Questions[stunnel](server)

WARNING: SSLv3 is obsolete. Consider disabling it altogether.

I'm trying to set up Stunnel to server as SSL cache. Everything was smooth, and mostly it works as designed.

Then I encountered errors in log files:

 SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Not all clients trigger that, for some strange reason. Connecting from CentOS using links - error shows up (tried multiple machines). Connecting from Ubuntu using links - no error.

Tried using wget, and all is smooth with TLSv1, but error shows up with SSLv3. At the same time, wget reports:

OpenSSL: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

Unable to establish SSL connection.

Here is my config:

pid = /etc/stunnel/stunnel.pid
debug = 3
output = /etc/stunnel/stunnel.log

socket=l:TCP_NODELAY=1
socket=r:TCP_NODELAY=1

verify=3    

; fixing "fingerprint does not match" error
fips=no

[https]
accept=12.34.56.78:443
connect=127.0.0.1:80
TIMEOUTclose=0
xforwardedfor=yes
CAfile = /path/to/ssl/example.com.cabundle
cert=/path/to/ssl/example.com.crt
key=/path/to/ssl/example.com.key

Anyone has any insight as to what's happening here? Googled for multiple hours now, can't figure it out.

OpenSSL version: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008.

Stunnel version: 4.32

EDIT:

Here is an output of openssl s_client -connect example.com:443 -ssl3

CONNECTED(00000004)
3897:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
3897:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530:

Same with -tls1 works OK, without any errors.

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches from the haproxy website.

However, the description mentions:

Note that this patch does not work with keep-alive, ...

My question is: What will this mean in practice for me? I'm unsure,

1. if this is about the keep-alive between
   • client and stunnel
   • stunnel and haproxy
   • or haproxy and backend server?
2. what this means for performance: If I have 100 icons on a web page, will the browser have to negotiate 100 full SSL connections, or can it re-use the SSL connection, just creating new TCP connections?

I am using RHEL 5.6 and trying to install stunnel with the 'xforwardfor' patch from haproxy to get a setup similar to this (older) post: http://www.buro9.com/blog/2009/12/07/installing-haproxy-load-balance-http-and-https/

When I run ./configure I get the following error:

*snip*
configure: **************************************** SSL
checking for SSL directory... Not found

Couldn't find your SSL library installation dir
Use --with-ssl option to fix this problem

From the stunnel documentation I need to pass a directory that has the ssl libraries (assuming libssl.so ? ) as well as a 'certs' directory.

I've tried creating a /etc/openssl directory with a 'certs' directory and a symlink to /lib64/libssl.so.6 but that didn't work.

What other libraries would I need ?

Update

From the config.log:

It was created by stunnel configure 4.32, which was generated by GNU Autoconf 2.61. Invocation command line was

$ ./configure --with-ssl=/lib64

## --------- ##
## Platform. ##
## --------- ##

uname -m = x86_64
uname -r = 2.6.18-238.12.1.el5
uname -s = Linux
* snip *
configure:23977: **************************************** SSL
configure:23996: checking for SSL directory
configure:24019: result: Not found

And running ls /lib64 | grep ssl:

$ ls -l /lib64 | grep ssl
-rwxr-xr-x 1 root root  315032 Dec  7  2010 libssl.so.0.9.8e
lrwxrwxrwx 1 root root      16 Jul 13 18:48 libssl.so.6 -> libssl.so.0.9.8e

We have a PHP application which connects to a MySQL server, and we wish to secure connections between the web & application servers and the database.

At peak times, the web servers make many hundreds of concurrent connections to the database, and perform lots of small reads and writes. I'm aware this isn't optimal, and am working on reducing the number of database connections in parallel to this.

We don't have persistent connections to the database turned on currently, and although we intend to in the future I would like to implement this independently of that.

Hardware wise - the MySQL server is quite chunky (16 core) as are the web servers. They're dedicated servers.

My question then surrounds the most performant way of securing & encrypting the connections to the database server.

My research so far has suggested that the main performance overhead is with setting up the SSL connection - once SSL is connected there is little performance penalty. And here's what I have about each method of securing the connection:

1. MySQL SSL Certificates - works just like normal SSL. Can use client certificates to prevent unauthorised connections. No persistent connections with our existing setup. Still have to have MySQL listening on an open port on the firewall.
2. stunnel. Set up a port to port ssl tunnel. Do not have to reconfigure MySQL. Can close the normal MySQL listening port to prevent malicious MySQL connection attempts. Does not support persistent connections. Unknown performance hit.
3. SSH Tunneling. Create an SSH tunnel between the client and the server. Do not have to reconfigure MySQL. Can close the normal MySQL listening port to prevent malicious MySQL connection attempts. Supports persistent connections, but these sometimes drop out. Unknown performance hit.

This is as far as I've been able to get. I'm aware of the limitations of benchmarks - in my experience of running them it's very difficult to simulate real world traffic. I was hoping that someone had some advice based on their own experiences of securing MySQL?

Thanks

A few computers, but not most, are rejecting the SSL certificate from my webserver. The problem seems to be that some computers are rejecting the CA certs. The problem seems to be manifesting on Mac OS X 10.6 when it is not fully updated.

According to http://www.sslshopper.com/index.php?q=ssl-checker.html#hostname=beta.asana.com -- there's no problem.

According to http://certlogik.com/sslchecker/, there's no intermediate certs being sent down.

My cert is from Starfield Technologies, and I'm using sf_bundle.crt from here: certs.godaddy.com/anonymous/repository.seam

I'm handling SSL on my server via stunnel with the following stunnel.conf:

cert = $CODEZ/admin/production/proxy/asana.pem
CAfile = $CODEZ/admin/production/proxy/sf_bundle.crt
pid =
client = no

[<forwarded port>]
accept = 443
connect = 8443

Any ideas what I could be doing wrong?