Stunnel/Certificates

Certificates in Stunnel

The official stunnel howto has some useful (but confusing) information about certificates: https://www.stunnel.org/howto.html

Client Certificates

Using stunnel in client mode (i.e., stunnel is not acting as an SSL server) means you (the client) probably don't need to present a valid certificate (to the server). While stunnel always requires a certificate (a pem file) to run, a dummy certificate is generated when stunnel is installed, and that dummy pem file can be used by the client since the server will probably not ask the client to present this certificate.

Generating a client SSL certificate is the same process as generating a server SSL certificate. See below, or "Generating stunnel certificate and private key" section of the stunnel howto: https://www.stunnel.org/howto.html

Server Certificates

The server will need a private key and an SSL certificate.

Generating a signed SSL certificate with LetsEncrypt: see LetsEncrypt

Generating a self-signed SSL certificate with openssl: RaspberryPi/SSH Stunnel#Generate Private Keys and Certificates for SSL

Controlling both server and client

Using stunnel in a situation where you control both the client and the server gives you two options:

• Skip verification of certificates
• Verify certificates against locally installed certificates

To turn on verification, see Stunnel/Certificates#Verification section below.

Controlling server only

Using stunnel in a situation where you do not control the client gives you three options:

• Skip verification of certificates (not recommended if there is no authentication involved with the traffic being passed to stunnel, since a malicious actor could intercept and decrypt traffic)
• Ask clients to install your certificate authority into their OpenSSL installation, so that they can verify the certificate
• Verify certificates against pre-installed, "pre-trusted" root certificates (e.g., Verisign)

Verification

By default, stunnel does not verify SSL certificates, so clients will accept whatever SSL certificate they get from the server (or an attacker pretending to be the server).

To turn on verification, set the verify option in the stunnel config file..

    verify = 1
        Verify the certificate, if present.
            If no certificate is presented by the remote end, accept the connection.
            If a certificate is presented, then
                If the certificate valid, it will log which certificate is being used, and continue the connection.
                If the certificate is invalid, it will drop the connection. 

    verify = 2
        Require and verify certificates

        Stunnel will require and verify certificates for every SSL connection. If no certificate or an invalid certificate is presented, then it will drop the connection. 

    verify = 3
        Require and verify certificates against locally installed certificates. 

Installing Certificate Authority

A self-signed certificate is the same as the certificate authority. To install an SSL certificate, see the OpenSSL guide to installing other people's certificates: http://www.gagravarr.org/writing/openssl-certs/others.shtml

The short version:

• If you are installing the certificate on a Mac, you will need to add it through the Keychain Access app
• If you are installing the certificate on Linux, you will need the .pem CA file, which you will put into a file named with the certificate's own hash

Installing certificate authority on linux

Start by obtaining the CA fingerprint from a trusted source. Calculate the fingerprint for the certificate and ensure it matches:

 openssl x509 -noout -fingerprint -in ca-certificate-file 

If they match, you are ready to install it. These commands will move the .pem CA file to the openssl directory, and will create a symbolic link to the .pem CA file with a filename equal to the certificate's hash, plus a .0 at the end:

$ cd /etc/ssl/
$ mv ~/my_ca.pem .
$ ln -s my_ca.pem `openssl x509 -hash -noout -in my_ca.pem`.0