Re: stunnel-users Digest, Vol 181, Issue 3
"Eric Eberhard" <[email protected]> Thu, 22 Aug 2019 12:59:31 -0700
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. --===============8178647099188884928== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0CEF_01D558E9.72EA4E40" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_0CEF_01D558E9.72EA4E40 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Thanks :) -- I think Daniel can solve his problem. If for some reason = he cannot make the app server output clear text he has to do it as you = laid out. If he can, he can do one stunnel with TLSv1.2 by making the = app output clear text. Both will work and should be secure. = I=E2=80=99d do the latter is possible =E2=80=93 way less overhead doing = encryption. We use similar logic with one stunnel and have millions of = transactions daily (XML not cXML but that does not matter =E2=80=93 ours = are often fairly large as in 100s of MB). Encrypting clear to SSLv3 = then back to clear to TLSv1.2 is three encryptions along that path = instead of one by making the app output clear text. The app will also = shrink if that matters as it won=E2=80=99t need encryption code. =20 E =20 From: stunnel-users [mailto:[email protected]] On Behalf = Of Brent Kimberley Sent: Thursday, August 22, 2019 7:29 AM To: [email protected] Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 =20 >>there is no reason to connect to localhost with any security =20 Should server/interface consolidation trigger functional/technical = rework prior to go live? =20 As per the diagram:=20 the app server node x TLS engine node interface is wrapped in SSL=20 the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 =20 >> SNI flag (RFC 3546) Good catch.=20 =20 =20 ---------------------------------------------------------------------- =20 Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <[email protected] <mailto:[email protected]> > To: "'Brent Kimberley'" <[email protected] = <mailto:[email protected]> >, <[email protected] <mailto:[email protected]> > =20 Thank you -- what I had in mind but I am not that fancy with the setups = as we use one. We go from our application in clear text to stunnel = TLSv1.2 which is clearly easier. I did make this work for a short while = a long time ago and did not save the files. Plus no may people's horror = we use inetd. Of course we only transfer 4 million XML docs per day and = handle 10 million Web calls and another million connections for credit = cards, etc. I have been told that if I had serious volume inetd is = slower -:) but I have not noticed enough of a slowdown to matter. And = inetd (at least on an IBM AIX server) is dead reliable and easy. =20 As a curiosity -- as I often see people coding unnecessarily -- there is = no reason to connect to localhost with any security at all unless your = app can only output SSLv3 which would imply a 3rd party vendor. The = traffic never hits the network in any way -- not even the network card = -- it goes directly to/from the TCP/IP stack which is why I mentioned = just making the app send clear text to one stunnel that outputs TLSv1.2 = ... if possible (may not be if it is something you don't have source = to). =20 Eric =20 -----Original Message----- From: Brent Kimberley [mailto:[email protected] = <mailto:[email protected]> ]=20 Sent: Tuesday, August 20, 2019 6:42 AM To: [email protected] <mailto:[email protected]>=20 Cc: [email protected] = <mailto:[email protected]> ; [email protected] = <mailto:[email protected]>=20 Subject: Re: stunnel-users Digest, Vol 181, Issue 1 =20 Your mileage may vary. =20 #########################################################################= ###### # From internal application to external host = #########################################################################= ###### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] = #########################################################################= ###### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal = terminator] ---http---> [external Initiator] # [external Initiator] = ---tls---> [external terminator] = #########################################################################= ###### # https://www.stunnel.org/static/stunnel.html = <https://www.stunnel.org/static/stunnel.html%20> = #########################################################################= ######=20 =20 [Internal_Terminator] options =3D SSLv3 client =3D no accept =3D host_ip:443 connect =3D localhost:54321 CAfile =3D int_init_wallet.pem cert =3D int_term_pub.pem key =3D int_term_priv.pem =20 [External_Initiator] options =3D SINGLE_ECDH_USE options =3D SINGLE_DH_USE ciphers =3D ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify =3D 3? client =3D yes options =3D TLSv1.2 accept =3D localhost:54321 connect =3D externalhostname:443 verifyChain =3D yes renegotiation =3D no CAfile =3D ext_term_wallet.pem cert =3D ext_init_pub.pem key =3D ext_init_priv.pem =20 =20 ---------------------------------------------------------------------- =20 Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <[email protected] = <mailto:[email protected]> > To: "[email protected] <mailto:[email protected]> " = <[email protected] <mailto:[email protected]> > Subject: [stunnel-users] https to https proxy =20 Hi, =20 Our punchout vendor switched their site to only accept tls 1.2 over the = weekend. Unfortunately our application will only support SSL. =20 We are using stunnel with other vendors but can control the inbound host = name. This recent one is one we can't manage as it is the software = provider. =20 I found a solution for doing https to https. I'm unclear how I get the = first https traffic to route to stunnel as the initial call will be from = the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate = any thoughts.. =20 =20 [Tunnel_in] client =3D yes accept =3D host_ip:443 connect =3D localhost:54321 =20 [Tunnel_out] client =3D no accept =3D localhost:54321 connect =3D externalhostname:443 =20 =20 =20 Best regards, =20 Dan =20 ------=_NextPart_000_0CEF_01D558E9.72EA4E40 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta = name=3DGenerator content=3D"Microsoft Word 15 (filtered = medium)"><style><!