System Admin News & Updates

Stunnel Changes: Removing Certificate Pinning 

September 28

Beginning in Q2, 2026, TT will no longer provide or update the stunnel.zip file which customers had previously used to perform certificate pinning. The final certificate in the stunnel.zip file will expire on Oct 17, 2026.   

Customers who previously download the stunnel.zip file from https://library.tradingtechnologies.com/tt-fix/general/stunnel.zip should migrate to their local machine’s certificate trust store as soon as possible. Digicert and AWS are both established Certificate Authorities and are available in the trust stores of modern operating systems.  

Please note: 

• Customers no longer need to download TTFIX.crt file  
• Customers must configure stunnel to use their OS trust store path for CA validation  
• TT will verify the correct authentication chain rather than a single pinned leaf certificate  

UAT and Production Migration Timeline 

• The AWS Trust Store will be available in UAT as of September 28 
• As of that date, customers who utilize the UAT environment will be required to have AWS in their trust store 
• In Production, customers may now utilize validation by Certificate Authority instead of using a pinned certificate  
• DigiCert will remain the production Certificate Authority until 10/17 
• After 10/17, AWS will be the required Certificate Authority provider 

Required Configuration Changes  

Previously Supported Configuration (pinned certificate)  

[orfix-tcp]   

client = yes   

accept = 127.0.0.1:11702   

connect = FullyQualifiedDomainName:port   

CAfile = TTFIX.crt   

verify = 3  

New Required Configuration (OS trust store with chain validation)  

[orfix-tcp]   

client = yes   

accept = 127.0.0.1:11702   

connect = FullyQualifiedDomainName:port   

verifyChain = yes   

CAfile = <OS_SPECIFIC_TRUST_STORE_PATH>  

Notes and Additional Guidance  

• The snippet above shows one section of the client configuration. For the other sections, see the online documentation here. 
• Stunnel versions: verifyChain = yes is broadly compatible. If required, verify = 2 provides comparable chain validation.  
• Customers currently connecting to TT FIX through stunnel should test the required configuration changes in UAT before migrating to production. 

For Windows Users  

Windows maintains trust certificates in the Windows trust store. To allow stunnel/OpenSSL to use Windows-managed trust rather than a separate PEM CA bundle, customers need an integration mechanism such as the OpenSSL CNG provider (cngprov.dll), available at https://www.stunnel.org/cng-downloads.html.

After downloading cngprov.dll from the stunnel site, place it in the ossl-modules folder in the stunnel directory, then update the stunnel configuration using the sample below. 

; — GLOBAL SECTION —
## cngprov provides access to the Windows trust store ##
provider = cngprov

; — SESSION LEVEL —
[orfix-tcp]
client = yes
accept = 127.0.0.1:11502
connect = FullyQualifiedDomainName:port
verifyChain = yes
## The Local Machine Root store is used as the trust source ##
CAstore = cng:store_name=Root;store_location=LocalMachine  

The following OS-specific trust store paths were gathered from publicly available sources. Customers should confirm the correct path with their internal IT teams before updating the stunnel configuration. 

OS-Specific Trust Store Paths 

• Ubuntu / Debian / Linux Mint: CAfile = /etc/ssl/certs/ca-certificates.crt 
• Red Hat (RHEL) / CentOS / Fedora / Amazon Linux: CAfile = /etc/pki/tls/certs/ca-bundle.crt 
• Alpine Linux: CAfile = /etc/ssl/cert.pem 
• SUSE / openSUSE: CAfile = /etc/ssl/ca-bundle.pem 
• Windows: Windows does not expose a single PEM of system roots. The stunnel installer provides a bundled root file. Use CAfile = ca-certs.pem (located in the stunnel installation directory). 
• macOS 
• Intel: CAfile = /usr/local/etc/openssl/cert.pem 
• Apple Silicon: CAfile = /opt/homebrew/etc/openssl/cert.pem