Stunnel is a small tool that can wrap the connection of other protocols with SSL/TLS.

learn more… | top users | synonyms

1
vote
1answer
25 views

stunnel4: Disable Secure Client-Initiated Renegotiation

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian ...
-1
votes
1answer
508 views

Stunnel and FIX

I am trying to use Stunnel to connect to a remote server through a proxy (I am using stunnel 4.56). Here is my config file stunnel.conf: cert = stunnel.pem key = stunnel.pem [https] accept = ...
0
votes
1answer
32 views

Binding stunnel on both IPv6 and IPv4

I would like to make a local unencrypted service that listens on 127.0.0.1:8000 available via SSL on both IPv4 and IPv6 on port 8001. Unfortunately, stunnel configuration [Server] accept = 8001 ...
0
votes
1answer
850 views

Stunnel, limits.conf

After reading the fine advice and accepted answer at Stunnel too many clients , I'm finding that this looks like our problem, but I'm having trouble applying the solution. First of all, ulimit is a ...
0
votes
0answers
33 views

Apache not forwarding to HAProxy

Scenario: I have a mobile application that needs to talk to a service hosted by an IBM Datapower appliance. However, the Datapower appliance requires bi-directional SSL and that will not work for ...
2
votes
1answer
185 views

Stunnel + Varnish + Apache questions

I am currently running Varnish in front of apache for all http traffic. I added stunnel so as to take advantage of the cache for HTTPS connections as well. So, for HTTPS, stunnel talks to varnish ...
0
votes
1answer
146 views

stunnel with TLS for POP3 and SMTP: config is?

Have used stunnel successfully for years over SSLv3. Simple config works with older stunnel and SSLv3: [noteworthypop] accept = 110 connect = secure.emailsrvr.com:995 [noteworthysmtp] accept = 25 ...
-1
votes
2answers
786 views

SSH over HTTPS through haproxy

I'm trying to setup an ssh over https connection using haproxy. I haven't found any working examples, so any help would be appreciated! client config; ~$ cat ~/.stunnel/stunnel.conf pid= client=yes ...
10
votes
3answers
4k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
7
votes
2answers
2k views

Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling

We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database. At peak times, the web servers make many ...
1
vote
2answers
412 views

reverse ssh tunnel over stunnel (or just reverse back down the stunnel connection)

I'm creating a security "dropbox" that can be deployed behind nat or any firewall, call out to a controlled publicly accessible server and then initiate control from the server. I know this is easily ...
7
votes
2answers
14k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
0
votes
0answers
71 views

Stunnel as Windows service doesn't “start” on reboot

Running stunnel 5.03 on Windows 2008 R2. Everything is installed and working fine. I can even start/stop the service no problem... When I reboot my server stunnel service shows as started but ...
1
vote
1answer
48 views

Does stunnel prevent non ssl traffic to “the” specified port?

So say I have an arbitrary tcp port 12345 and it's non ssl and I want to put stunnel to secure traffic to it. When stunnel is in front of it does it mean that this port is now tls/ssl only? Or can ...
0
votes
2answers
344 views

SSHD real-ip behind haproxy

I'm trying to setup an ssh over https connection using haproxy. I'm currently looking for a way for SSHD to get the source ip from haproxy, similar to reading X-Forwarded-For or X-Real-IP headers. ...
0
votes
2answers
2k views

why is stunnel doing this

I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following: Remote ...
1
vote
0answers
124 views

Can stunnel be used to round robin tcp connections without SSL?

Today, I'm already using stunnel to provide SSL termination to a set of TCP services where the connections are round-robin'ed, this is done, for example, like follows: [myserv] accept = 443 connect = ...
0
votes
1answer
115 views

Redis security using stunnel and AUTH

Im a redis newbie but want to make sure everything is setup securely as we deal with medical info. I have a few EC2 instances. One of which is a server that runs two redis instances, one for a dev ...
0
votes
1answer
210 views

Https on HAproxy 1.4 using stunnel

I'm running a load balancing server with HAproxy and implementing Https using stunnel on the same machine, on the actual webpages end i've got 2 diferent webs, A and B, with similar behaviour. Here ...
1
vote
1answer
84 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
1
vote
1answer
223 views

Using multiple SSL certificates with Stunnel

I have a HAProxy + stunnel setup, I would like to have different certificates for my domain and submdomain. Certificate 1 - example.com Certificate 2 - foo.example.com How do I configure Stunnel to do ...
2
votes
1answer
123 views

What does this notice mean “SNI: extension not received from the client”, in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of ...
0
votes
1answer
272 views

Use stunnel for Socket.io SSL support

I am trying to add SSL support to my node.js app, while connecting via socket.io. The traffic to socket.io is going to port 80. I would like stunnel to grab encrypted traffic from port 443, unencrypt ...
1
vote
1answer
66 views

How to best encrypt http traffic between frontent (VPS/AWS) and remote backend?

I have a couple of frontend servers running on AWS (running pound for SSL termination and Varnish for caching). My backend is at a remote location (not on AWS). I am looking for the best/fastest way ...
0
votes
2answers
351 views

Stunnel multiple ports through the same Port

I'm looking for some help regarding an stunnel configuration I'm working on. Basically I want to have a DMZ machine accept inbound connections to port 80 and 110, and then forward them through my ...
0
votes
1answer
216 views

Does stunnel cache DNS?

I'm using stunnel in client mode to proxy between my Haproxy and a HTTPS backend server. I've read that Haproxy caches the resolved IPs on each config load, which isn't a problem in my current setup. ...
0
votes
0answers
67 views

Why does stunnel keep on reading the old pem file?

