[stunnel-users] Stunnel Connectivity Issue

[Dheeraj Gautam]

Hi Team,



We are using 5.41 release of Stunnel software to establish TCP connection
with remote server using by TLSV1.2 protocol.



Enclosed configuration file wherein we are trying to establish TCP
connection with one my server along with provided certificate and key which
are pointed in config file.



Could you please let us know what parameters we are missing here due to
which connection is not establishing with remote server.



Although, stunnel logs indicating that configuration successful, but in logs
no where is mentioned about the connection is it connected or not, below is
the artifact for your easy ref.







Could you please help us here to resolve this issue.



Regards,



Dheeraj Gautam
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Małgorzata Olszówka]

Post by Dheeraj Gautam
Could you please let us know what parameters we are missing here due to
which connection is not establishing with remote server.
Although, stunnel logs indicating that configuration successful, but in
logs no where is mentioned about the connection is it connected or not,

Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate
stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata

[Dheeraj Gautam]

HI Guys,

below is the config which i have configured with TLSv1.2, but still
connection establishing only for while when i telnet telnet 127.0.0.1 9233.
and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228
accept = 127.0.0.1:9233
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two
endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without
subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict
trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from
127.0.0.1:62736
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from
172.16.1.23:62737
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW
YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com,
emailAddress=***@bloomberg.com
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0
byte(s) sent to socket

i want connection remained connected every time so that i can run the
application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <

Post by Dheeraj Gautam
Could you please let us know what parameters we are missing here due to

Post by Dheeraj Gautam
which connection is not establishing with remote server.
Although, stunnel logs indicating that configuration successful, but in
logs no where is mentioned about the connection is it connected or not,

Hello Dheeraj,
You should set the verifyChain option in order to verify the certificate
verifyChain = yes
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.
Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Liz Turi]

Hi, Dheeraj,

Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.

However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.

2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)
2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)
2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert
2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)
2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org>
Cc: stunnel-***@stunnel.org
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

HI Guys,

below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228<http://69.191.198.34:8228>
accept = 127.0.0.1:9233<http://127.0.0.1:9233>
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736<http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737<http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com<http://fixbeta.bloomberg.com>, emailAddress=***@bloomberg.com<mailto:***@bloomberg.com>
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

i want connection remained connected every time so that i can run the application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>> wrote:
Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

[Dheeraj Gautam]

Hi Liz,



Thanks for your reply.



Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.



But at the moment I don’t have idea like how the stunnel will remain connected.



Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.



Waiting for your valuable response.



Regards,



Dheeraj Gautam



From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com>; Małgorzata Olszówka <***@stunnel.org>
Cc: stunnel-***@stunnel.org
Subject: RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.



However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.



2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)

2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)

2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert

2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)

2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket



Liz Turi

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

<http://www.maehc.org> www.maehc.org

<https://www.facebook.com/massachusettsehealthcollab?fref=nf> <https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth> <https://twitter.com/MAeHC_org>



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org <mailto:***@stunnel.org> >
Cc: stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue



HI Guys,



below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.



[TCP]

client=yes

cert = BBG_cert.pem

key = BBG_key.pem

verifyChain = yes

CAfile = BBG_CACerts.pem

connect = 69.191.198.34:8228 <http://69.191.198.34:8228>

accept = 127.0.0.1:9233 <http://127.0.0.1:9233>

sslVersion = TLSv1.2



below the logs:



2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled

2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints

2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file

2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled

2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks

2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates

2017.06.13 16:37:16 LOG5[main]: Configuration successful

2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736 <http://127.0.0.1:62736>

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228 <http://69.191.198.34:8228>

2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737 <http://172.16.1.23:62737>

2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com <http://fixbeta.bloomberg.com> , emailAddress=***@bloomberg.com <mailto:***@bloomberg.com>

2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket



i want connection remained connected every time so that i can run the application.



application can be work only if the connection remain connected.



please help me to sort this out.



Regards,



Dheeraj Gautam



On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org <mailto:***@stunnel.org> > wrote:

Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,



Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com <http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Dheeraj Gautam]

Yes, I am testing the connection with telnet.



There is no another way to test the connection.



Regards,



Dheeraj Gautam



From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Tuesday, June 13, 2017 9:32 PM
To: 'Liz Turi' <***@maehc.org>; 'Małgorzata Olszówka' <***@stunnel.org>
Cc: stunnel-***@stunnel.org
Subject: RE: [stunnel-users] Stunnel Connectivity Issue



Hi Liz,



Thanks for your reply.



Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.



But at the moment I don’t have idea like how the stunnel will remain connected.



Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.



Waiting for your valuable response.



Regards,



Dheeraj Gautam



From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com <mailto:***@arborfs.com> >; Małgorzata Olszówka <***@stunnel.org <mailto:***@stunnel.org> >
Cc: stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.



However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.



2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)

2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)

2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert

2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)

2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket



Liz Turi

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

<http://www.maehc.org> www.maehc.org

<https://www.facebook.com/massachusettsehealthcollab?fref=nf> <https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth> <https://twitter.com/MAeHC_org>



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org <mailto:***@stunnel.org> >
Cc: stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue



HI Guys,



below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.



[TCP]

client=yes

cert = BBG_cert.pem

key = BBG_key.pem

verifyChain = yes

CAfile = BBG_CACerts.pem

connect = 69.191.198.34:8228 <http://69.191.198.34:8228>

accept = 127.0.0.1:9233 <http://127.0.0.1:9233>

sslVersion = TLSv1.2



below the logs:



2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled

2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints

2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file

2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled

2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks

2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates

2017.06.13 16:37:16 LOG5[main]: Configuration successful

2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736 <http://127.0.0.1:62736>

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228 <http://69.191.198.34:8228>

2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737 <http://172.16.1.23:62737>

2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com <http://fixbeta.bloomberg.com> , emailAddress=***@bloomberg.com <mailto:***@bloomberg.com>

2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket



i want connection remained connected every time so that i can run the application.



application can be work only if the connection remain connected.



please help me to sort this out.



Regards,



Dheeraj Gautam



On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org <mailto:***@stunnel.org> > wrote:

Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,



Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com <http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Liz Turi]

I’m not sure I understand your use case.

The connection is negotiated at the time of connection (you can see in your logs where stunnel receives a connection, and forwards it to its destination, where the TLS connection is negotiated at that point – it effective renegotiates at each connection attempt.

So – for example – if you’re looking to send a SOAP request and receive a response, the connection stays open until it receives the SOAP response (or times out, whichever comes first).

When you’re testing with a telnet command, that transaction time is very short (read subseconds usually). My SOAP request takes a couple of seconds.

That being said, I did find a reference in the archives that might help point you in the right direction for your use case: https://www.stunnel.org/pipermail/stunnel-users/2013-July/004277.html

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Tuesday, June 13, 2017 12:02 PM
To: Liz Turi <***@maehc.org>; 'Małgorzata Olszówka' <***@stunnel.org>
Cc: stunnel-***@stunnel.org
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

Thanks for your reply.

Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.

But at the moment I don’t have idea like how the stunnel will remain connected.

Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.

Waiting for your valuable response.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.

However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.

2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)
2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)
2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert
2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)
2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

HI Guys,

below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228<http://69.191.198.34:8228>
accept = 127.0.0.1:9233<http://127.0.0.1:9233>
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736<http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737<http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com<http://fixbeta.bloomberg.com>, emailAddress=***@bloomberg.com<mailto:***@bloomberg.com>
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

i want connection remained connected every time so that i can run the application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>> wrote:
Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

[Carter Browne]

Dheeraj,

stunnel will keep the connection open for as long as your applications
keeps it open. When you exit telnet, it closes the connection. I use
stunnel mostly for RDP, VNC and telnet and as long the application is
active, the port is open. You need to have your application open the
local port you want to route via stunnel (in your example
127.0.0.1:9233). As long as your application keeps the connection open
(ignoring such issues as communications failures), stunnel will maintain
the application. Telnet is a great tool for determining connectivity,
but your application is going to have to handle the connection going
forward.

Carter Browne

Post by Dheeraj Gautam
Hi Liz,
Thanks for your reply.
Actually we need to run a service which will work only once stunnel
connection establish and the service will work till the time
connection connected.
But at the moment I don’t have idea like how the stunnel will remain connected.
Could you please suggest me to fix this so that stunnel connection
remain connected and I can run the application.
Waiting for your valuable response.
Regards,
Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 9:19 PM
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue
Hi, Dheeraj,
Are you testing the connection with Telnet? Or are you testing with
the application. What I noticed in testing the connection is that once
the command is completed, the connection is closed.
However, when I test from my application, its only closed once all
transactions in that session are completed, and will show how much
data was passed on (following from my logs at the end of a non-telnet
test session.
*2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite
AES256-GCM-SHA384 (256-bit encryption)*
*2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)*
*2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent
close_notify alert*
*2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)*
*2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to
TLS, 1641 byte(s) sent to socket*
*Liz Turi*
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
fb_icon<https://www.facebook.com/massachusettsehealthcollab?fref=nf>li_icon<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>tw_icon<https://twitter.com/MAeHC_org>
Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 11:41 AM
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue
HI Guys,
below is the config which i have configured with TLSv1.2, but still
connection establishing only for while when i telnet telnet 127.0.0.1
9233. and just after connection closed.
[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228 <http://69.191.198.34:8228>
accept = 127.0.0.1:9233 <http://127.0.0.1:9233>
sslVersion = TLSv1.2
2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to
restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from
127.0.0.1:62736 <http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228
<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server
from 172.16.1.23:62737 <http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US,
ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA,
CN=fixbeta.bloomberg.com <http://fixbeta.bloomberg.com>,
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to
TLS, 0 byte(s) sent to socket
i want connection remained connected every time so that i can run the application.
application can be work only if the connection remain connected.
please help me to sort this out.
Regards,
Dheeraj Gautam
On 25 May 2017 at 12:29, Małgorzata Olszówka
Could you please let us know what parameters we are missing
here due to which connection is not establishing with remote
server.
Although, stunnel logs indicating that configuration
successful, but in logs no where is mentioned about the
connection is it connected or not,
Hello Dheeraj,
You should set the verifyChain option in order to verify the
verifyChain = yes
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.
Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
www.arborfs.com <http://www.arborfs.com>
This e-mail and any attachment are confidential and contain
proprietary information, some or all of which may be legally privileged.
It is intended solely for the use of the individual or entity to which
it is addressed. If you are not the intended recipient, please notify
the author immediately by telephone or by replying to this e-mail, and
then delete all copies of the e-mail on your system. If you are not
the intended recipient, you must not use, disclose, distribute, copy,
print or rely on this e-mail.
Whilst we have taken reasonable precautions to ensure that this e-mail
and any attachment has been checked for viruses, we cannot guarantee
that they are virus free and we cannot accept liability for any damage
sustained as a result of software viruses. We would advise that you
carry out your own virus checks, especially before opening an attachment.
CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally
privileged and confidential information intended only for the use of
the addressee named above. If the reader of this message is not the
intended recipient you are hereby notified that any dissemination,
distribution or copying of this email transmission is strictly
prohibited. If you have received this email transmission in error,
please notify us immediately. Thank you.
www.arborfs.com <http://www.arborfs.com>
This e-mail and any attachment are confidential and contain
proprietary information, some or all of which may be legally privileged.
It is intended solely for the use of the individual or entity to which
it is addressed. If you are not the intended recipient, please notify
the author immediately by telephone or by replying to this e-mail, and
then delete all copies of the e-mail on your system. If you are not
the intended recipient, you must not use, disclose, distribute, copy,
print or rely on this e-mail.
Whilst we have taken reasonable precautions to ensure that this e-mail
and any attachment has been checked for viruses, we cannot guarantee
that they are virus free and we cannot accept liability for any damage
sustained as a result of software viruses. We would advise that you
carry out your own virus checks, especially before opening an attachment.
_______________________________________________
stunnel-users mailing list
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

