2

I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode to the stunnel server mode?

  • Anyone know how I can modify the stunnel handshake validation? – Mark Shine Nov 18 '16 at 13:25
1

from man stunnel

verify = LEVEL
       verify the peer certificate

       level 0
           Request and ignore the peer certificate.

       level 1
           Verify the peer certificate if present.

       level 2
           Verify the peer certificate.

       level 3
           Verify the peer with locally installed certificate.

       level 4
           Ignore the CA chain and only verify the peer certificate.

       default
           No verify.

So it seems you can just add

verify = 0

to your config.

| improve this answer | |
  • 2
    This is a good answer but is not the answer I was looking for. I want to be able to verify the certificate but ignore the expiry date. Not disable cert check all the way. – Mark Shine Nov 17 '16 at 14:32
  • From a derisory search it doesn't seem like that is possible. Any reason why you can't simply regenerate the cert? Or tell the admin of the target system that they're spitting out an expired certificate? – slowko Nov 17 '16 at 14:38
  • See I have a stunnel setup by someone else that has done this exact thing but I have no clue how they did it. Stunnel seems to use openssl for the verification so I guess the question should be how to bypass openssl expiry check. But the user on the other end is a large user that requires way to much effort to renew then it is worth. – Mark Shine Nov 17 '16 at 14:49
0

Presumably, if your version of stunnel is dynamically linked and you're not against using LD_PRELOAD, you could use libfaketime and its wrapper (faketime) to start stunnel at a time when the certificate was still valid. Albeit this is not a proper answer, I think it could help the OpenSSL checks to pass.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.