Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Use stunnel when an existing TCP or UDP service needs TLS without changing the application. On Ubuntu, install the stunnel4 package, choose client mode for local plaintext-to-remote-TLS connections or server mode for inbound TLS termination, configure certificate verification and identity checks, then run and test the tunnel under the package’s systemd units.
What stunnel does
Stunnel is a TLS wrapper around an existing TCP or UDP service. It does not replace the application protocol: it accepts a connection on one side, performs TLS where configured, and forwards the application bytes on the other side. The project describes its purpose as adding TLS to an existing TCP or UDP service.
Recommended Free Tools
There are two fundamentally different designs:
| Design | Traffic flow | What stunnel authenticates | Typical listener |
|---|---|---|---|
| Client mode | Local plaintext application → stunnel → remote TLS server | The remote server’s certificate chain and hostname or IP address | 127.0.0.1, so only local applications can use the plaintext side |
| Server mode | Remote TLS client → stunnel → local or trusted plaintext application | Clients authenticate the certificate and key presented by this Ubuntu host; optional mutual TLS authenticates clients too | A public or private address and TLS port such as 8443 |
Choosing the wrong mode is the most common design error. Client mode protects the outbound hop to a TLS-only destination; server mode gives a legacy local service an encrypted entrance.
Prerequisites and safety checks
- An Ubuntu host with administrative access and working DNS if the tunnel uses a hostname.
- A TCP or UDP service to protect, plus its local or remote address and port.
- For client mode, the remote service must speak TLS on the destination port.
- For server mode, the certificate and private key must match, and the certificate file must contain the leaf certificate followed by any required intermediate certificates.
- A plan for which account will read the private key and which addresses should be reachable through the listening socket.
Do not expose a client-mode plaintext listener to an untrusted network. Bind it to loopback unless remote plaintext access is an intentional part of the design.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Install stunnel4 and inspect the build
Ubuntu distributes stunnel in the Universe repository as the stunnel4 package. Install it with:
sudo apt update
sudo apt install stunnel4The package installs the stunnel executables, default configuration support, documentation, and systemd integration. Important paths include /usr/bin/stunnel, /usr/bin/stunnel4, /etc/default/stunnel4, /etc/stunnel/README, /usr/lib/systemd/system/stunnel.target, and the template unit /usr/lib/systemd/system/stunnel@.service.
Check the installed version, linked OpenSSL library, compile-time defaults, and supported options before using a directive:
stunnel -version
stunnel -optionsOption availability can differ between Ubuntu releases and package builds. If an option is not listed, remove it or use the equivalent supported by that installed build rather than assuming a configuration copied from another system will work.
Choose client or server mode
Use client mode when the destination requires TLS
Client mode is appropriate when a local or legacy program only speaks plaintext but the remote endpoint expects TLS. The application connects to a local stunnel port; stunnel creates the encrypted connection outward.
Use server mode when Ubuntu should terminate TLS
Server mode is appropriate when stunnel should accept encrypted connections and forward cleartext to an application on the same host or another trusted endpoint. The server must present a certificate and its corresponding private key.
Free tools Windows power users keep installed
One-click scans. No signup required.
Configure a client-mode tunnel
Create a configuration such as /etc/stunnel/client.conf:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
foreground = yes
[remote-service]
client = yes
accept = 127.0.0.1:8080
connect = server.example.com:8443
verifyChain = yes
CAfile = /etc/ssl/certs/ca-certificates.crt
checkHost = server.example.com
sni = server.example.com
sslVersionMin = TLSv1.2Each setting has a specific security or routing purpose:
client = yesselects outbound client behavior.accept = 127.0.0.1:8080creates the local plaintext endpoint. A program on the same host should connect to this address and port.connect = server.example.com:8443identifies the TLS destination. Use the actual service name and port.verifyChain = yesrequires certificate-chain validation.CAfilepoints to the trusted CA bundle. Ubuntu’s system bundle is commonly/etc/ssl/certs/ca-certificates.crt.checkHostconfirms that the certificate identity matches the DNS name. UsecheckIPinstead when the endpoint is intentionally addressed by IP and the certificate contains that IP in its Subject Alternative Name.snisends the TLS Server Name Indication. It is needed when several virtual services share one IP address, but SNI by itself does not authenticate the peer.sslVersionMin = TLSv1.2prevents negotiation of older protocol versions when the installed build supports this option.foreground = yeskeeps the process attached to the terminal, which is useful for first-run diagnostics. Follow the installed service unit’s process expectations when moving to systemd.
Connect the local application
- Save the file with root ownership and restrict editing to administrators.
- Start stunnel in the foreground for an initial test:
sudo stunnel /etc/stunnel/client.conf. - Point the local application at
127.0.0.1:8080, not at the remote TLS port. - In another terminal, verify that the listener exists:
ss -ltnp | grep 8080. - Generate a real application request and watch the foreground output for DNS, connection, or certificate errors.
Once the test succeeds, stop the foreground process and run the configuration through the package’s service manager. Keeping the listener on loopback ensures that a nearby untrusted machine cannot send plaintext traffic into the tunnel.
Configure a server-mode tunnel
Server mode terminates TLS on Ubuntu and forwards decrypted traffic to a local application. A minimal configuration is:
foreground = yes
[web]
accept = 0.0.0.0:8443
connect = 127.0.0.1:8080
cert = /etc/stunnel/fullchain.pem
key = /etc/stunnel/private/server.key
sslVersionMin = TLSv1.2accept = 0.0.0.0:8443 listens on every IPv4 interface. Bind to a specific private or public address instead when the service should not be reachable everywhere. connect = 127.0.0.1:8080 forwards cleartext to the local application; use another trusted address only when the backend is deliberately remote.
The certificate file should contain the server’s leaf certificate first and the required intermediate certificates after it. The private key in key must correspond to that certificate. Clients will receive the chain from cert during the TLS handshake.
Obtain and install certificates
For a public service, obtain a certificate from a trusted certificate authority, commonly through an ACME client. Install the resulting chain and key outside user home directories, then reference their absolute paths in the configuration.
For short-lived development or testing, a self-signed certificate can include a Subject Alternative Name for the hostname or IP used by the client. Every client must explicitly trust that certificate. Turning off verification is not a safe substitute and should not be used to solve a trust error.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Protect the private key
The account that loads the key must be able to read it, but unrelated users should not. A restrictive baseline is:
sudo chown root:root /etc/stunnel/private/server.key
sudo chmod 600 /etc/stunnel/private/server.keyIf the service drops privileges to a dedicated account, grant only that account the required read access and keep the directory permissions restrictive as well.
Set up mutual TLS when clients need certificates
One-way TLS authenticates the server to clients. Mutual TLS also requires each client to present a certificate issued by a CA you control. On the server side, add the CA that signs client certificates:
verifyChain = yes
CAfile = /etc/stunnel/client-ca.pemIn stunnel’s authentication model, verifyChain = yes implies requireCert = yes; a client without a valid certificate chain is rejected. The server’s own cert and key remain necessary.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The client must supply its certificate and private key while continuing to verify the server:
client = yes
cert = /etc/stunnel/client/client-cert.pem
key = /etc/stunnel/client/client.key
verifyChain = yes
CAfile = /etc/ssl/certs/ca-certificates.crt
checkHost = server.example.comUse separate keys and certificates per client where possible. Revoking one client then does not require distributing a shared private key to every installation.
Run the tunnel with Ubuntu’s service units
The package includes a systemd target and a template unit, but unit names and defaults can vary by Ubuntu release. Inspect what is installed instead of assuming a particular service name:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
systemctl list-unit-files | grep stunnel
systemctl cat stunnel@.service
systemctl cat stunnel.targetRead /etc/default/stunnel4 and follow the comments for any release-specific startup switch. The template commonly maps an instance name to a configuration such as /etc/stunnel/client.conf, but confirm the path in the unit before starting it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAfter placing the file in the documented configuration directory, a typical template-unit workflow is:
sudo systemctl daemon-reload
sudo systemctl start stunnel@client.service
sudo systemctl enable stunnel@client.service
sudo systemctl status stunnel@client.serviceUse the exact unit shown by systemctl list-unit-files on your host. If the package provides a target or a release-specific reload action, use that interface for long-running operation and configuration reloads. Check logs with:
sudo journalctl -u stunnel@client.service -b
sudo journalctl -u stunnel@client.service -fFor a server configuration named server.conf, substitute the corresponding instance name if the installed template expects one. Do not run both a foreground copy and a systemd instance on the same listening port.
Validate the TLS endpoint
Check the local socket
Confirm that stunnel is listening on the address and port you intended:
ss -ltnp | grep 8080
ss -ltnp | grep 8443A client-mode listener should normally show 127.0.0.1:8080. A server-mode listener may show a public or private address on 8443, depending on the configuration.
Inspect a server handshake
From a client host, inspect the certificate and protocol negotiation with:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
openssl s_client -connect server.example.com:8443 -servername server.example.comThe -servername value tests the same SNI name used by a real client. Examine the displayed certificate chain, subject alternative names, verification result, and negotiated protocol. A successful TCP connection alone does not prove that the certificate identity is valid.
