How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
Add a comment
|
3 Answers
You can disable SSLv3 protocol on stunnel altogether.
From stunnel documentation:
sslVersion = SSL_VERSION
select version of SSL protocol Allowed
options: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
I've added this to the config file:
sslVersion = TLSv1 TLSv1.1 TLSv1.2
And now I am not able to connect with SSLv3 (using openssl s_client -connect my.domain.com:443 -ssl3)
NOTE: Some older versions of stunnel and OpenSSL don't support TLSv1.2 (and even TLSv1.1). In this case, remove them from sslVersion directive to avoid incorrect version of ssl protocol error.
-
I get the following error when I use the sslVersion = from above: Starting stunnel: file /etc/stunnel/stunnel.conf line 6: Incorrect version of SSL protocol. This is with 4.29. Can anyone else confirm that they do not get this error?– RossOct 17, 2014 at 21:43
-
Some older versions of stunnel do not support TLSv1.2 or TLSv1.1. Try removing those, leaving just TLSv1. Confirmed this working on an older installation.– SergeyOct 20, 2014 at 0:50
if you prefer to stick with older stunnel (like the 4.53 in your Debian Stable), you can disable SSLv2 and SSLv3 with:
sslVersion = all
options = NO_SSLv2
options = NO_SSLv3
instead of
sslVersion = TLSv1
which would disable TLSv1.1 and TLSv1.2 also.
-
1This works for me with stunnel 4.53 (Debian) and a modern OpenSSL (1.0.1e+security patches that Debian provides). I can connect to it using TLSv1.2. Yay! Sep 2, 2015 at 0:52
Since I cannot comment, I will "answer" (sorry).
Anyway, I am running stunnel 5.01 and I also get the "incorrect version of SSL" error after making the change to sslVersion:
[!] Server is down
[.] Reading configuration from file stunnel.conf
[!] Line 4: "sslVersion = TLSv1 TLSv1.1 TLSv1.2": Incorrect version of SSL protocol
Fixed (for me). Had to upgrade stunnel to v5.06 (most current release as of today). Conf file is exactly the same so I guess there is some mojo happening between v5.01 and v5.06 that goes beyond a mere mortal to understand.
