System Admin News & Updates

Stunnel Changes: Removing Certificate Pinning 

Prod-Live: September 25

Beginning in Q2, 2026, TT will no longer provide or update the stunnel.zip file which customers had previously used to perform certificate pinning. The final certificate in the stunnel.zip file will expire on Oct 17, 2026.   

Customers who previously download the stunnel.zip file from https://library.tradingtechnologies.com/tt-fix/general/stunnel.zip should migrate to their local machine’s certificate trust store as soon as possible. Digicert and AWS are both established Certificate Authorities and are available in the trust stores of modern operating systems.  

Important Dates: 

UAT: 

• September 22: The Digicert certificate has been replaced with an AWS certificate, which is not included in the stunnel.zip  
• As of that date, customers who utilize the UAT environment are required to have AWS in their trust store 

Prod-Sim: 

• As early as September 23, completed by September 24: The Digicert certificate will be replaced with an AWS certificate, which is not included in the stunnel.zip 
• As of that date, customers who utilize the UAT environment are required to have AWS in their trust store 

Prod-Live: 

• Cutoff Dates by location 
• September 25: NY Datacenter 
• October 2: All Remaining Datacenters 
• The Digicert certificate will be replaced with an AWS certificate, which is not included in the stunnel.zip 
• As of that date, customers who utilize the Prod environment are required to have AWS in their trust store. 

Please note: 

• Customers no longer need to download TTFIX.crt file  
• Customers must configure stunnel to use their OS trust store path for CA validation  
• TT will verify the correct authentication chain rather than a single pinned leaf certificate  

Required Configuration Changes  

Previously Supported Configuration (pinned certificate)  

[orfix-tcp]   

client = yes   

accept = 127.0.0.1:11702   

connect = FullyQualifiedDomainName:port   

CAfile = TTFIX.crt   

verify = 3   

New Required Configuration (OS trust store with chain validation)  

[orfix-tcp]   

client = yes   

accept = 127.0.0.1:11702   

connect = FullyQualifiedDomainName:port   

verifyChain = yes   

CAfile = <OS_SPECIFIC_TRUST_STORE_PATH>  

Notes and Additional Guidance  

• The snippet above shows one section of the client configuration. For the other sections, see the online documentation here. 
• Stunnel versions: verifyChain = yes is broadly compatible. If required, verify = 2 provides comparable chain validation.  
• Customers currently connecting to TT FIX through stunnel should test the required configuration changes in UAT before migrating to production. 

For Window Users  

Windows maintains trust certificates in the Windows trust store. To allow stunnel/OpenSSL to use Windows-managed trust rather than a separate PEM CA bundle, customers need an integration mechanism such as the OpenSSL CNG provider (cngprov.dll), available at https://www.stunnel.org/cng-downloads.html.

After downloading cngprov.dll from the stunnel site, place it in C:\Program Files (x86)\stunnel\ossl-modules.  Then update the stunnel configuration using the sample below. 

For Stunnel versions 5.75 or greater, the configuration is as follows:  

; — GLOBAL SECTION —
## cngprov provides access to the Windows trust store ##
provider = cngprov

; — SESSION LEVEL —
[orfix-tcp]
client = yes
accept = 127.0.0.1:11502
connect = FullyQualifiedDomainName:port
verifyChain = yes
## The Local Machine Root store is used as the trust source ## 
CAstore = cng:store_name=Root;store_location=LocalMachine 

For Stunnel versions earlier than 5.75  the config below will only be needed: 
; — SESSION LEVEL —
[orfix-tcp]
client = yes
accept = 127.0.0.1:11502
connect = FullyQualifiedDomainName:port
verifyChain = yes
CAfile = ca-certs.pem 

The following OS-specific trust store paths were gathered from publicly available sources. Customers should confirm the correct path with their internal IT teams before updating the stunnel configuration. 

OS-Specific Trust Store Paths 

• Ubuntu / Debian / Linux Mint: CAfile = /etc/ssl/certs/ca-certificates.crt 
• Red Hat (RHEL) / CentOS / Fedora / Amazon Linux: CAfile = /etc/pki/tls/certs/ca-bundle.crt 
• Alpine Linux: CAfile = /etc/ssl/cert.pem 
• SUSE / openSUSE: CAfile = /etc/ssl/ca-bundle.pem 
• Windows: Windows does not expose a single PEM of system roots. The stunnel installer provides a bundled root file. Use CAfile = ca-certs.pem (located in the stunnel installation directory). 
• macOS 
• Intel: CAfile = /usr/local/etc/openssl/cert.pem 
• Apple Silicon: CAfile = /opt/homebrew/etc/openssl/cert.pem