Exercise the application protocol
Send a real request through the local client-mode port or to the server-mode TLS port. Verify both sides: the application should receive the expected protocol bytes, and the remote service should see the connection arriving from the address expected by its access controls.
Hardening checklist
- Keep client-mode
accepton127.0.0.1unless remote plaintext access is explicitly required and protected by another control. - Set
sslVersionMin = TLSv1.2where the installed build supports it; confirm withstunnel -options. - For client verification, use a trusted
CAfiletogether withcheckHostorcheckIP. SNI selects a virtual host but does not authenticate it. - Restrict private-key ownership and mode, and ensure parent directories are not writable by untrusted users.
- Bind listening sockets before dropping privileges, then use
setuidandsetgidor the isolation controls supplied by the service manager. - If you use a chroot, copy every required runtime resource into it: configuration, certificate and CA files, resolver files, logs, PID files, and any other paths referenced by the configuration.
- Limit firewall exposure to the intended TLS port and source networks.
- Keep certificate renewal in mind. After replacing a chain or key, reload the instance through the installed service-manager interface and verify a fresh handshake.
Troubleshoot common failures
It works only when verification is disabled
This usually means the CA bundle is missing or wrong, the hostname does not match the certificate, the server omitted an intermediate certificate, or the SNI name is incorrect. Restore verification and correct the specific trust or identity problem. Do not leave verification disabled as a workaround.
The client reports an unknown or incomplete certificate chain
Confirm that CAfile points to a readable trust store containing the issuing CA. For a server you operate, make sure cert contains the leaf certificate followed by all required intermediates. A private CA requires its root or issuing CA to be installed in the client’s trust file.
The hostname check fails
Use the DNS name present in the certificate’s Subject Alternative Name with checkHost. If you intentionally connect by IP, use checkIP and ensure the IP itself appears in the certificate. Changing only sni does not fix a name mismatch.
Server startup fails before listening
Check the service log and then verify the key permissions, certificate paths, and certificate-key match. Typical causes are an unreadable key, a certificate file missing its chain, an address already in use, or a directive unsupported by the installed build. Recheck stunnel -version and stunnel -options.
The port is already in use
Identify the process holding the port:
sudo ss -ltnp | grep ':8443'Stop or reconfigure the conflicting service, or choose a different stunnel accept port. Do not start a second stunnel instance on the same address and port.
The tunnel starts but the application cannot communicate
Verify that the backend service is actually listening on the address in connect, that its protocol matches what the application sends, and that local firewall rules permit the connection. In client mode, confirm that the application uses the local accept port rather than attempting TLS itself. In server mode, confirm that the backend expects plaintext after TLS has been removed.
A chrooted or privilege-dropped instance fails unexpectedly
Look for missing files or permission errors in the logs. A chroot must contain the CA bundle, certificates, configuration, resolver data, and writable runtime locations required by the process. A reduced-privilege account must still be able to read certificates and keys and write only the paths it genuinely needs.
Deployment choices at a glance
| Requirement | Recommended arrangement | Certificate responsibility | Exposure and authentication |
|---|---|---|---|
| Legacy local program must reach a remote TLS service | Client mode with accept = 127.0.0.1:local-port |
Trust the remote CA; validate hostname or IP and send SNI when required | Plaintext exists only on loopback; normally one-way TLS |
| Remote users need encrypted access to a local plaintext daemon | Server mode with a public or private accept address |
Install the server chain and matching private key | TLS is exposed on the selected interface; add firewall rules and consider mutual TLS |
| Only approved client machines may connect | Server mode plus client-certificate verification | Server presents its certificate; server trusts the client CA | Mutual TLS with verifyChain = yes and a client cert/key |
| Temporary laboratory test | Foreground process and a self-signed certificate with a Subject Alternative Name | Clients explicitly trust the test certificate | Keep the listener private; never disable verification merely to make a test pass |
Final deployment sequence
- Install
stunnel4and inspect the version and supported options. - Decide whether traffic is local plaintext to remote TLS (client mode) or inbound TLS to a plaintext backend (server mode).
- Write the configuration with explicit addresses, ports, verification settings, and a minimum TLS version supported by the build.
- Install a trusted certificate chain and matching key for server mode, or configure the correct CA and identity checks for client mode.
- Protect key files and account for privilege dropping or chroot paths.
- Run the configuration in the foreground once, check the listening socket, and perform an application-level test.
- Move the tested instance under the Ubuntu package’s documented systemd unit, then monitor status and journal output after every reload or certificate renewal.
With those controls in place, stunnel provides a narrow, auditable TLS boundary around an otherwise unchanged TCP or UDP service while preserving certificate and hostname verification instead of hiding failures behind an insecure bypass.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
