Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS.

Therefore, i was trying stunnel to make SSL and connect the HTTP on it, but its not working when using Google App Engine and Stunnel.

$ cat /etc/stunnel/stunnel.conf
pid = /stunnel.pid
cert=/var/tmp/server.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
client=yes
; Some debugging stuff useful for troubleshooting
debug = 7
output = /var/log/stunnel.log
[SSL]
accept=0.0.0.0:443
connect=80

See the logs:

2014.02.06 09:13:34 LOG5[8293:140556325660608]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2014.02.06 09:13:34 LOG6[8293:140556325660608]: file ulimit = 1024 (can be changed with 'ulimit -n')
2014.02.06 09:13:34 LOG6[8293:140556325660608]: poll() used - no FD_SETSIZE limit for file descriptors
2014.02.06 09:13:34 LOG5[8293:140556325660608]: 500 clients allowed
2014.02.06 09:13:34 LOG7[8293:140556325660608]: FD 9 in non-blocking mode
2014.02.06 09:13:34 LOG7[8293:140556325660608]: FD 10 in non-blocking mode
2014.02.06 09:13:34 LOG7[8293:140556325660608]: FD 11 in non-blocking mode
2014.02.06 09:13:34 LOG7[8293:140556325660608]: SO_REUSEADDR option set on accept socket
2014.02.06 09:13:34 LOG7[8293:140556325660608]: SSL bound to 0.0.0.0:443
2014.02.06 09:13:34 LOG7[8299:140556325660608]: Created pid file /stunnel.pid

2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=12 from 82.x.x.LocalPC:49651
2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=13 from 82.x.x.LocalPC:49652
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325656320]: FD 12 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325656320]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 13 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Acquired libwrap process #0
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Acquired libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Releasing libwrap process #0
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Releasing libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Released libwrap process #0
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Released libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL permitted by libwrap from 82.x.x.LocalPC:49651
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL permitted by libwrap from 82.x.x.LocalPC:49652
2014.02.06 09:14:06 LOG5[8299:140556325656320]: SSL accepted connection from 82.x.x.LocalPC:49651
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL accepted connection from 82.x.x.LocalPC:49652
2014.02.06 09:14:06 LOG7[8299:140556325656320]: FD 15 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 16 in non-blocking mode
2014.02.06 09:14:06 LOG6[8299:140556325656320]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG6[8299:140556325586688]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325656320]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325656320]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325586688]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325656320]: SSL connected remote server from 82.x.x.x:36426
2014.02.06 09:14:06 LOG5[8299:140556325586688]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Remote FD=15 initialized
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL connected remote server from 82.x.x.x:36427
2014.02.06 09:14:06 LOG7[8299:140556325656320]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Remote FD=16 initialized
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325656320]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG5[8299:140556325656320]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL finished (1 left)
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325586688]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG5[8299:140556325586688]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL finished (0 left)
2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=12 from 82.x.x.LocalPC:49653
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 12 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Acquired libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Releasing libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Released libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL permitted by libwrap from 82.x.x.LocalPC:49653
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL accepted connection from 82.x.x.LocalPC:49653
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 13 in non-blocking mode
2014.02.06 09:14:06 LOG6[8299:140556325586688]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325586688]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325586688]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL connected remote server from 82.x.x.x:36428
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Remote FD=13 initialized
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325586688]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG5[8299:140556325586688]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL finished (0 left)
2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=12 from 82.x.x.LocalPC:49654
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 12 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Acquired libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Releasing libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Released libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL permitted by libwrap from 82.x.x.LocalPC:49654
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL accepted connection from 82.x.x.LocalPC:49654
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 13 in non-blocking mode
2014.02.06 09:14:06 LOG6[8299:140556325586688]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325586688]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325586688]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL connected remote server from 82.x.x.x:36429
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Remote FD=13 initialized
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325586688]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG5[8299:140556325586688]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL finished (0 left)

EDIT: here to verify locally the ssL

$ openssl s_client -ssl3 -connect localhost:443
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1391675538
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

EDIT:

Goal: visitor visits a valid address for example: https://www.yumyumyum.com (assume its valid and has CA, KEY, CERT files) and he is not forwarded to http://www.yumyumyum.com it should remain as https

1) when used Google App Engine it does not have HTTPS option as a result everything has to run as HTTP, now the service is running as HTTP, but when users use it as http, it causes other security problems

2) therefore, we needed a SSL Proxy to that HTTP so that the user always get https even behind the screen they are attached with http

is this clear description?

share|improve this question
    
Would you please describe the complete data flow? I am not sure any more whether I have understood that correctly (which is important for the answer, of course). –  Hauke Laging Feb 6 at 6:44
    
Please see my last EDIT section –  YumYumYum Feb 6 at 7:06
    
OK, that's what I expected. –  Hauke Laging Feb 6 at 7:14

1 Answer 1

up vote 2 down vote accepted

The problem is your (default changing) setting

client=yes

But you need stunnel in server mode, i.e. an SSL/TLS connection is offered to the outside and forwarded as an unencrypted connection.

share|improve this answer
    
client=no i set like your suggestion. But now when i go to haukelaging.com it works but then instantly i get into haukelaging.com rather then https –  YumYumYum Feb 6 at 6:38
    
@YumYumYum haukelaging.com? You connect to a domain that doesn't even exist...? See my comment to your question. –  Hauke Laging Feb 6 at 6:44
    
After changing to your suggestion its working. But for example https://www.yumyumyum.com i visit assume its a valid https certificate and domain. then i am automatically going to tihs http://www.yumyumyum.com instead of HTTPS it becomes HTTP. –  YumYumYum Feb 6 at 6:51
1  
Can you have a look at the HTTP headers? Maybe there is a redirection which does not even have anything to do with the SSL stuff. –  Hauke Laging Feb 6 at 7:16
    
YES - i did a test 1) iamServer1> echo 'server1 talking' | nc -l 80; 2) iamServer2> curl -v "https://iamServer1" 3) iamServer2> gets http://iamServer1 instead of https://iamServer1 –  YumYumYum Feb 6 at 9:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.