Setting up stunnel with psk install#
Setting up stunnel with psk software#
Setting up stunnel with psk windows#

Only) Exit an already started stunnel -quiet (Win32 Later only) Stop NT Service -reload (Windows NTĪnd later only) Reload the configuration file of the running NT Service -reopen (Windows NTĪnd later only) Reopen the log file of the running NT Service -exit (Win32 (Windows NT and later only) Uninstall NT Service -start (Windows NTĪnd later only) Start NT Service -stop (Windows NT and

Setting up stunnel with psk install#

NT and later only) Install NT Service -uninstall

Setting up stunnel with psk software#

This product includes cryptographic software written by Eric OPTIONS ¶ FILE Use specified configuration file -fd N (Unix only) Read the config file from specified file descriptor -help Print stunnel help menu -version Print stunnel version and compile time defaults -sockets Print default socket options -options Print supported TLS options -install (Windows Network sockets without changes to the source code. Standalone daemons like NNTP, SMTP and HTTP, and in tunneling PPP over Stunnel can be used to add TLS functionality toĬommonly used Inetd daemons like POP-2, POP-3, and IMAP servers, to On your system you can easily set them up to communicate with clients over The concept is that having non-TLS aware daemons running

The stunnel program is designed to work as TLSĮncryption wrapper between remote clients and local ( inetd-startable) help | -version | -sockets | -options DESCRIPTION ¶ options WIN32: stunnel [ [ -install | -uninstall | -start | -stop | The peer-certificate.pem file needs to contain the server certificate.Stunnel - TLS offloading and load-balancing proxy SYNOPSIS ¶ Unix: stunnel | -fd N | -help | -version | -sockets | The following configuration requires stunnel version 4.46 or higher: The ca-certs.pem file contains the certificates of trusted certificate authorities.Īlternatively, a technique known as certificate pinning can be used.

The following configuration requires stunnel 5.15 or later: Stunnel can use an existing PKI (Public Key Infrastructure). The 'key' option may be omitted if cert.pem also contains the private key. A certificate can also be purchased from one of the available commercial certificate authorities. On Unix platforms, a certificate can be built with 'make cert'.

Setting up stunnel with psk windows#

The Windows installer of stunnel automatically builds a certificate. Unless PSK authentication is configured, each stunnel server needs a certificate with the corresponding private key. The advantage of this configuration is that it does not require individual secrets for each of the clients. Certificatesįor simplicity, this tutorial only covers server authentication. Otherwise, all the clients sharing the same key will have to be reconfigured if the key is compromised. The psk1.txt file only needs a single line: test1:oaP4EishaeSaishei6rio6xeeph3azĮach client needs a separate secret. The psk.txt file contains one line for each client: test1:oaP4EishaeSaishei6rio6xeeph3az Server ConfigurationĪ trivial configuration example: PSK authentication requires stunnel version 5.09 or higher. PSK is also the fastest TLS authentication. It provides both client and server authentication. The easiest way to configure authentication is with PSK (Pre-Shared Key).

Client authentication allows for restricting access for individual clients (access control).

Server authentication prevents Man-In-The-Middle (MITM) attacks on the encryption protocol.

Either the TLS client, the TLS server, or both need to be authenticated: