Re: https to https proxy
Vincent Deschenes <[email protected]> Tue, 20 Aug 2019 17:13:37 +0000
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0@YTBPR01MB3886.CANPRD01.PROD.OUTLOOK.COM> |
--===============4908110918338216205== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_" --_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable You may also have to hack your application server host file to redirect the= name to the IP of your stunnel server. From: stunnel-users <[email protected]> On Behalf Of Eric E= berhard Sent: Monday, 19 August 2019 7:55 PM To: 'Daniel Trickett' <[email protected]>; stunnel-users@s= tunnel.org Subject: Re: [stunnel-users] https to https proxy I'll bite - probably missing something. Why not have your application outp= ut clear text to stunnel and set stunnel to TLSv1.2? In other words, drop = the SSL from your application. If that won't work I think you can do it with two stunnels (I got it to wor= k once before I did the above). One accepts SSLv3 and outputs clear text .= .. it is the client=3Dno option. The output goes to a stunnel that is clie= nt=3Dyes and is set to TLSv1.2 ... which outputs to your final destination. The output from the client=3Dno would be to localhost on some port that fir= es the second stunnel. I suspect you have to use different port numbers. All guesses as I am not sure exactly what you are doing ... but if it helps= , great :) Eric From: stunnel-users [mailto:[email protected]] On Behalf Of= Daniel Trickett Sent: Monday, August 19, 2019 11:21 AM To: [email protected]<mailto:[email protected]> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the wee= kend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host na= me. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the firs= t https traffic to route to stunnel as the initial call will be from the ap= plication will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any t= houghts.. [Tunnel_in] client =3D yes accept =3D host_ip:443 connect =3D localhost:54321 [Tunnel_out] client =3D no accept =3D localhost:54321 connect =3D externalhostname:443 Best regards, Dan --_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Verdana; panose-1:2 11 6 4 3 5 4 4 2 4;} @font-face {font-family:"Trebuchet MS"; panose-1:2 11 6 3 2 2 2 2 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} p.msonormal0, li.msonormal0, div.msonormal0 {mso-style-name:msonormal; mso-style-priority:99; mso-margin-top-alt:auto; margin-right:0cm; mso-margin-bottom-alt:auto; margin-left:0cm; font-size:12.0pt; font-family:"Times New Roman",serif;} span.EmailStyle19 {mso-style-type:personal; font-family:"Calibri",sans-serif; color:windowtext;} span.EmailStyle20 {mso-style-type:personal; font-family:"Calibri",sans-serif; color:#1F497D;} span.EmailStyle23 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:612.0pt 792.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-AU" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span lang=3D"EN-CA" style=3D"mso-fareast-language:E= N-US">You may also have to hack your application server host file to redire= ct the name to the IP of your stunnel server.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-CA" style=3D"mso-fareast-language:E= N-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-CA" style=3D"mso-fareast-language:E= N-US"><o:p> </o:p></span></p> <div> <div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm = 0cm 0cm"> <p class=3D"MsoNormal"><b><span lang=3D"EN-US">From:</span></b><span lang= =3D"EN-US"> stunnel-users <[email protected]> <b>On Behalf Of </b>Eric Eberhard<br> <b>Sent:</b> Monday, 19 August 2019 7:55 PM<br> <b>To:</b> 'Daniel Trickett' <[email protected]>; st= [email protected]<br> <b>Subject:</b> Re: [stunnel-users] https to https proxy<o:p></o:p></span><= /p> </div> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">I’= ;ll bite – probably missing something. Why not have your applic= ation output clear text to stunnel and set stunnel to TLSv1.2? In oth= er words, drop the SSL from your application.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">If that= won’t work I think you can do it with two stunnels (I got it to work= once before I did the above). One accepts SSLv3 and outputs clear te= xt … it is the client=3Dno option. The output goes to a stunnel that is client=3Dyes and is set to TLSv1.2 … which outp= uts to your final destination.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">The out= put from the client=3Dno would be to localhost on some port that fires the = second stunnel.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">I suspe= ct you have to use different port numbers.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">All gue= sses as I am not sure exactly what you are doing … but if it helps, g= reat </span><span lang=3D"EN-US" style=3D"font-family:Wingdings;color:#1F497D">J= </span><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">Eric<o:= p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <div> <div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm = 0cm 0cm"> <p class=3D"MsoNormal"><b><span lang=3D"EN-US">From:</span></b><span lang= =3D"EN-US"> stunnel-users [<a href=3D"mailto:stunnel-users-bounces@stunnel.= org">mailto:[email protected]</a>] <b>On Behalf Of </b>Daniel Trickett<br> <b>Sent:</b> Monday, August 19, 2019 11:21 AM<br> <b>To:</b> <a href=3D"mailto:[email protected]">stunnel-users@stunn= el.org</a><br> <b>Subject:</b> [stunnel-users] https to https proxy<o:p></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Hi,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Our punchout vendor switched th= eir site to only accept tls 1.2 over the weekend. Unfortunately our applica= tion will only support SSL. <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">We are using stunnel with other= vendors but can control the inbound host name. This recent one is one we c= an’t manage as it is the software provider.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">I found a solution for doing ht= tps to https. I’m unclear how I get the first https traffic to route = to stunnel as the initial call will be from the application will be to the = external host..<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Any thoughts on whether this wo= uld work for my situation? Appreciate any thoughts..<o:p></o:p></span= ></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p style=3D"mso-margin-top-alt:9.75pt;margin-right:0cm;margin-bottom:9.75pt= ;margin-left:0cm;background:white"> <span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Trebuchet = MS",sans-serif;color:#333333">[Tunnel_in]<br> client =3D yes<br> accept =3D <em><span style=3D"font-family:"Trebuchet MS",san= s-serif">host_ip</span></em>:443<br> connect =3D localhost:54321<o:p></o:p></span></p> <p style=3D"mso-margin-top-alt:9.75pt;margin-right:0cm;margin-bottom:9.75pt= ;margin-left:0cm;background:white;font-variant-ligatures: normal;font-varia= nt-caps: normal;orphans: 2;widows: 2;-webkit-text-stroke-width: 0px;text-de= coration-style: initial;text-decoration-color: initial;word-spacing:0px"> <span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Trebuchet = MS",sans-serif;color:#333333">[Tunnel_out]<br> client =3D no<br> accept =3D localhost:54321<br> connect =3D <em><span style=3D"font-family:"Trebuchet MS",sa= ns-serif">externalhostname</span></em>:443<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Verd= ana",sans-serif;color:black">Best regards,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:9.0pt;font-f= amily:"Verdana",sans-serif;color:black"><o:p> </o:p></span><= /p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Verd= ana",sans-serif;color:black">Dan<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:9.0pt;font-f= amily:"Verdana",sans-serif;color:black"><o:p> </o:p></span><= /p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> </div> </body> </html> --_000_YTBPR01MB3886C42D0F0229FB7D72E2B5D9AB0YTBPR01MB3886CANP_-- --===============4908110918338216205== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --===============4908110918338216205==--