通过Stunnel 实现SSL连接(测试ing)

1. 安装
2. AS3，Redhat 9默认已经安装
3. 需要下面两个包：
4. openssl
5. stunnel

1. [root@linuxas3 root]# rpm -qa |grep openssl
   openssl-0.9.7a-22.1
   openssl-devel-0.9.7a-22.1
   [root@linuxas3 root]# rpm -qa |grep stunnel
   stunnel-4.04-4
   [root@linuxas3 root]# cd /etc/stunnel/
   [root@linuxas3 stunnel]# ls
   stunnel.conf-sample stunnel.pem
   				

1. 配置

1. [root@linuxas3 stunnel]# cp stunnel.conf-sample stunnel.conf
   [root@linuxas3 stunnel]# mv stunnel.pem stunnel.pem.old
   [root@linuxas3 stunnel]# vi stunnel.conf
   				

1. Example 1. stunnel.conf

1. # Sample stunnel configuration file
   # Copyright by Michal Trojnara 2002
   
   # Comment it out on Win32
   cert = /etc/stunnel/stunnel.pem
   # chroot = /usr/var/run/stunnel/
   # PID is created inside chroot jail
   pid = /stunnel.pid
   #setuid = nobody
   #setgid = nogroup
   
   setuid = root
   setgid = root
   
   # Workaround for Eudora bug
   #options = DONT_INSERT_EMPTY_FRAGMENTS
   
   # Authentication stuff
   #verify = 2
   # don't forget about c_rehash CApath
   # it is located inside chroot jail:
   #CApath = /certs
   # or simply use CAfile instead:
   #CAfile = /usr/etc/stunnel/certs.pem
   
   # Some debugging stuff
   debug = 7
   output = stunnel.log
   
   # Use it for client mode
   #client = yes
   
   # Service-level configuration
   
   [pop3s]
   accept  = 995
   connect = 110
   
   [imaps]
   accept  = 993
   connect = 143
   
   [ssmtp]
   accept  = 465
   connect = 25
   
   [s1]
   accept  = 5000
   connect = mail.osw.pl:110
   # delay = yes
   
   [s2]
   accept  = 5001
   connect = mail.osw.pl:25
   
   #[https]
   #accept  = 443
   #connect = 80
   #TIMEOUTclose = 0
   
   [nntps]
   accept  = 563
   connect = 119
   					

1. 配置/运行 Stunnel

1. stunnel 默认配置文件是 /etc/stunnel/stunnel.conf
   下面是最小的服务方式配置文件内容示范：
   
   key = stunnel.pem
   [http2ssl]
   accept = 443
   connect = 127.0.0.1:80
   
   含义：使用 stunnel.pem 证书，将 127.0.0.1: 80 的端口加密映射成本机443端口，“ http2ssl ”是名称，可以改成其它的标识。 
   
   配置文件文件还有其它内容，详情请看帮助。
   
   直接运行stunnel，就可以启动 Stunnel 了。
   				

1. 创建服务器证书

1. [root@linuxas3 stunnel]# cp /usr/share/ssl/openssl.cnf /etc/openssl.cnf
   [root@linuxas3 stunnel]# nano -w /etc/openssl.cnf
   [root@linuxas3 stunnel]# openssl req -new -x509 -days 365 -nodes -config /etc/openssl.cnf -out stunnel.pem -keyout stunnel.pem
   
   Generating a 1024 bit RSA private key
   ....................++++++
   .......................++++++
   writing new private key to 'stunnel.pem'
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [GB]:CN
   State or Province Name (full name) [Berkshire]:GD
   Locality Name (eg, city) [Newbury]:Shen Zhen
   Organization Name (eg, company) [My Company Ltd]:none
   Organizational Unit Name (eg, section) []:postfix
   Common Name (eg, your name or your server's hostname) []:netkiller
   Email Address []:[e-mail]
   [root@linuxas3 stunnel]# openssl gendh 512 >> stunnel.pem
   [root@linuxas3 stunnel]# openssl x509 -subject -dates -fingerprint -in stunnel.pem
   [root@linuxas3 stunnel]# chmod 600 /etc/stunnel/stunnel.pem
   				

Stunnel 客户方式不需要证书。Stunnel 服务方式需要一个证书文件。
Stunnel 在 SSL Http Proxy 服务器是以服务方式运行的，所以必须要有一个证书。通过 openssl.exe 创建服务器证书。下面我将 Stunnel 关于创建证书的翻译如下：
“...运行下面的命令
openssl req -new -x509 -days 365 -nodes -config openssl.cnf -out stunnel.pem -keyout stunnel.pem 
这将会创建一个自己给自己签名的证书。参数的含义：
-days 365 
使这个证书的有效期是1年，之后它将不能再用。
-new 
创建一个新的证书
-x509 
创建一个 X509 证书（自己签名的）
-nodes 
这个证书没有密码
-config openssl.cnf 
OpenSSL 使用的配置文件 （可能需要修改的有[CA_default]和[req_distinguished_name]这两个 section，译者）
-out stunnel.pem 
把 SSL 证书写到哪里
-keyout stunnel.pem 
把 SSL 证书放到这个文件中

这个命令将会问你以下问题：
问题的回答示范
Country name 国家代码 PL, UK, US, CA...我国是CN,HK,TW
State or Province name 省
Locality Name 市
Organization Name 公司、组织名称
Organizational Unit Name 部门名称
Common Name (FQDN)  

注意：Common Name (FQDN) 应该是运行 stunnel 机器的主机名。如果你能通过不同的主机名访问这台机器，有些 SSL 客户会警告这个主机的证书有问题，所以最好是使它和用户访问的主机名匹配。

openssl gendh 512>> stunnel.pem 
这将生成 Diffie-Hellman 部分, 追加到 pem 文件中。

openssl x509 -subject -dates -fingerprint -in stunnel.pem 
这个命令是将你的证书信息在屏幕显示出来。”
					

1. 运行

1. [root@linuxas3 stunnel]# stunnel
   [root@linuxas3 stunnel]# ps ax |grep stunnel
   20733 ?        S      0:00 stunnel