuntu 14.04 64-bit. apt-get install build-essential -y apt-get install libssl-dev -y apt-get install wget -y cd srv wget https://www.stunnel.org/downloads/stunnel-5.23.tar.gz tar -xzf ...
2
votes
2answers
850 views

Failed to start stunnel4 on Ubuntu 15.04

I get the following error starting stunnel4 service on Ubuntu 15.04: root@scw-d91ec7:~# service stunnel4 start Job for stunnel4.service failed. See "systemctl status stunnel4.service" and "journalctl ...
1
vote
0answers
230 views

Syslog-ng and Stunnel between two hosts (Connection refused)

I'd like to setup syslog-ng over stunnel between a host on my LAN and a host in my DMZ but can't quite figure out the configuration. The stunnel config seems to be correct. If I shutdown syslog on ...
0
votes
0answers
194 views

CentOS Postfix/Dovecot status deferred conversation with 127.0.0.1[127.0.0.1] timed out while receiving the initial server greeting

Linux Kernel: Linux 2.6.32-504.16.2.el6.i686 on i686 RAM: 6GB OS: CentOS 6.6 Postfix 2.6.6 Dovecot 2.0.9 Relay Host Verizon Stunnel through 127.0.0.1:2525 Webmin 1.750 Virtualmin 4.17.gpl Multiple ...
6
votes
2answers
2k views

stunnel vpn traffic and ensure it looks like SSL traffic on port 443

I am trying to make my outgoing and incoming traffic look as legitimate as close to SSL traffic as possible. Is there a way to DPI my own traffic to ensure it looks like SSL traffic and not OpenVPN ...
2
votes
1answer
222 views

Set up stunnel to wrap SSL for a single application

I am trying to use stunnel to get an older usenet client to support SSL. I tried the following config: [myservice] accept = <LOCAL_PORT> connect = <REMOTE_HOST>:<REMOTE_PORT> but ...
1
vote
1answer
979 views

stunnel4: Disable Secure Client-Initiated Renegotiation

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian ...
0
votes
1answer
570 views

Binding stunnel on both IPv6 and IPv4

I would like to make a local unencrypted service that listens on 127.0.0.1:8000 available via SSL on both IPv4 and IPv6 on port 8001. Unfortunately, stunnel configuration [Server] accept = 8001 ...
0
votes
0answers
95 views

Apache not forwarding to HAProxy

Scenario: I have a mobile application that needs to talk to a service hosted by an IBM Datapower appliance. However, the Datapower appliance requires bi-directional SSL and that will not work for ...
0
votes
1answer
883 views

stunnel with TLS for POP3 and SMTP: config is?

Have used stunnel successfully for years over SSLv3. Simple config works with older stunnel and SSLv3: [noteworthypop] accept = 110 connect = secure.emailsrvr.com:995 [noteworthysmtp] accept = 25 ...
15
votes
3answers
8k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
3
votes
3answers
2k views

reverse ssh tunnel over stunnel (or just reverse back down the stunnel connection)

I'm creating a security "dropbox" that can be deployed behind nat or any firewall, call out to a controlled publicly accessible server and then initiate control from the server. I know this is easily ...
0
votes
1answer
236 views

Stunnel as Windows service doesn't “start” on reboot

Running stunnel 5.03 on Windows 2008 R2. Everything is installed and working fine. I can even start/stop the service no problem... When I reboot my server stunnel service shows as started but ...
1
vote
1answer
107 views

Does stunnel prevent non ssl traffic to “the” specified port?

So say I have an arbitrary tcp port 12345 and it's non ssl and I want to put stunnel to secure traffic to it. When stunnel is in front of it does it mean that this port is now tls/ssl only? Or can ...
0
votes
2answers
1k views

SSHD real-ip behind haproxy

I'm trying to setup an ssh over https connection using haproxy. I'm currently looking for a way for SSHD to get the source ip from haproxy, similar to reading X-Forwarded-For or X-Real-IP headers. ...
0
votes
2answers
2k views

SSH over HTTPS through haproxy

I'm trying to setup an ssh over https connection using haproxy. I haven't found any working examples, so any help would be appreciated! client config; ~$ cat ~/.stunnel/stunnel.conf pid= client=yes ...
1
vote
0answers
384 views

Can stunnel be used to round robin tcp connections without SSL?

Today, I'm already using stunnel to provide SSL termination to a set of TCP services where the connections are round-robin'ed, this is done, for example, like follows: [myserv] accept = 443 connect = ...
0
votes
1answer
282 views

Redis security using stunnel and AUTH

Im a redis newbie but want to make sure everything is setup securely as we deal with medical info. I have a few EC2 instances. One of which is a server that runs two redis instances, one for a dev ...
0
votes
1answer
507 views

Https on HAproxy 1.4 using stunnel

I'm running a load balancing server with HAproxy and implementing Https using stunnel on the same machine, on the actual webpages end i've got 2 diferent webs, A and B, with similar behaviour. Here ...
1
vote
1answer
173 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
2
votes
1answer
217 views

What does this notice mean “SNI: extension not received from the client”, in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of ...
2
votes
1answer
462 views

Using multiple SSL certificates with Stunnel

I have a HAProxy + stunnel setup, I would like to have different certificates for my domain and submdomain. Certificate 1 - example.com Certificate 2 - foo.example.com How do I configure Stunnel to do ...
1
vote
1answer
97 views

How to best encrypt http traffic between frontent (VPS/AWS) and remote backend?

I have a couple of frontend servers running on AWS (running pound for SSL termination and Varnish for caching). My backend is at a remote location (not on AWS). I am looking for the best/fastest way ...
0
votes
1answer
520 views

Use stunnel for Socket.io SSL support

I am trying to add SSL support to my node.js app, while connecting via socket.io. The traffic to socket.io is going to port 80. I would like stunnel to grab encrypted traffic from port 443, unencrypt ...
0
votes
3answers
1k views

Stunnel multiple ports through the same Port

I'm looking for some help regarding an stunnel configuration I'm working on. Basically I want to have a DMZ machine accept inbound connections to port 80 and 110, and then forward them through my ...
0
votes
1answer
566 views

Does stunnel cache DNS?

I'm using stunnel in client mode to proxy between my Haproxy and a HTTPS backend server. I've read that Haproxy caches the resolved IPs on each config load, which isn't a problem in my current setup. ...
0
votes
0answers
121 views

Why does stunnel keep on reading the old pem file?

I've updated the pem file using the rekeyed certificate. But upon checking the certificate information through various SSL checkers, the old certificate was being read. I tried reloading the stunnel ...
1
vote
0answers
61 views

How can I update rekeyed certificates on stunnel?

I have configured stunnel using GoDaddy certificate and it was working fine. Due to some circumstances, I need to rekey the certificate and update the pem file on the load balancer. Upon updating the ...
1
vote
0answers
255 views

Stunnel only for specific domain

I'm configuring stunnel to encapsulate SSL petitions to Haproxy. Haproxy serves several sites in the same IP address: domain.com - Website app.domain.com - Node.js webserver I acquired an SSL ...
1
vote
0answers
369 views

Issue connecting to Amazon RDS with stunnel on Windows

I'm trying to set up a local pgbouncer server that then connects using SSL to Amazon's PostgreSQL RDS service. According to pgbouncer's documentation, you need to use something like stunnel to connect....
1
vote
1answer
1k views

stunnel client uses improper SNI when talking to Apache

I have stunnel listening on port 80 and acting as a client connecting to Apache listening on port 443. Configuration is below. What I'm finding is that if I attempt to connect to localhost:80 the ...
2
votes
1answer
587 views

Encrypting peer-to-peer application with iptables and stunnel

I'm running legacy applications in which I do not have access to the source code. These components talk to each other using plaintext on a particular port. I would like to be able to secure the ...
1
vote
0answers
863 views

stunnel: redirect HTTP traffic to HTTPS

Is it possible for stunnel to detect non-SSL requests and issue a redirect to HTTPS URL? Or maybe it's possible to have stunnel mark these requests somehow and let the underlying app issue the ...
1
vote
1answer
836 views

How do I get iPXE to boot from HTTPS server with self signed cert?

I am chainloading iPXE (undionly.kpxe) and using an embedded script wanting to boot from HTTPS. The problem is the HTTPS server is connecting to the http server (a custom service) via stunnel using a ...
1
vote
0answers
296 views

Keepalived, Junos, and ARP caching

I'm trying to configure an active-passive stunnel setup, with the aid of Keepalived, for a public IP address at our company datacenter. I would like to know if a router or switch reconfiguration is ...