STUNNEL(8) stunnel TLS Proxy STUNNEL(8) (NAME) stunnel - TLS (SYNOPSIS) o Unix: stunnel [FILE] | -fd N | -help | -version | -sockets | -options o WIN32: stunnel [ [ -install | -uninstall | -start | -stop | -reload | -reopen | -exit ] [-quiet] [FILE] ] | -help | -version | -sockets | -options (DESCRIPTION) stunnel (wrapper) TLS ( inetd) . TLS TLS . stunnel TLS Inetd POP-2 POP-3 IMAP NNTP SMTP HTTP PPP . Eric Young (eay@cryptsoft.com) (OPTIONS) o FILE o -fd N ( ) (file descriptor) o -help stunnel o -version stunnel o -sockets o -options TLS o -install ( NT ) NT o -uninstall ( NT ) NT o -start ( NT ) NT o -stop ( NT ) NT o -reload ( NT ) NT o -reopen ( NT ) NT o -exit ( Win32) stunnel o -quiet ( Win32) (message box) (CONFIGURATION FILE) : o ( ). o `;' ( ). o `option_name = option_value'. o `[service_name]' . : o . o IP (IPv4 IPv6 ) . o ( ). (GLOBAL OPTIONS) o chroot = DIRECTORY ( ) chroot stunnel chroot stunnel (chroot jail) . CApath CRLpath pid exec chroot . chroot : o (Delayed resolver) /etc/nsswitch.conf /etc/resolv.conf . o /etc/timezone . o /dev/zero /dev/null. o compression = deflate | zlib | zstd | brotli : (no compression) TLS 1.2 . OpenSSL 1.1.0 securityLevel 1 . zlib zstd brotli OpenSSL . zstd brotli OpenSSL 3.2 . (chosen plaintext) . Deflate RFC 1951 . : TLS ( CRIME) . o debug = [FACILITY.]LEVEL syslog : emerg (0) alert (1) crit (2) err (3) warning (4) notice (5) info (6) debug (7). . debug = debug ( ) . stunnel . debug stunnel . notice (5) . (facility) `daemon' syslog . ( Win32 .) . o EGD = EGD_PATH ( ) (Entropy Gathering Daemon) Entropy Gathering Daemon OpenSSL . o engine = auto | ENGINE_ID : engine . o engineCtrl = COMMAND[:PARAMETER] o engineDefault = TASK_LIST OpenSSL . : ALL RSA DSA ECDH ECDSA DH RAND CIPHERS DIGESTS PKEY PKEY_CRYPTO PKEY_ASN1. o fips = yes | no FIPS 140-2. stunnel FIPS 140-2 FIPS . : no ( 5.00) o foreground = yes | quiet | no ( ) ( fork ). yes syslog output stderr . : background o iconActive = ICON_FILE ( ) .ico . o iconError = ICON_FILE ( ) .ico . o iconIdle = ICON_FILE ( ) .ico . o log = append | overwrite ( output) (append) (overwrite) . : append o output = FILE /dev/stdout ( splogger daemontools). o pid = FILE ( ) (pid) pid . pid chroot . o provider = PROVIDER_ID (provider) . PROVIDER_ID . OpenSSL 3.0 . o providerParameter = PROVIDER_ID:PARAMETER=VALUE . PROVIDER_ID PARAMETER VALUE . . OpenSSL 3.5 . o RNDbytes = BYTES o RNDfile = FILE OpenSSL (seed) . o RNDoverwrite = yes | no : yes o service = SERVICE ( ) stunnel syslog inetd TCP Wrappers . . : stunnel o setEnv = VAR_NAME=VALUE . VAR_NAME . . o syslog = yes | no ( ) syslog : yes o taskbar = yes | no ( WIN32) (taskbar) : yes (SERVICE-LEVEL OPTIONS) . libwrap ( TCP Wrappers) stunnel . stunnel inetd ( inetd xinetd tcpserver ) INETD (INETD MODE) . o accept = [HOST:]PORT IPv4 . IPv6 : accept = :::PORT o CAengine = ENGINE-SPECIFIC_CA_CERTIFICATE_IDENTIFIER CA (engine) CA verifyChain verifyPeer . CAengine . : pkcs11 cng. o CApath = CA_DIRECTORY CA CA verifyChain verifyPeer . XXXXXXXX.0 XXXXXXXX (subject) DER . CA OCSP (OCSP stapling) . OpenSSL 1.0.0 . OpenSSL 0.x.x OpenSSL 1.x.x c_rehash . CApath chroot . o CAfile = CA_FILE CA CA verifyChain verifyPeer . CA OCSP . o CAstore = URI_CA CA URI CA OSSL_STORE PKCS#11 ( ) . CAfile CAdir verifyChain verifyPeer OCSP . OpenSSL 3.0 . o cert = CERT_FILE | URI (certificate chain) stunnel . / CA . PEM P12 . . cert . . OpenSSL 1.0.2 . (PKCS#11 URI) . : provider OpenSSL 3.0 o checkEmail = EMAIL ( ) checkEmail . checkEmail . OpenSSL 1.0.2 . o checkHost = HOST ( ) checkHost . checkHost . OpenSSL 1.0.2 . o checkIP = IP IP ( ) IP IP checkIP . checkIP . OpenSSL 1.0.2 . o ciphers = CIPHER_LIST TLS ( TLSv1.2 ) (ciphersuites) TLSv1.3 . TLS DES-CBC3-SHA:IDEA-CBC-MD5. o ciphersuites = CIPHERSUITES_LIST TLSv1.3 TLSv1.3 . ciphersuites OpenSSL 3.0 . OpenSSL 1.1.1 . : TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 o client = yes | no ( TLS ) : no ( ) o config = COMMAND[:PARAMETER] OpenSSL OpenSSL . stunnel . SSL_CONF_cmd(3ssl) . config . config = Curves:list_curves curves . OpenSSL 1.0.2 . o connect = [HOST:]PORT localhost . connect . / connect (round-robin) . o CRLpath = DIRECTORY (CRL) stunnel verifyChain verifyPeer CRLcheckChain CRL CRL . CRL XXXXXXXX.r0 XXXXXXXX CRL . OpenSSL 1.0.0 . OpenSSL 0.x.x OpenSSL 1.x.x c_rehash . CRLpath chroot . o CRLfile = CRL_FILE (CRL) CRL verifyChain verifyPeer CRLcheckChain CRL . o CRLcheckChain = yes | no CRL verifyChain = yes CRLfile CRLpath . CRL () . CRLcheckChain = yes CRL . (Full-chain) CRL (fail closed). Root CA -> Intermediate CA -> Leaf CRL CRL . : no o curves = list ECDH `:' : . OpenSSL 1.1.1 . : openssl ecparam -list_curves : X25519:P-256:X448:P-521:P-384 (OpenSSL 1.1.1 ) prime256v1 (OpenSSL 1.1.1) o logId = TYPE . : o sequential stunnel . . o unique - . . o thread (thread) ( stunnel) . . o process (PID) inetd . : sequential o debug = LEVEL syslog : emerg (0) alert (1) crit (2) err (3) warning (4) notice (5) info (6) debug (7). . notice (5) . debug = debug debug = 7 stunnel . . . o delay = yes | no DNS connect DNS (Dynamic DNS) DNS stunnel (VPN dial-up) . (Delayed resolver) stunnel connect . failover = prio . : no o engineId = ENGINE_ID o engineNum = ENGINE_NUMBER 1 . o exec = EXECUTABLE_PATH inetd exec chroot . : REMOTE_HOST REMOTE_PORT SSL_CLIENT_DN SSL_CLIENT_I_DN. o execArgs = $0 $1 $2 ... exec ($0) . . o failover = rr | prio (Failover) "connect". o rr (round robin) - o prio - : prio o ident = USERNAME IDENT (RFC 1413) o include = DIRECTORY DIRECTORY . : : 00-global.conf : 01-service.conf 02-service.conf o key = KEY_FILE | URI cert . . : chmod 600 keyfile (PKCS#11 URI) . : (provider) OpenSSL 3.0 : cert o libwrap = yes | no /etc/hosts.allow /etc/hosts.deny. : no ( 5.00) o local = HOST IP . (bind) IP . o OCSP = URL OCSP ( ) o OCSPaia = yes | no OCSP AIA stunnel OCSP AIA ( Authority Information Access) . o OCSPflag = OCSP_FLAG OCSP OCSPflag . : NOCERTS NOINTERN NOSIGS NOCHAIN NOVERIFY NOEXPLICIT NOCASIGN NODELEGATED NOCHECKS TRUSTOTHER RESPID_KEY NOTIME o