[Dheeraj Gautam]

Hi Browne,



I am not understand like what config I have to do in stunnel config file.



As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port.



Nothing is happening when running the application, don’t know what I am missing as I am the new for stunnel.



Please help to fix this out.



Regards,



Dheeraj Gautam







From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Carter Browne
Sent: Tuesday, June 13, 2017 10:41 PM
To: stunnel-***@stunnel.org
Subject: Re: [stunnel-users] Stunnel Connectivity Issue



Dheeraj,

stunnel will keep the connection open for as long as your applications keeps it open. When you exit telnet, it closes the connection. I use stunnel mostly for RDP, VNC and telnet and as long the application is active, the port is open. You need to have your application open the local port you want to route via stunnel (in your example 127.0.0.1:9233). As long as your application keeps the connection open (ignoring such issues as communications failures), stunnel will maintain the application. Telnet is a great tool for determining connectivity, but your application is going to have to handle the connection going forward.

Carter Browne



On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:

Hi Liz,



Thanks for your reply.



Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.



But at the moment I don’t have idea like how the stunnel will remain connected.



Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.



Waiting for your valuable response.



Regards,



Dheeraj Gautam



From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <mailto:***@arborfs.com> <***@arborfs.com>; Małgorzata Olszówka <mailto:***@stunnel.org> <***@stunnel.org>
Cc: stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.



However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.



2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)

2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)

2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert

2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)

2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket



Liz Turi

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

<http://www.maehc.org> www.maehc.org

<https://www.facebook.com/massachusettsehealthcollab?fref=nf> <https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth> <https://twitter.com/MAeHC_org>



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org <mailto:***@stunnel.org> >
Cc: stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue



HI Guys,



below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.



[TCP]

client=yes

cert = BBG_cert.pem

key = BBG_key.pem

verifyChain = yes

CAfile = BBG_CACerts.pem

connect = 69.191.198.34:8228 <http://69.191.198.34:8228>

accept = 127.0.0.1:9233 <http://127.0.0.1:9233>

sslVersion = TLSv1.2



below the logs:



2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled

2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints

2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file

2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled

2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks

2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates

2017.06.13 16:37:16 LOG5[main]: Configuration successful

2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736 <http://127.0.0.1:62736>

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228 <http://69.191.198.34:8228>

2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737 <http://172.16.1.23:62737>

2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com <http://fixbeta.bloomberg.com> , emailAddress=***@bloomberg.com <mailto:***@bloomberg.com>

2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket



i want connection remained connected every time so that i can run the application.



application can be work only if the connection remain connected.



please help me to sort this out.



Regards,



Dheeraj Gautam



On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org <mailto:***@stunnel.org> > wrote:

Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,



Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com <http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.



www.arborfs.com <http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.






_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org <mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Ludolf Holzheid]

Post by Dheeraj Gautam
Hi Browne,
I am not understand like what config I have to do in stunnel config file.
As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port.

Dheeraj,

I'm afraid you confused the directions:

In you configuration file, you told Stunnel to accept connections on
localhost, port 9233 ("accept = 127.0.0.1:9233"). Then, you told
Stunnel, if such a connection is accepted, to connect to a remote
server at port 8228 ("connect = 69.191.198.34:8228").

As long as both connections are established, Stunnel will forward data
from localhost to 69.191.198.34 and vice versa, while encrypting the
data in the localhost -> 69.191.198.34 direction and decrypting the
data in the opposite direction (69.191.198.34 -> localhost).

With this setup, a client program (such as Thunderbird) sends and
receives plain-text data to/from a Stunnel instance on the same
machine, while a server program on a remote machine (such as the
Google mail server) sends and receives encrypted data to/from Stunnel.

Is this about the setup you have in mind?

Is your application server or client?
Does it send and receive plain-text data or encrypted data?


Ludolf
--
Ludolf Holzheid
 
Bihl+Wiedemann GmbH
Floßwörthstraße 41
68199 Mannheim, Germany
 
Tel: [phone]
Fax: [phone]
 
mailto:***@bihl-wiedemann.de
http://www.bihl-wiedemann.de
 
Sitz der Gesellschaft: Mannheim
Geschäftsführer: Jochen Bihl, Bernhard Wiedemann
Amtsgericht Mannheim, HRB 5796

[Carter Browne]

Dheeraj,

Without some more information, it is difficult to answer your question.

With stunnel in client mode, an application sends un-encrypted data to a
port and stunnel encrypts the data and sends it out a second port, e.g.:

[application]
accept = 127.0.0.1:12345
connect = remote:23456
client =yes

If your application is configured to run using port 8228, then you could
have

[application]
accept = 127.0.0.1:8228
connect = 69.191.198.34:8228
client = yes
... (your other parameters go here)

The information you need for the stunnel.conf file are:
1) The host address and port that you are writing to in your program
(can be a local address or any other valid ip address)
2) The remote address and port that you are connecting to (must be
different from (1).

The connection is only active for as long as your program is running (be
it telnet or any other application).

I hope that helps.

Carter Browne

Post by Dheeraj Gautam
Hi Browne,
I am not understand like what config I have to do in stunnel config file.
As per application it will trigger 8228 port of remote server, but at
the momen stunnel is working only when I am trying to telnet localhost
on 9233 port.
Nothing is happening when running the application, don’t know what I
am missing as I am the new for stunnel.
Please help to fix this out.
Regards,
Dheeraj Gautam
Behalf Of *Carter Browne
*Sent:* Tuesday, June 13, 2017 10:41 PM
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue
Dheeraj,
stunnel will keep the connection open for as long as your applications
keeps it open. When you exit telnet, it closes the connection. I use
stunnel mostly for RDP, VNC and telnet and as long the application is
active, the port is open. You need to have your application open the
local port you want to route via stunnel (in your example
127.0.0.1:9233). As long as your application keeps the connection
open (ignoring such issues as communications failures), stunnel will
maintain the application. Telnet is a great tool for determining
connectivity, but your application is going to have to handle the
connection going forward.
Carter Browne
Hi Liz,
Thanks for your reply.
Actually we need to run a service which will work only once
stunnel connection establish and the service will work till the
time connection connected.
But at the moment I don’t have idea like how the stunnel will
remain connected.
Could you please suggest me to fix this so that stunnel connection
remain connected and I can run the application.
Waiting for your valuable response.
Regards,
Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 9:19 PM
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue
Hi, Dheeraj,
Are you testing the connection with Telnet? Or are you testing
with the application. What I noticed in testing the connection is
that once the command is completed, the connection is closed.
However, when I test from my application, its only closed once all
transactions in that session are completed, and will show how much
data was passed on (following from my logs at the end of a
non-telnet test session.
*2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite
AES256-GCM-SHA384 (256-bit encryption)*
*2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)*
*2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent
close_notify alert*
*2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)*
*2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent
to TLS, 1641 byte(s) sent to socket*
*Liz Turi*
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
fb_icon<https://www.facebook.com/massachusettsehealthcollab?fref=nf>li_icon<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>tw_icon<https://twitter.com/MAeHC_org>
*On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 11:41 AM
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue
HI Guys,
below is the config which i have configured with TLSv1.2, but
still connection establishing only for while when i telnet telnet
127.0.0.1 9233. and just after connection closed.
[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228 <http://69.191.198.34:8228>
accept = 127.0.0.1:9233 <http://127.0.0.1:9233>
sslVersion = TLSv1.2
2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must
define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain"
without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to
restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection
from 127.0.0.1:62736 <http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected
69.191.198.34:8228 <http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote
server from 172.16.1.23:62737 <http://172.16.1.23:62737>
C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA,
CN=fixbeta.bloomberg.com <http://fixbeta.bloomberg.com>,
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to
TLS, 0 byte(s) sent to socket
i want connection remained connected every time so that i can run the application.
application can be work only if the connection remain connected.
please help me to sort this out.
Regards,
Dheeraj Gautam
On 25 May 2017 at 12:29, Małgorzata Olszówka
Could you please let us know what parameters we are
missing here due to which connection is not establishing
with remote server.
Although, stunnel logs indicating that configuration
successful, but in logs no where is mentioned about the
connection is it connected or not,
Hello Dheeraj,
You should set the verifyChain option in order to verify the
verifyChain = yes
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.
Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
www.arborfs.com <http://www.arborfs.com>
This e-mail and any attachment are confidential and contain
proprietary information, some or all of which may be legally privileged.
It is intended solely for the use of the individual or entity to
which it is addressed. If you are not the intended recipient,
please notify the author immediately by telephone or by replying
to this e-mail, and then delete all copies of the e-mail on your
system. If you are not the intended recipient, you must not use,
disclose, distribute, copy, print or rely on this e-mail.
Whilst we have taken reasonable precautions to ensure that this
e-mail and any attachment has been checked for viruses, we cannot
guarantee that they are virus free and we cannot accept liability
for any damage sustained as a result of software viruses. We
would advise that you carry out your own virus checks, especially
before opening an attachment.
CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally
privileged and confidential information intended only for the use
of the addressee named above. If the reader of this message is not
the intended recipient you are hereby notified that any
dissemination, distribution or copying of this email transmission
is strictly prohibited. If you have received this email
transmission in error, please notify us immediately. Thank you.
www.arborfs.com <http://www.arborfs.com>
This e-mail and any attachment are confidential and contain
proprietary information, some or all of which may be legally privileged.
It is intended solely for the use of the individual or entity to
which it is addressed. If you are not the intended recipient,
please notify the author immediately by telephone or by replying
to this e-mail, and then delete all copies of the e-mail on your
system. If you are not the intended recipient, you must not use,
disclose, distribute, copy, print or rely on this e-mail.
Whilst we have taken reasonable precautions to ensure that this
e-mail and any attachment has been checked for viruses, we cannot
guarantee that they are virus free and we cannot accept liability
for any damage sustained as a result of software viruses. We
would advise that you carry out your own virus checks, especially
before opening an attachment.
_______________________________________________
stunnel-users mailing list
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
www.arborfs.com <http://www.arborfs.com>
This e-mail and any attachment are confidential and contain
proprietary information, some or all of which may be legally privileged.
It is intended solely for the use of the individual or entity to which
it is addressed. If you are not the intended recipient, please notify
the author immediately by telephone or by replying to this e-mail, and
then delete all copies of the e-mail on your system. If you are not
the intended recipient, you must not use, disclose, distribute, copy,
print or rely on this e-mail.
Whilst we have taken reasonable precautions to ensure that this e-mail
and any attachment has been checked for viruses, we cannot guarantee
that they are virus free and we cannot accept liability for any damage
sustained as a result of software viruses. We would advise that you
carry out your own virus checks, especially before opening an attachment.

