Stunnel is a small tool that can wrap the connection of other protocols with SSL/TLS.

learn more… | top users | synonyms

15
votes
3answers
8k views

Protecting against POODLE SSL on stunnel

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
12
votes
3answers
7k views

How do I ensure that stunnel sends all intermediate CA certs?

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac ...
10
votes
4answers
7k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
9
votes
2answers
3k views

Connecting to MySQL securely - MySQL's SSL vs Stunnel vs SSH Tunneling

We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database. At peak times, the web servers make many ...
8
votes
2answers
23k views

Stunnel won't work with SSLv3 from some hosts

WARNING: SSLv3 is obsolete. Consider disabling it altogether. I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed. Then I encountered errors ...
7
votes
3answers
12k views

Bug setting up stunnel server: `SSL3_GET_CLIENT_HELLO:wrong version number`

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access: 2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160 2013....
6
votes
2answers
2k views

stunnel vpn traffic and ensure it looks like SSL traffic on port 443

I am trying to make my outgoing and incoming traffic look as legitimate as close to SSL traffic as possible. Is there a way to DPI my own traffic to ensure it looks like SSL traffic and not OpenVPN ...
5
votes
1answer
383 views

How does stunnel redirect traffic?

I am familiar with the stunnel.conf and I know how to specify which unencrypted ports it listens to and to which encrypted ports it redirects, but I would like to understand how it gets the power to "...
4
votes
1answer
4k views

Multiple SSL certs with Stunnel

I have purchased two PositiveSSL certs (seperately), one for manager.domain.com and another for domain.com. Originally I only needed manager.domain.com using SSL, but than I needed to use SSL on ...
4
votes
4answers
365 views

Is there an SSL equivelent to an ssh agent?

Here is my situation: There are a number of developers who all need to have access to be able to install ruby gems and python eggs from a remote source. Currently, we have a server inside our firewall ...
4
votes
2answers
4k views

Unknown protocol when trying to connect to remote host with stunnel

I'm trying to set up a stunnel for WebDav on Windows. I want to connect 80 port on my local interface to 443 on another machine in my network. I can ping the machine remote machine. However when I use ...
4
votes
0answers
1k views

Confused about stunnel's TIMEOUTclose setting

I understand from the stunnel documentation and from what I read on the Internet that MS has a buggy implementation of SSL; it fails to send a close_notify thing. The solution, says the documentation, ...
3
votes
3answers
4k views

STunnel Not Reading Configuration File

I generated an SSL certificate as specified on the answer to stunnel: SSL-to-SSL? (for smtp/imap) And have the following configuation file: cert = /home/marshall/stunnels/certs/umistunnel.keys ; ...
3
votes
4answers
3k views

Pound + HAProxy or Stunnel + HAProxy

I'm looking at introducing a loadbalancer to my existing site infrastructure to help with traffic growth and provide a level of failure protection. The site I am running uses SSL certificates for the ...
3
votes
3answers
2k views

reverse ssh tunnel over stunnel (or just reverse back down the stunnel connection)

I'm creating a security "dropbox" that can be deployed behind nat or any firewall, call out to a controlled publicly accessible server and then initiate control from the server. I know this is easily ...
3
votes
1answer
657 views

HAProxy and Stunnel PCI Compliance

I am setting up HAProxy to load balance between two web servers. Some of the pages on the site require SSL. Stunnel is handling the https connections and passing them off to haproxy (Stunnel ...
3
votes
1answer
2k views

stunnel: SSL-to-SSL? (for smtp/imap)

How can I configure stunnel to accpet SSL connections, and connect then to an SSL port on a different server? Here is my setup: Our ISP's server, "Mail Server", supports smtp/imap over SSL. (Not ...
3
votes
2answers
3k views

stunnel version 4.53 says SSL server needs a certificate on Windows 7

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a ...
3
votes
0answers
73 views

Why is the loopback device needed on a client side of Stunnel?

This SANS Institute guide states that "On the client side, a port listening on the loopback interface of the local system would send/receive data on the clear-text protocol and tunnel out on ...
2
votes
1answer
472 views

Using multiple SSL certificates with Stunnel

I have a HAProxy + stunnel setup, I would like to have different certificates for my domain and submdomain. Certificate 1 - example.com Certificate 2 - foo.example.com How do I configure Stunnel to do ...
2
votes
2answers
1k views

Ubuntu: Compressed, but not encrypted, tunnel for TCP?

How can I set up a tunnel for TCP connections between two hosts so that I can test a few different compression algorithms? I'm aware of stunnel & SSH, but want to avoid the overhead of encryption....
2
votes
2answers
130 views

Stunnel: ssl to ssl

I have a little service which listen only on https://localhost:41952 and checks source hostname (it must be localhost). I want to connect on "listen:1988" and redirect requests with stunnel to "...
2
votes
2answers
976 views

Failed to start stunnel4 on Ubuntu 15.04

I get the following error starting stunnel4 service on Ubuntu 15.04: root@scw-d91ec7:~# service stunnel4 start Job for stunnel4.service failed. See "systemctl status stunnel4.service" and "journalctl ...
2
votes
1answer
2k views

Stunnel too many clients

I'm trying to hook up stunnel and haproxy to forward https connections through to some backend servers. I've got haproxy setup right, and I seem to have stunnel set up right. Trouble is that when I ...
2
votes
1answer
232 views

Set up stunnel to wrap SSL for a single application

I am trying to use stunnel to get an older usenet client to support SSL. I tried the following config: [myservice] accept = <LOCAL_PORT> connect = <REMOTE_HOST>:<REMOTE_PORT> but ...
2
votes
2answers
912 views

Should I use an ssl terminator or just haproxy?

