# Install stunnel with Homebrew, apk, chocolatey, dnf, MacPorts, Nix, pacman, scoop, winget, zypper SSL tunneling program. Version 5.79 via Homebrew; verified 2026-06-29. ## Install ```sh sudo av install brew:stunnel ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install stunnel ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install stunnel ``` Evidence: MacPorts ports tree: security/stunnel/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add stunnel ``` Evidence: Alpine Linux edge package indexes: stunnel from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - dnf (92%): ```sh sudo dnf install stunnel ``` Evidence: Fedora Rawhide package metadata: stunnel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#stunnel ``` Evidence: nixpkgs package indexes: pkgs/by-name/st/stunnel/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S stunnel ``` Evidence: Arch Linux sync databases: stunnel from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install stunnel ``` Evidence: openSUSE Tumbleweed package metadata: stunnel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install stunnel ``` Evidence: Chocolatey community package catalog: stunnel from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','starship.install' - Scoop (92%): ```sh scoop install extras/stunnel ``` Evidence: Scoop official bucket manifest trees: bucket/stunnel.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id MichalTrojnara.Stunnel -e ``` Evidence: Windows Package Manager source index: MichalTrojnara.Stunnel from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:stunnel - **Package manager:** Homebrew - **Package manager page:** - **Version:** 5.79 - **Source summary:** SSL tunneling program - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-2.0-or-later - **Source archive:** - **Last updated:** 2026-06-29T16:45:11Z - **Generated:** 2026-07-08T18:08:21+00:00 ## Executables - stunnel (cli) - stunnel3 (cli) - stunnel (alias) - stunnel3 (alias) ## Dependencies - openssl@3 ## Install behavior - Post-install hook: not defined - Service: declared - Caveats: A bogus SSL server certificate has been installed to: $HOMEBREW_PREFIX/etc/stunnel/stunnel.pem This certificate will be used by default unless a config file says otherwise! Stunnel will refuse to load the sample configuration file if left unedited. In your stunnel configuration, specify a SSL certificate with the "cert =" option for each service. To use Stunnel with Homebrew services, make sure to set "foreground = yes" in your Stunnel configuration. - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 5.79 - Package-manager updated: 2026-06-29 - Local data: ok - Upstream repository: https://www.stunnel.org/ - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage stunnel is a long-running TLS wrapper proxy used to add TLS encryption to clients and servers that do not speak TLS themselves. ### Project history The official changelog records stunnel 0.1 as a testing skeleton on 1998-02-10 and stunnel 1.0 on 1998-02-11 as the first version with SSL support. That makes it one of the older still-packaged command-line TLS utilities in Unix and Windows ecosystems. The project has remained focused on wrapping arbitrary TCP services with SSL/TLS rather than replacing the underlying application protocol. Its manual and HOWTO present configuration as service sections that accept local connections and connect or execute another service behind the encrypted layer. ### Adoption history The input package facts list stunnel in Homebrew, Alpine, Fedora/DNF, MacPorts, Nix, Arch, Chocolatey, Scoop, WinGet, and openSUSE/Zypper. That breadth reflects stunnel's role as a portable operational tool rather than a single-platform utility. The official downloads page publishes source tarballs, Windows installers, Android builds, signatures, checksums, and rsync-accessible code archives, showing a release process designed for downstream packagers and administrators. ### How it is used Administrators use stunnel to put TLS in front of non-TLS-aware services or to create encrypted client-side tunnels to remote services. The manual describes global options plus per-service sections containing options such as accept, connect, certificates, keys, and verification settings. Common package usage is configuration-file driven: install the package, write stunnel.conf service blocks, provide certificates or keys where needed, and supervise stunnel as a daemon or service. ### Why package nerds care stunnel matters to package nerds because it is a classic tiny Unix tool with a huge compatibility surface: C code, OpenSSL linkage, service-manager integration, certificate file handling, Windows installers, and distribution patches all meet in one package. It is also a practical example of packaging security middleware. The package is not exciting because it owns an application protocol; it is important because it lets old or simple services survive in TLS-required environments. ### Timeline - 1998: stunnel 0.1 testing skeleton and stunnel 1.0 with SSL support appeared in the official changelog. - 