Bdtyktl

I'm trying to set an SSL connection with stunnel. Some kind of SSL proxy.

Final aim

Connect http only CLIENT to https only SERVER.

My plan is

1. CLIENT: change endpoint to PROXY
   


2. PROXY: use stunnel to receive requests from CLIENT and forward them to SERVER

stunnel.conf

cert = /etc/stunnel/stunnel.pem

foreground = yes

chroot = /var/run/stunnel

setuid = stunnel

setgid = stunnel

pid = /stunnel.pid

debug = 7

[my_route]

accept = 7121

connect = SERVER:443

;connect = SERVER:443/somedata

Test 1

$openssl s_client -connect SERVER:443

New, TLSv1/SSLv3, Server public key is 2048 bit

Test 2

openssl s_client -connect PROXY:7121

New, TLSv1/SSLv3, Server public key is 2048 bit

Result (connecting from CLIENT to SERVER through PROXY).

Service [my_route] accepted (FD=3) from 10.0.2.2:12345

Service [my_route] started

Service [my_route] accepted connection from 10.0.2.2:12345

SSL state (accept): before/accept initialization

SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket

Local socket (FD=3) closed

Service [my_route] finished (0 left)

Questions

1. Why doesn't the IP match to SERVER? Why is it connectiong to 10.0.2.2?
   
   Does it mean that I'm connecting to a wrong server? How can that happen?




2. What does this error say? That remote server uses another version of SSL, doesn't it?

1. Why doesn't the IP match to SERVER? Why is it connectiong to
   10.0.2.2?

Because that IP address is not the address of the server it is connecting to, but the address of the client machine it is receiving from (running openssl s_client).

Does it mean that I'm connecting to a wrong server? How can that
happen?

No, it has nothing to do with the server.

2. What does this error say? That remote server uses another version of SSL, doesn't it?

It means that your stunnel tries to speak SSL to the client (openssl s_client) connecting. They don't seem to agree on the SSL protocol version to use.

However, this is plain wrong. In the configuration you want to set up, stunnel should wait for HTTP connections, and tunnel those connection with HTTPS to SERVER. Therefore you may not use openssl s_client to connect to your stunnel as openssl s_client would use SSL and stunnel would be waiting for non-SSL connections.

To solve this, you'll need an extra line client = yes in your configuration. Then, instead of using openssl s_client as the client for your stunnel, you should either use telnet (telnet server2 7121), or a program able to speak HTTP to your server (like a web browser, or similar, with a URL starting like http://PROXY:7121/...).

Also, it is highly recommended to use IP addresses in your configuration file (instead of textual host names).

Something like this should work for you:

[my_route]

client = yes

accept = 7121

connect = aaa.bbb.ccc.ddd:443

Seems like this exact issue is addressed in this answer on Server Fault; the bolded part seems apropos to your scenario:

The stunnel server has options = NO_SSLv3, but the client is
trying to connect using SSLv3. You need to upgrade the client to
support a newer version of SSL or you need to change the stunnel
configuration to accept SSLv3.

adding this to the config file will do .

sslversion = all

and you might have missed another thing . you should explicitly set "client = yes" or it defaults to "no" .