SSL proxy with stunnel

Question

I'm trying to set an SSL connection with stunnel. Some kind of SSL proxy.

Final aim
Connect http only CLIENT to https only SERVER.

My plan is

1. CLIENT: change endpoint to PROXY
2. PROXY: use stunnel to receive requests from CLIENT and forward them to SERVER

stunnel.conf

cert = /etc/stunnel/stunnel.pem
foreground = yes
chroot = /var/run/stunnel
setuid = stunnel
setgid = stunnel
pid = /stunnel.pid
debug = 7
[my_route]
accept = 7121
connect = SERVER:443
;connect = SERVER:443/somedata

Test 1

$openssl s_client -connect SERVER:443
New, TLSv1/SSLv3, Server public key is 2048 bit

Test 2

openssl s_client -connect PROXY:7121
New, TLSv1/SSLv3, Server public key is 2048 bit

Result (connecting from CLIENT to SERVER through PROXY).

Service [my_route] accepted (FD=3) from 10.0.2.2:12345
Service [my_route] started
Service [my_route] accepted connection from 10.0.2.2:12345
SSL state (accept): before/accept initialization
SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
Local socket (FD=3) closed
Service [my_route] finished (0 left)

Questions

1. Why doesn't the IP match to SERVER? Why is it connectiong to 10.0.2.2?
   Does it mean that I'm connecting to a wrong server? How can that happen?

2. What does this error say? That remote server uses another version of SSL, doesn't it?

Answer 1

1. Why doesn't the IP match to SERVER? Why is it connectiong to 10.0.2.2?

Because that IP address is not the address of the server it is connecting to, but the address of the client machine it is receiving from (running openssl s_client).

Does it mean that I'm connecting to a wrong server? How can that happen?

No, it has nothing to do with the server.

2. What does this error say? That remote server uses another version of SSL, doesn't it?

It means that your stunnel tries to speak SSL to the client (openssl s_client) connecting. They don't seem to agree on the SSL protocol version to use.

However, this is plain wrong. In the configuration you want to set up, stunnel should wait for HTTP connections, and tunnel those connection with HTTPS to SERVER. Therefore you may not use openssl s_client to connect to your stunnel as openssl s_client would use SSL and stunnel would be waiting for non-SSL connections.

To solve this, you'll need an extra line client = yes in your configuration. Then, instead of using openssl s_client as the client for your stunnel, you should either use telnet (telnet server2 7121), or a program able to speak HTTP to your server (like a web browser, or similar, with a URL starting like http://PROXY:7121/...).

Also, it is highly recommended to use IP addresses in your configuration file (instead of textual host names).

Something like this should work for you:

[my_route]
client = yes
accept = 7121
connect = aaa.bbb.ccc.ddd:443

Answer 2

Seems like this exact issue is addressed in this answer on Server Fault; the bolded part seems apropos to your scenario:

The stunnel server has options = NO_SSLv3, but the client is trying to connect using SSLv3. You need to upgrade the client to support a newer version of SSL or you need to change the stunnel configuration to accept SSLv3.

Answer 3

adding this to the config file will do .

sslversion = all

and you might have missed another thing . you should explicitly set "client = yes" or it defaults to "no" .