2014: stunnel 5-era releases continued active OpenSSL security updates, including OpenSSL DLL updates during major vulnerability periods. - 2026: The official release list shows stunnel 5.79 released on 2026-06-29. ### Related projects - OpenSSL is the cryptographic library stunnel relies on for TLS functionality. - TCP Wrappers/libwrap appears in the manual as an optional access-control integration. ### Sources - - - - - - input.source_facts.package-manager ## Security Notes formula declares a Homebrew service. - **Geiger risk:** orange / medium - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /stunnel.conf ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** stunnel - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Nix - stunnel: normalized package name match | nixpkgs package indexes: pkgs/by-name/st/stunnel/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - stunnel - 5.76-r0: normalized package name match | Alpine Linux edge package indexes: stunnel from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSL encryption wrapper between network client and server | https://www.stunnel.org - apk - stunnel-doc - 5.76-r0: normalized package name match | Alpine Linux edge package indexes: stunnel-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSL encryption wrapper between network client and server (documentation) | https://www.stunnel.org - apk - stunnel-openrc - 5.76-r0: normalized package name match | Alpine Linux edge package indexes: stunnel-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | SSL encryption wrapper between network client and server (OpenRC init scripts) | https://www.stunnel.org - apk - stunnel3 - 5.76-r0: normalized package name match | Alpine Linux edge package indexes: stunnel3 from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Perl wrapper to use stunnel 3.x syntax in stunnel >=4.05 | https://www.stunnel.org - dnf - stunnel - 5.78-1.fc45: normalized package name match | Fedora Rawhide package metadata: stunnel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | A TLS-encrypting socket wrapper | https://www.stunnel.org/ - pacman - stunnel - 5.78-1: normalized package name match | Arch Linux sync databases: stunnel from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | A program that allows you to encrypt arbitrary TCP connections inside SSL | https://www.stunnel.org/ - zypper - stunnel - 5.78-1.1: normalized package name match | openSUSE Tumbleweed package metadata: stunnel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Universal TLS Tunnel | https://www.stunnel.org/ - zypper - stunnel-doc - 5.78-1.1: normalized package name match | openSUSE Tumbleweed package metadata: stunnel-doc from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Documentation for the universal TLS Tunnel | https://www.stunnel.org/ - MacPorts - stunnel: normalized package name match | MacPorts ports tree: security/stunnel/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Chocolatey - stunnel: normalized package name match | Chocolatey community package catalog: stunnel from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','starship.install' - Scoop - extras/stunnel: normalized package name match | Scoop official bucket manifest trees: bucket/stunnel.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 - winget - MichalTrojnara.Stunnel: normalized package name match | Windows Package Manager source index: MichalTrojnara.Stunnel from https://cdn.winget.microsoft.com/cache/source.msix ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - Runtime dependency declared by Homebrew. - [gnutls](https://www.automicvault.com/pkg/brew/gnutls/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [libressl](https://www.automicvault.com/pkg/brew/libressl/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [tlsx](https://www.automicvault.com/pkg/brew/tlsx/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [wolfssl](https://www.automicvault.com/pkg/brew/wolfssl/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [gsan](https://www.automicvault.com/pkg/brew/gsan/) - Shares av.db curated category or tags: cli, security, tls. - [nss](https://www.automicvault.com/pkg/brew/nss/) - Shares av.db curated category or tags: cli, security, tls. - [gmssl](https://www.automicvault.com/pkg/brew/gmssl/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [mbedtls](https://www.automicvault.com/pkg/brew/mbedtls/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [ssldump](https://www.automicvault.com/pkg/brew/ssldump/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, openssl, openssl-3, security, ssl. - [sslscan](https://www.automicvault.com/pkg/brew/sslscan/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, openssl, openssl-3, security, ssl. - [sslsplit](https://www.automicvault.com/pkg/brew/sslsplit/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, openssl, openssl-3, security, ssl. ## Combined YAML source View the package source record on GitHub. [combined/stunnel.yml](https://github.com/automic-vault/db/blob/main/combined/stunnel.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph