/usr/bin/stunnel

Initializing inetd mode configuration
stunnel 5.82 on x86_64-pc-linux-gnu platform
Compiled/running with OpenSSL 4.0.3 29 Sep 2026
Threading:PTHREAD Sockets:POLL,IPv6 TLS:OCSP,PSK,SNI,DTLS

Global options:
chroot                 = directory to chroot stunnel process
compression            = compression type
EGD                    = path to Entropy Gathering Daemon socket
foreground             = yes|quiet|no foreground mode (don't fork, log to stderr)
log                    = append|overwrite log file
output                 = file to append log messages
pid                    = pid file
provider               = OpenSSL provider to load
providerParameter      = provider:parameter=value
RNDbytes               = bytes to read from random seed files
RNDfile                = path to file with random seed data
RNDoverwrite           = yes|no overwrite seed datafiles with new random data
setEnv                 = name=value of an environment variable
syslog                 = yes|no send logging messages to syslog

Service-level options:
accept                 = [host:]port accept connections on specified host:port
CApath                 = CA certificate directory for 'verify' option
CAfile                 = CA certificate file for 'verify' option
CAstore                = URI to store of CA certificates
cert                   = certificate chain
checkEmail             = peer certificate email address
checkHost              = peer certificate host name pattern
checkIP                = peer certificate IP address
ciphers                = permitted ciphers for TLS 1.2 or older
ciphersuites           = permitted ciphersuites for TLS 1.3
client                 = yes|no client mode (remote service uses TLS)
config                 = command[:parameter] to execute
connect                = [host:]port to connect
CRLpath                = CRL directory
CRLfile                = CRL file
CRLcheckChain          = yes|no check CRLs for the full certificate chain
curves                 = ECDH curve names
debug                  = [facility].level (e.g. daemon.info)
delay                  = yes|no delay DNS lookup for 'connect' option
exec                   = file execute local inetd-type program
execArgs               = arguments for 'exec' (including $0)
failover               = rr|prio failover strategy
ident                  = username for IDENT (RFC 1413) checking
include                = directory with configuration file snippets
key                    = certificate private key
local                  = IP address to be used as source for remote connections
logId                  = connection identifier type
OCSP                   = OCSP responder URL
OCSPaia                = yes|no check the AIA responders from certificates
OCSPflag               = OCSP responder flags
OCSPnonce              = yes|no send and verify the OCSP nonce extension
OCSPrequire            = yes|no require a conclusive OCSP response
options                = TLS option to set/reset
protocol               = protocol to negotiate before TLS initialization
                         currently supported: cifs, connect, imap,
                             nntp, pgsql, pop3, proxy, smtp, socks
protocolAuthentication = authentication type for protocol negotiations
protocolDomain         = domain for protocol negotiations
protocolHeader         = custom header for protocol negotiations
protocolHost           = host:port for protocol negotiations
protocolPassword       = password for protocol negotiations
protocolUsername       = username for protocol negotiations
PSKidentity            = identity for PSK authentication
PSKsecrets             = secrets for PSK authentication
pty                    = yes|no allocate pseudo terminal for 'exec' option
redirect               = [host:]port to redirect on authentication failures
renegotiation          = yes|no support renegotiation
requireCert            = yes|no require client certificate
reset                  = yes|no send TCP RST on error
retry                  = yes|no retry connect+exec section
securityLevel          = set the security level
service                = service name
setgid                 = groupname for setgid()
setuid                 = username for setuid()
sessionCacheSize       = session cache size
sessionCacheTimeout    = session cache timeout (in seconds)
sessionResume          = yes|no enable session resumption
sessiond               = [host:]port use sessiond at host:port
sni                    = primary_service:host_name for an SNI virtual service
socket                 = a|l|r:option=value[:value]
                         set an option on accept/local/remote socket
sslVersion             = all|SSLv3|TLSv1|TLSv1.1|TLSv1.2|TLSv1.3 TLS version
sslVersionMax          = all|SSLv3|TLSv1|TLSv1.1|TLSv1.2|TLSv1.3 TLS version
sslVersionMin          = all|SSLv3|TLSv1|TLSv1.1|TLSv1.2|TLSv1.3 TLS version
stack                  = thread stack size (in bytes)
ticketKeySecret        = secret key for encryption/decryption TLSv1.3 tickets
ticketMacSecret        = key for HMAC operations on TLSv1.3 tickets
TIMEOUTbusy            = seconds to wait for expected data
TIMEOUTclose           = seconds to wait for close_notify
TIMEOUTconnect         = seconds to connect remote host
TIMEOUTidle            = seconds to keep an idle connection
TIMEOUTocsp            = seconds to connect OCSP responder
transparent            = none|source|destination|both transparent proxy mode
verify                 = level of peer certificate verification
verifyChain            = yes|no verify certificate chain
verifyPeer             = yes|no verify peer certificate
transport              = tcp|udp transport protocol