Re: https to https proxy
"Eric Eberhard" <[email protected]> Mon, 19 Aug 2019 16:55:15 -0700
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. --===============3981377607971200709== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0B33_01D556AE.E0E240C0" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_0B33_01D556AE.E0E240C0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I'll bite - probably missing something. Why not have your application output clear text to stunnel and set stunnel to TLSv1.2? In other words, drop the SSL from your application. If that won't work I think you can do it with two stunnels (I got it to work once before I did the above). One accepts SSLv3 and outputs clear text . it is the client=no option. The output goes to a stunnel that is client=yes and is set to TLSv1.2 . which outputs to your final destination. The output from the client=no would be to localhost on some port that fires the second stunnel. I suspect you have to use different port numbers. All guesses as I am not sure exactly what you are doing . but if it helps, great :) Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Monday, August 19, 2019 11:21 AM To: [email protected] Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan ------=_NextPart_000_0B33_01D556AE.E0E240C0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 = (filtered medium)"><style><!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Verdana; panose-1:2 11 6 4 3 5 4 4 2 4;} @font-face {font-family:"Trebuchet MS"; panose-1:2 11 6 3 2 2 2 2 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} p {mso-style-priority:99; mso-margin-top-alt:auto; margin-right:0in; mso-margin-bottom-alt:auto; margin-left:0in; font-size:12.0pt; font-family:"Times New Roman",serif;} span.EmailStyle17 {mso-style-type:personal; font-family:"Calibri",sans-serif; color:windowtext;} span.EmailStyle20 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DEN-US = link=3D"#0563C1" vlink=3D"#954F72"><div class=3DWordSection1><p = class=3DMsoNormal><span style=3D'color:#1F497D'>I’ll bite – = probably missing something. Why not have your application output = clear text to stunnel and set stunnel to TLSv1.2? In other words, = drop the SSL from your application.<o:p></o:p></span></p><p = class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'color:#1F497D'>If that won’t work = I think you can do it with two stunnels (I got it to work once before I = did the above). One accepts SSLv3 and outputs clear text … = it is the client=3Dno option. The output goes to a stunnel that is = client=3Dyes and is set to TLSv1.2 … which outputs to your final = destination.<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'color:#1F497D'>The output from the = client=3Dno would be to localhost on some port that fires the second = stunnel.<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'color:#1F497D'>I suspect you have to = use different port numbers.<o:p></o:p></span></p><p = class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'color:#1F497D'>All guesses as I am not = sure exactly what you are doing … but if it helps, great = </span><span style=3D'font-family:Wingdings;color:#1F497D'>J</span><span = style=3D'color:#1F497D'><o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p><p = class=3DMsoNormal><span = style=3D'color:#1F497D'>Eric<o:p></o:p></span></p><p = class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p><p = class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p><div><div = style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in'><p class=3DMsoNormal><b>From:</b> stunnel-users = [mailto:[email protected]] <b>On Behalf Of </b>Daniel = Trickett<br><b>Sent:</b> Monday, August 19, 2019 11:21 AM<br><b>To:</b> = [email protected]<br><b>Subject:</b> [stunnel-users] https to = https proxy<o:p></o:p></p></div></div><p = class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal>Hi,<o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Our punchout = vendor switched their site to only accept tls 1.2 over the weekend. = Unfortunately our application will only support SSL. <o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>We are using = stunnel with other vendors but can control the inbound host name. This = recent one is one we can’t manage as it is the software = provider.<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal>I found a solution for doing https to https. I’m = unclear how I get the first https traffic to route to stunnel as the = initial call will be from the application will be to the external = host..<o:p></o:p></p><p class=3DMsoNormal>Any thoughts on whether this = would work for my situation? Appreciate any = thoughts..<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p = style=3D'mso-margin-top-alt:9.75pt;margin-right:0in;margin-bottom:9.75pt;= margin-left:0in;background:white'><span = style=3D'font-size:10.0pt;font-family:"Trebuchet = MS",sans-serif;color:#333333'>[Tunnel_in]<br>client =3D yes<br>accept = =3D <em><span style=3D'font-family:"Trebuchet = MS",sans-serif'>host_ip</span></em>:443<br>connect =3D = localhost:54321<o:p></o:p></span></p><p = style=3D'mso-margin-top-alt:9.75pt;margin-right:0in;margin-bottom:9.75pt;= margin-left:0in;background:white;font-variant-ligatures: = normal;font-variant-caps: normal;orphans: 2;widows: = 2;-webkit-text-stroke-width: 0px;text-decoration-style: = initial;text-decoration-color: initial;word-spacing:0px'><span = style=3D'font-size:10.0pt;font-family:"Trebuchet = MS",sans-serif;color:#333333'>[Tunnel_out]<br>client =3D no<br>accept = =3D localhost:54321<br>connect =3D <em><span = style=3D'font-family:"Trebuchet = MS",sans-serif'>externalhostname</span></em>:443<o:p></o:p></span></p><p = class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal><span = style=3D'font-family:"Verdana",sans-serif;color:black'>Best = regards,<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Verdana",sans-serif;color:black'><o= :p> </o:p></span></p><p class=3DMsoNormal><span = style=3D'font-family:"Verdana",sans-serif;color:black'>Dan<o:p></o:p></sp= an></p><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Verdana",sans-serif;color:black'><o= :p> </o:p></span></p><p = class=3DMsoNormal><o:p> </o:p></p></div></body></html> ------=_NextPart_000_0B33_01D556AE.E0E240C0-- --===============3981377607971200709== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --===============3981377607971200709==--