I'm trying to figure out how to set up my architecture for a socket.io app that will require both https and wss connections. I've found many tutorials on the web suggesting that you use something like ...
2
votes
2answers
135 views

Replace Cisco 2600 PTP T1

Our office and an outside location have a dedicated T1 point to point connected with Cisco2600's. We need to eliminate the need of the T1 circuit as it is costly and would like to route the traffic ...
2
votes
2answers
2k views

Cannot find ssl libraries when configuring stunnel

I am using RHEL 5.6 and trying to install stunnel with the 'xforwardfor' patch from haproxy to get a setup similar to this (older) post: http://www.buro9.com/blog/2009/12/07/installing-haproxy-load-...
2
votes
1answer
193 views

Stunnel TLS authentication with multiple Authorities

I am trying to secure a rethinkdb cluster behind stunnel. The service needs to support multiple Certificate Authorities (CA). Currently I concat the accepted CAs into one file (/certs/ca.pem) but it ...
2
votes
1answer
219 views

What does this notice mean “SNI: extension not received from the client”, in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of ...
2
votes
1answer
604 views

Encrypting peer-to-peer application with iptables and stunnel

I'm running legacy applications in which I do not have access to the source code. These components talk to each other using plaintext on a particular port. I would like to be able to secure the ...
2
votes
1answer
291 views

Stunnel + Varnish + Apache questions

I am currently running Varnish in front of apache for all http traffic. I added stunnel so as to take advantage of the cache for HTTPS connections as well. So, for HTTPS, stunnel talks to varnish ...
2
votes
1answer
746 views

HTTPS Stunnel and Haproxy

I am trying to use stunnel infront of Haproxy for SSL support. SSL certificates are located according to stunnel configuration. I am also able to get the https connection, but every time I use https, ...
2
votes
0answers
14 views

stunnel TIMEOUTconnect on Ubuntu 15.10

We use stunnel extensively for LDAP proxying. We recently set up a Ubuntu 15.10 server to migrate some of the tunnels to and are unable to get it to work. We've scraped through the logs, configs, ...
2
votes
0answers
103 views

iptables configuations for stunnel+squid

I'm building a highly anonymous proxy server with squid and stunnel, and I'm facing a configurations problem on iptables. The server should act like this: browser <-> client stunnel <=> ...
2
votes
0answers
406 views

HTTP to HTTPS local proxy that can do the HTTPS connection over a proxy

Here's the deal: Our client software can only connect using http protocol, it can not do https. However, security requirements dictate end-to-end security, so we need to use https when talking to ...
2
votes
0answers
776 views

pfsense + haproxy + stunnel as reverse proxy with load balancing and ssl terminaltion

i have this topology as title says with a pfsense with installed haproxy and stunnel. Because i saw that haproxy can't do ssl termination i thought about stunnel. But i don't know how to set up it. My ...
2
votes
2answers
4k views

why is stunnel doing this

I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following: Remote ...
1
vote
1answer
252 views

Securing stunnel.pem on Windows

How can I prevent reading of the stunnel.pem file by any user other than the service user running Stunnel? How can I permit access to this directory (C:\Program Files\stunnel) in Windows XP to only ...
1
vote
1answer
113 views

Does stunnel prevent non ssl traffic to “the” specified port?

So say I have an arbitrary tcp port 12345 and it's non ssl and I want to put stunnel to secure traffic to it. When stunnel is in front of it does it mean that this port is now tls/ssl only? Or can ...
1
vote
1answer
1k views

Stunnel and FIX

I am trying to use Stunnel to connect to a remote server through a proxy (I am using stunnel 4.56). Here is my config file stunnel.conf: cert = stunnel.pem key = stunnel.pem [https] accept = 127.0....
1
vote
3answers
3k views

Stunnel Connection Issue: 140943F2 SSL3_READ_BYTES:sslv3 alert unexpected message

Cant seem to connect using stunnel to the other party. Getting an error: SSL_connect: 140943F2: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message Any idea?
1
vote
2answers
2k views

stunnel+HAProxy+Apache question, multiple site certificates

currently I'm using the following scheme to serve both static y and dynamic content. I have compiled stunnel with X-Forwarded-For support patch. Internet(http) -> haproxy (frontend1) -> Apache Farm ...
1
vote
1answer
1k views

Using virtual IP with stunnel and haproxy

We have a load-balancer setup, in which an HTTPS Request flows through the following steps:- Client -> DNS -> stunnel on Load-Balancer -> HAProxy on LB -> Web-Server This setup works ...
1
vote
1answer
1k views

Stunnel, limits.conf

After reading the fine advice and accepted answer at Stunnel too many clients , I'm finding that this looks like our problem, but I'm having trouble applying the solution. First of all, ulimit is a ...
1
vote
1answer
1k views

stunnel4: Disable Secure Client-Initiated Renegotiation

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian ...
1
vote
1answer
180 views

DER encoded hash

according to the manpage of stunnel4 the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the ...
1
vote
1answer
98 views

How to best encrypt http traffic between frontent (VPS/AWS) and remote backend?

I have a couple of frontend servers running on AWS (running pound for SSL termination and Varnish for caching). My backend is at a remote location (not on AWS). I am looking for the best/fastest way ...
1
vote
1answer
1k views

stunnel client uses improper SNI when talking to Apache

I have stunnel listening on port 80 and acting as a client connecting to Apache listening on port 443. Configuration is below. What I'm finding is that if I attempt to connect to localhost:80 the ...
1
vote
1answer
1k views

Redirect non-https traffic when using Varnish and nginx

I am using Stunnel, Varnish, and nginx with a nodejs app, and I'm having trouble redirecting non-https pages (http://manager.domain.com) to their respective https page (https://manager.domain.com). I ...