according to the manpage of stunnel4

the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert (the first 4 bytes of the MD5 hash in least significant byte order).

How can I produce a such thing ?

I tried, unsuccessfully :s :

openssl x509 -in cert.crt -inform PEM -out cert.der -outform DER


openssl dgst cert.der

2 Answers 2


Try this:

# openssl x509 -in cert.pem -noout -hash

This will give you the hash that OpenSSL is expecting to get for a certificates directory.

  • The documentation for stunnel4 is probably not up to date, but with a modern version of OpenSSL, you'd need -subject_hash_old to produce an MD5 hash, since -hash would use SHA-1. (Details here.) I guess stunnel4 might not care either way and delegate all this to the version of OpenSSL it's linked to.
    – Bruno
    May 16, 2014 at 1:50
  • Yes, any application using OpenSSL does (or at least should) delegate all this to the underlying OpenSSL library. May 16, 2014 at 19:49

c_rehash, openssl rehash

Create symbolic links to files named by the hash values.

See man c_rehash or openssl rehash:

On some platforms, the openssl rehash command is available as an external script called c_rehash. They are functionally equivalent, except for minor differences noted [in the manpages].

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.