I am digging a little deeper into this. I am not an stunnel expert, and I welcome comments & help.
The tunnel seems to close down after it considers the bitfloor.com certificate. Do I manage this at my end, or ask for shtylman to do something?
Here is my stunnel configuration file.
Here is the /var/log/stunnel4/bitfloor.log file after a connection attempt.
aubrey@gaia:/var/log/stunnel4$ sudo more bitfloor.log
2013.03.18 12:31:56 LOG7[11658:3078449600]: No limit detected for the number of clients
2013.03.18 12:31:56 LOG7[11658:3078449600]: signal_pipe: FD=3 allocated (non-blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: signal_pipe: FD=4 allocated (non-blocking mode)
2013.03.18 12:31:56 LOG5[11658:3078449600]: stunnel 4.42 on i686-pc-linux-gnu platform
2013.03.18 12:31:56 LOG5[11658:3078449600]: Compiled with OpenSSL 1.0.0e 6 Sep 2011
2013.03.18 12:31:56 LOG5[11658:3078449600]: Running with OpenSSL 1.0.1 14 Mar 2012
2013.03.18 12:31:56 LOG5[11658:3078449600]: Update OpenSSL shared libraries or rebuild stunnel
2013.03.18 12:31:56 LOG5[11658:3078449600]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,I
Pv6
2013.03.18 12:31:56 LOG5[11658:3078449600]: Reading configuration from file /etc/stunnel/bitfloor.co
nf
2013.03.18 12:31:56 LOG7[11658:3078449600]: Snagged 64 random bytes from /home/aubrey/.rnd
2013.03.18 12:31:56 LOG7[11658:3078449600]: Wrote 1024 new random bytes to /home/aubrey/.rnd
2013.03.18 12:31:56 LOG7[11658:3078449600]: PRNG seeded successfully
2013.03.18 12:31:56 LOG6[11658:3078449600]: Initializing SSL context for service fix-prod
2013.03.18 12:31:56 LOG7[11658:3078449600]: Loaded verify certificates from /etc/stunnel/certs/bitfl
oor.stunnel.crt
2013.03.18 12:31:56 LOG7[11658:3078449600]: Loaded /etc/stunnel/certs/bitfloor.stunnel.crt revocatio
n lookup file
2013.03.18 12:31:56 LOG7[11658:3078449600]: SSL options set: 0x00000004
2013.03.18 12:31:56 LOG6[11658:3078449600]: SSL context initialized
2013.03.18 12:31:56 LOG5[11658:3078449600]: Configuration successful
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=5 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=6 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=6 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=7 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=7 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=8 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=8 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=9 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=9 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: libwrap_init: FD=10 allocated (blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: accept socket: FD=11 allocated (non-blocking mode)
2013.03.18 12:31:56 LOG7[11658:3078449600]: Option SO_REUSEADDR set on accept socket
2013.03.18 12:31:56 LOG7[11658:3078449600]: Service fix-prod bound to 192.168.0.200:5252
2013.03.18 12:31:56 LOG7[11658:3078449600]: Service fix-prod opened FD=11
2013.03.18 12:31:56 LOG7[11664:3078449600]: Created pid file /var/run/stunnel4.pid
2013.03.18 13:45:53 LOG7[11664:3078449600]: local socket: FD=0 allocated (non-blocking mode)
2013.03.18 13:45:54 LOG7[11664:3078449600]: Service fix-prod accepted FD=0 from 192.168.0.200:34637
2013.03.18 13:45:54 LOG7[11664:3078540096]: Service fix-prod started
2013.03.18 13:45:54 LOG7[11664:3078540096]: Option TCP_NODELAY set on local socket
2013.03.18 13:45:54 LOG7[11664:3078540096]: Waiting for a libwrap process
2013.03.18 13:45:54 LOG7[11664:3078540096]: Acquired libwrap process #0
2013.03.18 13:45:54 LOG7[11664:3078540096]: Releasing libwrap process #0
2013.03.18 13:45:54 LOG7[11664:3078540096]: Released libwrap process #0
2013.03.18 13:45:54 LOG7[11664:3078540096]: Service fix-prod permitted by libwrap from 192.168.0.200
:34637
2013.03.18 13:45:54 LOG5[11664:3078540096]: Service fix-prod accepted connection from 192.168.0.200:
34637
2013.03.18 13:45:54 LOG7[11664:3078540096]: remote socket: FD=1 allocated (non-blocking mode)
2013.03.18 13:45:54 LOG6[11664:3078540096]: connect_blocking: connecting 107.6.65.226:5252
2013.03.18 13:45:54 LOG7[11664:3078540096]: connect_blocking: s_poll_wait 107.6.65.226:5252: waiting
10 seconds
2013.03.18 13:45:54 LOG5[11664:3078540096]: connect_blocking: connected 107.6.65.226:5252
2013.03.18 13:45:54 LOG5[11664:3078540096]: Service fix-prod connected remote server from 192.168.0.
200:51960
2013.03.18 13:45:54 LOG7[11664:3078540096]: Remote FD=1 initialized
2013.03.18 13:45:54 LOG7[11664:3078540096]: Option TCP_NODELAY set on remote socket
2013.03.18 13:45:54 LOG7[11664:3078540096]: SNI: host name: api.bitfloor.com
2013.03.18 13:45:54 LOG7[11664:3078540096]: SSL state (connect): before/connect initialization
2013.03.18 13:45:54 LOG7[11664:3078540096]: SSL state (connect): SSLv3 write client hello A
2013.03.18 13:45:54 LOG7[11664:3078540096]: SSL state (connect): SSLv3 read server hello A
2013.03.18 13:45:54 LOG7[11664:3078540096]: Starting certificate verification: depth=0, /C=US/ST=New
York/L=New York/O=Bitfloor, Inc./CN=bitfloor.com/
[email protected]2013.03.18 13:45:54 LOG4[11664:3078540096]: CERT: Verification error: self signed certificate
2013.03.18 13:45:54 LOG4[11664:3078540096]: Certificate check failed: depth=0, /C=US/ST=New York/L=N
ew York/O=Bitfloor, Inc./CN=bitfloor.com/
[email protected]2013.03.18 13:45:54 LOG7[11664:3078540096]: SSL alert (write): fatal: unknown CA
2013.03.18 13:45:54 LOG3[11664:3078540096]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_
GET_SERVER_CERTIFICATE:certificate verify failed
2013.03.18 13:45:54 LOG5[11664:3078540096]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to s
ocket
2013.03.18 13:45:54 LOG7[11664:3078540096]: Service fix-prod finished (0 left)
2013.03.18 13:45:54 LOG7[11664:3078540096]: str_stats: 0 block(s), 0 byte(s)