Install Ubuntu’s stunnel4 package, decide whether the tunnel is a client or server, then create a configuration that pairs the correct listener with a TLS destination or certificate. For a secure deployment, validate the certificate chain and hostname, keep plaintext listeners on loopback unless exposure is intentional, protect private keys, and verify the running service with OpenSSL and system logs.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What stunnel does
Stunnel is a TLS wrapper for an existing TCP or UDP service. It does not replace the application protocol; it places an encrypted TLS connection around that protocol so an older or otherwise plaintext service can communicate securely.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The direction of the connection determines the configuration:
| Design | What stunnel accepts | What stunnel connects to | Certificate responsibility |
|---|---|---|---|
| Client mode | Plaintext from a local application | A remote TLS service | The remote server presents a certificate that the client must validate |
| Server mode | Inbound TLS connections | A local or trusted remote plaintext application | Your stunnel endpoint presents a certificate and matching private key |
Use client mode when software on Ubuntu cannot speak TLS but its destination requires TLS. Use server mode when outside clients need an encrypted entry point while the application behind stunnel still speaks cleartext.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prerequisites and package installation
Before you begin
- An Ubuntu system with administrator access through
sudo. - A TCP service and its intended listening or destination port.
- For client mode, the remote hostname and TLS port.
- For server mode, a certificate chain and matching private key, or a temporary self-signed certificate for development.
- Firewall rules that permit only the listener you deliberately intend to expose.
Ubuntu distributes stunnel in the Universe repository as the stunnel4 package. Install it with:
sudo apt update
sudo apt install stunnel4The package normally supplies the executable names /usr/bin/stunnel and /usr/bin/stunnel4, a default settings file at /etc/default/stunnel4, documentation under /etc/stunnel, and systemd integration through stunnel.target and the template unit [email protected].
Check the installed build
Options differ between builds, so check the version, linked OpenSSL library, compile-time defaults, and supported features before relying on a particular directive:
stunnel -version
stunnel -optionsIf an option in a sample configuration is rejected, compare the spelling and availability reported by these commands with the configuration you are trying to load.
Client mode: connect a local plaintext application to a remote TLS service
In client mode, an application connects to a local stunnel listener without encryption. Stunnel then opens a TLS connection to the remote endpoint. Keep the local listener on 127.0.0.1 unless another machine genuinely needs to send plaintext to it; exposing that port can defeat the security goal.
1. Create a client configuration
Place a configuration such as /etc/stunnel/client.conf in the package’s stunnel configuration directory:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
foreground = yes
[remote-service]
client = yes
accept = 127.0.0.1:8080
connect = server.example.com:8443
verifyChain = yes
CAfile = /etc/ssl/certs/ca-certificates.crt
checkHost = server.example.com
sni = server.example.com
sslVersionMin = TLSv1.2Each directive has a specific job:
client = yesselects client mode.accept = 127.0.0.1:8080creates the local plaintext socket. Your application should connect to port 8080 on the same Ubuntu host.connect = server.example.com:8443identifies the remote TLS host and port.verifyChain = yesrequires validation of the peer’s certificate chain.CAfilepoints to trusted certificate authorities. Ubuntu’s system bundle is shown above; use the trust store appropriate to your installation if it differs.checkHostverifies that the certificate identity matches the expected DNS name. UsecheckIPinstead when the service is intentionally addressed by an IP identity and the certificate contains that IP.snisends the server name during the TLS handshake. This is needed by some name-based hosting arrangements, but SNI by itself does not authenticate the peer.sslVersionMin = TLSv1.2prevents negotiation of older TLS versions when the installed build supports this setting.foreground = yeskeeps the process attached to the terminal, which is useful while testing the file and watching immediate errors.
2. Point the application at the local socket
Change the application’s destination from the remote TLS host and port to 127.0.0.1:8080. The application sends its normal, unencrypted protocol to stunnel; stunnel handles the encrypted leg to server.example.com:8443.
Do not configure the local application to perform a second TLS handshake unless that is explicitly part of the protocol design. In the usual client-mode arrangement, the application speaks plaintext to stunnel and stunnel alone speaks TLS to the remote service.
