Re: https to https proxy

Vincent Deschenes <[email protected]> Tue, 20 Aug 2019 17:13:37 +0000
Newsgroups gmane.network.stunnel.user
Message-ID <YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0@YTBPR01MB3886.CANPRD01.PROD.OUTLOOK.COM>
--===============4908110918338216205==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_"

--_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

You may also have to hack your application server host file to redirect the=
 name to the IP of your stunnel server.


From: stunnel-users <[email protected]> On Behalf Of Eric E=
berhard
Sent: Monday, 19 August 2019 7:55 PM
To: 'Daniel Trickett' <[email protected]>; stunnel-users@s=
tunnel.org
Subject: Re: [stunnel-users] https to https proxy

I'll bite - probably missing something.  Why not have your application outp=
ut clear text to stunnel and set stunnel to TLSv1.2?  In other words, drop =
the SSL from your application.

If that won't work I think you can do it with two stunnels (I got it to wor=
k once before I did the above).  One accepts SSLv3 and outputs clear text .=
.. it is the client=3Dno option.  The output goes to a stunnel that is clie=
nt=3Dyes and is set to TLSv1.2 ... which outputs to your final destination.

The output from the client=3Dno would be to localhost on some port that fir=
es the second stunnel.

I suspect you have to use different port numbers.

All guesses as I am not sure exactly what you are doing ... but if it helps=
, great :)

Eric


From: stunnel-users [mailto:[email protected]] On Behalf Of=
 Daniel Trickett
Sent: Monday, August 19, 2019 11:21 AM
To: [email protected]<mailto:[email protected]>
Subject: [stunnel-users] https to https proxy

Hi,

Our punchout vendor switched their site to only accept tls 1.2 over the wee=
kend. Unfortunately our application will only support SSL.

We are using stunnel with other vendors but can control the inbound host na=
me. This recent one is one we can't manage as it is the software provider.

I found a solution for doing https to https. I'm unclear how I get the firs=
t https traffic to route to stunnel as the initial call will be from the ap=
plication will be to the external host..
Any thoughts on whether this would work for my situation?  Appreciate any t=
houghts..


[Tunnel_in]
client =3D yes
accept =3D host_ip:443
connect =3D localhost:54321

[Tunnel_out]
client =3D no
accept =3D localhost:54321
connect =3D externalhostname:443



Best regards,

Dan



--_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Verdana;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:"Trebuchet MS";
	panose-1:2 11 6 3 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-style-priority:99;
	mso-margin-top-alt:auto;
	margin-right:0cm;
	mso-margin-bottom-alt:auto;
	margin-left:0cm;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
span.EmailStyle19
	{mso-style-type:personal;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
span.EmailStyle20
	{mso-style-type:personal;
	font-family:"Calibri",sans-serif;
	color:#1F497D;}
span.EmailStyle23
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-AU" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span lang=3D"EN-CA" style=3D"mso-fareast-language:E=
N-US">You may also have to hack your application server host file to redire=
ct the name to the IP of your stunnel server.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-CA" style=3D"mso-fareast-language:E=
N-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-CA" style=3D"mso-fareast-language:E=
N-US"><o:p>&nbsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"EN-US">From:</span></b><span lang=
=3D"EN-US"> stunnel-users &lt;[email protected]&gt;
<b>On Behalf Of </b>Eric Eberhard<br>
<b>Sent:</b> Monday, 19 August 2019 7:55 PM<br>
<b>To:</b> 'Daniel Trickett' &lt;[email protected]&gt;; st=
[email protected]<br>
<b>Subject:</b> Re: [stunnel-users] https to https proxy<o:p></o:p></span><=
/p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">I&#8217=
;ll bite &#8211; probably missing something.&nbsp; Why not have your applic=
ation output clear text to stunnel and set stunnel to TLSv1.2?&nbsp; In oth=
er words, drop the SSL from your application.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">If that=
 won&#8217;t work I think you can do it with two stunnels (I got it to work=
 once before I did the above).&nbsp; One accepts SSLv3 and outputs clear te=
xt &#8230; it is the client=3Dno option.&nbsp; The output goes
 to a stunnel that is client=3Dyes and is set to TLSv1.2 &#8230; which outp=
uts to your final destination.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">The out=
put from the client=3Dno would be to localhost on some port that fires the =
second stunnel.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">I suspe=
ct you have to use different port numbers.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">All gue=
sses as I am not sure exactly what you are doing &#8230; but if it helps, g=
reat
</span><span lang=3D"EN-US" style=3D"font-family:Wingdings;color:#1F497D">J=
</span><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">Eric<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"EN-US">From:</span></b><span lang=
=3D"EN-US"> stunnel-users [<a href=3D"mailto:stunnel-users-bounces@stunnel.=
org">mailto:[email protected]</a>]
<b>On Behalf Of </b>Daniel Trickett<br>
<b>Sent:</b> Monday, August 19, 2019 11:21 AM<br>
<b>To:</b> <a href=3D"mailto:[email protected]">stunnel-users@stunn=
el.org</a><br>
<b>Subject:</b> [stunnel-users] https to https proxy<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Hi,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Our punchout vendor switched th=
eir site to only accept tls 1.2 over the weekend. Unfortunately our applica=
tion will only support SSL.
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">We are using stunnel with other=
 vendors but can control the inbound host name. This recent one is one we c=
an&#8217;t manage as it is the software provider.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">I found a solution for doing ht=
tps to https. I&#8217;m unclear how I get the first https traffic to route =
to stunnel as the initial call will be from the application will be to the =
external host..<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Any thoughts on whether this wo=
uld work for my situation?&nbsp; Appreciate any thoughts..<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p style=3D"mso-margin-top-alt:9.75pt;margin-right:0cm;margin-bottom:9.75pt=
;margin-left:0cm;background:white">
<span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:&quot;Trebuchet =
MS&quot;,sans-serif;color:#333333">[Tunnel_in]<br>
client =3D yes<br>
accept =3D&nbsp;<em><span style=3D"font-family:&quot;Trebuchet MS&quot;,san=
s-serif">host_ip</span></em>:443<br>
connect =3D localhost:54321<o:p></o:p></span></p>
<p style=3D"mso-margin-top-alt:9.75pt;margin-right:0cm;margin-bottom:9.75pt=
;margin-left:0cm;background:white;font-variant-ligatures: normal;font-varia=
nt-caps: normal;orphans: 2;widows: 2;-webkit-text-stroke-width: 0px;text-de=
coration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:&quot;Trebuchet =
MS&quot;,sans-serif;color:#333333">[Tunnel_out]<br>
client =3D no<br>
accept =3D localhost:54321<br>
connect =3D&nbsp;<em><span style=3D"font-family:&quot;Trebuchet MS&quot;,sa=
ns-serif">externalhostname</span></em>:443<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:&quot;Verd=
ana&quot;,sans-serif;color:black">Best regards,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:9.0pt;font-f=
amily:&quot;Verdana&quot;,sans-serif;color:black"><o:p>&nbsp;</o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:&quot;Verd=
ana&quot;,sans-serif;color:black">Dan<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:9.0pt;font-f=
amily:&quot;Verdana&quot;,sans-serif;color:black"><o:p>&nbsp;</o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p>&nbsp;</o:p></span></p>
</div>
</body>
</html>

--_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_--

--===============4908110918338216205==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

--===============4908110918338216205==--