![带有 SNI 的 Stunnel:部分 *名称*:未找到 SNI 部分名称](https://linux22.com/image/692217/%E5%B8%A6%E6%9C%89%20SNI%20%E7%9A%84%20Stunnel%EF%BC%9A%E9%83%A8%E5%88%86%20*%E5%90%8D%E7%A7%B0*%EF%BC%9A%E6%9C%AA%E6%89%BE%E5%88%B0%20SNI%20%E9%83%A8%E5%88%86%E5%90%8D%E7%A7%B0.png)
我正在尝试在同一个 IP 上使用带有 2 个域的 stunnel。
我的配置是这样的:
;key = /etc/ssl/private/namecheap/server.key
# See this link http://www.sysadminworld.com/2011/how-do-i-use-an-intermediate-certificate-with-stunnel/
# The intermediatev.pem is comodo-rsa-domain-validation-sha-2-w-root.ca-bundle
# Restart /etc/init.d/stunnel4 restart
cert = /etc/ssl/private/namecheap/stunnel.pem
;CApath = /etc/ssl/private/namecheap/www_soinfit_com.ca-bundle
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = all
; no, we don't want SSLv2
;options = NO_SSLv2
; Some security enhancements for UNIX systems - comment them out on Win32
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside the chroot jail
pid = /stunnel4.pid
[paleo-dating]
sni = https:www.paleo-dating.com
cert = /etc/ssl/private/namecheap/stunnel-dating.pem
accept = 5555
connect = localhost:5556
[shoptprod]
accept = 6676
connect = localhost:6060
[shoptest]
accept = 7676
connect = localhost:7070
[chatprod]
accept = 8686
connect = localhost:8080
[chattest]
accept = 9676
connect = localhost:9090
[groupchattest]
accept = 5656
connect = localhost:5050
[groupchatprd]
accept = 4646
connect = localhost:4040
当我跑步时 /etc/init.d/stunnel4 restart
我收到此错误:
Restarting SSL tunnels: Clients allowed=500
stunnel 4.53 on x86_64-pc-linux-gnu platform
Compiled with OpenSSL 1.0.1e 11 Feb 2013
Running with OpenSSL 1.0.1t 3 May 2016
Update OpenSSL shared libraries or rebuild stunnel
Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6
Reading configuration from file /etc/stunnel/stunnel.conf
Compression not enabled
Snagged 64 random bytes from /root/.rnd
Wrote 1024 new random bytes to /root/.rnd
PRNG seeded successfully
Initializing service section [paleo-dating]
Section paleo-dating: SNI section name not found
str_stats: 39 block(s), 7369 data byte(s), 2262 control byte(s)
[Failed: /etc/stunnel/stunnel.conf]
You should check that you have specified the pid= in you configuration file
答案1
我希望你已经解决了困扰你四年的问题。然而,我带着同样的问题来到这里,答案如下:
Stunnel 尝试将 SNI 密钥的第一部分与命名部分进行匹配。如果配置中没有这样的部分,它将失败并出现给定的错误。
查看上面的配置,该行sni = https:www.paleo-dating.com
指的是缺失的[https]
块。您可以随意命名它,只要两个字符串相等即可。此外,密钥也accept
属于那里:
[paleo-dating]
sni = https:www.paleo-dating.com
cert = /etc/ssl/private/namecheap/stunnel-dating.pem
; accept = 5555 <-- This goes below
connect = localhost:5556
[https]
accept = 5555
; Fallback
connect = fallback:1234
cert = fallback-cert.pem
这将接受端口上的安全连接5555并转发至本地主机:5556当(且仅当)客户端使用服务器名称指示扩展,其值为www.paleo-dating.com.否则后备证书.pem证书被提供给客户端,并且连接被转发到端口1234在主机上倒退。