Thanks for your suggestion, I just tried but nothing changed.
> Il 9 novembre 2018 alle 12.44 Flo Rance <[email protected]> ha scritto:
>
> Hi,
>
> Damn, it seems that there's a serious issue with OCSP and microsoft certificates.
>
>
> You can try to put the option: OCSPaia = no to see if it fixes the issue, but it seems that it needs further investigations.
>
> https://www.stunnel.org/static/stunnel.html
>
> Regards,
> Flo
>
> On Fri, Nov 9, 2018 at 12:36 PM < [email protected] mailto:[email protected] > wrote:
>
> > >
> > Hello,
> >
> > I'm encountering an issue while using sTunnel with an Office365 account.
> >
> > sTunnel worked properly for a few months, while it gived an error with certificates since yesterday, whilst didn't change anything in the configuration.
> >
> > This is our configuration:
> >
> > [pop3s]
> > client = yes
> > accept =http://127.0.0.1:2001
> > connect =http://outlook.office365.com:995
> > CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem
> > checkHost =http://outlook.office365.com
> > verifyChain = yes
> > OCSPaia = yes
> >
> > This is what we get in the log:
> >
> > 2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s)
> > 2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=---
> > 2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) fromhttp://127.0.0.1:49619
> > 2018.11.09 11:34:09 LOG7[main]: Creating a new thread
> > 2018.11.09 11:34:09 LOG7[main]: New thread created
> > 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started
> > 2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672)
> > 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket
> > 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection fromhttp://127.0.0.1:49619
> > 2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0
> > 2018.11.09 11:34:09 LOG6[30]: s_connect: connectinghttp://40.101.9.178:995
> > 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_waithttp://40.101.9.178:995 : waiting 10 seconds
> > 2018.11.09 11:34:09 LOG5[30]: s_connect: connectedhttp://40.101.9.178:995
> > 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server fromhttp://172.31.20.23:49620
> > 2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668)
> > 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket
> > 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized
> > 2018.11.09 11:34:09 LOG6[30]: SNI: sending servername:http://outlook.office365.com
> > 2018.11.09 11:34:09 LOG6[30]: Peer certificate required
> > 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect initialization
> > 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client hello A
> > 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello A
> > 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US, O=DigiCert Inc, OU=http://www.digicert.com , CN=DigiCert Global Root CA
> > 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded
> > 2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate
> > 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US, O=DigiCert Inc, OU=http://www.digicert.com , CN=DigiCert Global Root CA
> > 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
> > 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded
> > 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocsp.digicert.com"
> > 2018.11.09 11:34:09 LOG6[30]: s_connect: connectinghttp://93.184.220.29:80
> > 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_waithttp://93.184.220.29:80 : waiting 10 seconds
> > 2018.11.09 11:34:09 LOG5[30]: s_connect: connectedhttp://93.184.220.29:80
> > 2018.11.09 11:34:09 LOG7[30]: OCSP: Connectedhttp://ocsp.digicert.com:80
> > 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received
> > 2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good
> > 2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT
> > 2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT
> > 2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted
> > 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
> > 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=http://outlook.com
> > 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded
> > 2018.11.09 11:34:09 LOG6[30]: CERT: Host name "http://outlook.office365.com " matched with "*.http://office365.com "
> > 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocspx.digicert.com"
> > 2018.11.09 11:34:09 LOG6[30]: s_connect: connectinghttp://93.184.220.29:80
> > 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_waithttp://93.184.220.29:80 : waiting 10 seconds
> > 2018.11.09 11:34:09 LOG5[30]: s_connect: connectedhttp://93.184.220.29:80
> > 2018.11.09 11:34:09 LOG7[30]: OCSP: Connectedhttp://ocspx.digicert.com:80
> > 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received
> > 2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized
> > 2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=http://outlook.com
> > 2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure
> > 2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
> > 2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
> > 2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for session connect address
> > 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed
> > 2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed
> > 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left)
> >
> >
> > Can you please help me?
> >
> > Thanks in advance!
> >
> > _______________________________________________
> > stunnel-users mailing list
> > [email protected] mailto:[email protected]
> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
> >
> > >
_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.