[Liz Turi]

Hi, Dheeraj,

Your logs say that you’re connecting successfully to the port that your application is listening on. Have you tried testing from the application, or calls to the application?

This line (along with the next couple of lines) suggest that telnet is connecting through to the remote host listening on 8228.

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>

It closes the connection via telnet because telnet isn’t going to run your application for you.

We need more information about how you’re connecting to your application? (or intending to)


Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 1:21 PM
To: ***@cbcs-usa.com; stunnel-***@stunnel.org
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

Hi Browne,

I am not understand like what config I have to do in stunnel config file.

As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port.

Nothing is happening when running the application, don’t know what I am missing as I am the new for stunnel.

Please help to fix this out.

Regards,

Dheeraj Gautam



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Carter Browne
Sent: Tuesday, June 13, 2017 10:41 PM
To: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue


Dheeraj,

stunnel will keep the connection open for as long as your applications keeps it open. When you exit telnet, it closes the connection. I use stunnel mostly for RDP, VNC and telnet and as long the application is active, the port is open. You need to have your application open the local port you want to route via stunnel (in your example 127.0.0.1:9233). As long as your application keeps the connection open (ignoring such issues as communications failures), stunnel will maintain the application. Telnet is a great tool for determining connectivity, but your application is going to have to handle the connection going forward.

Carter Browne

On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:
Hi Liz,

Thanks for your reply.

Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.

But at the moment I don’t have idea like how the stunnel will remain connected.

Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.

Waiting for your valuable response.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com><mailto:***@arborfs.com>; Małgorzata Olszówka <***@stunnel.org><mailto:***@stunnel.org>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.

However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.

2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)
2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)
2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert
2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)
2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

HI Guys,

below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228<http://69.191.198.34:8228>
accept = 127.0.0.1:9233<http://127.0.0.1:9233>
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736<http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737<http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com<http://fixbeta.bloomberg.com>, emailAddress=***@bloomberg.com<mailto:***@bloomberg.com>
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

i want connection remained connected every time so that i can run the application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>> wrote:
Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.



_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

[Dheeraj Gautam]

Hi Liz,



We have stuck badly to establish stunnel connection with one of our
partner, We have configured Client mode configuration on our server to
connect server to run the application.



Below is the config which We have done on my server:



; ***************************************** Example TLS Client mode services

; Certificate

cert = Talomoncert.pem

key = Talomonkey.pem

CAfile = TalomonCACerts.pem

;FIPS

fips=no

; Protocol version (all, SSLv2, SSLv3, TLSv1)

sslVersion = TLSv1.2



; Some performance tunings

socket = l:TCP_NODELAY=1

socket = r:TCP_NODELAY=1



; Some debugging stuff useful for troubleshooting

debug = 7

output = stunnel.log



; Use it for client mode

client = yes

; Service-level configuration

[FIX]

accept = 127.0.0.1:9260

connect = 69.191.230.34:8228

;protocol=connect

;protocolHost= 69.191.230.34:8228

TIMEOUTconnect = 5



Our partner saying that they are not getting any TLS connection on their
server due to which connection is not establishing.



Could you please help us to get this sort out as we have no more idea how
we can troubleshoot this.



Thanks in advance.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Tuesday, June 13, 2017 11:40 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Your logs say that you’re connecting successfully to the port that your
application is listening on. Have you tried testing from the application,
or calls to the application?



This line (along with the next couple of lines) suggest that telnet is
connecting through to the remote host listening on 8228.



2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228



It closes the connection via telnet because telnet isn’t going to run your
application for you.



We need more information about how you’re connecting to your application?
(or intending to)





*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 1:21 PM
*To:* ***@cbcs-usa.com; stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Hi Browne,



I am not understand like what config I have to do in stunnel config file.



As per application it will trigger 8228 port of remote server, but at the
momen stunnel is working only when I am trying to telnet localhost on 9233
port.



Nothing is happening when running the application, don’t know what I am
missing as I am the new for stunnel.



Please help to fix this out.



Regards,



Dheeraj Gautam







*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Carter Browne
*Sent:* Tuesday, June 13, 2017 10:41 PM
*To:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Dheeraj,

stunnel will keep the connection open for as long as your applications
keeps it open. When you exit telnet, it closes the connection. I use
stunnel mostly for RDP, VNC and telnet and as long the application is
active, the port is open. You need to have your application open the local
port you want to route via stunnel (in your example 127.0.0.1:9233). As
long as your application keeps the connection open (ignoring such issues as
communications failures), stunnel will maintain the application. Telnet is
a great tool for determining connectivity, but your application is going to
have to handle the connection going forward.

Carter Browne



On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:

Hi Liz,



Thanks for your reply.



Actually we need to run a service which will work only once stunnel
connection establish and the service will work till the time connection
connected.



But at the moment I don’t have idea like how the stunnel will remain
connected.



Could you please suggest me to fix this so that stunnel connection remain
connected and I can run the application.



Waiting for your valuable response.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org <***@maehc.org>]
*Sent:* Tuesday, June 13, 2017 9:19 PM
*To:* Dheeraj Gautam <***@arborfs.com>
<***@arborfs.com>; Małgorzata Olszówka
<***@stunnel.org> <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Are you testing the connection with Telnet? Or are you testing with the
application. What I noticed in testing the connection is that once the
command is completed, the connection is closed.



However, when I test from my application, its only closed once all
transactions in that session are completed, and will show how much data was
passed on (following from my logs at the end of a non-telnet test session.



*2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite
AES256-GCM-SHA384 (256-bit encryption)*

*2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)*

*2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify
alert*

*2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)*

*2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS,
1641 byte(s) sent to socket*



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 11:41 AM
*To:* Małgorzata Olszówka <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



HI Guys,



below is the config which i have configured with TLSv1.2, but still
connection establishing only for while when i telnet telnet 127.0.0.1 9233.
and just after connection closed.



[TCP]

client=yes

cert = BBG_cert.pem

key = BBG_key.pem

verifyChain = yes

CAfile = BBG_CACerts.pem

connect = 69.191.198.34:8228

accept = 127.0.0.1:9233

sslVersion = TLSv1.2



below the logs:



2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled

2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two
endpoints

2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file

2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled

2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without
subject checks

2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict
trusted certificates

2017.06.13 16:37:16 LOG5[main]: Configuration successful

2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from
127.0.0.1:62736

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228

2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from
172.16.1.23:62737

2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW
YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com,
emailAddress=***@bloomberg.com

2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0
byte(s) sent to socket



i want connection remained connected every time so that i can run the
application.



application can be work only if the connection remain connected.



please help me to sort this out.



Regards,



Dheeraj Gautam



On 25 May 2017 at 12:29, Małgorzata Olszówka <
***@stunnel.org> wrote:

Could you please let us know what parameters we are missing here due to
which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in
logs no where is mentioned about the connection is it connected or not,



Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate
stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.



_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Liz Turi]

What do your debug logs say? What happens when you send a test message through? Are you sure you have the remote IP address/port correct? Is there IP filtering or a firewall in place between the two?

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 5:27 AM
To: Liz Turi <***@maehc.org>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

We have stuck badly to establish stunnel connection with one of our partner, We have configured Client mode configuration on our server to connect server to run the application.

Below is the config which We have done on my server:

; ***************************************** Example TLS Client mode services
; Certificate
cert = Talomoncert.pem
key = Talomonkey.pem
CAfile = TalomonCACerts.pem
;FIPS
fips=no
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = TLSv1.2

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log

; Use it for client mode
client = yes
; Service-level configuration
[FIX]
accept = 127.0.0.1:9260<http://127.0.0.1:9260>
connect = 69.191.230.34:8228<http://69.191.230.34:8228>
;protocol=connect
;protocolHost= 69.191.230.34:8228<http://69.191.230.34:8228>
TIMEOUTconnect = 5

Our partner saying that they are not getting any TLS connection on their server due to which connection is not establishing.

