client = yes in the
[myservice] section. This tells stunnel that the
connect (aka "server") side is the SSL one and the
accept (aka "client") side is plain. The default is the opposite, which requires an SSL certificate.
But that's not all! For some insane reason, stunnel defaults to completely insecure mode that does no verification of the server's certificates, which means that you would be subject to man-in-the-middle (MitM) attacks! To fix this, use the
verify = 2 and
CAfile options. On Ubuntu, the
CAfile can be found at
/etc/ssl/certs/ca-certificates.crt (from the
ca-certificates package). While you're at it, also set
options = NO_SSLv2 to disable the insecure SSLv2 protocol.
Finally, when you configure your usenet program, disable SSL, since the connection between the application and stunnel does NOT use SSL.
I wrote the following wrapper script to help with this. Replace
<REMOTE_PORT> as appropriate, and replace
# ... with whatever command you want to run.
# Start stunnel in the background.
cat << EOF | stunnel4 -fd 0
pid = $PIDFILE
# Enable proper SSL security. Without this, you are completely insecure!
verify = 2
CAfile = /etc/ssl/certs/ca-certificates.crt
options = NO_SSLv2
client = yes
accept = <LOCAL_PORT>
connect = <REMOTE_HOST>:<REMOTE_PORT>
# Start whatever program you want.
# Kill stunnel.
kill $(cat "$PIDFILE")