View source for Stunnel: Install 4.24

<span id="top"></span>
<div style="padding:0;margin:0; border-bottom:3px inset #000000">
{| 
| [[Image:uc_small_logo.gif | MPG UniCenter]] ||
Stunnel: 
[[Stunnel: Home | Home]] | 
[[Stunnel: Upgrade 4.24 | Upgrade 4.24]] |  
[[Stunnel: Install 4.24 | Install]] |  
[[Stunnel: SSL Certificate | SSL Certificate]] |
[[Stunnel: Single Vhost | Single Vhost]] |   
[[Stunnel: Resolved | Resolved]] |  
[[Stunnel: Basics | Basics]] |  
[[Stunnel: Cost | Cost]] |   
[[Stunnel: Original | Original]]    
|}
</div>
{| cellpadding="2"
|
__TOC__
||
''' 3.5 Apollo'''<br>
''' Stunnel upgrded to 4.24'''<br>
''' Stunnel upgrded to 4.25'''
|}
Since the release of Apollo I have received a number of emails asking what needs to be changed to get Stunnel working. Also had several emails where users do not like the server being accessed by both http and https. Result is the remainder of this write-up that addresses these issues and targets only Apollo. I have also taken the opportunity to upgrade (S''tunnel 4.24'') as covered on the previous [[Stunnel: Upgrade 4.24 | page]].

== Where to get the upgrade ==
My unofficial plugin is based on the original Uniform Server plugin (Stunnel-4.05) this can be found at the Sourceforge [http://sourceforge.net/project/showfiles.php?group_id=53691&package_id=49448 download page]. I have previously upgraded 3.3 to use the latest version of Stunnel (Stunnel-4.20). For 3.5-Apollo I have changed the file paths to reflect the new folder names. In addition there are a few minor changes that I will explain later.

* '''Download''': This file '''[http://wiki.uniformserver.com/exeload/stunnel/uc35Stunnel_424.exe uc35Stunnel_424.exe]''' and save it to folder '''Uniform Server'''.<br>
*''' MD5''': 7c1f5ab98e500cfbc084f18719c7112d


'''''Note 1''''':
Stunnel upgraded to 4.25 this also includes a minor modification to Stunnel configuration file, prevents a blank "Choose a digital certificate" pop-up in IE.

* '''Download''': This file '''[http://wiki.uniformserver.com/exeload/stunnel/uc35Stunnel_425.exe uc35Stunnel_425.exe]''' and save it to folder '''Uniform Server'''.<br>
*''' MD5''': dd5542ed9e83426d77437769d2af0cee


'''''Note 2''''': The file contains all files required for a full update, it is a self extracting archive, '''double click''' to run. <br>To avoid conflicts with official releases I use the suffix uc for both folders and files where appropriate (uc stands for UniCenter).


On completion you will find the following folders and files have been created:

'''''Folder'' : <nowiki>*</nowiki>\Uniform Server'''
* ucStunnel_stop.bat
* ucStunnel_start.bat
 
'''''Folder'' : <nowiki>*</nowiki>\UniformServer\udrive\home\admin\www\plugins\stunnel_424'''
* .htaccess
* index.html
* stunnel.php
* sslstart.cgi
* sslstop.cgi
''
'''''Folder'' : <nowiki>*</nowiki>\UniformServer\udrive\home\admin\www\plugins\stunnel_424\bin'''
{|
|-
|
* .htaccess
* libeay32.dll
* libssl32.dll
* mpg_create.bat
* mpg_stunnel_stop.bat
* mpg_stunnel_start.bat
* mpg_perl_stop.bat
* mpg_perl_start.bat
* mpg_php_stop.bat
* mpg_php_start.bat
|
&nbsp;&nbsp;&nbsp;
|valign="top"|
* openssl.exe
* stunnel
* ssleay32.dll
* stunnel.conf
* stunnel.pem
* stunnel.rnd
* stunnel_424.exe
* zlib1.dll
|}

'''''[[#top | Top]]'''''

== How to Run ==
This plugin like the official version has several ways of starting and stopping Stunnel.

=== Preferred method ===
Navigate to folder '''Uniform Server''' double clink on '''ucStunnel_start.bat''' or '''ucStunnel_stop.bat''' to start and stop the Stunnel server respectively.


'''''Note 1''''': Stunnel is independent of Uniform Server; this allows you to start Stunnel before or after staring UniServer.

'''''Note 2''''': The above two batch files do not directly start Stunnel they use intermediary files mpg_stunnel_start.bat and mpg_stunnel_start.bat found in folder  *\Uniform Server\udrive\home\admin\www\plugins\stunnel_424\bin. They allow other external programs to start and stop Stunnel in addition they provide Stunnel with [[Stunnel: Resolved#Stunnel Path Independence| path independence]].

=== From a browser via your Apache server ===
Start Uniform Server and type the following into your browser address bar:

'''<nowiki>http://localhost/apanel/plugins/stunnel_424/index.html</nowiki>'''

This opens Stunnel’s control page, you will find the controls have been duplicated, left set of links use [[Stunnel: Resolved#Practical Solutions| Perl cgi pages]] while links on the right use [[Stunnel: Resolved#Practical Solutions| PHP pages]]. Either allows you to start and stop Stunnel.

'''Note''': The above duplication is not really required its provided only to show examples of using either Perl or PHP to control Stunnel.

=== Other programs ===
If you are using other programs to control Stunnel such as UniTray they should use the two batch files '''mpg_stunnel_start.bat''' and '''mpg_stunnel_stop.bat''' located in folder <nowiki>*</nowiki>''\Uniform Server\udrive\home\admin\www\plugins\stunnel_424\bin'' for this purpose. Using these files allows Stunnel to be started before or after UniServer.

'''''Note''''': Check out this page for background information on mpg_stunnel_start.bat

'''''[[#top | Top]]'''''

== Testing ==
Testing is straightforward, start both servers Uniform and Stunnel.
Type '''<nowiki>https://localhost</nowiki>''' into your browser address bar.

Your browser will start a secure transaction resulting in either a warning pop-up stating the “Server Certificate has Expired” or you will receive several security alerts “Security Alert check this page for screen shots” accept certificate for a single session (do not save the certificate to your browser)

The actual wording will vary across browsers just accept this certificate temporarily for this session.

The net result will be a '''padlock symbol''' indicating a secure connection and Stunnel is working correctly.

'''''[[#top | Top]]'''''
== Security certificate ==
If you view the certificate (this example shows the result from Firefox) you will see something like this:

<pre>
SSL Server Certificate  	 
Issued To 	 
Common Name (CN)         fred.gotdns.com
Organization (O)         Mike Gleaves UniCenter
Organizational Unit (OU) Uniform Server 3.5-Apollo example
Serial Numer             00
Issued By 	 
Common Name (CN)         fred.gotdns.com
Organization (O)         Mike Gleaves UniCenter
Organizational Unit (OU) Uniform Server 3.5-Apollo example
Validity 	 
Issued On                22/08/2007
Expires On               19/08/2017
Fingerprints 	 
SHA1 Fingerprint         80:87:52:6D:30:54:B1:8E:BD:56:B6:3E:F3:08:42:02:15:C7:1A:30
MD5 Fingerprint          EC:29:34:94:D8:33:F9:16:EC:BF:9E:56:06:B8:B6:42
</pre>

The above information gives you an idea what will be required when creating your own certificate and private key, note these are both contained in the file stunnel.pem.

'''Important Note'''

At this point I must stress the private key (certificate) shipped with Stunnel and UniServer are both compromised and pose a security risk.

Anyone downloading Stunnel have the same key (certificate) this is ideal for testing but not for production or a personal server. However it is extremely easy to create your own personal unique certificate I cover this on the [[Stunnel: SSL Certificate | next page]].

This certificate is unique to you and is the one you can save to your browser if you wish to avoid those [[Stunnel: Cost#Secure personal server | annoying security alerts]]. 

'''''[[#top | Top]]'''''

----

{| 
| [[Image:uc_small_logo.gif]] || [[User:Ric|Ric]]
|}

[[Category: UniCenter]]
[[Category: Support]]
[[Category: Installation]]
[[Category: Application]]
[[Category: Development]]
[[Category: Plugins]]