Could you please help us to get this sort out as we have no more idea how we can troubleshoot this.

Thanks in advance.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Tuesday, June 13, 2017 11:40 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Your logs say that you’re connecting successfully to the port that your application is listening on. Have you tried testing from the application, or calls to the application?

This line (along with the next couple of lines) suggest that telnet is connecting through to the remote host listening on 8228.

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>

It closes the connection via telnet because telnet isn’t going to run your application for you.

We need more information about how you’re connecting to your application? (or intending to)


Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 1:21 PM
To: ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

Hi Browne,

I am not understand like what config I have to do in stunnel config file.

As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port.

Nothing is happening when running the application, don’t know what I am missing as I am the new for stunnel.

Please help to fix this out.

Regards,

Dheeraj Gautam



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Carter Browne
Sent: Tuesday, June 13, 2017 10:41 PM
To: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue


Dheeraj,

stunnel will keep the connection open for as long as your applications keeps it open. When you exit telnet, it closes the connection. I use stunnel mostly for RDP, VNC and telnet and as long the application is active, the port is open. You need to have your application open the local port you want to route via stunnel (in your example 127.0.0.1:9233<http://127.0.0.1:9233>). As long as your application keeps the connection open (ignoring such issues as communications failures), stunnel will maintain the application. Telnet is a great tool for determining connectivity, but your application is going to have to handle the connection going forward.

Carter Browne

On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:
Hi Liz,

Thanks for your reply.

Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.

But at the moment I don’t have idea like how the stunnel will remain connected.

Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.

Waiting for your valuable response.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com><mailto:***@arborfs.com>; Małgorzata Olszówka <***@stunnel.org><mailto:***@stunnel.org>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.

However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.

2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)
2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)
2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert
2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)
2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

HI Guys,

below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228<http://69.191.198.34:8228>
accept = 127.0.0.1:9233<http://127.0.0.1:9233>
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736<http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737<http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com<http://fixbeta.bloomberg.com>, emailAddress=***@bloomberg.com<mailto:***@bloomberg.com>
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

i want connection remained connected every time so that i can run the application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>> wrote:
Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.


_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

[Dheeraj Gautam]

Hi Liz,



Find attached stunnel log herewith, yes the configured remote server IP
address and port details are correct.

At remote end they have allowed our source address and they are getting an
error during TLS handshake, the issue appears to be with the TLS
certificate and are sending them back resulting in the handshake error.

Also, please let us know if we can have a call with you and remote session
to get this fix.

I will be thankful to you.

Regards,

Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Thursday, August 3, 2017 5:58 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



What do your debug logs say? What happens when you send a test message
through? Are you sure you have the remote IP address/port correct? Is there
IP filtering or a firewall in place between the two?



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* Dheeraj Gautam [mailto:***@arborfs.com
<***@arborfs.com>]
*Sent:* Thursday, August 3, 2017 5:27 AM
*To:* Liz Turi <***@maehc.org>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi Liz,



We have stuck badly to establish stunnel connection with one of our
partner, We have configured Client mode configuration on our server to
connect server to run the application.



Below is the config which We have done on my server:



; ***************************************** Example TLS Client mode services

; Certificate

cert = Talomoncert.pem

key = Talomonkey.pem

CAfile = TalomonCACerts.pem

;FIPS

fips=no

; Protocol version (all, SSLv2, SSLv3, TLSv1)

sslVersion = TLSv1.2



; Some performance tunings

socket = l:TCP_NODELAY=1

socket = r:TCP_NODELAY=1



; Some debugging stuff useful for troubleshooting

debug = 7

output = stunnel.log



; Use it for client mode

client = yes

; Service-level configuration

[FIX]

accept = 127.0.0.1:9260

connect = 69.191.230.34:8228

;protocol=connect

;protocolHost= 69.191.230.34:8228

TIMEOUTconnect = 5



Our partner saying that they are not getting any TLS connection on their
server due to which connection is not establishing.



Could you please help us to get this sort out as we have no more idea how
we can troubleshoot this.



Thanks in advance.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Tuesday, June 13, 2017 11:40 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Your logs say that you’re connecting successfully to the port that your
application is listening on. Have you tried testing from the application,
or calls to the application?



This line (along with the next couple of lines) suggest that telnet is
connecting through to the remote host listening on 8228.



2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228



It closes the connection via telnet because telnet isn’t going to run your
application for you.



We need more information about how you’re connecting to your application?
(or intending to)





*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 1:21 PM
*To:* ***@cbcs-usa.com; stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Hi Browne,



I am not understand like what config I have to do in stunnel config file.



As per application it will trigger 8228 port of remote server, but at the
momen stunnel is working only when I am trying to telnet localhost on 9233
port.



Nothing is happening when running the application, don’t know what I am
missing as I am the new for stunnel.



Please help to fix this out.



Regards,



Dheeraj Gautam







*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Carter Browne
*Sent:* Tuesday, June 13, 2017 10:41 PM
*To:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Dheeraj,

stunnel will keep the connection open for as long as your applications
keeps it open. When you exit telnet, it closes the connection. I use
stunnel mostly for RDP, VNC and telnet and as long the application is
active, the port is open. You need to have your application open the local
port you want to route via stunnel (in your example 127.0.0.1:9233). As
long as your application keeps the connection open (ignoring such issues as
communications failures), stunnel will maintain the application. Telnet is
a great tool for determining connectivity, but your application is going to
have to handle the connection going forward.

Carter Browne



On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:

Hi Liz,



Thanks for your reply.



Actually we need to run a service which will work only once stunnel
connection establish and the service will work till the time connection
connected.



But at the moment I don’t have idea like how the stunnel will remain
connected.



Could you please suggest me to fix this so that stunnel connection remain
connected and I can run the application.



Waiting for your valuable response.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org <***@maehc.org>]
*Sent:* Tuesday, June 13, 2017 9:19 PM
*To:* Dheeraj Gautam <***@arborfs.com>
<***@arborfs.com>; Małgorzata Olszówka
<***@stunnel.org> <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Are you testing the connection with Telnet? Or are you testing with the
application. What I noticed in testing the connection is that once the
command is completed, the connection is closed.



However, when I test from my application, its only closed once all
transactions in that session are completed, and will show how much data was
passed on (following from my logs at the end of a non-telnet test session.



*2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite
AES256-GCM-SHA384 (256-bit encryption)*

*2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)*

*2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify
alert*

*2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)*

*2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS,
1641 byte(s) sent to socket*



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 11:41 AM
*To:* Małgorzata Olszówka <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



HI Guys,



below is the config which i have configured with TLSv1.2, but still
connection establishing only for while when i telnet telnet 127.0.0.1 9233.
and just after connection closed.



[TCP]

client=yes

cert = BBG_cert.pem

key = BBG_key.pem

verifyChain = yes

CAfile = BBG_CACerts.pem

connect = 69.191.198.34:8228

accept = 127.0.0.1:9233

sslVersion = TLSv1.2



below the logs:



2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled

2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two
endpoints

2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file

2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled

2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without
subject checks

2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict
trusted certificates

2017.06.13 16:37:16 LOG5[main]: Configuration successful

2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from
127.0.0.1:62736

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228

2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from
172.16.1.23:62737

2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW
YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com,
emailAddress=***@bloomberg.com

2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0
byte(s) sent to socket



i want connection remained connected every time so that i can run the
application.



application can be work only if the connection remain connected.



please help me to sort this out.



Regards,



Dheeraj Gautam



On 25 May 2017 at 12:29, Małgorzata Olszówka <
***@stunnel.org> wrote:

Could you please let us know what parameters we are missing here due to
which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in
logs no where is mentioned about the connection is it connected or not,



Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate
stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.



_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Liz Turi]

This looks like you’re successfully negotiating your client connection to the remote server, but there’s no data being transferred.

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 8:38 AM
To: Liz Turi <***@maehc.org>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

Find attached stunnel log herewith, yes the configured remote server IP address and port details are correct.
At remote end they have allowed our source address and they are getting an error during TLS handshake, the issue appears to be with the TLS certificate and are sending them back resulting in the handshake error.
Also, please let us know if we can have a call with you and remote session to get this fix.
I will be thankful to you.
Regards,
Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Thursday, August 3, 2017 5:58 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

What do your debug logs say? What happens when you send a test message through? Are you sure you have the remote IP address/port correct? Is there IP filtering or a firewall in place between the two?

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 5:27 AM
To: Liz Turi <***@maehc.org<mailto:***@maehc.org>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

We have stuck badly to establish stunnel connection with one of our partner, We have configured Client mode configuration on our server to connect server to run the application.

Below is the config which We have done on my server:

; ***************************************** Example TLS Client mode services
; Certificate
cert = Talomoncert.pem
key = Talomonkey.pem
CAfile = TalomonCACerts.pem
;FIPS
fips=no
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = TLSv1.2

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log

; Use it for client mode
client = yes
; Service-level configuration
[FIX]
accept = 127.0.0.1:9260<http://127.0.0.1:9260>
connect = 69.191.230.34:8228<http://69.191.230.34:8228>
;protocol=connect
;protocolHost= 69.191.230.34:8228<http://69.191.230.34:8228>
TIMEOUTconnect = 5

Our partner saying that they are not getting any TLS connection on their server due to which connection is not establishing.

Could you please help us to get this sort out as we have no more idea how we can troubleshoot this.

Thanks in advance.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Tuesday, June 13, 2017 11:40 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Your logs say that you’re connecting successfully to the port that your application is listening on. Have you tried testing from the application, or calls to the application?

This line (along with the next couple of lines) suggest that telnet is connecting through to the remote host listening on 8228.

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>

It closes the connection via telnet because telnet isn’t going to run your application for you.

We need more information about how you’re connecting to your application? (or intending to)


Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 1:21 PM
To: ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

Hi Browne,

I am not understand like what config I have to do in stunnel config file.

As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port.

Nothing is happening when running the application, don’t know what I am missing as I am the new for stunnel.

Please help to fix this out.