3. Test the listener and remote handshake
Start the configuration directly while diagnosing it:
sudo stunnel /etc/stunnel/client.confIn a second terminal, confirm that the local port is listening:
ss -ltnp | grep 8080Test the remote certificate and handshake independently with OpenSSL. Include the server name when the destination uses name-based TLS:
openssl s_client -connect server.example.com:8443 -servername server.example.comA successful OpenSSL connection does not replace stunnel’s identity checks; it helps distinguish a network or TLS-handshake problem from a local configuration problem.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Server mode: expose a plaintext service through an inbound TLS endpoint
Server mode makes stunnel the TLS termination point. It accepts encrypted connections on one address and forwards decrypted traffic to an application that may be on the same host or another trusted endpoint.
1. Prepare the certificate and key
A public service should use a certificate issued by a trusted certificate authority, commonly obtained and renewed with an ACME client. Configure the certificate file with the leaf certificate followed by any required intermediate certificates. Configure the matching private key separately.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The following example assumes the application already listens on 127.0.0.1:8080 and stunnel will accept TLS on port 8443:
foreground = yes
[web]
accept = 0.0.0.0:8443
connect = 127.0.0.1:8080
cert = /etc/stunnel/fullchain.pem
key = /etc/stunnel/private/server.key
sslVersionMin = TLSv1.2accept = 0.0.0.0:8443 binds on all IPv4 interfaces. Replace it with a specific address when the endpoint should be reachable only through one interface. The connect line should point to the application’s actual cleartext listener.
2. Protect the private key
The account that loads the key must be able to read it, but unrelated users should not. A root-owned key with mode 600 is a conservative starting point:
sudo chown root:root /etc/stunnel/private/server.key
sudo chmod 600 /etc/stunnel/private/server.keyIf you configure stunnel to drop privileges after opening the listening socket, the post-drop account still needs the permissions required to use the already loaded material and access any other files needed at runtime. Plan ownership and service isolation together rather than fixing permissions by making the key world-readable.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
3. Test certificate presentation
Start the configuration in the foreground first:
sudo stunnel /etc/stunnel/server.confFrom a client host, inspect the endpoint:
openssl s_client -connect server.example.com:8443 -servername server.example.comThen exercise the application protocol through the TLS port. A completed TLS handshake only proves that stunnel presented a usable certificate and negotiated TLS; the backend application must also be reachable at the address in connect.
Certificate validation and identity checks
Why chain validation and name checking are separate
A trusted CA chain answers “Was this certificate issued by a trusted authority?” A hostname or IP check answers “Was it issued for the endpoint I intended to reach?” A secure client configuration needs both. Keep verifyChain = yes, provide a usable CAfile, and set checkHost or checkIP as appropriate.
SNI selects the certificate or virtual host that the remote server should use. It is not proof that the selected certificate belongs to your intended service, so do not treat sni as a substitute for identity validation.
Self-signed certificates for development
For short-lived testing, the stunnel HOWTO describes generating a self-signed certificate with a Subject Alternative Name. Every client that connects must explicitly trust that certificate. A connection that works only after verification is disabled is not fixed; it is merely no longer checking the peer. Install the development CA or certificate in the intended trust store instead.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Mutual TLS: authenticate both sides
Ordinary TLS authenticates the server to the client. Mutual TLS adds client certificates so the server can require an identity from every connecting client.
Server-side requirements
Configure the server with the CA that issued client certificates:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
verifyChain = yes
CAfile = /etc/stunnel/client-ca.pemIn stunnel’s authentication model, verifyChain = yes implies requireCert = yes; clients that do not present a certificate chaining to the configured CA are rejected.
Client-side requirements
The client supplies its own certificate and key while continuing to validate the server:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →cert = /etc/stunnel/client/client.crt
key = /etc/stunnel/client/client.key
verifyChain = yes
CAfile = /etc/ssl/certs/ca-certificates.crt
checkHost = server.example.comKeep the client key permissions as restrictive as the server key. Mutual TLS is appropriate when possession of a trusted client certificate should be required in addition to a network connection.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Run stunnel under Ubuntu’s service manager
The Ubuntu package includes a target unit and a templated unit. Exact enable, start, and reload behavior can vary by Ubuntu release and package revision, so inspect the units installed on your system and use the service-manager interface they expose. The relevant package files include:
/usr/lib/systemd/system/stunnel.target/usr/lib/systemd/system/[email protected]
After placing a configuration in the package’s documented configuration location, check the selected unit’s status and logs. Keep foreground execution for initial syntax and permission tests, then let the installed service unit supervise the long-running process where appropriate. Use the reload operation provided by that unit when rotating certificates or changing configuration; do not assume every release uses the same instance name or reload action.
