STUNNEL(8) stunnel TLS Proxy STUNNEL(8) (NAME) stunnel.pl - TLS/SSL (SYNOPSIS) o Unix: stunnel [FILE] | -fd N | -help | -version | -sockets | -options o WIN32: stunnel [ [ -install | -uninstall | -start | -stop | -reload | -reopen | -exit ] [-quiet] [FILE] ] | -help | -version | -sockets | -options (DESCRIPTION) stunnel TLS ( inetd) . TLS TLS . stunnel TLS inetd POP-3 IMAP NNTP SMTP HTTP PPP . (OPTIONS) o FILE o -fd N ( ) (file descriptor) o -help stunnel o -version stunnel o -sockets o -options TLS o -install ( Windows NT ) NT o -uninstall ( Windows NT ) NT o -start ( Windows NT ) NT o -stop ( Windows NT ) NT o -reload ( Windows NT ) NT o -reopen ( Windows NT ) NT o -exit ( Win32) o -quiet ( Win32) (CONFIGURATION FILE) : o ( ) o `;' ( ) o `_ = _' o `[_]' : o o (IPv4 IPv6 ) o ( ) (GLOBAL OPTIONS) o chroot = DIRECTORY ( ) stunnel (chroot) . CApath CRLpath pid exec chroot . chroot : o DNS /etc/nsswitch.conf /etc/resolv.conf o /etc/timezone o /dev/zero /dev/null o compression = deflate | zlib | zstd | brotli : TLS 1.2 . OpenSSL 1.1.0 securityLevel 1 . zlib zstd brotli OpenSSL . zstd brotli OpenSSL 3.2 . . deflate RFC 1951 . : TLS CRIME . o debug = [FACILITY.]LEVEL : emerg (0) alert (1) crit (2) err (3) warning (4) notice (5) info (6) debug (7). ( ) . notice (5) . debug = debug debug = 7 stunnel . stunnel . . (facility) daemon . Win32 . . o EGD = EGD_PATH ( ) Entropy Gathering Daemon Entropy Gathering Daemon OpenSSL . o engine = auto | DEVICE_ID (cryptographic engine) : <<>> . o engineCtrl = COMMAND[:PARAMETER] o engineDefault = TASK_LIST OpenSSL OpenSSL . : ALL RSA DSA ECDH ECDSA DH RAND CIPHERS DIGESTS PKEY PKEY_CRYPTO PKEY_ASN1. o fips = yes | no FIPS 140-2 stunnel FIPS 140-2 FIPS . : no ( 5.00) o foreground = yes | quiet | no ( ) stunnel (daemon) . yes syslog output (stderr) . o iconActive = ICON_FILE ( ) .ico 16x16 . o iconError = ICON_FILE ( ) .ico 16x16 . o iconIdle = ICON_FILE ( ) .ico 16x16 . o log = append | overwrite ( output) . : append o output = FILE . ( splogger daemontools) /dev/stdout . o pid = FILE ( ) (PID) . chroot pid . o provider = PROVIDER_ID (provider) . PROVIDER_ID . OpenSSL 3.0 . o providerParameter = PROVIDER_ID:PARAMETER=VALUE . PROVIDER_ID PARAMETER VALUE . . OpenSSL 3.5 . o RNDbytes = BYTES o RNDfile = FILE OpenSSL . o RNDoverwrite = yes | no : yes ( ) o service = SERVICE ( ) syslog TCP Wrapper inetd . . : stunnel o setEnv = VAR_NAME=VALUE . VAR_NAME . . o syslog = yes | no ( ) syslog : yes () o taskbar = yes | no ( WIN32) ( ) : yes () (SERVICE-LEVEL OPTIONS) . libwrap (TCP wrappers) . stunnel inetd ( inetd xinetd tcpserver) INETD . o accept = [HOST:]PORT stunnel IPv4 . IPv6 : accept = :::port o CAengine = CA_ENGINE_ID (CA) verifyChain verifyPeer . . : pkcs11 cng. o CApath = CA_DIR stunnel verifyChain verifyPeer . XXXXXXXX.0 XXXXXXXX DER . root CA OCSP (OCSP stapling) . OpenSSL 