stunnel 5.45 and TLS 1.3

[j***@esilo.com]

Hello. I am attempting to implement stunnel wrapper to HTTP to support only TLS 1.3 and 1.2 in order to get the best score at ssllabs.com. I downloaded and installed the 5.45 released 21st May 2018 and TLS 1.3 works with the nightly build of firefox but I am having trouble getting TLS 1.3 to work with browsers that support it but also support TLS 1.2 for older ones, while maintaining an A+ score on ssllabs.com.

My configuration is:

...

sslVersion = all
options = NO_SSLv3
options = NO_TLSv1

ciphers = TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:CHACHA20-POLY1305-SHA256:AES-256-GCM-SHA384

...


But the test indicates:

* That the server does not support TLS 1.3, and
* The server does not support Forward Secrecy with the reference browsers. Grade capped to B

... even though Firefox nightly does indicate that it was able to use TLS 1.3.

Any thoughts on how to configure the sslVersion, options, and ciphers to get a grade A and support both TLS 1.3 and 1.2 ?

[j***@esilo.com]

I think I got things working best with:


sslVersion = all
options = NO_SSLv3
options = NO_TLSv1
options = NO_TLSv1.1

ciphers = TLS13-AES-256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

However, after scanning my site with the ssllabs.com scanner, it appears to have crashed stunnel because after scanning, I can't connect. Firefox indicates:

An error occurred during a connection to testwww.esilo.com. Peer reports it experienced an internal error. Error code: SSL_ERROR_INTERNAL_ERROR_ALERT

There may be a bug in there somewhere...