connection attempt 1/1: server unreachable. Built-in certificates expired at may 29 2025 (today)

[sudo-gera]

Suddenly it stopped working on all my machines.
Deep inspecting helped me to understand that it depends on built-in certs that come inside release zip file.
And today (05/29/2025) is expiration date.

[sudo-gera]

Yup, im stupid enough to use prebuilt certs. Don't worry, i use it only in isolated environments.

[sudo-gera]

quick and unsafe workaround created by chatgpt and fixed by me.

one-machine fix:

• download latest release for 64bit linux:

wget https://github.com/securesocketfunneling/ssf/releases/download/3.0.0/ssf-linux-x86_64-3.0.0.zip

• unzip it

unzip ssf-linux-x86_64-3.0.0.zip

• cd into new dir

cd ssf-linux-x86_64-3.0.0

• create here fix.sh with following contents:

#!/bin/bash

set -e

# Output directories
CERT_DIR="./certs"
TRUSTED_DIR="$CERT_DIR/trusted"
mkdir -p "$TRUSTED_DIR"

# Subject information
CA_SUBJ="/C=US/ST=State/L=Locality/O=SSF_CA/OU=Org/CN=SSF Root CA"
SRV_SUBJ="/C=US/ST=State/L=Locality/O=SSF_Server/OU=Org/CN=ssf.local"

echo "Generating CA private key and certificate..."
openssl req -x509 -nodes -newkey rsa:4096 \
  -keyout "$CERT_DIR/ca.key" \
  -out "$TRUSTED_DIR/ca.crt" \
  -days 36500 `# 36500 is UNSAFE, use 3650 for safety (but you have to regenerate it more often)#`\
  -subj "$CA_SUBJ"

echo "Generating server private key and CSR..."
openssl req -newkey rsa:4096 -nodes \
  -keyout "$CERT_DIR/private.key" \
  -out "$CERT_DIR/server.csr" \
  -subj "$SRV_SUBJ"

echo "Creating x509 extension file..."
cat > "$CERT_DIR/extfile.txt" <<EOF
basicConstraints=CA:FALSE
keyUsage=nonRepudiation, digitalSignature, keyEncipherment
EOF

echo "Signing server certificate with CA..."
openssl x509 -req \
  -in "$CERT_DIR/server.csr" \
  -CA "$TRUSTED_DIR/ca.crt" \
  -CAkey "$CERT_DIR/ca.key" \
  -CAcreateserial \
  -out "$CERT_DIR/certificate.crt" \
  -days 36500 `# 36500 is UNSAFE, use 3650 for safety (but you have to regenerate it more often)#`\
  -extfile "$CERT_DIR/extfile.txt"

echo "Generating Diffie-Hellman parameters (this may take a few minutes)..."
openssl dhparam -out "$CERT_DIR/dh4096.pem" 1024
# 1024 is UNSAFE, use 4096 for safety (but generation would take much longer)

echo "Cleaning up temporary files..."
rm "$CERT_DIR/extfile.txt" "$CERT_DIR/server.csr" "$CERT_DIR/ca.key"

echo "✅ Certificate generation complete. Files are in $CERT_DIR"

• execute it

chmod +x ./fix.sh
./fix.sh

• done (only for localhost)
  now you can run on this machine:

(./ssfd &) && ./ssf 127.0.0.1

many-machines fix

You may notice, that in workaround above we connected to localhost.

That's good, but not enough.

Suppose we have multiple machines (even non-linux, such as windows ones).

In this case, all you need to do is to copy certs dir from your linux machine to all others, replacing certs dir from zip file.

For example, on windows you can open PowerShell and type:

rm -r ./ssf/certs
scp -r 192.168.999.999:./ssf/certs ./ssf/certs

This command assumes that you extracted ssf.zip into home dir on each machine and renamed it into ssf.
Don't forget to replace 192.168.999.999 with actual ip address of your linux machine.

[sudo-gera]

Update: make workaround easier

Instead of long text no one would read, let me make your life easier.

Here is list of patched release archives, similar to archives on website.

Just download one you want and use it as usual.

prebuilt binaries (patched by me)

• Windows 32bits
• Windows 64bits
• Linux 32bits
• Linux 64bits
• Raspberry Pi 2/3

WARNING:

the whole idea of using prebuit certs instead of generating new ones works only for isolated environments, where everyone trusts everyone. Don't make your server accessible from the outside world.