15

How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?

19

You can disable SSLv3 protocol on stunnel altogether.

From stunnel documentation:

sslVersion = SSL_VERSION

select version of SSL protocol Allowed

options: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2

I've added this to the config file:

sslVersion = TLSv1 TLSv1.1 TLSv1.2

And now I am not able to connect with SSLv3 (using openssl s_client -connect my.domain.com:443 -ssl3)

NOTE: Some older versions of stunnel and OpenSSL don't support TLSv1.2 (and even TLSv1.1). In this case, remove them from sslVersion directive to avoid incorrect version of ssl protocol error.

  • I get the following error when I use the sslVersion = from above: Starting stunnel: file /etc/stunnel/stunnel.conf line 6: Incorrect version of SSL protocol. This is with 4.29. Can anyone else confirm that they do not get this error? – Ross Oct 17 '14 at 21:43
  • Some older versions of stunnel do not support TLSv1.2 or TLSv1.1. Try removing those, leaving just TLSv1. Confirmed this working on an older installation. – Sergey Oct 20 '14 at 0:50
10

if you prefer to stick with older stunnel (like the 4.53 in your Debian Stable), you can disable SSLv2 and SSLv3 with:

sslVersion = all
options = NO_SSLv2
options = NO_SSLv3

instead of

sslVersion = TLSv1

which would disable TLSv1.1 and TLSv1.2 also.

  • 1
    This works for me with stunnel 4.53 (Debian) and a modern OpenSSL (1.0.1e+security patches that Debian provides). I can connect to it using TLSv1.2. Yay! – Christopher Schultz Sep 2 '15 at 0:52
2

Since I cannot comment, I will "answer" (sorry).

Anyway, I am running stunnel 5.01 and I also get the "incorrect version of SSL" error after making the change to sslVersion:

[!] Server is down
[.] Reading configuration from file stunnel.conf
[!] Line 4: "sslVersion = TLSv1 TLSv1.1 TLSv1.2": Incorrect version of SSL protocol

Fixed (for me). Had to upgrade stunnel to v5.06 (most current release as of today). Conf file is exactly the same so I guess there is some mojo happening between v5.01 and v5.06 that goes beyond a mere mortal to understand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.