I've updated the pem file using the rekeyed certificate. But upon checking the certificate information through various SSL checkers, the old certificate was being read. I tried reloading the stunnel ...
1
vote
0answers
47 views

How can I update rekeyed certificates on stunnel?

I have configured stunnel using GoDaddy certificate and it was working fine. Due to some circumstances, I need to rekey the certificate and update the pem file on the load balancer. Upon updating the ...
1
vote
0answers
144 views

Stunnel only for specific domain

I'm configuring stunnel to encapsulate SSL petitions to Haproxy. Haproxy serves several sites in the same IP address: domain.com - Website app.domain.com - Node.js webserver I acquired an SSL ...
1
vote
0answers
236 views

Issue connecting to Amazon RDS with stunnel on Windows

I'm trying to set up a local pgbouncer server that then connects using SSL to Amazon's PostgreSQL RDS service. According to pgbouncer's documentation, you need to use something like stunnel to ...
1
vote
1answer
628 views

stunnel client uses improper SNI when talking to Apache

I have stunnel listening on port 80 and acting as a client connecting to Apache listening on port 443. Configuration is below. What I'm finding is that if I attempt to connect to localhost:80 the ...
0
votes
1answer
238 views

Stunnel config loads succefully but it does not connect

i have a VPS and a running Stunnel service there, listening on port 80, on my client side, i have setup the stunnel and generated the .pem file succefully. Server conf: ;Certificate cert = ...
2
votes
2answers
3k views

Unknown protocol when trying to connect to remote host with stunnel

I'm trying to set up a stunnel for WebDav on Windows. I want to connect 80 port on my local interface to 443 on another machine in my network. I can ping the machine remote machine. However when I use ...
2
votes
1answer
312 views

Encrypting peer-to-peer application with iptables and stunnel

I'm running legacy applications in which I do not have access to the source code. These components talk to each other using plaintext on a particular port. I would like to be able to secure the ...
0
votes
0answers
423 views

stunnel: redirect HTTP traffic to HTTPS

Is it possible for stunnel to detect non-SSL requests and issue a redirect to HTTPS URL? Or maybe it's possible to have stunnel mark these requests somehow and let the underlying app issue the ...
1
vote
1answer
425 views

How do I get iPXE to boot from HTTPS server with self signed cert?

I am chainloading iPXE (undionly.kpxe) and using an embedded script wanting to boot from HTTPS. The problem is the HTTPS server is connecting to the http server (a custom service) via stunnel using a ...
0
votes
1answer
748 views

stunnel in client mode as proxy for sendmail

I'm configuring an internal mail network that is supposed to do all the transmission using ssl and I want to have all the encryption done by stunnel. So far I have pop3s, imaps and sendmail in server ...
1
vote
0answers
151 views

Keepalived, Junos, and ARP caching

I'm trying to configure an active-passive stunnel setup, with the aid of Keepalived, for a public IP address at our company datacenter. I would like to know if a router or switch reconfiguration is ...
0
votes
1answer
807 views

stunnel error when connecting from a news reader: SSL3_READ_BYTES:tlsv1 alert unknown ca

I'm trying to set up stunnel to provide secure access to an nntp server. Following the instructions here I created a self-signed key and certificate. The commands I ran were: openssl genrsa -des3 ...
0
votes
2answers
432 views

End to end encryption with CQ5 and Dispatcher

I am currently working on an Adobe CQ5 (CMS) application that will be serving sensitive information, so communications should be encrypted using SSL end-to-end. The problem is that it is not ...
3
votes
4answers
240 views

Is there an SSL equivelent to an ssh agent?

Here is my situation: There are a number of developers who all need to have access to be able to install ruby gems and python eggs from a remote source. Currently, we have a server inside our firewall ...
5
votes
3answers
5k views

Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access: 2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160 ...
0
votes
1answer
707 views

stunnel can't bind to 0.0.0.0

I keep getting this error when trying to use stunnel to work between my sbs2003 server and office 365 mail server: stunnel: bind permission denied (wsaeacces) (10013) to 0.0.0.0:110 Does anyone ...
0
votes
1answer
271 views

set _SERVER[“HTTPS”] to yes with stunnel Haproxy Nginx

I am trying to set the _SERVER["HTTPS"] php variable to yes on my web servers. Actually, https trafic come to stunnel which forward it to haproxy which forward it to my web servers running under ...
1
vote
3answers
2k views

STunnel Not Reading Configuration File

I generated an SSL certificate as specified on the answer to stunnel: SSL-to-SSL? (for smtp/imap) And have the following configuation file: cert = /home/marshall/stunnels/certs/umistunnel.keys ; ...
1
vote
3answers
2k views

Stunnel Connection Issue: 140943F2 SSL3_READ_BYTES:sslv3 alert unexpected message

Cant seem to connect using stunnel to the other party. Getting an error: SSL_connect: 140943F2: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message Any idea?
1
vote
1answer
998 views

Using virtual IP with stunnel and haproxy

We have a load-balancer setup, in which an HTTPS Request flows through the following steps:- Client -> DNS -> stunnel on Load-Balancer -> HAProxy on LB -> Web-Server This setup works ...
2
votes
1answer
686 views

HTTPS Stunnel and Haproxy

I am trying to use stunnel infront of Haproxy for SSL support. SSL certificates are located according to stunnel configuration. I am also able to get the https connection, but every time I use https, ...
3
votes
4answers
2k views

Pound + HAProxy or Stunnel + HAProxy

I'm looking at introducing a loadbalancer to my existing site infrastructure to help with traffic growth and provide a level of failure protection. The site I am running uses SSL certificates for the ...
2
votes
2answers
764 views

Should I use an ssl terminator or just haproxy?

I'm trying to figure out how to set up my architecture for a socket.io app that will require both https and wss connections. I've found many tutorials on the web suggesting that you use something like ...