1.0.0 . OpenSSL 0.x.x 1.x.x c_rehash . chroot CApath . o CAfile = CA_FILE verifyChain verifyPeer . root CA OCSP (OCSP stapling) . o CAstore = CA_URI URI CA OSSL_STORE PKCS#11 ( ) . CAfile CApath verifyChain verifyPeer OCSP stapling . OpenSSL 3.0 . o cert = CERT_FILE | URI stunnel . / Root CA . PEM P12 . . . cert . . OpenSSL 1.0.2 . provider cert (PKCS#11 URI) . : provider OpenSSL 3.0 . o checkEmail = EMAIL checkEmail . checkEmail . OpenSSL 1.0.2 . o checkHost = HOST checkHost . checkHost . OpenSSL 1.0.2 . o checkIP = IP IP checkIP . IP IP checkIP . OpenSSL 1.0.2 . o ciphers = CIPHER_LIST SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 . TLS : DES-CBC3-SHA:IDEA-CBC-MD5 o ciphersuites = CIPHERSUITES_LIST TLSv1.3 . OpenSSL 3.0 ciphersuites . ciphersuites OpenSSL 1.1.1 . : TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 o client = yes | no ( TLS ) : no ( ) o config = COMMAND[:PARAMETER] OpenSSL OpenSSL . OpenSSL stunnel . SSL_CONF_cmd(3ssl) . config OpenSSL . config = Curves:list_curves curves . OpenSSL 1.0.2 . o connect = [HOST:]PORT stunnel . . o CRLpath = CRL_DIR (CRL) stunnel CRL verifyChain verifyPeer CRLcheckChain . CRL XXXXXXXX.r0 XXXXXXXX CRL . OpenSSL 1.0.0 . OpenSSL 0.x.x 1.x.x c_rehash . chroot CRLpath . o CRLfile = CRL_FILE (CRL) CRL verifyChain verifyPeer CRLcheckChain . o CRLcheckChain = yes | no CRL verifyChain = yes CRL CRLfile CRLpath . CRL () . CRLcheckChain = yes CRL . CRL . Root CA -> Intermediate CA -> Leaf Certificate CRL Intermediate CA CRL Root CA . : no o curves = list ECDH `:' : . OpenSSL 1.1.1 . : openssl ecparam -list_curves : X25519:P-256:X448:P-521:P-384 ( OpenSSL 1.1.1 ) prime256v1 (OpenSSL 1.1.1) o logId = TYPE . : o sequential stunnel . . o unique . . o thread ( stunnel) . . o process (PID) inetd . : sequential o debug = LEVEL : emerg (0) alert (1) crit (2) err (3) warning (4) notice (5) info (6) debug (7). . debug = debug debug = 7 . notice (5) . o delay = yes | no DNS connect DNS DNS stunnel ( VPN ) . connect DNS . failover = prio . : no o engineId = DEVICE_NUMBER o engineNum = DEVICE_NUMBER 1 . o exec = PROGRAM_PATH inetd chroot exec . : REMOTE_HOST REMOTE_PORT SSL_CLIENT_DN SSL_CLIENT_I_DN. o execArgs = $0 $1 $2 ... exec ($0) (quoting) . . o failover = rr | prio "connect". o rr (round robin) - o prio (priority) - : prio o ident = USERNAME IDENT ( RFC 1413) o include = DIRECTORY . : : 00-global.conf : 01-service.conf 02-service.conf o key = KEY_FILE | URI cert . . : chmod 600 keyfile provider key (PKCS#11 URI) . : provider OpenSSL 3.0 . : cert o libwrap = yes | no /etc/hosts.allow /etc/hosts.deny. : no ( 5.00 ) o local = HOST IP IP . o OCSP = URL (responder) OCSP o OCSPaia = yes | no AIA OCSPaia OCSP AIA ( - Authority Information Access) . o OCSPflag = OCSP_FLAG OCSP : NOCERTS NOINTERN NOSIGS NOCHAIN NOVERIFY NOEXPLICIT NOCASIGN NODELEGATED NOCHECKS