OCSPnonce = yes | no nonce OCSP OCSP (replay attacks) . nonce ( ) OCSP. o OCSPrequire = yes | no OCSP (stapling) OCSP . : yes o options = SSL_OPTIONS OpenSSL OpenSSL SSL_CTX_set_options(3ssl) SSL_OP_. stunnel -options stunnel OpenSSL . options . ("-") . TLS Eudora : options = DONT_INSERT_EMPTY_FRAGMENTS : options = NO_SSLv2 options = NO_SSLv3 OpenSSL 1.1.0 TLS sslVersionMax sslVersionMin . o protocol = PROTO TLS TLS . protocol TLS . : o cifs ( ) CIFS Samba . Samba 3.0.0 . o capwin o capwinctrl . o connect 5.2 RFC 2817 - TLS HTTP/1.1 - CONNECT . o imap RFC 2595 - TLS IMAP POP3 ACAP o ldap RFC 2830 - ( 3): o nntp RFC 4642 - (TLS) (NNTP) . o pgsql o pop3 RFC 2449 - POP3 o proxy IP HAProxy PROXY 1 o smtp RFC 2487 - SMTP SMTP TLS o socks 4 4a 5 SOCKS . SOCKS TLS . BIND SOCKS . USERID . VPN SOCKS . o protocolAuthentication = AUTHENTICATION `connect' `smtp' . `connect' `basic' `ntlm'. `connect' `basic' . `smtp' `plain' `login'. `smtp' `plain' . o protocolDomain = DOMAIN `connect' . o protocolHeader = HEADER (header) `connect' . o protocolHost = ADDRESS `connect' protocolHost HOST:PORT TLS . stunnel connect . `smtp' protocolHost SMTP HELO/EHLO . o protocolPassword = PASSWORD `connect' `smtp' . o protocolUsername = USERNAME `connect' `smtp' . o PSKidentity = IDENTITY PSK PSK PSKidentity stunnel PSK . . : PSKsecrets. o PSKsecrets = FILE PSK : IDENTITY:KEY . 16 32 . . o pty = yes | no ( ) (pseudoterminal) `exec' o redirect = [HOST:]PORT TLS . redirect . o renegotiation = yes | no TLS (renegotiation) TLS . (DoS) : TLS . : yes ( OpenSSL) o reset = yes | no TCP RST . : yes o retry = yes | no | DELAY connect+exec DELAY . "retry = yes" "retry = 1000" . : no o securityLevel = LEVEL : o 0 (level 0) . o 1 (level 1) 80 . 80 . RSA DSA DH 1024 ECC 160 . (export cipher suites) 80 . 2 SSL . MD5 MAC . SSLv3 TLS 1.0 TLS 1.1 OpenSSL 3.0 . o 2 (level 2) 112 . RSA DSA DH 2048 ECC 224 . 1 RC4 . . 3 SSL OpenSSL 3.0 . o 3 (level 3) 128 . RSA DSA DH 3072 ECC 256 . 2 (forward secrecy) . (Session tickets) . TLS 1.1 OpenSSL 3.0 . o 4 (level 4) 192 . RSA DSA DH 7680 ECC 384 . SHA1 MAC . TLS 1.2 OpenSSL 3.0 . o 5 (level 5) 256 . RSA DSA DH 15360 ECC 512 . o : 2 securityLevel OpenSSL 1.1.0 . o requireCert = yes | no verifyChain verifyPeer requireCert no stunnel . verifyChain = yes verifyPeer = yes requireCert = yes . : no o setgid = GROUP ( ) (GID) : setgid() . : "accept". o setuid = USER ( ) (UID) : setuid() . : "accept". o sessionCacheSize = NUM_ENTRIES () sessionCacheSize . 0 . (DoS) . o sessionCacheTimeout = TIMEOUT TLS . o sessionResume = yes | no (session resumption) : yes o sessiond = HOST:PORT TLS sessiond o sni = SERVICE_NAME:SERVER_NAME_PATTERN ( ) ( ) Server Name Indication (SNI) TLS (RFC 3546). SERVICE_NAME accept . SERVER_NAME_PATTERN . `*' `*.example.com'. . sni . . connect protocol protocol TLS . Libwrap ( ) : TCP TLS. sni OpenSSL 1.0.0 . o sni = SERVER_NAME ( ) TLS Server Name Indication (RFC 3546). SERVER_NAME SNI . sni OpenSSL 1.0.0 . o socket = a|l|r:OPTION=VALUE[:VALUE] (accept) (local) (remote) linger