Strange connection failure in one environment

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============9118048402967365769==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="uJhrfWPY3igJVePScE1YP4xoNRBtfusKJ"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--uJhrfWPY3igJVePScE1YP4xoNRBtfusKJ
Content-Type: multipart/mixed; boundary="eaDsGSnMSDykTb8eaM749G2arUItxz3oe";
 protected-headers="v1"
From: Christopher Schultz <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Strange connection failure in one environment

--eaDsGSnMSDykTb8eaM749G2arUItxz3oe
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

All,

I've been using stunnel in two environments (dev, prod) for a long time
without any problems. Recently, my dev environment started acting funny
and I can't connect to it from outside the box.

Can someone take a look and let me know if you have any suggestions for
where to look for a problem?

Both environments have the following things in common:

1. Hosted in Amazon EC2, no load-balancer in the way
2. Configuration requires client-certificate to connect
3. All certificates are valid, self-signed, and properly-trusted by both
sides
4. TLS configuration has been locked-down to TLSv1.2, selected cipher
suites, FIPS mode=3Doff
5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips

The production (working) environment happens to be i686 and the
development environment happens to be x86-86, but I don't believe that
is relevant.

When I use e.g. "openssl s_client" to connect to the production
environment and I *do not* provide a client certificate, I am able to
perform the initial TLS handshake, get a cipher suite negotiated, etc.
and then the connection fails because I didn't provide the client
certificate, of course. I *can* see in the handshake the list of allowed
client certificates.

When I do the same in development, I get a handshake failure. No allowed
client certificates are shown. No nothing.

If I connect on localhost to the dev server, I get what I'm expecting:
allowed client certificates are listed, connection is closed because I'm
not using the client certificate. Connecting from another host gets my a
handshake failure.

Again, there are no load-balancers or anything between the outside and
the EC2 instance. I'm connecting as directly as it's possible to
connect. The box definitely allows incoming connections on the port I'm
trying to use; the AWS security group is configured correctly.

I have tried dropping ALL security configuration on the dev server's
stunnel.conf such as client-cert requirements, TLS protocols, cipher
suites, etc. and I get the same behavior every time. I'm starting to
think that it has nothing to do with my stunnel.conf configuration at
all, but I'm at a loss as to where to look, next.

Any ideas?

-chris


--eaDsGSnMSDykTb8eaM749G2arUItxz3oe--

--uJhrfWPY3igJVePScE1YP4xoNRBtfusKJ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl2zAf0ACgkQHPApP6U8
pFi86w/9EXCQ6EGytW9qPMvs23H7gF6L2sQhnYkUf19J/ADLyr2ToFWxQ1uQgZja
3DiTg4X/fnvIASpUhEH7015EQlmDlNTBGvJFBhkaOb0EKLodpUl2HF3i8nC3JUKk
xFai5M+FhuhPEccwLkrnztNLHTWxmgCRCt/1aYdVG+NA715KvmcAbBfgscHpbw9R
8xUTyU+KiwUox9cx9kHNCCzRX9cS86lkiLeGxcT3B1bnkpYXzA59nNrq7Apb5K+p
plyAYWnN7Fx+QPr70X9dGU1BpW4brTWcQvF1vtxKuzboVclKgY70oIs+xXTaemPM
h1qsZpiGzNHKl9Yfd62i6KVBci/4V35Eh7BU/iSzqPCGpH+RJjfRzYapsO9bCqdd
2FLaH83WZ8QZ17lw5S1QCU9XPipor7GfWeDVrOLYSiW14PGylC4YjSXYFL2zofPV
zh3pVfhpnDfAjvM0cBR3IJsYUVytYlc4Crzg2IGsmVMD7SLoDxQwx/078l/A9Sm8
M8wYXGgI1hKvtw4SSRIyte1KmNalFSr/1icG+iHUukgGEU1fdA3NlejgunH88ghu
meJn+cJnyZJTuv76gwuOnzhI4aQ9SVJDRU5M6z+TOvtcmfnyMq+YLxBD8MeSjKhf
bOxTldpTHqX2ZpZ8Mghk2HLfbi/7QLrP3hAVmD6bLdazkznH1Aw=
=ZCuP
-----END PGP SIGNATURE-----

--uJhrfWPY3igJVePScE1YP4xoNRBtfusKJ--

--===============9118048402967365769==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

--===============9118048402967365769==--