Regards,

Dheeraj Gautam



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Carter Browne
Sent: Tuesday, June 13, 2017 10:41 PM
To: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue


Dheeraj,

stunnel will keep the connection open for as long as your applications keeps it open. When you exit telnet, it closes the connection. I use stunnel mostly for RDP, VNC and telnet and as long the application is active, the port is open. You need to have your application open the local port you want to route via stunnel (in your example 127.0.0.1:9233<http://127.0.0.1:9233>). As long as your application keeps the connection open (ignoring such issues as communications failures), stunnel will maintain the application. Telnet is a great tool for determining connectivity, but your application is going to have to handle the connection going forward.

Carter Browne

On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:
Hi Liz,

Thanks for your reply.

Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.

But at the moment I don’t have idea like how the stunnel will remain connected.

Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.

Waiting for your valuable response.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com><mailto:***@arborfs.com>; Małgorzata Olszówka <***@stunnel.org><mailto:***@stunnel.org>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.

However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.

2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)
2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)
2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert
2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)
2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

HI Guys,

below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228<http://69.191.198.34:8228>
accept = 127.0.0.1:9233<http://127.0.0.1:9233>
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736<http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737<http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com<http://fixbeta.bloomberg.com>, emailAddress=***@bloomberg.com<mailto:***@bloomberg.com>
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

i want connection remained connected every time so that i can run the application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>> wrote:
Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.


_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

[Dheeraj Gautam]

Hi Liz,



The logs are being generating only when I am doing telnet to myself like
telnet 127.0.0.1 9260.



No logs are coming while running the application.



Could you please remote my machine so that you can get complete
understanding about the setup.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Thursday, August 3, 2017 6:13 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



This looks like you’re successfully negotiating your client connection to
the remote server, but there’s no data being transferred.



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* Dheeraj Gautam [mailto:***@arborfs.com
<***@arborfs.com>]
*Sent:* Thursday, August 3, 2017 8:38 AM
*To:* Liz Turi <***@maehc.org>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi Liz,



Find attached stunnel log herewith, yes the configured remote server IP
address and port details are correct.

At remote end they have allowed our source address and they are getting an
error during TLS handshake, the issue appears to be with the TLS
certificate and are sending them back resulting in the handshake error.

Also, please let us know if we can have a call with you and remote session
to get this fix.

I will be thankful to you.

Regards,

Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Thursday, August 3, 2017 5:58 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



What do your debug logs say? What happens when you send a test message
through? Are you sure you have the remote IP address/port correct? Is there
IP filtering or a firewall in place between the two?



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* Dheeraj Gautam [mailto:***@arborfs.com
<***@arborfs.com>]
*Sent:* Thursday, August 3, 2017 5:27 AM
*To:* Liz Turi <***@maehc.org>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi Liz,



We have stuck badly to establish stunnel connection with one of our
partner, We have configured Client mode configuration on our server to
connect server to run the application.



Below is the config which We have done on my server:



; ***************************************** Example TLS Client mode services

; Certificate

cert = Talomoncert.pem

key = Talomonkey.pem

CAfile = TalomonCACerts.pem

;FIPS

fips=no

; Protocol version (all, SSLv2, SSLv3, TLSv1)

sslVersion = TLSv1.2



; Some performance tunings

socket = l:TCP_NODELAY=1

socket = r:TCP_NODELAY=1



; Some debugging stuff useful for troubleshooting

debug = 7

output = stunnel.log



; Use it for client mode

client = yes

; Service-level configuration

[FIX]

accept = 127.0.0.1:9260

connect = 69.191.230.34:8228

;protocol=connect

;protocolHost= 69.191.230.34:8228

TIMEOUTconnect = 5



Our partner saying that they are not getting any TLS connection on their
server due to which connection is not establishing.



Could you please help us to get this sort out as we have no more idea how
we can troubleshoot this.



Thanks in advance.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Tuesday, June 13, 2017 11:40 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Your logs say that you’re connecting successfully to the port that your
application is listening on. Have you tried testing from the application,
or calls to the application?



This line (along with the next couple of lines) suggest that telnet is
connecting through to the remote host listening on 8228.



2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228



It closes the connection via telnet because telnet isn’t going to run your
application for you.



We need more information about how you’re connecting to your application?
(or intending to)





*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 1:21 PM
*To:* ***@cbcs-usa.com; stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Hi Browne,



I am not understand like what config I have to do in stunnel config file.



As per application it will trigger 8228 port of remote server, but at the
momen stunnel is working only when I am trying to telnet localhost on 9233
port.



Nothing is happening when running the application, don’t know what I am
missing as I am the new for stunnel.



Please help to fix this out.



Regards,



Dheeraj Gautam







*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Carter Browne
*Sent:* Tuesday, June 13, 2017 10:41 PM
*To:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Dheeraj,

stunnel will keep the connection open for as long as your applications
keeps it open. When you exit telnet, it closes the connection. I use
stunnel mostly for RDP, VNC and telnet and as long the application is
active, the port is open. You need to have your application open the local
port you want to route via stunnel (in your example 127.0.0.1:9233). As
long as your application keeps the connection open (ignoring such issues as
communications failures), stunnel will maintain the application. Telnet is
a great tool for determining connectivity, but your application is going to
have to handle the connection going forward.

Carter Browne



On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:

Hi Liz,



Thanks for your reply.



Actually we need to run a service which will work only once stunnel
connection establish and the service will work till the time connection
connected.



But at the moment I don’t have idea like how the stunnel will remain
connected.



Could you please suggest me to fix this so that stunnel connection remain
connected and I can run the application.



Waiting for your valuable response.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org <***@maehc.org>]
*Sent:* Tuesday, June 13, 2017 9:19 PM
*To:* Dheeraj Gautam <***@arborfs.com>
<***@arborfs.com>; Małgorzata Olszówka
<***@stunnel.org> <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Are you testing the connection with Telnet? Or are you testing with the
application. What I noticed in testing the connection is that once the
command is completed, the connection is closed.



However, when I test from my application, its only closed once all
transactions in that session are completed, and will show how much data was
passed on (following from my logs at the end of a non-telnet test session.



*2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite
AES256-GCM-SHA384 (256-bit encryption)*

*2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)*

*2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify
alert*

*2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)*

*2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS,
1641 byte(s) sent to socket*



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 11:41 AM
*To:* Małgorzata Olszówka <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



HI Guys,



below is the config which i have configured with TLSv1.2, but still
connection establishing only for while when i telnet telnet 127.0.0.1 9233.
and just after connection closed.



[TCP]

client=yes

cert = BBG_cert.pem

key = BBG_key.pem

verifyChain = yes

CAfile = BBG_CACerts.pem

connect = 69.191.198.34:8228

accept = 127.0.0.1:9233

sslVersion = TLSv1.2



below the logs:



2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled

2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two
endpoints

2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file

2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled

2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without
subject checks

2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict
trusted certificates

2017.06.13 16:37:16 LOG5[main]: Configuration successful

2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from
127.0.0.1:62736

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228

2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from
172.16.1.23:62737

2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW
YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com,
emailAddress=***@bloomberg.com

2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0
byte(s) sent to socket



i want connection remained connected every time so that i can run the
application.



application can be work only if the connection remain connected.



please help me to sort this out.



Regards,



Dheeraj Gautam



On 25 May 2017 at 12:29, Małgorzata Olszówka <
***@stunnel.org> wrote:

Could you please let us know what parameters we are missing here due to
which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in
logs no where is mentioned about the connection is it connected or not,



Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate
stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.



_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Liz Turi]

I’m sorry, Dheeraj,

I cannot do that.

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 8:46 AM
To: Liz Turi <***@maehc.org>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

The logs are being generating only when I am doing telnet to myself like telnet 127.0.0.1 9260.

No logs are coming while running the application.

Could you please remote my machine so that you can get complete understanding about the setup.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Thursday, August 3, 2017 6:13 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

This looks like you’re successfully negotiating your client connection to the remote server, but there’s no data being transferred.

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 8:38 AM
To: Liz Turi <***@maehc.org<mailto:***@maehc.org>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

Find attached stunnel log herewith, yes the configured remote server IP address and port details are correct.
At remote end they have allowed our source address and they are getting an error during TLS handshake, the issue appears to be with the TLS certificate and are sending them back resulting in the handshake error.
Also, please let us know if we can have a call with you and remote session to get this fix.
I will be thankful to you.
Regards,
Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Thursday, August 3, 2017 5:58 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

What do your debug logs say? What happens when you send a test message through? Are you sure you have the remote IP address/port correct? Is there IP filtering or a firewall in place between the two?

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 5:27 AM
To: Liz Turi <***@maehc.org<mailto:***@maehc.org>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

We have stuck badly to establish stunnel connection with one of our partner, We have configured Client mode configuration on our server to connect server to run the application.

Below is the config which We have done on my server:

; ***************************************** Example TLS Client mode services
; Certificate
cert = Talomoncert.pem
key = Talomonkey.pem
CAfile = TalomonCACerts.pem
;FIPS
fips=no
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = TLSv1.2

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log

; Use it for client mode
client = yes
; Service-level configuration
[FIX]
accept = 127.0.0.1:9260<http://127.0.0.1:9260>
connect = 69.191.230.34:8228<http://69.191.230.34:8228>
;protocol=connect
;protocolHost= 69.191.230.34:8228<http://69.191.230.34:8228>
TIMEOUTconnect = 5

Our partner saying that they are not getting any TLS connection on their server due to which connection is not establishing.

Could you please help us to get this sort out as we have no more idea how we can troubleshoot this.

Thanks in advance.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Tuesday, June 13, 2017 11:40 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Your logs say that you’re connecting successfully to the port that your application is listening on. Have you tried testing from the application, or calls to the application?

This line (along with the next couple of lines) suggest that telnet is connecting through to the remote host listening on 8228.

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>

It closes the connection via telnet because telnet isn’t going to run your application for you.

We need more information about how you’re connecting to your application? (or intending to)


Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 1:21 PM
To: ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

Hi Browne,

I am not understand like what config I have to do in stunnel config file.

As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port.

Nothing is happening when running the application, don’t know what I am missing as I am the new for stunnel.

Please help to fix this out.