l_onof:l_linger . tv_sec:tv_usec . : socket = l:SO_LINGER=1:60 set one minute timeout for closing local socket socket = r:SO_OOBINLINE=yes place out-of-band data directly into the receive data stream for remote sockets socket = a:SO_REUSEADDR=no disable address reuse (enabled by default) socket = a:SO_BINDTODEVICE=lo only accept connections on loopback interface o sslVersion = SSL_VERSION TLS : all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 OpenSSL . OpenSSL TLSv1.1 TLSv1.2 TLSv1.3 . OpenSSL SSLv2 . SSLv2 SSLv3 . sslVersion = SSL_VERSION OpenSSL 1.1.0 : sslVersionMax = SSL_VERSION sslVersionMin = SSL_VERSION o sslVersionMax = SSL_VERSION : all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 all OpenSSL . OpenSSL . sslVersionMax OpenSSL 1.1.0 . : all o sslVersionMin = SSL_VERSION : all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 all OpenSSL . OpenSSL . sslVersionMin OpenSSL 1.1.0 . : TLSv1 o stack = BYTES ( FORK) (stack) . (crash) . : 65536 ( ) o ticketKeySecret = SECRET (session ticket) RFC 5077 . ticketKeySecret ticketMacSecret (cluster) . 16 32 32 64 . . . ticketKeySecret OpenSSL 1.0.0 . ticket OpenSSL 1.1.1 NO_TICKET redirect . o ticketMacSecret = SECRET 16 32 32 64 . . . ticketMacSecret OpenSSL 1.0.0 . o TIMEOUTbusy = SECONDS o TIMEOUTclose = SECONDS close_notify ( MSIE 0 ) o TIMEOUTconnect = SECONDS o TIMEOUTidle = SECONDS (idle) o TIMEOUTocsp = SECONDS OCSP o transport = tcp | udp : o tcp TLS TCP (). o udp DTLS UDP. . DTLS DDoS . : tcp o transparent = none | source | destination | both ( ) (transparent proxy) : o none . . o source TLS stunnel . : o ( connect) Linux >=2.6.28 stunnel (root) setuid . iptables ( /etc/rc.local ): iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 >/proc/sys/net/ipv4/conf/lo/rp_filter stunnel setuid . o ( connect) Linux 2.2.x transparent proxy . . stunnel . stunnel setuid . o ( connect) FreeBSD >=8.0 . stunnel setuid . o ( exec) libstunnel.so . _RLD_LIST Tru64 LD_PRELOAD . o destination connect . : [transparent] client = yes accept = transparent = destination iptables /etc/rc.local . : /sbin/iptables -t nat -I OUTPUT -p tcp --dport \ -m ! --uid-owner \ -j DNAT --to-destination : : /sbin/iptables -I INPUT -i eth0 -p tcp --dport -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport \ -i eth0 -j DNAT --to-destination : . o both source destination. : o yes source . o no none . o verify = LEVEL verifyChain verifyPeer . o 0 (level 0) . o 1 (level 1) . o 2 (level 2) . o 3 (level 3) () . o 4 (level 4) . o (No verify). o verifyChain = yes | no CA checkHost checkIP . CA CAfile CApath . : no o verifyPeer = yes | no ( ) CAfile CApath . : no (RETURN VALUE) stunnel . (SIGNALS) stunnel : o SIGHUP . : o chroot o foreground o pid o setgid o setuid `setuid' stunnel (<1024) . `chroot' stunnel ( pid) chroot . o SIGUSR1 stunnel. (log rotation) . o SIGUSR2 . o SIGTERM, SIGQUIT, SIGINT stunnel. . (EXAMPLES) TLS imapd : [imapd] accept = 993 exec = /usr/sbin/imapd execArgs = imapd : [imapd] accept = 993 connect = 143 imapd TLS 119 localhost : [imap] client = yes accept = 143 connect = servername:993 pppd 2020 : [vpn] accept = 2020 exec = /usr/sbin/pppd execArgs = pppd local pty = yes stunnel inetd imapd stunnel.conf . [service_name] . exec = /usr/sbin/imapd execArgs = imapd VPN SOCKS : [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verifyPeer = yes CAfile = stunnel.pem vpn_server : [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key : curl --socks4a localhost http://www.example.com/ SNI : [virtual] ; primary service accept = 443 cert = default.pem connect = default.internal.mydomain.com:8080 [sni1] ; secondary service 1 sni = virtual:server1.mydomain.com cert = server1.pem connect = server1.internal.mydomain.com:8081 [sni2] ; secondary service 2 sni = virtual:server2.mydomain.com cert = server2.pem connect = server2.internal.mydomain.com:8082 verifyPeer = yes CAfile = server2-allowed-clients.pem ( ). CAPI . CA . engine = capi [service] engineId = capi client = yes accept = 127.0.0.1:8080 connect = example.com:8443 pkcs11: engine = pkcs11 engineCtrl = MODULE_PATH:opensc-pkcs11.so engineCtrl = PIN:123456 [service] engineId = pkcs11 client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey SoftHSM: engine = pkcs11 engineCtrl = MODULE_PATH:softhsm2.dll engineCtrl = PIN:12345 [service] engineId = pkcs11 client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=KeyCert (provider) `pkcs11prov`: : OpenSSL 3.0 setEnv = PKCS11_MODULE_PATH=opensc-pkcs11.dll setEnv = PKCS11_PIN:123456 provider = pkcs11prov [service] client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey : OpenSSL 3.5 provider = pkcs11prov providerParameter = pkcs11prov:pkcs11_module=opensc-pkcs11.dll providerParameter = pkcs11prov:pin=123456 [service] client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey PKCS#11 `ossl-modules` `PKCS11_MODULE_PATH` `pkcs11_module` . (NOTES) (RESTRICTIONS) FTP stunnel FTP . TLS FTP telnet . INETD (INETD MODE) stunnel connect exec . stunnel inetd xinetd tcpserver. inetd.conf : imaps stream tcp nowait root @bindir@/stunnel stunnel @sysconfdir@/stunnel/imaps.conf inetd ( imaps) stunnel . accept stunnel . [service_name] . (EXAMPLES) . (CERTIFICATES) TLS X.509 . . OpenSSL . . .pem ( CSR) . : -----BEGIN RSA PRIVATE KEY----- [encoded key] -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- [encoded certificate] -----END CERTIFICATE----- (RANDOMNESS) stunnel TLS (PRNG) (seed) . : o RNDfile. o RANDFILE . o .rnd RANDFILE . o `--with-random' . o . o egd EGD. o egd `--with-egd-sock' . o /dev/urandom. ( ) RNDfile . RNDfile -- stunnel . RNDoverwrite . openssl rand OpenSSL . : /dev/urandom OpenSSL PRNG . /dev/urandom OpenSSL . OpenSSL stunnel. DH (DH PARAMETERS) 4.40 stunnel 2048 (hardcoded) DH . 5.18 stunnel 24 DH . DH . DH DH : openssl dhparam 2048 >> stunnel.pem (FILES) o @sysconfdir@/stunnel/stunnel.conf stunnel (BUGS) execArgs Win32 (quoting) . (SEE ALSO) o stunnel o OpenSSL (AUTHORS) o Michal Trojnara stunnel 5.80 2026.07.31 STUNNEL(8)