PHP Fatal error: Uncaught Error: Call to undefined function log_msg() in /usr/local/etc/inc/plugins.inc:251
Stack trace:
0 /usr/local/opnsense/scripts/stunnel/generate_certs.php(89): plugins_configure('crl')
1 {main}
thrown in /usr/local/etc/inc/plugins.inc on line 251
While working on the documentation I noticed my previous comment was wrong, which also invalidates the need for an optional setting. When it comes to the "CAfile" setting, the chain shouldn't be provided, for the listener (the server cert) it shouldn't matter at all if you ship the chain since it's not part of the authentication.
This commits simplifies https://github.com/opnsense/plugins/pull/2854 by removing the option. The current documentation online doesn't need any modifications for this.
commit e873aa41591442e16ec0581fa8b6e8696a1821ff
Author: Ad Schellevis <ad@opnsense.org>
Date: Mon Jul 4 14:23:32 2022 +0200
security/stunnel: Add option to chain intermediate CAs (https://github.com/opnsense/plugins/pull/2854), better explain impact and add move to advanced
commit 1e86212ad759a10ae3c229d709a5718ab79208d5
Author: Johnny S. Lee <6614805+johnnyslee@users.noreply.github.com>
Date: Mon Feb 21 09:52:26 2022 +0800
security/stunnel: Allow GUI usage of restart action
For example, we can now select "Restart Stunnel" from
`Service/ACME-Client/Automations>Run-Command>System-or-Plugin-Command`
in GUI.
commit 005af925b1e4c96022953757297c5a0782a81825
Author: Johnny S. Lee <6614805+johnnyslee@users.noreply.github.com>
Date: Mon Feb 21 09:45:28 2022 +0800
security/stunnel: Add option to chain intermediate CAs
Add an option, defaults disabled, to chain intermediate CAs which is
required when using ACME cert.
The current code generates conf line:
```
connect = [::1]:53
```
will end up producing the following:
```
Error resolving "[::1]": Neither nodename nor servname known (EAI_NONAME)
```
stunnel(8) states that an address parameter of an option may be either:
> ...
> A colon-separated pair of IP address (either IPv4, IPv6, or domain name)
and port number.
> ...
which means there should not be special treatment on IPv6 addresses.
Franco Fichtner
Ad Schellevis
Patrick M. Hausen
Monviech
Johnny S. Lee
Nicola Bonavita