title: Configuring stunnel and openssl on Windows to support TLS 1.2
body: <p>I'm having trouble enabling TLS 1.2 connections on a Windows (environment has both Windows 2008 and Windows 10 environments) platform. Currently, my private keys are managed by the Windows certificate store, using the CAPI engineId within stunnel (v 5.41), which uses OpenSSL 1.0.2k-fips. Because of this, stunnel can only negotiate a TLS 1.1 connection (SSLv2 and SSLv3/TLS1 are disabled for obvious reasons).</p>
  
  <p>I’ve tried compiling OpenSSL 1.1.0f and stunnel 5.41, but no luck either cross compiling under CentOS, nor under Windows using either MSYS2/MINGW32 or Cygwin.</p>
  
  <p>I am specifically looking for a way to manage the pfx/p12 (private key) in stunnel without resorting to the Windows certificate store. I found an example on how to configure stunnel to use capi - which worked beautifully, but because openssl 1.0.2 doesn't support ciphers that are used in TLS 1.2, only TLS 1.1 works. I need TLS 1.2.</p>
  
  <p><a href="https://www.stunnel.org/pipermail/stunnel-users/2017-February/005720.html" rel="nofollow noreferrer">https://www.stunnel.org/pipermail/stunnel-users/2017-February/005720.html</a> documents why I can't use TLS 1.2 with OpenSSL 1.0.2.</p>
  
  <p>OpenSSL 1.0.2 is what is built into stunnel 5.41. Recompiling didn't work. I'm specifically looking for how to configure stunnel to point at a pkcs12 key.</p>