.TH STUNNEL 8 "18 January 1999"
.SH NAME
stunnel \- universal SSL tunnel
.SH SYNOPSIS
stunnel [-c][-p pemfile][-v level][-d[ip:]port[-f]] -l program | -r [ip:]port
.SH DESCRIPTION
.PP
The \fBstunnel\fR program is designed to work as \fISSL\fR encryption wrapper 
between remote client and local (\fIinetd\fR-startable) or remote
server. The concept is that having non-SSL aware daemons running on
your system you can easily setup them to communicate with clients over
secure SSL channel.
.PP
.B stunnel
can be used to add SSL functionality to commonly used \fIinetd\fR
daemons like POP-2, POP-3 and IMAP servers as well as to standalone
daemons like NNTP, SMTP and HTTP without changes to the source code.
.PP
This product includes cryptographic software written by
Eric Young (eay@cryptsoft.com)
.SH OPTIONS
.TP
.B -c
client mode (remote service uses SSL)
.RS
default: server mode
.RE
.TP
.B -p pemfile
certificate (*.pem) file name
.RS
default: @SSLDIR@/certs/stunnel.pem
.RE
.TP
.B -v level
verify peer certificate
.TP
.B -d [ip:]port
daemon mode (ip defaults to INADDR_ANY)
.RS
default: inetd mode
.RE
.TP
.B -f
foreground mode (don't fork, log to stderr)
.RS
default: background in daemon mode
.RE
.TP
.B -l program
execute local inetd-type program
.TP
.B -r [ip:]port
connect to remote daemon
.RS
(ip defaults to INADDR_LOOPBACK)
.RE
.SH CERTIFICATES
Each SSL enabled daemon needs to present a valid X.509 certificate
to the peer. It also needs a private key to decrypt the incoming
data. The easiest way to obtain a certificate and a key is to 
generate the with free \fISSLeay\fR package. You can find more
information on certificates generation on pages listed below.
.PP
Two things are important when generating certificate-key pair for \fBstunnel\fR.
The private key cannot be encrypted, because the server has no way to obtain
password from the user. To produce an unencrypted key add \fI-nodes\fR option
when running \fIreq\fR command from \fISSLeay\fR kit.
.PP
Order of contents of the \fI.pem\fR file is also important. It should contain
unencrypted private key first, then a signed certificate
(not certificate request).
There should be also empty lines after certificate and private key.
Plaintext certificate information appended on the top of generated certificate
should be discarded. So the file should look like this:
.sp
.nf
-----BEGIN RSA PRIVATE KEY-----
[encoded key]
-----END RSA PRIVATE KEY-----
[empty line]
-----BEGIN CERTIFICATE-----
[encoded certificate]
-----END CERTIFICATE-----
[empty line]
.fi
.sp
.SH LIMITATIONS
\fIstunnel\fR cannot be used for FTP daemon because of the nature
of FTP protocol which utilizes multiple ports for data transfers.
There are available SSL enabled versions of FTP and telnet daemons, however.
.SH SEE ALSO
.BR ssl (1),
.BR tcpd (8),
.BR inetd (8)
.TP
.BI http://mike.daewoo.com.pl/computer/stunnel
Stunnel home page
.TP
.BI http://www.psy.uq.oz.au/~ftp/Crypto/
SSLeay FAQ
.TP
.BI http://www.camb.opengroup.org/RI/www/prism/wwwj/
overview of SSL certification using SSLeay package
.SH AUTHORS
.na
.nf
Michal Trojnara <Michal.Trojnara@centertel.pl>
Adam Hernik <adas@infocentrum.com>
Pawel Krawczyk <kravietz@ceti.com.pl>