-- /* Font Definitions */ @font-face {font-family:Helvetica; panose-1:2 11 6 4 2 2 2 2 2 4;} @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman",serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue = vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'= >Thanks </span><span = style=3D'font-size:11.0pt;font-family:Wingdings;color:#1F497D'>J</span><s= pan = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'= > -- I think Daniel can solve his problem.=C2=A0 If for some reason he = cannot make the app server output clear text he has to do it as you laid = out.=C2=A0 If he can, he can do one stunnel with TLSv1.2 by making the = app output clear text.=C2=A0 Both will work and should be secure.=C2=A0 = I=E2=80=99d do the latter is possible =E2=80=93 way less overhead doing = encryption.=C2=A0 We use similar logic with one stunnel and have = millions of transactions daily (XML not cXML but that does not matter = =E2=80=93 ours are often fairly large as in 100s of MB).=C2=A0 = Encrypting clear to SSLv3 then back to clear to TLSv1.2 is three = encryptions along that path instead of one by making the app output = clear text.=C2=A0 The app will also shrink if that matters as it = won=E2=80=99t need encryption code.<o:p></o:p></span></p><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'= ><o:p> </o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'= >E<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'= ><o:p> </o:p></span></p><div><div = style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in'><p class=3DMsoNormal><b><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span><= /b><span style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'> = stunnel-users [mailto:[email protected]] <b>On Behalf Of = </b>Brent Kimberley<br><b>Sent:</b> Thursday, August 22, 2019 7:29 = AM<br><b>To:</b> [email protected]<br><b>Subject:</b> Re: = [stunnel-users] stunnel-users Digest, Vol 181, Issue = 3<o:p></o:p></span></p></div></div><p = class=3DMsoNormal><o:p> </o:p></p><div><div><p = class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'>>><span = style=3D'color:#26282A'>there is no reason to connect to localhost with = any security</span><o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'><o:p> </o:p></span></p>= </div><div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif;color:black'>Should = server/interface consolidation trigger functional/technical rework prior = to go live?</span><span = style=3D'font-family:"Helvetica",sans-serif'><o:p></o:p></span></p></div>= <div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'><o:p> </o:p></span></p>= </div><div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif;color:#26282A'>As per the = diagram: </span><span = style=3D'font-family:"Helvetica",sans-serif'><o:p></o:p></span></p></div>= <div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif;color:#26282A'> = the app server node x TLS engine node interface is wrapped in = SSL </span><span = style=3D'font-family:"Helvetica",sans-serif'><o:p></o:p></span></p></div>= <div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif;color:#26282A'> = the internal localhost x localhost interface is in the = clear</span><span = style=3D'font-family:"Helvetica",sans-serif'><o:p></o:p></span></p></div>= <div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif;color:#26282A'> = the TLS engine node x punchout-vendor node is wrapped in = TLSv1.2</span><span = style=3D'font-family:"Helvetica",sans-serif'><o:p></o:p></span></p></div>= <div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'><o:p> </o:p></span></p>= </div><div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'>>> SNI flag = (RFC 3546)<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'>Good = catch. <o:p></o:p></span></p></div><div><div><div><p = class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'><o:p> </o:p></span></p>= </div></div></div><div><p class=3DMsoNormal><span = style=3D'font-family:"Helvetica",sans-serif'><o:p> </o:p></span></p>= </div></div><div id=3D"ydp8b198da9yahoo_quoted_6588234430"><div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>----------------------------------------------------------------------= <o:p></o:p></span></p></div><div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Message: 1<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Date: Wed, 21 Aug 2019 08:01:08 = -0700<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>From: "Eric Eberhard" <<a = href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>To: "'Brent Kimberley'" <<a = href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>>,<o:p></o:p></span></= p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'> <<a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>><o:p></o:p></span></p>= </div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Thank you -- what I had in mind but I am not that fancy with the = setups as we use one. We go from our application in clear text to = stunnel TLSv1.2 which is clearly easier. I did make this work for = a short while a long time ago and did not save the files. Plus no = may people's horror we use inetd. Of course we only transfer 4 = million XML docs per day and handle 10 million Web calls and another = million connections for credit cards, etc. I have been told that = if I had serious volume inetd is slower -:) but I have not noticed = enough of a slowdown to matter. And inetd (at least on an IBM AIX = server) is dead reliable and easy.<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>As a curiosity -- as I often see people coding unnecessarily -- there = is no reason to connect to localhost with any security at all unless = your app can only output SSLv3 which would imply a 3rd party = vendor. The traffic never hits the network in any way -- not even = the network card -- it goes directly to/from the TCP/IP stack which is = why I mentioned just making the app send clear text to one stunnel that = outputs TLSv1.2 ... if possible (may not be if it is something you don't = have source to).<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>-----Original Message-----<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>From: Brent Kimberley [mailto:<a = href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>] = <o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Sent: Tuesday, August 20, 2019 6:42 = AM<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>To: <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><o:p></o:p></span></p></di= v><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Cc: <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>; <a = href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><o:p></o:p></span></p></div><div><= p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Subject: Re: stunnel-users Digest, Vol 181, Issue = 1<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Your mileage may vary.<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>######################################################################= #########<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'># From internal application to external host = #########################################################################= ######<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'># [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] = #########################################################################= ######<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'># [internal_initiator] ---ssl---> [Internal = terminator] # [Internal terminator] ---http---> [external Initiator] = # [external Initiator] ---tls---> [external terminator] = #########################################################################= ######<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'># <a href=3D"https://www.stunnel.org/static/stunnel.html%20" = target=3D"_blank">https://www.stunnel.org/static/stunnel.html = </a>#####################################################################= ########## <o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>[Internal_Terminator]<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>options =3D SSLv3<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>client =3D no<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>accept =3D host_ip:443<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>connect =3D localhost:54321<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>CAfile =3D = int_init_wallet.pem<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>cert =3D = int_term_pub.pem<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>key =3D = int_term_priv.pem<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>[External_Initiator]<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>options =3D SINGLE_ECDH_USE<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>options =3D SINGLE_DH_USE<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>ciphers =3D = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256<o:p></o:p></span>= </p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>verify =3D 3?<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>client =3D yes<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>options =3D TLSv1.2<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>accept =3D localhost:54321<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>connect =3D externalhostname:443<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>verifyChain =3D yes<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>renegotiation =3D no<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>CAfile =3D = ext_term_wallet.pem<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>cert =3D = ext_init_pub.pem<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>key =3D = ext_init_priv.pem<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>----------------------------------------------------------------------= <o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Date: Mon, 19 Aug 2019 18:21:18 = +0000<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>From: Daniel Trickett <<a = href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>><o:p></o:p></= span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>To: "<a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>" <<a = href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>><o:p></o:p></span></p>= </div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Subject: [stunnel-users] https to https = proxy<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Our punchout vendor switched their site to only accept tls 1.2 over = the weekend. Unfortunately our application will only support = SSL.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>We are using stunnel with other vendors but can control the inbound = host name. This recent one is one we can't manage as it is the software = provider.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>I found a solution for doing https to https. I'm unclear how I get = the first https traffic to route to stunnel as the initial call will be = from the application will be to the external = host..<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Any thoughts on whether this would work for my situation? = Appreciate any thoughts..<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>[Tunnel_in]<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>client =3D yes<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>accept =3D host_ip:443<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>connect =3D localhost:54321<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>[Tunnel_out]<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>client =3D no<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>accept =3D localhost:54321<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>connect =3D externalhostname:443<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Best regards,<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'>Dan<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282= A'><o:p> </o:p></span></p></div></div></div></div></div></body></htm= l> ------=_NextPart_000_0CEF_01D558E9.72EA4E40-- --===============8178647099188884928== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --===============8178647099188884928==--