stunnel

stunnel [configfile] | -fd n | -help | -version | -sockets | -options

stunnel is a TLS/SSL proxy that wraps arbitrary TCP connections with encryption without requiring any changes to the application code. It uses OpenSSL for all cryptographic operations and supports modern TLS versions.In server mode (the default), stunnel listens for incoming TLS-encrypted connections and forwards them unencrypted to a backend service (e.g. a plain-text IMAP or SMTP daemon). In client mode (`client = yes`), it accepts unencrypted connections from local clients and establishes a TLS-encrypted tunnel to a remote TLS server.Stunnel reads a configuration file that contains global settings and one or more named service sections. Each service section defines an independent tunnel. Multiple tunnels can run within a single stunnel process.It supports inetd-style operation (omit `accept`; stunnel inherits the socket), daemon mode, and launch by systemd. Unix signals control a running daemon: `SIGHUP` reloads the configuration, `SIGUSR1` reopens the log file, and `SIGTERM`/`SIGQUIT`/`SIGINT` shut it down.FTP limitation: stunnel cannot tunnel the FTP data channel because FTP uses dynamically negotiated secondary ports.

configfile

Path to the configuration file to use

Read configuration from file descriptor n (Unix only)

Display help message

Display version information and compile-time defaults

Show default socket options

Show supported TLS/SSL options compiled into OpenSSL

Wrap a plain IMAP daemon with TLS (server mode)

$ [imapd]
accept  = 993
exec    = /usr/sbin/imapd
execArgs = imapd
cert    = /etc/stunnel/server.pem

$ [imapd]
accept  = 993
connect = 143
cert    = /etc/stunnel/server.pem

$ [imap-client]
client  = yes
accept  = 127.0.0.1:143
connect = mail.example.com:993

$ ; Server side
[socks-server]
protocol = socks
accept   = 9080
cert     = /etc/stunnel/server.pem

; Client side
[socks-client]
client   = yes
accept   = 127.0.0.1:1080
connect  = vpnserver.example.com:9080
verifyChain = yes
CAfile   = /etc/stunnel/ca.pem

Stunnel is driven entirely by a configuration file. The file uses INI-style syntax: global directives appear at the top, then one or more named service sections in `[service_name]` blocks. Lines beginning with `;` are comments.Global directives (selected)foreground

Keep the process in the foreground and log to stderr instead of syslog. Values: `yes | no`. Default: `no`

Path to the PID file. An empty value disables PID file creation. Path is relative to `chroot` if set (Unix only)

Chroot jail directory. Stunnel drops privileges and changes root to this directory after startup (Unix only)

Unix user to run as after startup (Unix only)

Unix group to run as after startup (Unix only)

Logging verbosity level. Format: `[FACILITY.]LEVEL`. Levels: emerg(0), alert(1), crit(2), err(3), warning(4), notice(5), info(6), debug(7). Default: `notice`

Append log messages to the specified file instead of syslog

Enable or disable logging to syslog. Values: `yes | no`. Default: `yes`

Accept connections on the specified address. Format: `[HOST:]PORT`. Omit `accept` in inetd mode

Forward connections to the specified address. Format: `[HOST:]PORT`. Default host: `localhost`. Multiple entries are supported for round-robin load balancing

Enable client mode — the remote end is expected to speak TLS. Values: `yes | no`. Default: `no` (server mode)

Path to the PEM or PKCS#12 certificate chain file. Required in server mode; optional in client mode unless the server requires client certificates

Path to the private key file. Defaults to the value of `cert` when omitted. The file should only be readable by its owner

Load trusted CA certificates from a file. Used with `verifyChain` or `verifyPeer`

Load trusted CA certificates from a directory. Certificate files must be named in the OpenSSL hash format (`XXXXXXXX.0`)

Verify the peer certificate chain starting from a trusted root CA. Values: `yes | no`. Default: `no`

Verify the end-entity (leaf) peer certificate. Values: `yes | no`. Default: `no`

Verify the hostname in the peer certificate's Subject Alternative Names. Multiple entries allowed. Requires OpenSSL 1.0.2+

Server Name Indication. In client mode: SNI hostname to send. In server mode: `SERVICENAME:SERVERNAME_PATTERN` for virtual hosting. Requires OpenSSL 1.0.0+

Application-level protocol to negotiate TLS with. Supported: `cifs`, `connect`, `imap`, `ldap`, `nntp`, `pgsql`, `pop3`, `proxy`, `smtp`, `socks`

Execute a local inetd-style program instead of connecting to a remote host. The program's stdin/stdout are used for the unencrypted side of the tunnel

Whitespace-separated argument list for `exec`, including the program name as `$0`

Delay DNS resolution for `connect` until a client connects. Values: `yes | no`. Default: `no`

Colon-delimited list of TLS 1.2 and earlier cipher suites to allow

Colon-delimited list of TLS 1.3 ciphersuites. Default: `TLSCHACHA20POLY1305SHA256:TLSAES256GCMSHA384:TLSAES128GCM_SHA256`. Requires OpenSSL 1.1.1+

Minimum TLS protocol version. Requires OpenSSL 1.1.0+. Default: `TLSv1`

Maximum TLS protocol version. Requires OpenSSL 1.1.0+. Default: `all`

OpenSSL security level (0–5). Level 2 requires at least 112-bit security (default). Requires OpenSSL 1.1.0+

Enable transparent proxy mode. Values: `none`, `source`, `destination`, `both`. Requires kernel and routing support (Unix only)

Set a socket option. Format: `a|l|r:OPTION=VALUE[:VALUE]` where `a`=accept socket, `l`=local socket, `r`=remote socket

SSLv2 and SSLv3 are disabled by default due to known security vulnerabilities. Certificate chain verification (`verifyChain = yes`) and hostname checking (`checkHost`) should be enabled in production client configurations to prevent man-in-the-middle attacks. Transparent proxy mode requires specific kernel support and routing configuration. The `compression` option poses a security risk (CRIME-style attacks) when the application allows attacker-controlled plaintext.

stunnel was created by Michał Trojnara in 1998 as a universal TLS wrapper for TCP services. It remains in active development and supports modern TLS 1.3 and current OpenSSL APIs.

openssl(1), openssl-s_client(1), certbot(1), socat(1), haproxy(1)