I have a little service which listen only on https://localhost:41952 and checks source hostname (it must be localhost). I want to connect on "listen:1988" and redirect requests with stunnel to "localhost:41952" -> redirect https://localhost:41952

current config:

cert = stunnel.pem
accept =
connect = localhost:41952

openssl_client log:


Please note that this certificate is different, than it is on localhost:41952.

curl test:

$ curl -vk
*   Trying
* Connected to ( port 1988 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: localhost
> GET /DYMO/DLS/Printing/Check HTTP/1.1
> Host:
> User-Agent: curl/7.43.0
> Accept: */*

waiting forever.

Maybe I need client = yes? But I don't have any certificate, unless which I exported from Firefox on the site of the service https://localhost:41952

My original question:

Free reverse proxy with SSL for Windows


stunnel is a program to create a gateway between non-SSL and SSL. From the description on the home page:

Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code

This tool is not designed to create a gateway from SSL to SSL. What you need in your case is just a simple TCP forwarder which can be done with socat:

socat TCP4-LISTEN:1988,fork TCP4:

With this forwarder the connection to gets forwarded to The client will get the original certificate from the server because the forwarding is done at the TCP level. The server will see the connection coming from

EDIT: after lots of communication it is now clear that the aim is not to have the right source hostname es claimed and in the question and not the right Referer as claimed in a response but that the Host HTTP request header has the expected value 'localhost'. Since the host header is set from the URL you would need to make sure that the request gets forwarded to the remote system and the browser is not trying to resolve the URL by itself, because otherwise it would try to connect to server on the machine where the browser is running. To defer the resolving of the URL to the target system you need to run a proxy there, i.e. either something like Charles Proxy which you've tried or some SOCKS proxy.

  • Originally I am looked for a reverse SSL proxy, the stunnel was recommended here: serverfault.com/questions/727751/… - Is there any Windows equivalent to socat?
    – user66638
    Oct 9 '15 at 11:55
  • @user66638: linuxtechres.blogspot.de/2010/10/…. And the question you refer to is about forwarding SSL->TCP, not SSL->SSL or TCP->TCP. Oct 9 '15 at 12:15
  • Thank you. I tried out, but it is change the referrer's hostname. It must be localhost, this is why I am looking for a reverse proxy.
    – user66638
    Oct 9 '15 at 12:48
  • @user66638: Now I see what you problem is and it has nothing to do with what you described. A proxy will not help here because it does not change the Referer-Header of the HTTP request. To manipulate the header with curl just use curl -e http://localhost/. Oct 9 '15 at 13:08
  • Hmmm. The only thing what is worked is the Charles Proxy -> dropbox.com/s/fbcza7sos1dxj7w/… and dropbox.com/s/7bttou72qwhkqt7/… - With this two setting I am abble to connect from any remote device. I do not want to believe that this can be achieved only by this program.
    – user66638
    Oct 9 '15 at 14:31

So to connect to and reach SSL service that listens on port 4952 of loopback interface on host with IP

We need to 2 stunnel stanzas to achive what we want.

cert = stunnel.pem
client = no
accept =
connect = localhost:1987

cert = stunnel.pem
client = yes
accept = localhost:1987
connect = localhost:4952

The only thing what I cannot achieve is to modify header host to localhost for all request in stunnel.

From curl it's working perfectly:

$ curl -k -H "Host: localhost"
  • thanks for your answer, it worked very well in my case! you saved my day! Jan 8 '19 at 14:14

I've solved a similar HTTPS-TO-HTTPS problem on Windows with this command:

netsh interface portproxy add v4tov4 listenport=443 listenaddress= connectport=[remote-https-port] connectaddress=[remote-ip]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.