我一直在使用stunnel以前的版本.它在SSL服务器模式下显然没有证书的功能.这对我们没有必要,因为我们只是运行一个localhost服务器来隧道到远程服务器.
无论如何,我已经阅读了FAQ教程和与此相关的内容,并尝试了一切.无论我如何处理证书或密钥设置,它仍然会给出同样的错误,这是完整的输出….
No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service section [FIX] Section FIX: SSL server needs a certificate Server is down
; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [FIX] accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 TIMEOUTconnect = 5 [FIXLIVE] accept = 127.0.0.1:5680 connect = 216.52.236.185:51581 TIMEOUTconnect = 5
请注意,stunnel安装了stunnel.pem文件.我试着取消注释密钥的配置行.还使用openssh按指令重新生成密钥.
没有任何区别.这是stunnel的缺陷吗？或者我做错了什么？
为每个服务添加client = yes以修复该错误消息.
您还需要设置选项以设置正确的SSL安全性;见下文.
# Enable proper SSL security. Without this,you are completely insecure! verify = 2 CAfile = /etc/ssl/certs/ca-certificates.crt options = NO_SSLv2 [FIX] client = yes accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 TIMEOUTconnect = 5 [FIXLIVE] client = yes accept = 127.0.0.1:5680 connect = 216.52.236.185:51581 TIMEOUTconnect = 5