When a service fails to start, inspect the journal for the exact configuration file, option, address, and file path reported. The first error is usually more useful than a later client-side timeout.
Free tools Windows power users keep installed
One-click scans. No signup required.
Hardening checklist
- Bind client-mode
acceptto127.0.0.1unless remote plaintext access is deliberate and protected by another control. - Require TLS 1.2 or later with
sslVersionMin = TLSv1.2when the installed build supports it. - Use chain validation and a hostname or IP identity check together. SNI alone is not authentication.
- Keep private keys owned by the account that loads them and restrict their mode, commonly to 600.
- Bind listening sockets before dropping privileges, then use
setuidandsetgid, or equivalent service-manager isolation, where appropriate. - If you use a chroot, copy every required runtime item into the jail: configuration, certificate and CA files, resolver files, logs, PID files, and any other files needed by the process.
- Expose only the TLS listener in firewall rules for server mode; do not publish the backend cleartext port.
- Keep certificate renewal in mind. A renewed certificate is useful only after the running stunnel process loads it successfully.
Choosing between client and server designs
| Question | Client mode | Server mode |
|---|---|---|
| Where is plaintext? | Between the local application and stunnel | Between stunnel and the backend application |
| Who presents the main certificate? | The remote TLS server | Your stunnel endpoint |
| What must be verified? | Remote CA chain plus hostname or IP | Client certificates as well if mutual TLS is enabled |
| Typical listener exposure | Loopback-only | A selected external interface or all interfaces |
| Most common failure | Trust-store, hostname, chain, or SNI mismatch | Unreadable key, incomplete chain, occupied port, or unsupported option |
Choose client mode when the remote service already terminates TLS and your local software cannot. Choose server mode when you control the certificate presented to incoming clients and need to keep an existing backend protocol unchanged.
Troubleshooting stunnel failures
The tunnel works only when verification is disabled
This normally points to one of four configuration problems: the CA bundle is missing or wrong, the certificate name does not match the name you used, the server omitted an intermediate certificate, or the SNI value is incorrect for a name-based endpoint. Restore verification and correct the trust or identity configuration instead of leaving verification disabled.
- Confirm the configured
CAfileexists and is readable. - Check that
checkHostmatches a name in the server certificate, or usecheckIPonly when an IP identity is actually certified. - Use
openssl s_clientwith the same destination and-servernamevalue to inspect the presented chain. - Ensure the server presents the leaf certificate followed by required intermediates.
Stunnel cannot start in server mode
Common causes are a private key that the loading account cannot read, a certificate file without the required chain, an address already in use, or a directive unsupported by the installed build.
Quick Recap
- Run
stunnel -versionandstunnel -optionsto verify feature support. - Check ownership and mode on the certificate and key files.
- Confirm no other process owns the configured
acceptaddress and port. - Read the service journal or foreground error, correcting the first reported file or option.
- Verify that the certificate and private key belong together and that the certificate chain is complete.
The listener is up but the application still fails
- In client mode, verify that the application uses the local
acceptaddress and not the original remote port. - In server mode, verify that the backend is listening at the exact
connectaddress and accepts the cleartext protocol stunnel forwards. - Check firewall rules separately for the TLS listener and backend port.
- Use
ss -ltnpto confirm which process owns each local socket. - Compare the protocol expected by the application with the protocol terminated by stunnel; stunnel transports bytes but does not translate application commands.
A repeatable deployment sequence
- Install
stunnel4withsudo apt updateandsudo apt install stunnel4. - Record the installed version and supported options.
- Decide whether plaintext flows from a local application to a remote TLS service or from inbound TLS to a plaintext backend.
- Write one service section with an unambiguous
acceptandconnectpair. - For a client, configure CA validation and hostname or IP checking, adding SNI when the remote service requires it.
- For a server, install a complete certificate chain and matching key, then restrict key permissions.
- Start the file in the foreground and fix syntax, permission, certificate, or binding errors before using a service unit.
- Check the local socket with
ssand inspect the TLS handshake withopenssl s_client. - Move to the installed systemd interface for long-running operation, status checks, logs, and reloads.
- Document certificate renewal, trust-store changes, listener exposure, and the backend address so future changes do not silently break the tunnel.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