TRUSTOTHER RESPID_KEY NOTIME OCSPflag . o OCSPnonce = yes | no OCSP (OCSP nonce) OCSPnonce OCSP (replay attacks) . OCSP ( ) . o OCSPrequire = yes | no OCSP OCSP (stapling) . : yes o options = SSL_OPTIONS OpenSSL SSL_CTX_set_options(3ssl) SSL_OP_ . stunnel -options stunnel OpenSSL . options . ("-") . TLS Eudora : options = DONT_INSERT_EMPTY_FRAGMENTS : options = NO_SSLv2 options = NO_SSLv3 OpenSSL 1.1.0 TLS sslVersionMax sslVersionMin . o protocol = PROTOCOL TLS TLS . protocol TLS . : o cifs CIFS Samba . 3.0.0 Samba . o capwin o capwinctrl . o connect RFC 2817 - Upgrading to TLS Within HTTP/1.1 5.2 - Requesting a Tunnel with CONNECT . o imap RFC 2595 - Using TLS with IMAP, POP3 and ACAP o ldap RFC 2830 - Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security o nntp RFC 4642 - Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP) . o pgsql o pop3 RFC 2449 - POP3 Extension Mechanism o proxy IP 1 HAProxy PROXY o smtp RFC 2487 - SMTP Service Extension for Secure SMTP over TLS o socks SOCKS 4 4a 5 . SOCKS TLS . BIND SOCKS . USERID . <<>> VPN SOCKS . o protocolAuthentication = AUTHENTICATION `connect' `smtp' . `connect' `basic' `ntlm' . `connect' `basic' . `smtp' `plain' `login' . `smtp' `plain' . o protocolDomain = DOMAIN `connect' . o protocolHeader = HEADER `connect' . o protocolHost = HOST `connect' protocolHost TLS . stunnel connect . `smtp' protocolHost HELO/EHLO . o protocolPassword = PASSWORD `connect' `smtp' . o protocolUsername = USERNAME `connect' `smtp' . o PSKidentity = IDENTITY PSK ( ) PSKidentity PSK . . : PSKsecrets o PSKsecrets = FILE PSK : IDENTITY:KEY . . . o pty = yes | no ( ) (pseudo-terminal) `exec' o redirect = [HOST:]PORT . redirect . o renegotiation = yes | no (renegotiation) TLS TLS . (DoS) CPU : TLS . : yes ( OpenSSL) o reset = yes | no TCP RST . : yes o retry = yes | no | DELAY connect+exec DELAY . "retry = yes" "retry = 1000" . : no o securityLevel = LEVEL : o 0 . o 1 . . RSA DSA DH ECC (export) . SSLv2 . MD5 MAC . OpenSSL 3.0 TLS 1.2 . o 2 . RSA DSA DH ECC . RC4 . . SSLv3 OpenSSL 3.0 . o 3 . RSA DSA DH ECC . (forward secrecy) . (session tickets) . TLS 1.1 OpenSSL 3.0 . o 4 . RSA DSA DH ECC . SHA1 MAC . TLS 1.2 OpenSSL 3.0 . o 5 . RSA DSA DH ECC . o : 2 securityLevel OpenSSL 1.1.0 . o requireCert = yes | no verifyChain verifyPeer requireCert no stunnel . verifyChain = yes verifyPeer = yes requireCert yes . : no o setgid = GROUP_ID ( ) : stunnel . : "accept". o setuid = USER_ID ( ) : stunnel . : "accept". o sessionCacheSize = CACHE_SIZE () TLS . 