Regards,

Dheeraj Gautam



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Carter Browne
Sent: Tuesday, June 13, 2017 10:41 PM
To: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue


Dheeraj,

stunnel will keep the connection open for as long as your applications keeps it open. When you exit telnet, it closes the connection. I use stunnel mostly for RDP, VNC and telnet and as long the application is active, the port is open. You need to have your application open the local port you want to route via stunnel (in your example 127.0.0.1:9233<http://127.0.0.1:9233>). As long as your application keeps the connection open (ignoring such issues as communications failures), stunnel will maintain the application. Telnet is a great tool for determining connectivity, but your application is going to have to handle the connection going forward.

Carter Browne

On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:
Hi Liz,

Thanks for your reply.

Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.

But at the moment I don’t have idea like how the stunnel will remain connected.

Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.

Waiting for your valuable response.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com><mailto:***@arborfs.com>; Małgorzata Olszówka <***@stunnel.org><mailto:***@stunnel.org>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.

However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.

2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)
2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)
2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert
2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)
2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

HI Guys,

below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228<http://69.191.198.34:8228>
accept = 127.0.0.1:9233<http://127.0.0.1:9233>
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736<http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737<http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com<http://fixbeta.bloomberg.com>, emailAddress=***@bloomberg.com<mailto:***@bloomberg.com>
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

i want connection remained connected every time so that i can run the application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>> wrote:
Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.


_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

[Dheeraj Gautam]

Could you please suggest how we get this sort out, our partner is claiming
that issue is at our end.



We have setup this stunnel connection with TLSv1.2 on our Window 2012
server.



Could you share any doc which explain how should we integrate our service
with stunnel.



Also, please confirm is our configuration correct or not? We have to send
request along with TLS.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Thursday, August 3, 2017 6:21 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



I’m sorry, Dheeraj,



I cannot do that.



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* Dheeraj Gautam [mailto:***@arborfs.com
<***@arborfs.com>]
*Sent:* Thursday, August 3, 2017 8:46 AM
*To:* Liz Turi <***@maehc.org>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi Liz,



The logs are being generating only when I am doing telnet to myself like
telnet 127.0.0.1 9260.



No logs are coming while running the application.



Could you please remote my machine so that you can get complete
understanding about the setup.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Thursday, August 3, 2017 6:13 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



This looks like you’re successfully negotiating your client connection to
the remote server, but there’s no data being transferred.



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* Dheeraj Gautam [mailto:***@arborfs.com
<***@arborfs.com>]
*Sent:* Thursday, August 3, 2017 8:38 AM
*To:* Liz Turi <***@maehc.org>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi Liz,



Find attached stunnel log herewith, yes the configured remote server IP
address and port details are correct.

At remote end they have allowed our source address and they are getting an
error during TLS handshake, the issue appears to be with the TLS
certificate and are sending them back resulting in the handshake error.

Also, please let us know if we can have a call with you and remote session
to get this fix.

I will be thankful to you.

Regards,

Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Thursday, August 3, 2017 5:58 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



What do your debug logs say? What happens when you send a test message
through? Are you sure you have the remote IP address/port correct? Is there
IP filtering or a firewall in place between the two?



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* Dheeraj Gautam [mailto:***@arborfs.com
<***@arborfs.com>]
*Sent:* Thursday, August 3, 2017 5:27 AM
*To:* Liz Turi <***@maehc.org>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Cc:* Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <
***@arborfs.com>; Ishu Singh <***@arborfs.com>
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi Liz,



We have stuck badly to establish stunnel connection with one of our
partner, We have configured Client mode configuration on our server to
connect server to run the application.



Below is the config which We have done on my server:



; ***************************************** Example TLS Client mode services

; Certificate

cert = Talomoncert.pem

key = Talomonkey.pem

CAfile = TalomonCACerts.pem

;FIPS

fips=no

; Protocol version (all, SSLv2, SSLv3, TLSv1)

sslVersion = TLSv1.2



; Some performance tunings

socket = l:TCP_NODELAY=1

socket = r:TCP_NODELAY=1



; Some debugging stuff useful for troubleshooting

debug = 7

output = stunnel.log



; Use it for client mode

client = yes

; Service-level configuration

[FIX]

accept = 127.0.0.1:9260

connect = 69.191.230.34:8228

;protocol=connect

;protocolHost= 69.191.230.34:8228

TIMEOUTconnect = 5



Our partner saying that they are not getting any TLS connection on their
server due to which connection is not establishing.



Could you please help us to get this sort out as we have no more idea how
we can troubleshoot this.



Thanks in advance.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org]
*Sent:* Tuesday, June 13, 2017 11:40 PM
*To:* Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com;
stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Your logs say that you’re connecting successfully to the port that your
application is listening on. Have you tried testing from the application,
or calls to the application?



This line (along with the next couple of lines) suggest that telnet is
connecting through to the remote host listening on 8228.



2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228



It closes the connection via telnet because telnet isn’t going to run your
application for you.



We need more information about how you’re connecting to your application?
(or intending to)





*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 1:21 PM
*To:* ***@cbcs-usa.com; stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Hi Browne,



I am not understand like what config I have to do in stunnel config file.



As per application it will trigger 8228 port of remote server, but at the
momen stunnel is working only when I am trying to telnet localhost on 9233
port.



Nothing is happening when running the application, don’t know what I am
missing as I am the new for stunnel.



Please help to fix this out.



Regards,



Dheeraj Gautam







*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Carter Browne
*Sent:* Tuesday, June 13, 2017 10:41 PM
*To:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



Dheeraj,

stunnel will keep the connection open for as long as your applications
keeps it open. When you exit telnet, it closes the connection. I use
stunnel mostly for RDP, VNC and telnet and as long the application is
active, the port is open. You need to have your application open the local
port you want to route via stunnel (in your example 127.0.0.1:9233). As
long as your application keeps the connection open (ignoring such issues as
communications failures), stunnel will maintain the application. Telnet is
a great tool for determining connectivity, but your application is going to
have to handle the connection going forward.

Carter Browne



On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:

Hi Liz,



Thanks for your reply.



Actually we need to run a service which will work only once stunnel
connection establish and the service will work till the time connection
connected.



But at the moment I don’t have idea like how the stunnel will remain
connected.



Could you please suggest me to fix this so that stunnel connection remain
connected and I can run the application.



Waiting for your valuable response.



Regards,



Dheeraj Gautam



*From:* Liz Turi [mailto:***@maehc.org <***@maehc.org>]
*Sent:* Tuesday, June 13, 2017 9:19 PM
*To:* Dheeraj Gautam <***@arborfs.com>
<***@arborfs.com>; Małgorzata Olszówka
<***@stunnel.org> <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* RE: [stunnel-users] Stunnel Connectivity Issue



Hi, Dheeraj,



Are you testing the connection with Telnet? Or are you testing with the
application. What I noticed in testing the connection is that once the
command is completed, the connection is closed.



However, when I test from my application, its only closed once all
transactions in that session are completed, and will show how much data was
passed on (following from my logs at the end of a non-telnet test session.



*2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite
AES256-GCM-SHA384 (256-bit encryption)*

*2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)*

*2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify
alert*

*2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)*

*2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS,
1641 byte(s) sent to socket*



*Liz Turi*

Sr. Consultant

Massachusetts eHealth Collaborative

860 Winter Street, Waltham, MA 02451

(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589

www.maehc.org

[image: fb_icon]
<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[image:
li_icon]
<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[image:
tw_icon] <https://twitter.com/MAeHC_org>



*From:* stunnel-users [mailto:stunnel-users-***@stunnel.org
<stunnel-users-***@stunnel.org>] *On Behalf Of *Dheeraj Gautam
*Sent:* Tuesday, June 13, 2017 11:41 AM
*To:* Małgorzata Olszówka <***@stunnel.org>
*Cc:* stunnel-***@stunnel.org
*Subject:* Re: [stunnel-users] Stunnel Connectivity Issue



HI Guys,



below is the config which i have configured with TLSv1.2, but still
connection establishing only for while when i telnet telnet 127.0.0.1 9233.
and just after connection closed.



[TCP]

client=yes

cert = BBG_cert.pem

key = BBG_key.pem

verifyChain = yes

CAfile = BBG_CACerts.pem

connect = 69.191.198.34:8228

accept = 127.0.0.1:9233

sslVersion = TLSv1.2



below the logs:



2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled

2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two
endpoints

2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file

2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf

2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected

2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled

2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without
subject checks

2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict
trusted certificates

2017.06.13 16:37:16 LOG5[main]: Configuration successful

2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from
127.0.0.1:62736

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228

2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from
172.16.1.23:62737

2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW
YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com,
emailAddress=***@bloomberg.com

2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0
byte(s) sent to socket



i want connection remained connected every time so that i can run the
application.



application can be work only if the connection remain connected.



please help me to sort this out.



Regards,



Dheeraj Gautam



On 25 May 2017 at 12:29, Małgorzata Olszówka <
***@stunnel.org> wrote:

Could you please let us know what parameters we are missing here due to
which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in
logs no where is mentioned about the connection is it connected or not,



Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate
stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.



_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users





www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.



www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.


CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged
and confidential information intended only for the use of the addressee
named above. If the reader of this message is not the intended recipient
you are hereby notified that any dissemination, distribution or copying of
this email transmission is strictly prohibited. If you have received this
email transmission in error, please notify us immediately. Thank you.
--
www.arborfs.com

This e-mail and any attachment are confidential and contain proprietary
information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it
is addressed. If you are not the intended recipient, please notify the
author immediately by telephone or by replying to this e-mail, and then
delete all copies of the e-mail on your system. If you are not the
intended recipient, you must not use, disclose, distribute, copy, print or
rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and
any attachment has been checked for viruses, we cannot guarantee that they
are virus free and we cannot accept liability for any damage sustained as a
result of software viruses. We would advise that you carry out your own
virus checks, especially before opening an attachment.

[Liz Turi]

Hi, Dheeraj,

The documentation I found to set up my server was found online in message list archives and blogs. Outside of the FAQ and Documentation of stunnel.org, the only issue I ran into was with my certificate – I had been over thinking it, and stumbled upon my solution. It does not seem like that is your issue, however, and since every environment is different, I can’t actually say whether or not your configuration is appropriate or not to your given environment and use case.

