How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?

3 Answers 3


You can disable SSLv3 protocol on stunnel altogether.

From stunnel documentation:

sslVersion = SSL_VERSION

select version of SSL protocol Allowed

options: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2

I've added this to the config file:

sslVersion = TLSv1 TLSv1.1 TLSv1.2

And now I am not able to connect with SSLv3 (using openssl s_client -connect my.domain.com:443 -ssl3)

NOTE: Some older versions of stunnel and OpenSSL don't support TLSv1.2 (and even TLSv1.1). In this case, remove them from sslVersion directive to avoid incorrect version of ssl protocol error.

  • I get the following error when I use the sslVersion = from above: Starting stunnel: file /etc/stunnel/stunnel.conf line 6: Incorrect version of SSL protocol. This is with 4.29. Can anyone else confirm that they do not get this error?
    – Ross
    Oct 17, 2014 at 21:43
  • Some older versions of stunnel do not support TLSv1.2 or TLSv1.1. Try removing those, leaving just TLSv1. Confirmed this working on an older installation.
    – Sergey
    Oct 20, 2014 at 0:50

if you prefer to stick with older stunnel (like the 4.53 in your Debian Stable), you can disable SSLv2 and SSLv3 with:

sslVersion = all
options = NO_SSLv2
options = NO_SSLv3

instead of

sslVersion = TLSv1

which would disable TLSv1.1 and TLSv1.2 also.

  • 1
    This works for me with stunnel 4.53 (Debian) and a modern OpenSSL (1.0.1e+security patches that Debian provides). I can connect to it using TLSv1.2. Yay! Sep 2, 2015 at 0:52

Since I cannot comment, I will "answer" (sorry).

Anyway, I am running stunnel 5.01 and I also get the "incorrect version of SSL" error after making the change to sslVersion:

[!] Server is down
[.] Reading configuration from file stunnel.conf
[!] Line 4: "sslVersion = TLSv1 TLSv1.1 TLSv1.2": Incorrect version of SSL protocol

Fixed (for me). Had to upgrade stunnel to v5.06 (most current release as of today). Conf file is exactly the same so I guess there is some mojo happening between v5.01 and v5.06 that goes beyond a mere mortal to understand.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .