Re: [Newsletter/Marketing] RE: stunnel-users Digest, Vol 181, Issue 3
Daniel Trickett <[email protected]> Thu, 22 Aug 2019 22:38:03 +0000
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <AM5PR0601MB23230C0C057D838BF2D9A73886A50@AM5PR0601MB2323.eurprd06.prod.outlook.com> |
--===============4909416133916443449== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_AM5PR0601MB23230C0C057D838BF2D9A73886A50AM5PR0601MB2323_" --_000_AM5PR0601MB23230C0C057D838BF2D9A73886A50AM5PR0601MB2323_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi I did solve the issue with the solution as described in the first email in = the chain. Thanks for your comments and support. Get Outlook for Android<https://aka.ms/ghei36> ________________________________ From: Eric Eberhard <[email protected]> Sent: Thursday, August 22, 2019 3:59:31 PM To: 'Brent Kimberley' <[email protected]>; [email protected]= rg <[email protected]> Cc: Daniel Trickett <[email protected]> Subject: [Newsletter/Marketing] RE: [stunnel-users] stunnel-users Digest, V= ol 181, Issue 3 Thanks :) -- I think Daniel can solve his problem. If for some reason he c= annot make the app server output clear text he has to do it as you laid out= . If he can, he can do one stunnel with TLSv1.2 by making the app output c= lear text. Both will work and should be secure. I=92d do the latter is po= ssible =96 way less overhead doing encryption. We use similar logic with o= ne stunnel and have millions of transactions daily (XML not cXML but that d= oes not matter =96 ours are often fairly large as in 100s of MB). Encrypti= ng clear to SSLv3 then back to clear to TLSv1.2 is three encryptions along = that path instead of one by making the app output clear text. The app will= also shrink if that matters as it won=92t need encryption code. E From: stunnel-users [mailto:[email protected]] On Behalf Of= Brent Kimberley Sent: Thursday, August 22, 2019 7:29 AM To: [email protected] Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 >>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework p= rior to go live? As per the diagram: the app server node x TLS engine node interface is wrapped in SSL the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 >> SNI flag (RFC 3546) Good catch. ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <[email protected]<mailto:[email protected]>> To: "'Brent Kimberley'" <[email protected]<mailto:brent_kimberley@= rogers.com>>, <[email protected]<mailto:[email protected]>> Thank you -- what I had in mind but I am not that fancy with the setups as = we use one. We go from our application in clear text to stunnel TLSv1.2 wh= ich is clearly easier. I did make this work for a short while a long time = ago and did not save the files. Plus no may people's horror we use inetd. = Of course we only transfer 4 million XML docs per day and handle 10 millio= n Web calls and another million connections for credit cards, etc. I have = been told that if I had serious volume inetd is slower -:) but I have not n= oticed enough of a slowdown to matter. And inetd (at least on an IBM AIX s= erver) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no= reason to connect to localhost with any security at all unless your app ca= n only output SSLv3 which would imply a 3rd party vendor. The traffic neve= r hits the network in any way -- not even the network card -- it goes direc= tly to/from the TCP/IP stack which is why I mentioned just making the app s= end clear text to one stunnel that outputs TLSv1.2 ... if possible (may not= be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected]<mailto:brent_kimbe= [email protected]>] Sent: Tuesday, August 20, 2019 6:42 AM To: [email protected]<mailto:[email protected]> Cc: [email protected]<mailto:daniel.trickett@milliporesigm= a.com>; [email protected]<mailto:[email protected]> Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ###########################################################################= #### # From internal application to external host ##############################= ################################################# # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ####################= ########################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal termi= nator] ---http---> [external Initiator] # [external Initiator] ---tls---> = [external terminator] ####################################################= ########################### # https://www.stunnel.org/static/stunnel.html <https://clicktime.symantec.c= om/3hPKYmesDrxGuE2bv5e7rh6H2?u=3Dhttps%3A%2F%2Fwww.stunnel.org%2Fstatic%2Fs= tunnel.html%2520> #########################################################= ###################### [Internal_Terminator] options =3D SSLv3 client =3D no accept =3D host_ip:443 connect =3D localhost:54321 CAfile =3D int_init_wallet.pem cert =3D int_term_pub.pem key =3D int_term_priv.pem [External_Initiator] options =3D SINGLE_ECDH_USE options =3D SINGLE_DH_USE ciphers =3D ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify =3D 3? client =3D yes options =3D TLSv1.2 accept =3D localhost:54321 connect =3D externalhostname:443 verifyChain =3D yes renegotiation =3D no CAfile =3D ext_term_wallet.pem cert =3D ext_init_pub.pem key =3D ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <[email protected]<mailto:daniel.tri= [email protected]>> To: "[email protected]<mailto:[email protected]>" <stunnel-= [email protected]<mailto:[email protected]>> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the wee= kend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host na= me. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the firs= t https traffic to route to stunnel as the initial call will be from the ap= plication will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any t= houghts.. [Tunnel_in] client =3D yes accept =3D host_ip:443 connect =3D localhost:54321 [Tunnel_out] client =3D no accept =3D localhost:54321 connect =3D externalhostname:443 Best regards, Dan --_000_AM5PR0601MB23230C0C057D838BF2D9A73886A50AM5PR0601MB2323_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:Helvetica; panose-1:2 11 6 4 2 2 2 2 2 4;} @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman",serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-US" link=3D"blue" vlink=3D"purple"> <div dir=3D"auto" style=3D"direction: ltr; margin: 0; padding: 0; font-fami= ly: sans-serif; font-size: 11pt; color: black; "> Hi<br> <br> </div> <div dir=3D"auto" style=3D"direction: ltr; margin: 0; padding: 0; font-fami= ly: sans-serif; font-size: 11pt; color: black; "> I did solve the issue with the solution as described in the first email in = the chain. Thanks for your comments and support.<br> <br> </div> <div dir=3D"auto" style=3D"direction: ltr; margin: 0; padding: 0; font-fami= ly: sans-serif; font-size: 11pt; color: black; "> <span id=3D"OutlookSignature"> <div dir=3D"auto" style=3D"direction: ltr; margin: 0; padding: 0; font-fami= ly: sans-serif; font-size: 11pt; color: black; "> Get <a href=3D"https://aka.ms/ghei36">Outlook for Android</a></div> </span><br> </div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Eric Eberhard <fla= [email protected]><br> <b>Sent:</b> Thursday, August 22, 2019 3:59:31 PM<br> <b>To:</b> 'Brent Kimberley' <[email protected]>; stunnel-us= [email protected] <[email protected]><br> <b>Cc:</b> Daniel Trickett <[email protected]><br> <b>Subject:</b> [Newsletter/Marketing] RE: [stunnel-users] stunnel-users Di= gest, Vol 181, Issue 3</font> <div> </div> </div> <div> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:#1F497D">Thanks </span><span style=3D"font-size:11.0pt;font-family:Wingdings;color:#1F497D"= >J</span><span style=3D"font-size:11.0pt;font-family:"Calibri",sa= ns-serif;color:#1F497D"> -- I think Daniel can solve his problem. If = for some reason he cannot make the app server output clear text he has to do it as you laid out. If he can, he can do one= stunnel with TLSv1.2 by making the app output clear text. Both will = work and should be secure. I=92d do the latter is possible =96 way le= ss overhead doing encryption. We use similar logic with one stunnel and have millions of transactions daily (XML not cXML but= that does not matter =96 ours are often fairly large as in 100s of MB).&nb= sp; Encrypting clear to SSLv3 then back to clear to TLSv1.2 is three encryp= tions along that path instead of one by making the app output clear text. The app will also shrink if that m= atters as it won=92t need encryption code.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:#1F497D"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:#1F497D">E<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:#1F497D"><o:p> </o:p></span></p> <div> <div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"= ;Calibri",sans-serif">From:</span></b><span style=3D"font-size:11.0pt;= font-family:"Calibri",sans-serif"> stunnel-users [mailto:stunnel-= [email protected]] <b>On Behalf Of </b>Brent Kimberley<br> <b>Sent:</b> Thursday, August 22, 2019 7:29 AM<br> <b>To:</b> [email protected]<br> <b>Subject:</b> Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3<= o:p></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif">>><span style=3D"color:#26282A">there is no reason to connec= t to localhost with any security</span><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif;color:black">Should server/interface consolidation trigger function= al/technical rework prior to go live?</span><span style=3D"font-family:&quo= t;Helvetica",sans-serif"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif;color:#26282A">As per the diagram: </span><span style=3D"font-= family:"Helvetica",sans-serif"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif;color:#26282A"> the app server node x TLS engine n= ode interface is wrapped in SSL </span><span style=3D"font-family:&quo= t;Helvetica",sans-serif"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif;color:#26282A"> the internal localhost x localhost inte= rface is in the clear</span><span style=3D"font-family:"Helvetica"= ;,sans-serif"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif;color:#26282A"> the TLS engine node x punchout-vendor n= ode is wrapped in TLSv1.2</span><span style=3D"font-family:"Helvetica&= quot;,sans-serif"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif">>> SNI flag (RFC 3546)<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif">Good catch. <o:p></o:p></span></p> </div> <div> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif"><o:p> </o:p></span></p> </div> </div> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Helvetica",san= s-serif"><o:p> </o:p></span></p> </div> </div> <div id=3D"ydp8b198da9yahoo_quoted_6588234430"> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">-----------------------------------= -----------------------------------<o:p></o:p></span></p> </div> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Message: 1<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Date: Wed, 21 Aug 2019 08:01:08 -07= 00<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">From: "Eric Eberhard" <= ;<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</= a>><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">To: "'Brent Kimberley'" &= lt;<a href=3D"mailto:[email protected]" target=3D"_blank">brent_ki= [email protected]</a>>,<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"> <<a href=3D"m= ailto:[email protected]" target=3D"_blank">[email protected]= g</a>><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Thank you -- what I had in mind but= I am not that fancy with the setups as we use one. We go from our ap= plication in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time a= go and did not save the files. Plus no may people's horror we use ine= td. Of course we only transfer 4 million XML docs per day and handle = 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume= inetd is slower -:) but I have not noticed enough of a slowdown to matter.= And inetd (at least on an IBM AIX server) is dead reliable and easy.= <o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">As a curiosity -- as I often see pe= ople coding unnecessarily -- there is no reason to connect to localhost wit= h any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never= hits the network in any way -- not even the network card -- it goes direct= ly to/from the TCP/IP stack which is why I mentioned just making the app se= nd clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have sour= ce to).<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Eric<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">-----Original Message-----<o:p></o:= p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">From: Brent Kimberley [mailto:<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">brent_kimberley@= rogers.com</a>] <o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Sent: Tuesday, August 20, 2019 6:42= AM<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">To: <a href=3D"mailto:[email protected]" target=3D"_blank">stunnel-user= [email protected]</a><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Cc: <a href=3D"mailto:[email protected]" target=3D"_blank">dan= [email protected]</a>; <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a= ><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Subject: Re: stunnel-users Digest, = Vol 181, Issue 1<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Your mileage may vary.<o:p></o:p></= span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">###################################= ############################################<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"># From internal application to exte= rnal host #################################################################= ##############<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"># [Int_Init] -> [Int_Term] ->= [Ext_Init] -> [Ext_Term] ##############################################= #################################<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"># [internal_initiator] ---ssl= ---> [Internal terminator] # [Internal terminator] ---http---> = [external Initiator] # [external Initiator] ---tls---> [exte= rnal terminator] ##############################################################= #################<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"># <a href=3D"https://clicktime.symantec.com/3hPKYmesDrxGuE2bv5e7rh6H2?u=3Dhtt= ps%3A%2F%2Fwww.stunnel.org%2Fstatic%2Fstunnel.html%2520" target=3D"_blank"> https://www.stunnel.org/static/stunnel.html </a>###########################= #################################################### <o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">[Internal_Terminator]<o:p></o:p></s= pan></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">options =3D SSLv3<o:p></o:p></span>= </p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">client =3D no<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">accept =3D host_ip:443<o:p></o:p></= span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">connect =3D localhost:54321<o:p></o= :p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">CAfile = =3D int_init_wallet.pem<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">cert &nb= sp; =3D int_term_pub.pem<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">key &nbs= p; =3D int_term_priv.pem<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">[External_Initiator]<o:p></o:p></sp= an></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">options =3D SINGLE_ECDH_USE<o:p></o= :p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">options =3D SINGLE_DH_USE<o:p></o:p= ></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">ciphers =3D ECDHE-RSA-AES256-GCM-SH= A384:ECDHE-RSA-AES128-GCM-SHA256<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">verify =3D 3?<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">client =3D yes<o:p></o:p></span></p= > </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">options =3D TLSv1.2<o:p></o:p></spa= n></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">accept =3D localhost:54321<o:p></o:= p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">connect =3D externalhostname:443<o:= p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">verifyChain =3D yes<o:= p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">renegotiation =3D no<o:p></o:= p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">CAfile = =3D ext_term_wallet.pem<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">cert &nb= sp; =3D ext_init_pub.pem<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">key &nbs= p; =3D ext_init_priv.pem<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">-----------------------------------= -----------------------------------<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Date: Mon, 19 Aug 2019 18:21:18 = 3;0000<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">From: Daniel Trickett <<a href= =3D"mailto:[email protected]" target=3D"_blank">daniel.tri= [email protected]</a>><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">To: "<a href=3D"mailto:stunnel= [email protected]" target=3D"_blank">[email protected]</a>" &= lt;<a href=3D"mailto:[email protected]" target=3D"_blank">stunnel-u= [email protected]</a>><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Subject: [stunnel-users] https to h= ttps proxy<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Hi,<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Our punchout vendor switched their = site to only accept tls 1.2 over the weekend. Unfortunately our application= will only support SSL.<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">We are using stunnel with other ven= dors but can control the inbound host name. This recent one is one we can't= manage as it is the software provider.<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">I found a solution for doing https = to https. I'm unclear how I get the first https traffic to route to stunnel= as the initial call will be from the application will be to the external host..<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Any thoughts on whether this would = work for my situation? Appreciate any thoughts..<o:p></o:p></span></p= > </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">[Tunnel_in]<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">client =3D yes<o:p></o:p></span></p= > </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">accept =3D host_ip:443<o:p></o:p></= span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">connect =3D localhost:54321<o:p></o= :p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">[Tunnel_out]<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">client =3D no<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">accept =3D localhost:54321<o:p></o:= p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">connect =3D externalhostname:443<o:= p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Best regards,<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A">Dan<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"He= lvetica",sans-serif;color:#26282A"><o:p> </o:p></span></p> </div> </div> </div> </div> </div> </div> </body> </html> --_000_AM5PR0601MB23230C0C057D838BF2D9A73886A50AM5PR0601MB2323_-- --===============4909416133916443449== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --===============4909416133916443449==--