{"slug": "stunnel", "name": "stunnel", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 6, "warners": 1, "score": 2.334, "rising": 0.35, "first": "2025-12-14", "latest": "2026-09-20", "why": "then stunnel is easier to use in this context than ssh", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 2, "compare": 0, "warn": 1}, "spark": [0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "then stunnel is easier to use in this context than ssh", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://www.stunnel.org/", "pricing": "", "aliases": ["stunnel", "Stunnel"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 796420834, "item_id": 49776302, "url": "https://news.ycombinator.com/item?id=49776302", "by": "1vuio0pswjnm7", "date": "2026-09-20", "version": null, "stance": "recommend", "quote": "Use a local forward proxy, e.g., stunnel, haproxy, etc.", "excerpt": "That superuser thread from 2018 (it's ECH now not ESNI) isn't much help Although I do like the comment at the bottom that states the problem as disabling SNI not encrypting it. Encrypting SNI/ClientHello is over complicated, which is why ESNI was flawed and (allegedly) why Cloudflare disabled it. The solution to the plaintext SNI problem is to not send SNI (I don't send it unless necessary) There is an alternative no", "context": "", "use_case": "avoid sending SNI", "switched_from": "", "story": "Spain orders blocks on Archive.today and its mirrors"}, {"id": 747659952, "item_id": 46728747, "url": "https://news.ycombinator.com/item?id=46728747", "by": "chasil", "date": "2026-01-22", "version": null, "stance": "recommend", "quote": "then stunnel is easier to use in this context than ssh", "excerpt": "If you want an encrypted tunnel maintained by inetd or systemd socket activation, then stunnel is easier to use in this context than ssh. Edit: I put stunnel on port 443 and have it connect to port 80 on my Apache webservers, because I like one way of doing TLS. This guide has been useful for many years in cipher selection: https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/", "context": "", "use_case": "", "switched_from": "", "story": "Stunnel"}, {"id": 747641440, "item_id": 46727590, "url": "https://news.ycombinator.com/item?id=46727590", "by": "ranger_danger", "date": "2026-01-22", "version": null, "stance": "recommend", "quote": "I use it to wrap my gstreamer tcp streams in TLS", "excerpt": "I use it to wrap my gstreamer tcp streams in TLS to send them over the internet, but socat can also do the same thing.", "context": "", "use_case": "TLS wrapping for TCP streams", "switched_from": "", "story": "Stunnel"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 740304129, "item_id": 46269008, "url": "https://news.ycombinator.com/item?id=46269008", "by": "novotimo", "date": "2025-12-14", "version": null, "stance": "warn", "quote": "stunnel crashes at under 100 handshakes per second", "excerpt": "I\u2019ve been working on a TLS proxy/TLS terminator that can handle 3000 TLS handshakes per second (basically an stunnel replacement, but stunnel crashes at under 100 handshakes per second) as a pet project, but I\u2019ve realized that with some polishing this can be really useful. https://github.com/novotimo/tlsproxy This is still in development (todo are privilege dropping, in place config reloads, log burst suppression, mu", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What Are You Working On? (December 2025)"}]}], "who": [], "tags": [], "use_cases": ["avoid sending sni", "wrapping plaintext tcp legacy traffic", "tls wrapper for althttpd", "tls wrapping for tcp streams"], "compared": [{"slug": "haproxy", "name": "HAProxy", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=46726916", "title": "Stunnel", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=49772961", "title": "Spain orders blocks on Archive.today and its mirrors", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46264491", "title": "Ask HN: What Are You Working On? (December 2025)", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"warn": 1}, "2026-01": {"recommend": 2, "neutral": 2}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 1}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "quotes": [{"id": 796420834, "item_id": 49776302, "url": "https://news.ycombinator.com/item?id=49776302", "by": "1vuio0pswjnm7", "date": "2026-09-20", "version": null, "stance": "recommend", "quote": "Use a local forward proxy, e.g., stunnel, haproxy, etc.", "excerpt": "That superuser thread from 2018 (it's ECH now not ESNI) isn't much help Although I do like the comment at the bottom that states the problem as disabling SNI not encrypting it. Encrypting SNI/ClientHello is over complicated, which is why ESNI was flawed and (allegedly) why Cloudflare disabled it. The solution to the plaintext SNI problem is to not send SNI (I don't send it unless necessary) There is an alternative no", "context": "", "use_case": "avoid sending SNI", "switched_from": "", "story": "Spain orders blocks on Archive.today and its mirrors"}, {"id": 747686304, "item_id": 46730394, "url": "https://news.ycombinator.com/item?id=46730394", "by": "Piraty", "date": "2026-01-23", "version": null, "stance": "neutral", "quote": "", "excerpt": "I was involved in a very similar situation once. I recommend wireguard for this, it's mature for years, has superb support in linux and some BSDs and there are userspace implementations if you need that. It wraps traffic in UDP, the overhead is much smaller thus throughput mich higher than traditional TCP-based VPN (you want to avoid tcp-in-tcp!). There were once patches posted to lkml that passed QoS-flags from the ", "context": "", "use_case": "Wrapping plaintext TCP legacy traffic", "switched_from": "", "story": "Stunnel"}, {"id": 747659952, "item_id": 46728747, "url": "https://news.ycombinator.com/item?id=46728747", "by": "chasil", "date": "2026-01-22", "version": null, "stance": "recommend", "quote": "then stunnel is easier to use in this context than ssh", "excerpt": "If you want an encrypted tunnel maintained by inetd or systemd socket activation, then stunnel is easier to use in this context than ssh. Edit: I put stunnel on port 443 and have it connect to port 80 on my Apache webservers, because I like one way of doing TLS. This guide has been useful for many years in cipher selection: https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/", "context": "", "use_case": "", "switched_from": "", "story": "Stunnel"}, {"id": 747645200, "item_id": 46727825, "url": "https://news.ycombinator.com/item?id=46727825", "by": "ectospheno", "date": "2026-01-22", "version": null, "stance": "neutral", "quote": "I used it once with althttpd.", "excerpt": "I used it once with althttpd. https://sqlite.org/althttpd/doc/trunk/althttpd.md", "context": "", "use_case": "TLS wrapper for althttpd", "switched_from": "", "story": "Stunnel"}, {"id": 747641440, "item_id": 46727590, "url": "https://news.ycombinator.com/item?id=46727590", "by": "ranger_danger", "date": "2026-01-22", "version": null, "stance": "recommend", "quote": "I use it to wrap my gstreamer tcp streams in TLS", "excerpt": "I use it to wrap my gstreamer tcp streams in TLS to send them over the internet, but socat can also do the same thing.", "context": "", "use_case": "TLS wrapping for TCP streams", "switched_from": "", "story": "Stunnel"}, {"id": 740304129, "item_id": 46269008, "url": "https://news.ycombinator.com/item?id=46269008", "by": "novotimo", "date": "2025-12-14", "version": null, "stance": "warn", "quote": "stunnel crashes at under 100 handshakes per second", "excerpt": "I\u2019ve been working on a TLS proxy/TLS terminator that can handle 3000 TLS handshakes per second (basically an stunnel replacement, but stunnel crashes at under 100 handshakes per second) as a pet project, but I\u2019ve realized that with some polishing this can be really useful. https://github.com/novotimo/tlsproxy This is still in development (todo are privilege dropping, in place config reloads, log burst suppression, mu", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What Are You Working On? (December 2025)"}]}