Re: Issue with Office365 certificates

Flo Rance <[email protected]>
Newsgroups gmane.network.stunnel.user
Message-ID <CAHogYcXvDWE2scey4tx-aBO7PWJfR7-bkE8LtYPyEDVweYqaRw@mail.gmail.com> 
Weird, I tried and it works perfectly for me using your configuration and
stunnel 5.48.

*OCSPaia* = yes

2018.11.09 14:39:56 LOG6[0]: SNI: sending servername: outlook.office365.com
2018.11.09 14:39:56 LOG6[0]: Peer certificate required
2018.11.09 14:39:56 LOG7[0]: TLS state (connect): before SSL initialization
2018.11.09 14:39:56 LOG7[0]: TLS state (connect): SSLv3/TLS write client
hello
2018.11.09 14:39:56 LOG7[0]: TLS state (connect): SSLv3/TLS write client
hello
2018.11.09 14:39:56 LOG7[0]: TLS state (connect): SSLv3/TLS read server
hello
2018.11.09 14:39:56 LOG7[0]: Verification started at depth=2: C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
2018.11.09 14:39:56 LOG7[0]: CERT: Pre-verification succeeded
2018.11.09 14:39:56 LOG7[0]: OCSP: Ignoring root certificate
2018.11.09 14:39:56 LOG6[0]: Certificate accepted at depth=2: C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
2018.11.09 14:39:56 LOG7[0]: Verification started at depth=1: C=US,
O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
2018.11.09 14:39:56 LOG7[0]: CERT: Pre-verification succeeded
2018.11.09 14:39:56 LOG5[0]: OCSP: Connecting the AIA responder "
http://ocsp.digicert.com"
2018.11.09 14:39:56 LOG6[0]: s_connect: connecting 93.184.220.29:80
2018.11.09 14:39:56 LOG7[0]: s_connect: s_poll_wait 93.184.220.29:80:
waiting 10 seconds
2018.11.09 14:39:56 LOG5[0]: s_connect: connected 93.184.220.29:80
2018.11.09 14:39:56 LOG7[0]: OCSP: Connected ocsp.digicert.com:80
2018.11.09 14:39:56 LOG7[0]: OCSP: Response received
2018.11.09 14:39:56 LOG6[0]: OCSP: Status: good
2018.11.09 14:39:56 LOG6[0]: OCSP: This update: Nov  9 00:00:00 2018 GMT
2018.11.09 14:39:56 LOG6[0]: OCSP: Next update: Nov 16 00:00:00 2018 GMT
2018.11.09 14:39:56 LOG5[0]: OCSP: Certificate accepted
2018.11.09 14:39:56 LOG6[0]: Certificate accepted at depth=1: C=US,
O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
2018.11.09 14:39:56 LOG7[0]: Verification started at depth=0: C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com
2018.11.09 14:39:56 LOG7[0]: CERT: Pre-verification succeeded
2018.11.09 14:39:56 LOG6[0]: CERT: Host name "outlook.office365.com"
matched with "*.office365.com"
2018.11.09 14:39:56 LOG5[0]: OCSP: Connecting the AIA responder "
http://ocspx.digicert.com"
2018.11.09 14:39:56 LOG6[0]: s_connect: connecting 93.184.220.29:80
2018.11.09 14:39:56 LOG7[0]: s_connect: s_poll_wait 93.184.220.29:80:
waiting 10 seconds
2018.11.09 14:39:57 LOG5[0]: s_connect: connected 93.184.220.29:80
2018.11.09 14:39:57 LOG7[0]: OCSP: Connected ocspx.digicert.com:80
2018.11.09 14:39:57 LOG7[0]: OCSP: Response received
2018.11.09 14:39:57 LOG3[0]: OCSP: Responder error: 6: unauthorized
2018.11.09 14:39:57 LOG4[0]: Rejected by OCSP at depth=0: C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com
2018.11.09 14:39:57 LOG7[0]: Remove session callback
2018.11.09 14:39:57 LOG7[0]: TLS alert (write): fatal: handshake failure
2018.11.09 14:39:57 LOG3[0]: SSL_connect: 1416F086: error:1416F086:SSL
routines:tls_process_server_certificate:certificate verify failed