0 . (DoS) RAM . o sessionCacheTimeout = SECONDS TLS TLS . o sessionResume = yes | no (session resumption) : yes o sessiond = HOST:PORT sessiond - TLS o sni = SERVICE_NAME:SERVER_NAME_PATTERN ( ) ( ) Server Name Indication TLS ( RFC 3546). SERVICE_NAME accept . SERVER_NAME_PATTERN . `*' : '*.example.com". . sni . . connect protocol TLS . libwrap : TCP TLS. sni OpenSSL 1.0.0 . o sni = SERVER_NAME ( ) Server Name Indication TLS ( RFC 3546). SERVER_NAME SNI . sni OpenSSL 1.0.0 . o socket = a|l|r:OPTION=VALUE[:VALUE] // linger l_onoff:l_linger . time tv_sec:tv_usec . : socket = l:SO_LINGER=1:60 socket = r:SO_OOBINLINE=yes (out-of-band) socket = a:SO_REUSEADDR=no ( ) socket = a:SO_BINDTODEVICE=lo (loopback) o sslVersion = SSL_VERSION TLS : all SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 OpenSSL . OpenSSL TLSv1.1 TLSv1.2 TLSv1.3 . OpenSSL SSLv2 . SSLv2 SSLv3 . OpenSSL 1.1.0 sslVersion = SSL_VERSION : sslVersionMax = SSL_VERSION sslVersionMin = SSL_VERSION o sslVersionMax = SSL_VERSION TLS : all SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 all OpenSSL . OpenSSL . sslVersionMax OpenSSL 1.1.0 . : all o sslVersionMin = SSL_VERSION TLS : all SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 all OpenSSL . OpenSSL . sslVersionMin OpenSSL 1.1.0 . : TLSv1 o stack = BYTES ( FORK) . . : 65536 ( ) o ticketKeySecret = SECRET RFC 5077 . ticketKeySecret ticketMacSecret . . . . ticketKeySecret OpenSSL 1.0.0 . NO_TICKET OpenSSL 1.1.1 redirect . o ticketMacSecret = SECRET . . . ticketMacSecret OpenSSL 1.0.0 . o TIMEOUTbusy = SECONDS o TIMEOUTclose = SECONDS close_notify ( MSIE 0 ) o TIMEOUTconnect = SECONDS o TIMEOUTidle = SECONDS o TIMEOUTocsp = SECONDS OCSP o transport = tcp | udp : o tcp TLS TCP (). o udp DTLS UDP. . DTLS (DDoS) . : tcp o transparent = none | source | destination | both ( ) : o none . . o source stunnel. : o ( connect) Linux >=2.6.28 iptables ( /etc/rc.local ): iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 >/proc/sys/net/ipv4/conf/lo/rp_filter stunnel root setuid . o ( connect) Linux 2.2.x transparent proxy . stunnel . stunnel root setuid . o ( connect) FreeBSD >=8.0 . stunnel root setuid . o ( exec) libstunnel.so . _RLD_LIST Tru64 LD_PRELOAD . o destination connect . : [transparent] client = yes accept = transparent = destination iptables /etc/rc.local . : /sbin/iptables -t nat -I OUTPUT -p tcp --dport \ -m ! --uid-owner \ -j DNAT --to-destination : : /sbin/iptables -I INPUT -i eth0 -p tcp --dport -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport \ -i eth0 -j DNAT --to-destination : . o both . : o yes source . o no none . o verify = LEVEL verifyChain verifyPeer . o 0 o 1 o 2 (CA) o 3 o 4 CA o o verifyChain = yes | no checkHost checkIP . (Root CA) CAfile CApath . : no o verifyPeer = yes | no CAfile CApath . : no (RETURN VALUE) stunnel . (SIGNALS) : o SIGHUP . : o chroot o foreground o pid o setgid o setuid `setuid' stunnel (<1024) . `chroot' stunnel ( pid) `chroot' . o SIGUSR1 . (log rotation) stunnel . o SIGUSR2 . o SIGTERM, SIGQUIT, SIGINT . . (EXAMPLES) imapd : [imapd] accept = 993 exec = /usr/sbin/imapd execArgs = imapd : [imapd] accept = 993 connect = 143 TLS imapd localhost 119 : [imap] client = yes accept = 143 connect = server:993 pppd stunnel (VPN) . 2020 : [vpn] accept = 2020 exec = /usr/sbin/pppd execArgs = pppd local pty = yes stunnel inetd . [_] . exec = /usr/sbin/imapd execArgs = imapd VPN : [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verifyPeer = yes CAfile = stunnel.pem vpn_server: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key : curl --socks4a localhost http://www.example.com SNI: [virtual] ; accept = 443 cert = default.pem connect = default.internal.mydomain.com:8080 [sni1] ; sni = virtual:server1.mydomain.com cert = server1.pem connect = server1.internal.mydomain.com:8081 [sni2] ; sni = virtual:server2.mydomain.com cert = server2.pem connect = server2.internal.mydomain.com:8082 verifyPeer = yes CAfile = server2-allowed-clients.pem (Windows Certificate Store ): engine = capi [service] engineId = capi client = yes accept = 127.0.0.1:8080 connect = example.com:8443 CAPI cert CA Certificate Store . pkcs11: engine = pkcs11 engineCtrl = MODULE_PATH:opensc-pkcs11.so engineCtrl = PIN:123456 [service] engineId = pkcs11 client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey SoftHSM: engine = pkcs11 engineCtrl = MODULE_PATH:softhsm2.dll engineCtrl = PIN:12345 [service] engineId = pkcs11 client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=KeyCert `pkcs11prov`: : OpenSSL 3.0 setEnv = PKCS11_MODULE_PATH=opensc-pkcs11.dll setEnv = PKCS11_PIN:123456 provider = pkcs11prov [service] client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey : OpenSSL 3.5 provider = pkcs11prov providerParameter = pkcs11prov:pkcs11_module=opensc-pkcs11.dll providerParameter = pkcs11prov:pin=123456 [service] client = yes accept = 127.0.0.1:8080 connect = example.com:843 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey PKCS#11 `ossl-modules` `PKCS11_MODULE_PATH` `pkcs11_module` . (NOTES) (RESTRICTIONS) stunnel FTP . FTP TLS . INETD ( ) (INETD MODE) stunnel connect exec . stunnel . inetd xinetd tcpserver. /etc/inetd.conf : imaps stream tcp nowait root @bindir@/stunnel stunnel @sysconfdir@/stunnel/imaps.conf ( imaps) ( inetd) stunnel accept . ([_]) . . . (CERTIFICATES) TLS X.509 . . OpenSSL . . .pem ( ). : -----BEGIN RSA PRIVATE KEY----- [ ] -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- [ ] -----END CERTIFICATE----- (RANDOMNESS) stunnel PRNG ( ) TLS . : o RNDfile. o RANDFILE . o .rnd RANDFILE . o `--with-random' . o . o egd EGD . o egd `--with-egd-socket' . o /dev/urandom. PRNG . RNDfile . RNDfile stunnel . RNDoverwrite . openssl rand OpenSSL . /dev/urandom OpenSSL PRNG . /dev/urandom . OpenSSL stunnel. DH (DH PARAMETERS) 4.40 stunnel 2048 DH . 5.18 . DH . DH : openssl dhparam 2048 >> stunnel.pem (FILES) o @sysconfdir@/stunnel/stunnel.conf (BUGS) execArgs Win32 (quoting) . (SEE ALSO) o stunnel o OpenSSL (AUTHOR) o Michal Trojnara stunnel 5.80 2026.07.31 STUNNEL(8)