I would recommend seeing how much of your use case can be replicated within your development environment, confirm that you can send and receive messages between client and server settings, and then connect with your remote server, testing with them – confirming that you see packet transmission in your stunnel logs.

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 8:56 AM
To: Liz Turi <***@maehc.org>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Could you please suggest how we get this sort out, our partner is claiming that issue is at our end.

We have setup this stunnel connection with TLSv1.2 on our Window 2012 server.

Could you share any doc which explain how should we integrate our service with stunnel.

Also, please confirm is our configuration correct or not? We have to send request along with TLS.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Thursday, August 3, 2017 6:21 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

I’m sorry, Dheeraj,

I cannot do that.

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 8:46 AM
To: Liz Turi <***@maehc.org<mailto:***@maehc.org>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

The logs are being generating only when I am doing telnet to myself like telnet 127.0.0.1 9260.

No logs are coming while running the application.

Could you please remote my machine so that you can get complete understanding about the setup.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Thursday, August 3, 2017 6:13 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

This looks like you’re successfully negotiating your client connection to the remote server, but there’s no data being transferred.

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 8:38 AM
To: Liz Turi <***@maehc.org<mailto:***@maehc.org>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

Find attached stunnel log herewith, yes the configured remote server IP address and port details are correct.
At remote end they have allowed our source address and they are getting an error during TLS handshake, the issue appears to be with the TLS certificate and are sending them back resulting in the handshake error.
Also, please let us know if we can have a call with you and remote session to get this fix.
I will be thankful to you.
Regards,
Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Thursday, August 3, 2017 5:58 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

What do your debug logs say? What happens when you send a test message through? Are you sure you have the remote IP address/port correct? Is there IP filtering or a firewall in place between the two?

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 5:27 AM
To: Liz Turi <***@maehc.org<mailto:***@maehc.org>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Cc: Gurpreet Ahuja <***@arborfs.com<mailto:***@arborfs.com>>; Sumit Sharma <***@arborfs.com<mailto:***@arborfs.com>>; Ishu Singh <***@arborfs.com<mailto:***@arborfs.com>>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi Liz,

We have stuck badly to establish stunnel connection with one of our partner, We have configured Client mode configuration on our server to connect server to run the application.

Below is the config which We have done on my server:

; ***************************************** Example TLS Client mode services
; Certificate
cert = Talomoncert.pem
key = Talomonkey.pem
CAfile = TalomonCACerts.pem
;FIPS
fips=no
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = TLSv1.2

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log

; Use it for client mode
client = yes
; Service-level configuration
[FIX]
accept = 127.0.0.1:9260<http://127.0.0.1:9260>
connect = 69.191.230.34:8228<http://69.191.230.34:8228>
;protocol=connect
;protocolHost= 69.191.230.34:8228<http://69.191.230.34:8228>
TIMEOUTconnect = 5

Our partner saying that they are not getting any TLS connection on their server due to which connection is not establishing.

Could you please help us to get this sort out as we have no more idea how we can troubleshoot this.

Thanks in advance.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org<mailto:***@maehc.org>]
Sent: Tuesday, June 13, 2017 11:40 PM
To: Dheeraj Gautam <***@arborfs.com<mailto:***@arborfs.com>>; ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Your logs say that you’re connecting successfully to the port that your application is listening on. Have you tried testing from the application, or calls to the application?

This line (along with the next couple of lines) suggest that telnet is connecting through to the remote host listening on 8228.

2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>

It closes the connection via telnet because telnet isn’t going to run your application for you.

We need more information about how you’re connecting to your application? (or intending to)


Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 1:21 PM
To: ***@cbcs-usa.com<mailto:***@cbcs-usa.com>; stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

Hi Browne,

I am not understand like what config I have to do in stunnel config file.

As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port.

Nothing is happening when running the application, don’t know what I am missing as I am the new for stunnel.

Please help to fix this out.

Regards,

Dheeraj Gautam



From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Carter Browne
Sent: Tuesday, June 13, 2017 10:41 PM
To: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue


Dheeraj,

stunnel will keep the connection open for as long as your applications keeps it open. When you exit telnet, it closes the connection. I use stunnel mostly for RDP, VNC and telnet and as long the application is active, the port is open. You need to have your application open the local port you want to route via stunnel (in your example 127.0.0.1:9233<http://127.0.0.1:9233>). As long as your application keeps the connection open (ignoring such issues as communications failures), stunnel will maintain the application. Telnet is a great tool for determining connectivity, but your application is going to have to handle the connection going forward.

Carter Browne

On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:
Hi Liz,

Thanks for your reply.

Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected.

But at the moment I don’t have idea like how the stunnel will remain connected.

Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application.

Waiting for your valuable response.

Regards,

Dheeraj Gautam

From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com><mailto:***@arborfs.com>; Małgorzata Olszówka <***@stunnel.org><mailto:***@stunnel.org>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue

Hi, Dheeraj,

Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed.

However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session.

2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)
2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)
2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert
2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)
2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket

Liz Turi
Sr. Consultant
Massachusetts eHealth Collaborative
860 Winter Street, Waltham, MA 02451
(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589
www.maehc.org<http://www.maehc.org>
[fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=tyah&trkInfo=clickedVertical%3Acompany%2Cidx%3A1-1-1%2CtarId%3A1432746657126%2Ctas%3AMassachusetts+eHEalth>[tw_icon]<https://twitter.com/MAeHC_org>

From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>>
Cc: stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

HI Guys,

below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed.

[TCP]
client=yes
cert = BBG_cert.pem
key = BBG_key.pem
verifyChain = yes
CAfile = BBG_CACerts.pem
connect = 69.191.198.34:8228<http://69.191.198.34:8228>
accept = 127.0.0.1:9233<http://127.0.0.1:9233>
sslVersion = TLSv1.2

below the logs:

2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled
2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints
2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file
2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf
2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected
2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled
2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks
2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates
2017.06.13 16:37:16 LOG5[main]: Configuration successful
2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:62736<http://127.0.0.1:62736>
2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228<http://69.191.198.34:8228>
2017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:62737<http://172.16.1.23:62737>
2017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com<http://fixbeta.bloomberg.com>, emailAddress=***@bloomberg.com<mailto:***@bloomberg.com>
2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

i want connection remained connected every time so that i can run the application.

application can be work only if the connection remain connected.

please help me to sort this out.

Regards,

Dheeraj Gautam

On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org<mailto:***@stunnel.org>> wrote:
Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.


_______________________________________________

stunnel-users mailing list

stunnel-***@stunnel.org<mailto:stunnel-***@stunnel.org>

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users



www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.


www.arborfs.com<http://www.arborfs.com>

This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.

It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.

Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

[Jose Alf.]

Dheeraj,
Are you sure your client application is connecting to 127.0.0.1 port 9260?...
The fact that no events are logged when you run your application makes me thin it is not doing it. You may want to double check. You can use a utility such as tcpview to verify or something more powerful like Wireshark.


Regards,
From: Dheeraj Gautam <***@arborfs.com>
To: Liz Turi <***@maehc.org>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Ishu Singh <***@arborfs.com>; Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>
Sent: Thursday, August 3, 2017 7:46 AM
Subject: Re: [stunnel-users] Stunnel Connectivity Issue

