How can I mitigate POODLE SSL vulnerability when using stunnel as HTTPS reverse proxy?
You can disable SSLv3 protocol on stunnel altogether.
From stunnel documentation:
sslVersion = SSL_VERSION
select version of SSL protocol Allowed
options: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
I've added this to the config file:
sslVersion = TLSv1 TLSv1.1 TLSv1.2
And now I am not able to connect with SSLv3 (using
openssl s_client -connect my.domain.com:443 -ssl3)
NOTE: Some older versions of stunnel and OpenSSL don't support TLSv1.2 (and even TLSv1.1). In this case, remove them from
sslVersion directive to avoid
incorrect version of ssl protocol error.
Since I cannot comment, I will "answer" (sorry).
Anyway, I am running stunnel 5.01 and I also get the "incorrect version of SSL" error after making the change to sslVersion:
[!] Server is down [.] Reading configuration from file stunnel.conf [!] Line 4: "sslVersion = TLSv1 TLSv1.1 TLSv1.2": Incorrect version of SSL protocol
Fixed (for me). Had to upgrade stunnel to v5.06 (most current release as of today). Conf file is exactly the same so I guess there is some mojo happening between v5.01 and v5.06 that goes beyond a mere mortal to understand.