The tag has no wiki summary.

learn more… | top users | synonyms

8
votes
4answers
5k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
8
votes
2answers
4k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
7
votes
1answer
2k views

Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling

We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database. At peak times, the web servers make many ...
5
votes
2answers
10k views

Stunnel won't work with SSLv3 from some hosts

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors in log files: SSL_accept: 1408F10B: error:1408F10B:SSL ...
4
votes
3answers
2k views

Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access: 2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160 ...
3
votes
4answers
2k views

Pound + HAProxy or Stunnel + HAProxy

I'm looking at introducing a loadbalancer to my existing site infrastructure to help with traffic growth and provide a level of failure protection. The site I am running uses SSL certificates for the ...
3
votes
1answer
437 views

HAProxy and Stunnel PCI Compliance

I am setting up HAProxy to load balance between two web servers. Some of the pages on the site require SSL. Stunnel is handling the https connections and passing them off to haproxy (Stunnel ...
3
votes
4answers
216 views

Is there an SSL equivelent to an ssh agent?

Here is my situation: There are a number of developers who all need to have access to be able to install ruby gems and python eggs from a remote source. Currently, we have a server inside our firewall ...
2
votes
2answers
551 views

Ubuntu: Compressed, but not encrypted, tunnel for TCP?

How can I set up a tunnel for TCP connections between two hosts so that I can test a few different compression algorithms? I'm aware of stunnel & SSH, but want to avoid the overhead of ...
2
votes
1answer
1k views

Stunnel too many clients

I'm trying to hook up stunnel and haproxy to forward https connections through to some backend servers. I've got haproxy setup right, and I seem to have stunnel set up right. Trouble is that when I ...
2
votes
1answer
1k views

Multiple SSL certs with Stunnel

I have purchased two PositiveSSL certs (seperately), one for manager.domain.com and another for domain.com. Originally I only needed manager.domain.com using SSL, but than I needed to use SSL on ...
2
votes
2answers
672 views

Should I use an ssl terminator or just haproxy?

I'm trying to figure out how to set up my architecture for a socket.io app that will require both https and wss connections. I've found many tutorials on the web suggesting that you use something like ...
2
votes
2answers
121 views

Replace Cisco 2600 PTP T1

Our office and an outside location have a dedicated T1 point to point connected with Cisco2600's. We need to eliminate the need of the T1 circuit as it is costly and would like to route the traffic ...
2
votes
1answer
169 views

Encrypting peer-to-peer application with iptables and stunnel

I'm running legacy applications in which I do not have access to the source code. These components talk to each other using plaintext on a particular port. I would like to be able to secure the ...
2
votes
1answer
659 views

HTTPS Stunnel and Haproxy

I am trying to use stunnel infront of Haproxy for SSL support. SSL certificates are located according to stunnel configuration. I am also able to get the https connection, but every time I use https, ...
2
votes
1answer
56 views

What does this notice mean “SNI: extension not received from the client”, in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of ...
1
vote
1answer
230 views

Securing stunnel.pem on Windows

How can I prevent reading of the stunnel.pem file by any user other than the service user running Stunnel? How can I permit access to this directory (C:\Program Files\stunnel) in Windows XP to only ...
1
vote
1answer
99 views

Using multiple SSL certificates with Stunnel

I have a HAProxy + stunnel setup, I would like to have different certificates for my domain and submdomain. Certificate 1 - example.com Certificate 2 - foo.example.com How do I configure Stunnel to do ...
1
vote
3answers
1k views

Stunnel Connection Issue: 140943F2 SSL3_READ_BYTES:sslv3 alert unexpected message

Cant seem to connect using stunnel to the other party. Getting an error: SSL_connect: 140943F2: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message Any idea?
1
vote
2answers
2k views

stunnel+HAProxy+Apache question, multiple site certificates

currently I'm using the following scheme to serve both static y and dynamic content. I have compiled stunnel with X-Forwarded-For support patch. Internet(http) -> haproxy (frontend1) -> Apache Farm ...
1
vote
1answer
950 views

Using virtual IP with stunnel and haproxy

We have a load-balancer setup, in which an HTTPS Request flows through the following steps:- Client -> DNS -> stunnel on Load-Balancer -> HAProxy on LB -> Web-Server This setup works ...
1
vote
1answer
1k views

stunnel: SSL-to-SSL? (for smtp/imap)

How can I configure stunnel to accpet SSL connections, and connect then to an SSL port on a different server? Here is my setup: Our ISP's server, "Mail Server", supports smtp/imap over SSL. (Not ...
1
vote
3answers
2k views

Unknown protocol when trying to connect to remote host with stunnel

I'm trying to set up a stunnel for WebDav on Windows. I want to connect 80 port on my local interface to 443 on another machine in my network. I can ping the machine remote machine. However when I use ...
1
vote
1answer
39 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
1
vote
1answer
45 views

How to best encrypt http traffic between frontent (VPS/AWS) and remote backend?

I have a couple of frontend servers running on AWS (running pound for SSL termination and Varnish for caching). My backend is at a remote location (not on AWS). I am looking for the best/fastest way ...
1
vote
1answer
619 views

Redirect non-https traffic when using Varnish and nginx

I am using Stunnel, Varnish, and nginx with a nodejs app, and I'm having trouble redirecting non-https pages (http://manager.domain.com) to their respective https page (https://manager.domain.com). I ...
1
vote
1answer
1k views

stunnel version 4.53 says SSL server needs a certificate on Windows 7

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a ...
1
vote
1answer
431 views

Does stunnel support multiple forwardings over the same connection?

A lot of the tutorials on stunnel show only single forwardings. It stunnel limited to only fowarding and listening to one port on both ends, or can it handle both local and remote forwarding in the ...
1
vote
3answers
2k views

OpenSource (Layer 4) Load Balancer that can pass through original client IP?

I am setting up a web application which uses SSL for all requests. It needs to have room for scaling and also be highly available. It seems that the "recommended" way to handle this is to setup a pair ...
1
vote
1answer
924 views

Is stunnel capable of working like ssh -R?

I have a machine running MySQL (Windows), on a private network (let's say 192.168.1.10), behind a masquerading gateway. No port forwarding to 192.168.1.10 is possible. I also have a server with a ...
1
vote
0answers
36 views

How can I update rekeyed certificates on stunnel?

I have configured stunnel using GoDaddy certificate and it was working fine. Due to some circumstances, I need to rekey the certificate and update the pem file on the load balancer. Upon updating the ...
1
vote
0answers
70 views

Stunnel only for specific domain

I'm configuring stunnel to encapsulate SSL petitions to Haproxy. Haproxy serves several sites in the same IP address: domain.com - Website app.domain.com - Node.js webserver I acquired an SSL ...
1
vote
0answers
178 views

Issue connecting to Amazon RDS with stunnel on Windows

I'm trying to set up a local pgbouncer server that then connects using SSL to Amazon's PostgreSQL RDS service. According to pgbouncer's documentation, you need to use something like stunnel to ...
1
vote
1answer
219 views

How do I get iPXE to boot from HTTPS server with self signed cert?

I am chainloading iPXE (undionly.kpxe) and using an embedded script wanting to boot from HTTPS. The problem is the HTTPS server is connecting to the http server (a custom service) via stunnel using a ...
1
vote
0answers
108 views

Keepalived, Junos, and ARP caching

I'm trying to configure an active-passive stunnel setup, with the aid of Keepalived, for a public IP address at our company datacenter. I would like to know if a router or switch reconfiguration is ...
1
vote
0answers
108 views

Stunnel + Varnish + Apache questions

I am currently running Varnish in front of apache for all http traffic. I added stunnel so as to take advantage of the cache for https connections as well. So, for https, stunnel talks to varnish ...
1
vote
0answers
229 views

stunnel Haproxy ldap authentication

in our setup port 433 is handled by stunnel. After that haproxy will dispatches the request to the appropriate backend. I have managed to enable authentication in haproxy. But the users and passwords ...
1
vote
1answer
99 views

Stunnel delaying boot

My stunnel implementation works fine when the network is plugged in but it takes an awful amount of time, which delays the whole boot process, when there is no network connected to the machine. As ...
1
vote
0answers
410 views

pfsense + haproxy + stunnel as reverse proxy with load balancing and ssl terminaltion

i have this topology as title says with a pfsense with installed haproxy and stunnel. Because i saw that haproxy can't do ssl termination i thought about stunnel. But i don't know how to set up it. My ...
1
vote
0answers
586 views

Confused about stunnel's TIMEOUTclose setting

I understand from the stunnel documentation and from what I read on the Internet that MS has a buggy implementation of SSL; it fails to send a close_notify thing. The solution, says the documentation, ...
1
vote
1answer
441 views

SSL, Front-end caches, and web servers

I'm looking to add SSL to some sites. My current setup is varnish -> nginx -> python wsgi server. The varnish sits at the front and caches both static and dynamic content. The nginx server serves ...
1
vote
1answer
372 views

Unreasonably slow stunnel

I setup stunnel on OSX to tunnel traffic to my Django dev server because Facebook needs HTTPS these days but I noticed it's being absurdly slow. It seems like it can only handle a single connection at ...
1
vote
0answers
241 views

Switch stunnel from self-signed cert to signed by CA cert

We use stunnel configured to provide SSL-tunnel between SERVER A (where we have stunnel configured as client) and many SERVERS B (where we deployed stunnel configured to work in server mode). We use ...
1
vote
1answer
364 views

Unable to connect to remote secure site using stunnel

I've got a remote machine I need to connect to that uses HTTPS and a client I need to connect to it with that doesn't support HTTPS. Enter stunnel. I'm running it as follows, then connecting with the ...
0
votes
2answers
592 views

SSH over stunnel with secret public (client) ssl certificate

I am in a situation where I cannot have passwordless login for ssh and ssh server could not be run over any other port other than the default port. So, I have chosen to use stunnel to tunnel ssh. On ...
0
votes
3answers
1k views

STunnel Not Reading Configuration File

I generated an SSL certificate as specified on the answer to stunnel: SSL-to-SSL? (for smtp/imap) And have the following configuation file: cert = /home/marshall/stunnels/certs/umistunnel.keys ; ...
0
votes
2answers
1k views

Stunnel Error binding pop3s to 0.0.0.0:110

I'm setting up stunnel so a non SSL enabled app can access a Gmail / Google Apps account. Here's the config I'm using: CLIENT=YES [pop3s] accept = 110 connect = pop.gmail.com:995 [imaps] accept = ...
0
votes
1answer
36 views

Https on HAproxy 1.4 using stunnel

I'm running a load balancing server with HAproxy and implementing Https using stunnel on the same machine, on the actual webpages end i've got 2 diferent webs, A and B, with similar behaviour. Here ...
0
votes
1answer
231 views

apache authentication stunnel

Apache is listening on port 80 and redirecting everything to https, which is handled by stunnel. If I put in authentication in it redirects before it does the authentication. Is there a way to handle ...
0
votes
3answers
572 views

Architecture question: adding SSL into the mix

Currently we have a configuration that at the highest level looks like this: [Traffic] -> Varnish (caching) -> HaProxy (load balancing) -> Apache (content and services) There are (obviously?) ...