*OCSPaia* = no

2018.11.09 14:41:17 LOG6[0]: SNI: sending servername: outlook.office365.com
2018.11.09 14:41:17 LOG6[0]: Peer certificate required
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): before SSL initialization
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS write client
hello
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS write client
hello
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS read server
hello
2018.11.09 14:41:17 LOG7[0]: Verification started at depth=2: C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
2018.11.09 14:41:17 LOG7[0]: CERT: Pre-verification succeeded
2018.11.09 14:41:17 LOG6[0]: Certificate accepted at depth=2: C=US,
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
2018.11.09 14:41:17 LOG7[0]: Verification started at depth=1: C=US,
O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
2018.11.09 14:41:17 LOG7[0]: CERT: Pre-verification succeeded
2018.11.09 14:41:17 LOG6[0]: Certificate accepted at depth=1: C=US,
O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
2018.11.09 14:41:17 LOG7[0]: Verification started at depth=0: C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com
2018.11.09 14:41:17 LOG7[0]: CERT: Pre-verification succeeded
2018.11.09 14:41:17 LOG6[0]: CERT: Host name "outlook.office365.com"
matched with "*.office365.com"
2018.11.09 14:41:17 LOG5[0]: Certificate accepted at depth=0: C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS read server
certificate
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS read server key
exchange
2018.11.09 14:41:17 LOG6[0]: Client certificate not requested
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS read server done
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS write client
key exchange
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS write change
cipher spec
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS write finished
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS write finished
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS read change
cipher spec
2018.11.09 14:41:17 LOG7[0]: TLS state (connect): SSLv3/TLS read finished
2018.11.09 14:41:17 LOG7[0]: New session callback
2018.11.09 14:41:17 LOG7[0]: Peer certificate was cached (4683 bytes)
2018.11.09 14:41:17 LOG7[0]:      1 client connect(s) requested
2018.11.09 14:41:17 LOG7[0]:      1 client connect(s) succeeded
2018.11.09 14:41:17 LOG7[0]:      0 client renegotiation(s) requested
2018.11.09 14:41:17 LOG7[0]:      0 session reuse(s)
2018.11.09 14:41:17 LOG6[0]: TLS connected: new session negotiated
2018.11.09 14:41:17 LOG6[0]: TLSv1.2 ciphersuite:
ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption)
2018.11.09 14:41:17 LOG7[0]: Compression: null, expansion: null
2018.11.09 14:41:17 LOG6[0]: TLS socket closed (read hangup)
2018.11.09 14:41:17 LOG7[0]: Sent socket write shutdown
2018.11.09 14:41:17 LOG6[0]: Read socket closed (readsocket)
2018.11.09 14:41:17 LOG7[0]: Sending close_notify alert
2018.11.09 14:41:17 LOG7[0]: TLS alert (write): warning: close notify
2018.11.09 14:41:17 LOG6[0]: SSL_shutdown successfully sent close_notify
alert
2018.11.09 14:41:17 LOG5[0]: Connection closed: 24 byte(s) sent to TLS, 386
byte(s) sent to socket
2018.11.09 14:41:17 LOG7[0]: Remote descriptor (FD=8) closed
2018.11.09 14:41:17 LOG7[0]: Local descriptor (FD=3) closed
2018.11.09 14:41:17 LOG7[0]: Service [imaps] finished (0 left)

Regards,
Flo

On Fri, Nov 9, 2018 at 1:02 PM <[email protected]> wrote:

> Thanks for your suggestion, I just tried but nothing changed.
>
> Il 9 novembre 2018 alle 12.44 Flo Rance <[email protected]> ha scritto:
>
> Hi,
>
> Damn, it seems that there's a serious issue with OCSP and microsoft
> certificates.
>
>
> You can try to put the option: *OCSPaia* = no to see if it fixes the
> issue, but it seems that it needs further investigations.
>
> https://www.stunnel.org/static/stunnel.html
>
> Regards,
> Flo
>
> On Fri, Nov 9, 2018 at 12:36 PM < [email protected]> wrote:
>
> Hello,
>
> I'm encountering an issue while using sTunnel with an Office365 account.
>
> sTunnel worked properly for a few months, while it gived an error with
> certificates since yesterday, whilst didn't change anything in the
> configuration.
>
> This is our configuration:
>
> [pop3s]
> client = yes
> accept = 127.0.0.1:2001
> connect = outlook.office365.com:995
> CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem
> checkHost = outlook.office365.com
> verifyChain = yes
> OCSPaia = yes
>
> This is what we get in the log:
>
> 2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s)
> 2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=---
> 2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) from
> 127.0.0.1:49619
> 2018.11.09 11:34:09 LOG7[main]: Creating a new thread
> 2018.11.09 11:34:09 LOG7[main]: New thread created
> 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started
> 2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672)
> 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket
> 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection from
> 127.0.0.1:49619
> 2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0
> 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 40.101.9.178:995
> 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 40.101.9.178:995:
> waiting 10 seconds
> 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 40.101.9.178:995
> 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server from
> 172.31.20.23:49620
> 2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668)
> 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket
> 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized
> 2018.11.09 11:34:09 LOG6[30]: SNI: sending servername:
> outlook.office365.com
> 2018.11.09 11:34:09 LOG6[30]: Peer certificate required
> 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect
> initialization
> 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client
> hello A
> 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello
> A
> 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US,
> O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
> 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded
> 2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate
> 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US,
> O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
> 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US,
> O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
> 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded
> 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "
> http://ocsp.digicert.com"
> 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80
> 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80:
> waiting 10 seconds
> 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80
> 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocsp.digicert.com:80
> 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received
> 2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good
> 2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT
> 2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT
> 2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted
> 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US,
> O=DigiCert Inc, CN=DigiCert Cloud Services CA-1
> 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US,
> ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com
> 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded
> 2018.11.09 11:34:09 LOG6[30]: CERT: Host name "outlook.office365.com"
> matched with "*.office365.com"
> 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "
> http://ocspx.digicert.com"
> 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80
> 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80:
> waiting 10 seconds
> 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80
> 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocspx.digicert.com:80
> 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received
> 2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized
> 2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US,
> ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com
> 2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure
> 2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL
> routines:ssl3_get_server_certificate:certificate verify failed
> 2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0
> byte(s) sent to socket
> 2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for
> session connect address
> 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed
> 2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed
> 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left)
>
>
> Can you please help me?
>
> Thanks in advance!
> _______________________________________________
> stunnel-users mailing list
> [email protected]
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>
> _______________________________________________
> stunnel-users mailing list
> [email protected]
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>

_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.