stunnel - how to setup stunnel to handle ssl and attach http with it?

Question

I am running Google App Engine which is a http web server with some redirecting and other real-time stuff. But it does not have SSL to include so its unable to make HTTPS.

Therefore, i was trying stunnel to make SSL and connect the HTTP on it, but its not working when using Google App Engine and Stunnel.

$ cat /etc/stunnel/stunnel.conf
pid = /stunnel.pid
cert=/var/tmp/server.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
client=yes
; Some debugging stuff useful for troubleshooting
debug = 7
output = /var/log/stunnel.log
[SSL]
accept=0.0.0.0:443
connect=80

See the logs:

2014.02.06 09:13:34 LOG5[8293:140556325660608]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2014.02.06 09:13:34 LOG6[8293:140556325660608]: file ulimit = 1024 (can be changed with 'ulimit -n')
2014.02.06 09:13:34 LOG6[8293:140556325660608]: poll() used - no FD_SETSIZE limit for file descriptors
2014.02.06 09:13:34 LOG5[8293:140556325660608]: 500 clients allowed
2014.02.06 09:13:34 LOG7[8293:140556325660608]: FD 9 in non-blocking mode
2014.02.06 09:13:34 LOG7[8293:140556325660608]: FD 10 in non-blocking mode
2014.02.06 09:13:34 LOG7[8293:140556325660608]: FD 11 in non-blocking mode
2014.02.06 09:13:34 LOG7[8293:140556325660608]: SO_REUSEADDR option set on accept socket
2014.02.06 09:13:34 LOG7[8293:140556325660608]: SSL bound to 0.0.0.0:443
2014.02.06 09:13:34 LOG7[8299:140556325660608]: Created pid file /stunnel.pid

2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=12 from 82.x.x.LocalPC:49651
2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=13 from 82.x.x.LocalPC:49652
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325656320]: FD 12 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325656320]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 13 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Acquired libwrap process #0
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Acquired libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Releasing libwrap process #0
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Releasing libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Released libwrap process #0
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Released libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL permitted by libwrap from 82.x.x.LocalPC:49651
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL permitted by libwrap from 82.x.x.LocalPC:49652
2014.02.06 09:14:06 LOG5[8299:140556325656320]: SSL accepted connection from 82.x.x.LocalPC:49651
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL accepted connection from 82.x.x.LocalPC:49652
2014.02.06 09:14:06 LOG7[8299:140556325656320]: FD 15 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 16 in non-blocking mode
2014.02.06 09:14:06 LOG6[8299:140556325656320]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG6[8299:140556325586688]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325656320]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325656320]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325586688]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325656320]: SSL connected remote server from 82.x.x.x:36426
2014.02.06 09:14:06 LOG5[8299:140556325586688]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325656320]: Remote FD=15 initialized
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL connected remote server from 82.x.x.x:36427
2014.02.06 09:14:06 LOG7[8299:140556325656320]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Remote FD=16 initialized
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325656320]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG5[8299:140556325656320]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325656320]: SSL finished (1 left)
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325586688]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG5[8299:140556325586688]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL finished (0 left)
2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=12 from 82.x.x.LocalPC:49653
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 12 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Acquired libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Releasing libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Released libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL permitted by libwrap from 82.x.x.LocalPC:49653
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL accepted connection from 82.x.x.LocalPC:49653
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 13 in non-blocking mode
2014.02.06 09:14:06 LOG6[8299:140556325586688]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325586688]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325586688]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL connected remote server from 82.x.x.x:36428
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Remote FD=13 initialized
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325586688]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG5[8299:140556325586688]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL finished (0 left)
2014.02.06 09:14:06 LOG7[8299:140556325660608]: SSL accepted FD=12 from 82.x.x.LocalPC:49654
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL started
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 12 in non-blocking mode
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on local socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Waiting for a libwrap process
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Acquired libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Releasing libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Released libwrap process #1
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL permitted by libwrap from 82.x.x.LocalPC:49654
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL accepted connection from 82.x.x.LocalPC:49654
2014.02.06 09:14:06 LOG7[8299:140556325586688]: FD 13 in non-blocking mode
2014.02.06 09:14:06 LOG6[8299:140556325586688]: connect_blocking: connecting 82.x.x.x:80
2014.02.06 09:14:06 LOG7[8299:140556325586688]: connect_blocking: s_poll_wait 82.x.x.x:80: waiting 10 seconds
2014.02.06 09:14:06 LOG5[8299:140556325586688]: connect_blocking: connected 82.x.x.x:80
2014.02.06 09:14:06 LOG5[8299:140556325586688]: SSL connected remote server from 82.x.x.x:36429
2014.02.06 09:14:06 LOG7[8299:140556325586688]: Remote FD=13 initialized
2014.02.06 09:14:06 LOG7[8299:140556325586688]: TCP_NODELAY option set on remote socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): before/connect initialization
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL state (connect): SSLv3 write client hello A
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL alert (write): fatal: handshake failure
2014.02.06 09:14:06 LOG3[8299:140556325586688]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2014.02.06 09:14:06 LOG5[8299:140556325586688]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.02.06 09:14:06 LOG7[8299:140556325586688]: SSL finished (0 left)

