From charlesreid1
Stunnel Ssl Wrapper
The stunnel application is a SSL encryption wrapper that can tunnel unencrypted traffic (like redis) through a SSL encrypted tunnel to another server. While stunnel adds SSL encryption it does not guarantee 100% that the traffic will never be captured unencrypted. I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS. Therefore, i was trying stunnel to make SSL and connect the HTTP on it, but its not working when using Google App Engine and Stunnel.
- 1Certificates in Stunnel
- 2Verification
- 2.1Installing Certificate Authority
The official stunnel howto has some useful (but confusing) information about certificates: https://www.stunnel.org/howto.html
Client Certificates
Using stunnel in client mode (i.e., stunnel is not acting as an SSL server) means you (the client) probably don't need to present a valid certificate (to the server). While stunnel always requires a certificate (a pem file) to run, a dummy certificate is generated when stunnel is installed, and that dummy pem file can be used by the client since the server will probably not ask the client to present this certificate.
Generating a client SSL certificate is the same process as generating a server SSL certificate. See below, or 'Generating stunnel certificate and private key' section of the stunnel howto: https://www.stunnel.org/howto.html
Server Certificates
The server will need a private key and an SSL certificate.
Generating a signed SSL certificate with LetsEncrypt: see LetsEncrypt
Generating a self-signed SSL certificate with openssl: RaspberryPi/SSH Stunnel#Generate Private Keys and Certificates for SSL
Controlling both server and client
Using stunnel in a situation where you control both the client and the server gives you two options:
- Skip verification of certificates
- Verify certificates against locally installed certificates
To turn on verification, see Stunnel/Certificates#Verification section below.
Controlling server only
Stunnel Download
Using stunnel in a situation where you do not control the client gives you three options:
- Skip verification of certificates (not recommended if there is no authentication involved with the traffic being passed to stunnel, since a malicious actor could intercept and decrypt traffic)
- Ask clients to install your certificate authority into their OpenSSL installation, so that they can verify the certificate
- Verify certificates against pre-installed, 'pre-trusted' root certificates (e.g., Verisign)
By default, stunnel does not verify SSL certificates, so clients will accept whatever SSL certificate they get from the server (or an attacker pretending to be the server).
To turn on verification, set the verify option in the stunnel config file..
Installing Certificate Authority
A self-signed certificate is the same as the certificate authority. To install an SSL certificate, see the OpenSSL guide to installing other people's certificates: http://www.gagravarr.org/writing/openssl-certs/others.shtml
The short version:
- If you are installing the certificate on a Mac, you will need to add it through the Keychain Access app
- If you are installing the certificate on Linux, you will need the .pem CA file, which you will put into a file named with the certificate's own hash
Installing certificate authority on mac
Start by obtaining the CA fingerprint from a trusted source. Calculate the fingerprint for the certificate and ensure it matches:
Example:
If they match, you are ready to install it. Open Keychain Acces.app to add the certificate to the Mac keychain.
The CA file needs to be in PKCS12 format (yet another annoying decision to do weird non-standard things by apple engineers). Turn an X509 .der or .pem format into PKCS12 format using this command:
If the key and certificate files are separate:
If only doing this with a certificate,
Example:
OS X requires a password on the key file. I left it empty, and it seemed to be okay with that.
Now open Keychain Access.app. On the left side, pick System. Then pick File > Import Items. Import the.p12 file. You should see new entries that include the name of the certificate authority that signed the certificate.
Pick 'Trust Always' when importing.
Testing installed certificate authority on Mac
where stnnel.fullchain.pem is the certificate signed by the SSL certificate just added to the Keychain Access app. I had issues:
from manpage of verify(1ssl):
Am giving up on verification step on Mac.
Installing certificate authority on linux
Start by obtaining the CA fingerprint from a trusted source. Calculate the fingerprint for the certificate and ensure it matches:
If they match, you are ready to install it. These commands will move the .pem CA file to the openssl directory, and will create a symbolic link to the .pem CA file with a filename equal to the certificate's hash, plus a .0 at the end:
Testing installed certificate authority on Linux
Now test the certificate authority by checking a certificate that has been signed by the CA:
Stunnel Sslv3 Alert Illegal Parameter
