Corero web portal setup

[saggu]

Hi,

 

Does anybody have experience setting up stunnel to encrypt traffic from and to a web server? How easy/difficult is it?

 

Thanks,

Saggu

[snagrat]

I'd be interested in this as well

[lostsoul]

We use stunnel for this very purpose, I didn't set it up originally, but recently went through the process of installing a new certificate on the server. All the config is done with a text file, and is self explanatory.

 

You will probably want to remove any passphrase from the key, otherwise the stunnel service will not restart automatically.

[saggu]

Thank you @lostsoul.

[IrritableTech]

For anyone else who took longer to sort this than they should have done, here are the steps I took. If nothing else it will help me if I need to do it again in the future!

 

Install

Install stunnel on the civica/corero server from stunnel.org

Run a command prompt as administrator and run

cd C:\Program Files (x86)\stunnel\bin

stunnel -install

Which will add it as a service.

 

Get a certificate

 

You need to make a cert request on the civica server. I ended up running the following command (taken from stunnel.org but adapted slightly)

openssl req -new -days 365 -nodes -config "C:\Program Files (x86)\stunnel\config\stunnel.cnf -out certreq.pem -keyout stunnel.pem

I took my certreq.pem and took it to StartSSL.Com and got a free 1 year certificate. You'll need to validate a domain name and go through the wizard - pretty self explanatory. You'll also need to have setup your DNS entries for the server eg. civica.school.county.sch.uk

I received my signed certificate as a *.pem

Open this file in notepad and add the stunnel.pem contents to certificate before the certificate data - it'll end up something like this...

-----BEGIN PRIVATE KEY-----

*L0T5OfStuFf...

-----END PRIVATE KEY-----

--------BEGIN CERTIFICATE--------

*L0T5OfStuFf...

--------END CERTIFICATE--------

 

Save it as Civica.pem in the C:\Program Files (x86)\stunnel\config folder.

 

Configure Stunnel

 

Right click on the GUI and Edit Configuration.

I commented out everything a wrote my own entry:

;***************************************************************************

; Civica Config

;***************************************************************************

 

 

; TLS front-end to finance system

[https]

accept = 443

connect = 8000

cert = Civica.pem

; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel

; Microsoft implementations do not use TLS close-notify alert and thus they

; are vulnerable to truncation attacks

TIMEOUTclose = 0

 

;***************************************************************************

debug = info

output = stunnel.log

 

Finally right click on the GUI and reload Configuration.

Check that there are no errors in the log.

Fire up your firewall and block port 8000 and open 443.

Edited September 8, 2016 by IrritableTech