<!--#yiv6620247297 _filtered #yiv6620247297 {font-family:"Cambria Math";panose-1:2 4 5 3 5 4 6 3 2 4;} _filtered #yiv6620247297 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;} _filtered #yiv6620247297 {font-family:Consolas;panose-1:2 11 6 9 2 2 4 3 2 4;} _filtered #yiv6620247297 {}#yiv6620247297 #yiv6620247297 p.yiv6620247297MsoNormal, #yiv6620247297 li.yiv6620247297MsoNormal, #yiv6620247297 div.yiv6620247297MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:12.0pt;font-family:"Times New Roman", serif;color:black;}#yiv6620247297 a:link, #yiv6620247297 span.yiv6620247297MsoHyperlink {color:blue;text-decoration:underline;}#yiv6620247297 a:visited, #yiv6620247297 span.yiv6620247297MsoHyperlinkFollowed {color:purple;text-decoration:underline;}#yiv6620247297 pre {margin:0in;margin-bottom:.0001pt;font-size:10.0pt;font-family:"Courier New";color:black;}#yiv6620247297 span.yiv6620247297HTMLPreformattedChar {font-family:Consolas;color:black;}#yiv6620247297 p.yiv6620247297msonormal0, #yiv6620247297 li.yiv6620247297msonormal0, #yiv6620247297 div.yiv6620247297msonormal0 {margin-right:0in;margin-left:0in;font-size:12.0pt;font-family:"Times New Roman", serif;color:black;}#yiv6620247297 span.yiv6620247297EmailStyle20 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle21 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle22 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle23 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle24 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle25 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle26 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle27 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle28 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 span.yiv6620247297EmailStyle31 {font-family:"Calibri", sans-serif;color:windowtext;}#yiv6620247297 .yiv6620247297MsoChpDefault {font-size:10.0pt;} _filtered #yiv6620247297 {margin:1.0in 1.0in 1.0in 1.0in;}#yiv6620247297 div.yiv6620247297WordSection1 {}-->Hi Liz, The logs are being generating only when I am doing telnet to myself like telnet 127.0.0.1 9260. No logs are coming while running the application. Could you please remote my machine so that you can get complete understanding about the setup. Regards, Dheeraj Gautam From: Liz Turi [mailto:***@maehc.org]
Sent: Thursday, August 3, 2017 6:13 PM
To: Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue This looks like you’re successfully negotiating your client connection to the remote server, but there’s no data being transferred.  Liz TuriSr. ConsultantMassachusetts eHealth Collaborative860 Winter Street, Waltham, MA 02451(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589www.maehc.org From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 8:38 AM
To: Liz Turi <***@maehc.org>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue Hi Liz, Find attached stunnel log herewith, yes the configured remote server IP address and port details are correct.At remote end they have allowed our source address and they are getting an error during TLS handshake, the issue appears to be with the TLS certificate and are sending them back resulting in the handshake error.Also, please let us know if we can have a call with you and remote session to get this fix.I will be thankful to you.Regards,Dheeraj Gautam From: Liz Turi [mailto:***@maehc.org]
Sent: Thursday, August 3, 2017 5:58 PM
To: Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue What do your debug logs say? What happens when you send a test message through? Are you sure you have the remote IP address/port correct? Is there IP filtering or a firewall in place between the two? Liz TuriSr. ConsultantMassachusetts eHealth Collaborative860 Winter Street, Waltham, MA 02451(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589www.maehc.org From: Dheeraj Gautam [mailto:***@arborfs.com]
Sent: Thursday, August 3, 2017 5:27 AM
To: Liz Turi <***@maehc.org>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Cc: Gurpreet Ahuja <***@arborfs.com>; Sumit Sharma <***@arborfs.com>; Ishu Singh <***@arborfs.com>
Subject: RE: [stunnel-users] Stunnel Connectivity Issue Hi Liz, We have stuck badly to establish stunnel connection with one of our partner, We have configured Client mode configuration on our server to connect server to run the application. Below is the config which We have done on my server: ; ***************************************** Example TLS Client mode services; Certificatecert = Talomoncert.pemkey = Talomonkey.pemCAfile = TalomonCACerts.pem;FIPSfips=no; Protocol version (all, SSLv2, SSLv3, TLSv1)sslVersion = TLSv1.2 ; Some performance tunings  socket = l:TCP_NODELAY=1  socket = r:TCP_NODELAY=1   ; Some debugging stuff useful for troubleshooting  debug = 7  output = stunnel.log   ; Use it for client mode  client = yes; Service-level configuration[FIX]  accept = 127.0.0.1:9260connect = 69.191.230.34:8228;protocol=connect;protocolHost= 69.191.230.34:8228TIMEOUTconnect  = 5 Our partner saying that they are not getting any TLS connection on their server due to which connection is not establishing. Could you please help us to get this sort out as we have no more idea how we can troubleshoot this. Thanks in advance. Regards, Dheeraj Gautam From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 11:40 PM
To: Dheeraj Gautam <***@arborfs.com>; ***@cbcs-usa.com; stunnel-***@stunnel.org
Subject: RE: [stunnel-users] Stunnel Connectivity Issue Hi, Dheeraj, Your logs say that you’re connecting successfully to the port that your application is listening on. Have you tried testing from the application, or calls to the application? This line (along with the next couple of lines) suggest that telnet is connecting through to the remote host listening on 8228.  2017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:8228 It closes the connection via telnet because telnet isn’t going to run your application for you. We need more information about how you’re connecting to your application? (or intending to)  Liz TuriSr. ConsultantMassachusetts eHealth Collaborative860 Winter Street, Waltham, MA 02451(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589www.maehc.org From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 1:21 PM
To: ***@cbcs-usa.com; stunnel-***@stunnel.org
Subject: Re: [stunnel-users] Stunnel Connectivity Issue Hi Browne, I am not understand like what config I have to do in stunnel config file. As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port. Nothing is happening when running the application, don’t know what I am missing as I am the new for stunnel. Please help to fix this out. Regards, Dheeraj Gautam   From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Carter Browne
Sent: Tuesday, June 13, 2017 10:41 PM
To: stunnel-***@stunnel.org
Subject: Re: [stunnel-users] Stunnel Connectivity Issue Dheeraj,stunnel will keep the connection open for as long as your applications keeps it open.  When you exit telnet, it closes the connection.  I use stunnel mostly for RDP, VNC and telnet and as long the application is active, the port is open.  You need to have your application open the local port you want to route via stunnel (in your example 127.0.0.1:9233).  As long as your application keeps the connection open (ignoring such issues as communications failures), stunnel will maintain the application.  Telnet is a great tool for determining connectivity, but your application is going to have to handle the connection going forward.Carter Browne On 6/13/2017 12:01 PM, Dheeraj Gautam wrote:
Hi Liz, Thanks for your reply. Actually we need to run a service which will work only once stunnel connection establish and the service will work till the time connection connected. But at the moment I don’t have idea like how the stunnel will remain connected. Could you please suggest me to fix this so that stunnel connection remain connected and I can run the application. Waiting for your valuable response. Regards, Dheeraj Gautam From: Liz Turi [mailto:***@maehc.org]
Sent: Tuesday, June 13, 2017 9:19 PM
To: Dheeraj Gautam <***@arborfs.com>; Małgorzata Olszówka <***@stunnel.org>
Cc: stunnel-***@stunnel.org
Subject: RE: [stunnel-users] Stunnel Connectivity Issue Hi, Dheeraj, Are you testing the connection with Telnet? Or are you testing with the application. What I noticed in testing the connection is that once the command is completed, the connection is closed. However, when I test from my application, its only closed once all transactions in that session are completed, and will show how much data was passed on (following from my logs at the end of a non-telnet test session. 2017.06.13 10:16:08 LOG6[1]: Negotiated TLSv1.2 ciphersuite AES256-GCM-SHA384 (256-bit encryption)2017.06.13 10:16:18 LOG6[1]: Read socket closed (readsocket)2017.06.13 10:16:18 LOG6[1]: SSL_shutdown successfully sent close_notify alert2017.06.13 10:16:18 LOG6[1]: TLS closed (SSL_read)2017.06.13 10:16:18 LOG5[1]: Connection closed: 2791 byte(s) sent to TLS, 1641 byte(s) sent to socket Liz TuriSr. ConsultantMassachusetts eHealth Collaborative860 Winter Street, Waltham, MA 02451(m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589www.maehc.org From: stunnel-users [mailto:stunnel-users-***@stunnel.org] On Behalf Of Dheeraj Gautam
Sent: Tuesday, June 13, 2017 11:41 AM
To: Małgorzata Olszówka <***@stunnel.org>
Cc: stunnel-***@stunnel.org
Subject: Re: [stunnel-users] Stunnel Connectivity Issue HI Guys, below is the config which i have configured with TLSv1.2, but still connection establishing only for while when i telnet telnet 127.0.0.1 9233. and just after connection closed. [TCP]client=yescert = BBG_cert.pemkey = BBG_key.pemverifyChain = yesCAfile = BBG_CACerts.pemconnect = 69.191.198.34:8228accept  = 127.0.0.1:9233sslVersion = TLSv1.2 below the logs: 2017.06.13 11:57:49 LOG5[main]: Reading configuration from file stunnel.conf2017.06.13 11:57:49 LOG5[main]: UTF-8 byte order mark detected2017.06.13 11:57:49 LOG5[main]: FIPS mode disabled2017.06.13 11:57:49 LOG3[main]: Service [TCP]: Each service must define two endpoints2017.06.13 11:57:49 LOG3[main]: Failed to reload the configuration file2017.06.13 16:37:16 LOG5[main]: Reading configuration from file stunnel.conf2017.06.13 16:37:16 LOG5[main]: UTF-8 byte order mark detected2017.06.13 16:37:16 LOG5[main]: FIPS mode disabled2017.06.13 16:37:16 LOG4[main]: Service [TCP] uses "verifyChain" without subject checks2017.06.13 16:37:16 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates2017.06.13 16:37:16 LOG5[main]: Configuration successful2017.06.13 16:38:38 LOG5[11]: Service [TCP] accepted connection from 127.0.0.1:627362017.06.13 16:38:38 LOG5[11]: s_connect: connected 69.191.198.34:82282017.06.13 16:38:38 LOG5[11]: Service [TCP] connected remote server from 172.16.1.23:627372017.06.13 16:38:39 LOG5[11]: Certificate accepted at depth=0: C=US, ST=NEW YORK, L=NEW YORK, O=Bloomberg LP, OU=FIXBETA, CN=fixbeta.bloomberg.com, emailAddress=***@bloomberg.com2017.06.13 16:39:10 LOG5[11]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket i want connection remained connected every time so that i can run the application. application can be work only if the connection remain connected. please help me to sort this out. Regards, Dheeraj Gautam On 25 May 2017 at 12:29, Małgorzata Olszówka <***@stunnel.org> wrote:

Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server.

Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not,


Hello Dheeraj,

You should set the verifyChain option in order to verify the certificate stored in the file specified with CAfile:
verifyChain = yes

Then you can test your connection:
telnet 127.0.0.1 9233
the stunnel logs will show information about the connection attempt.

Regards,
Małgorzata
_______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
  www.arborfs.comThis e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.It is intended solely for the use of the individual or entity to which it is addressed.  If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system.  If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses.  We would advise that you carry out your own virus checks, especially before opening an attachment.
CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you. www.arborfs.comThis e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.It is intended solely for the use of the individual or entity to which it is addressed.  If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system.  If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses.  We would advise that you carry out your own virus checks, especially before opening an attachment. _______________________________________________stunnel-users mailing liststunnel-***@stunnel.orghttps://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
  www.arborfs.comThis e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.It is intended solely for the use of the individual or entity to which it is addressed.  If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system.  If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses.  We would advise that you carry out your own virus checks, especially before opening an attachment.
CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you. www.arborfs.comThis e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.It is intended solely for the use of the individual or entity to which it is addressed.  If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system.  If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses.  We would advise that you carry out your own virus checks, especially before opening an attachment.
CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you. www.arborfs.comThis e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged.It is intended solely for the use of the individual or entity to which it is addressed.  If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system.  If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses.  We would advise that you carry out your own virus checks, especially before opening an attachment.
CONFIDENTIALITY NOTICE
The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.
www.arborfs.com
This e-mail and any attachment areconfidential and contain proprietary information, some or all of which may belegally privileged.It is intended solely for the use of theindividual or entity to which it is addressed.  If you are not theintended recipient, please notify the author immediately by telephone or byreplying to this e-mail, and then delete all copies of the e-mail on yoursystem.  If you are not the intended recipient, you must not use,disclose, distribute, copy, print or rely on this e-mail.Whilst we have taken reasonableprecautions to ensure that this e-mail and any attachment has been checked forviruses, we cannot guarantee that they are virus free and we cannot acceptliability for any damage sustained as a result of software viruses.  Wewould advise that you carry out your own virus checks, especially beforeopening an attachment._______________________________________________
stunnel-users mailing list
stunnel-***@stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users