EDIT: here to verify locally the ssL

$ openssl s_client -ssl3 -connect localhost:443
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1391675538
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

EDIT:

Goal: visitor visits a valid address for example: https://www.yumyumyum.com (assume its valid and has CA, KEY, CERT files) and he is not forwarded to http://www.yumyumyum.com it should remain as https

1) when used Google App Engine it does not have HTTPS option as a result everything has to run as HTTP, now the service is running as HTTP, but when users use it as http, it causes other security problems

2) therefore, we needed a SSL Proxy to that HTTP so that the user always get https even behind the screen they are attached with http

is this clear description?

Would you please describe the complete data flow? I am not sure any more whether I have understood that correctly (which is important for the answer, of course). — Hauke Laging, Feb 6, 2014 at 6:44

Hauke Laging · Accepted Answer · 2014-02-06 06:36:02Z

2

The problem is your (default changing) setting

client=yes

But you need stunnel in server mode, i.e. an SSL/TLS connection is offered to the outside and forwarded as an unencrypted connection.

edited Feb 6, 2014 at 6:36

answered Feb 6, 2014 at 6:21

Hauke Laging

88.4k18 gold badges126 silver badges174 bronze badges

client=no i set like your suggestion. But now when i go to haukelaging.com it works but then instantly i get into haukelaging.com rather then https
– user11085
Feb 6, 2014 at 6:38
@YumYumYum haukelaging.com? You connect to a domain that doesn't even exist...? See my comment to your question.
– Hauke Laging
Feb 6, 2014 at 6:44
After changing to your suggestion its working. But for example https://www.yumyumyum.com i visit assume its a valid https certificate and domain. then i am automatically going to tihs http://www.yumyumyum.com instead of HTTPS it becomes HTTP.
– user11085
Feb 6, 2014 at 6:51
1

Can you have a look at the HTTP headers? Maybe there is a redirection which does not even have anything to do with the SSL stuff.
– Hauke Laging
Feb 6, 2014 at 7:16
YES - i did a test 1) iamServer1> echo 'server1 talking' | nc -l 80; 2) iamServer2> curl -v "https://iamServer1" 3) iamServer2> gets http://iamServer1 instead of https://iamServer1
– user11085
Feb 6, 2014 at 9:45

| Show 1 more comment

Stack Exchange Network

stunnel - how to setup stunnel to handle ssl and attach http with it?

1 Answer 1

You must log in to answer this question.

Hot Network Questions

stunnel - how to setup stunnel to handle ssl and attach http with it?

1 Answer 1

You must log in to answer this question.

Related

Hot Network Questions