1

How is it possible to disable Secure Client-Initiated Renegotiation in stunnel4? I'm using version stunnel 4.53-1.1ubuntu1 on Ubuntu 14.04 Trusty with OpenSSL 1.0.1f and stunnel 4.53-1.1 on Debian Wheezy with OpenSSL 1.0.1e.

The stunnel docs lists an option for that:

renegotiation = yes | no

support SSL renegotiation

but unfortunately, this leads to the following error:

Line 70: "renegotiation = no": Specified option name is not valid here

But where is this the option valid? I tried it for the single services (which makes no sense anyhow), but it didn't work either. The documentation is not very verbose about this, and I couldn't find any information about this with search engines.

Has anyone a clue, how to get this right?

I used the following minimal configuration:

pid=/stunnel4.pid
debug = 5
output = /var/log/stunnel4/stunnel.log
cert = /etc/ssl/certs/ssl-cert-snakeoil.pem
key = /etc/ssl/private/ssl-cert-snakeoil.key
renegotiation = no
[https]
accept  = 443
connect = localhost:8000

These tests showed, that Renegotiation is supported:

Qualys' ssltest shows:

Secure Client-Initiated Renegotiation: Supported DoS DANGER (more info)

Doing it manually with openssl, also confirms:

$ openssl s_client -connect localhost:443
CONNECTED(00000003)
[...]
---
R
RENEGOTIATING
depth=0 CN = mint.home
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = mint.home
verify return:1
sebix
  • 4,175
  • 2
  • 25
  • 45

1 Answers1

1

According to stunnel ChangeLog, renegotiation parameter was added in stunnel version 4.54. That explains why stunnel 4.53 complains about

Specified option name is not valid here

The alternative solutions:

  1. Installing stunnel deb file with higher version for example stunnel for jessie (testing) or for sid (unstable)
  2. Doing self-compile stunnel
masegaloeh
  • 17,978
  • 9
  • 56
  • 104
  • Can confirm that for Ubuntu (installed the deb from utopic), works as expected. On debian, two requirements are not met. Thanks :) – sebix Feb 13 '15 at 09:26