Stunnel Connection Information
OpenYield runs the stunnel servers and your side connects to them as a client. Your FIX engine connects to a local stunnel port, and stunnel encrypts the traffic to OpenYield. stunnel is optional in Test and required in Main unless you use AWS PrivateLink or AWS Direct Connect. For those options, contact OpenYield for more information.
Placeholders such as <COMPID> below stand for the values in your connection email. See FIX Connection Information for your FIX session parameters.
Your Stunnel Parameters
| Parameter | Placeholder | Description |
|---|---|---|
| Environment | <ENVIRONMENT> | Test or Main |
| Host | <HOST> | The DNS name to connect to, also used in checkHost (except connectone.openyld.com) |
| CompID | <COMPID> | Your firm identifier, used here to name each connection |
| Certificate File | <CERT-FILE> | OpenYield-ConTest.pem (Test) or OpenYield-Main.pem (Main) |
| Certificate Expiry | <CERT-EXPIRY> | Date the current certificate expires |
| TR Stunnel Port | <TR-STUNNEL-PORT> | OpenYield port for your Trading session |
| MD Stunnel Port | <MD-STUNNEL-PORT> | OpenYield port for your Market Data session |
| OB Stunnel Port | <OB-STUNNEL-PORT> | OpenYield port for your Order Book session |
| DC Stunnel Port | <DC-STUNNEL-PORT> | OpenYield port for your Drop Copy session |
| RQ Stunnel Port | <RQ-STUNNEL-PORT> | OpenYield port for your Request Quote session |
| Allowlisted IPs | You provide | Main only. Send your static IP addresses (or CIDR ranges) to OpenYield during onboarding. |
The SFTP password for downloading the certificate is not emailed. OpenYield gives it to you on a Zoom call.
Environments
| Test | Main | |
|---|---|---|
| Hosts | contest.openyld.com (18.220.26.232) | connect.openyld.com (34.205.60.36) or connectone.openyld.com (54.145.185.124) |
| Incoming Connections | Any internet IP address | Allowlisted IP addresses only |
| Certificate | OpenYield-ConTest.pem | OpenYield-Main.pem (valid for both Main hosts) |
| Host Name Verification | checkHost = contest.openyld.com | checkHost = connect.openyld.com. Do not set checkHost for connectone.openyld.com. |
| Stunnel Ports | FIX port + 2000: TR 670x, MD 630x, OB 650x, DC 690x, RQ 710x | 63xx, assigned per session |
| Hours | 08:00 – 17:00, Monday – Friday (America/New_York) | 08:00 – 17:00, Monday – Friday (America/New_York) |
In Test, the direct (unencrypted) FIX port and the stunnel port differ by 2000. For example, TR on FIX port 4704 is available through stunnel on 6704, and RQ on 5104 through 7104.
OpenYield uses the default stunnel server configuration, which does not allow the insecure SSL v3 protocol.
Setup Steps
1. Download the Certificate
The certificate is on OpenYield's SFTP server:
| Setting | Value |
|---|---|
| Server | sftp.openyld.com |
| Port | 22 (SFTP) |
| User | certificates |
| Password | Provided by OpenYield on a Zoom call |
OpenYield makes a new certificate available one week before the current one expires.
2. Install the Certificate
Copy the certificate to your stunnel configuration folder (usually /etc/stunnel/) and restrict its permissions:
chmod 0600 /etc/stunnel/<CERT-FILE>
3. Include a Configuration Folder
We recommend keeping each connection set in its own file in an include folder. Add this line to stunnel.conf:
include = /etc/stunnel/conf.d
4. Create the Connection File
Create a file in the include folder, for example /etc/stunnel/conf.d/openyield.conf, with one section per session:
[<COMPID>-TR]
client = yes
accept = 127.0.0.1:<TR-LOCAL-PORT>
connect = <HOST>:<TR-STUNNEL-PORT>
CAfile = /etc/stunnel/<CERT-FILE>
verifyChain = yes
OCSPaia = yes
verifyPeer = yes
checkHost = <HOST>
[<COMPID>-MD]
client = yes
accept = 127.0.0.1:<MD-LOCAL-PORT>
connect = <HOST>:<MD-STUNNEL-PORT>
CAfile = /etc/stunnel/<CERT-FILE>
verifyChain = yes
OCSPaia = yes
verifyPeer = yes
checkHost = <HOST>
Add a section in the same format for each other session you use (OB, DC, RQ).
If your host is connectone.openyld.com, remove the checkHost line from every section. That host must not use host name verification.
You choose each local port (<TR-LOCAL-PORT>, <MD-LOCAL-PORT>, …). Use any free port on your host, as long as it matches your FIX configuration.
5. Point Your FIX Engine at Stunnel
Configure each FIX session to connect to its local stunnel accept port instead of OpenYield's host. This makes sure all traffic goes through the encrypted tunnel:
[SESSION]
SenderCompID=<COMPID>-TR
TargetCompID=OPENYIELD-TR
SocketConnectHost=127.0.0.1
SocketConnectPort=<TR-LOCAL-PORT>
[SESSION]
SenderCompID=<COMPID>-MD
TargetCompID=OPENYIELD-MD
SocketConnectHost=127.0.0.1
SocketConnectPort=<MD-LOCAL-PORT>
Security Recommendations
The sample connection file above already includes both of these recommendations. For connectone.openyld.com, leave out checkHost.
Full Chain Check
We strongly recommend a full certificate chain check on every connection:
; Full Chain Check
verifyChain = yes
OCSPaia = yes
Certificate Pinning
We also recommend pinning the host (see OWASP: Certificate and Public Key Pinning):
; Pinning
verifyPeer = yes
checkHost = <HOST>
; checkIP = <HOST IP ADDRESS>
To pin by IP address instead of host name, use checkIP with the IPv4 address of your host from the Environments table above.
Do not use host name verification (checkHost) with connectone.openyld.com. Keep verifyPeer, verifyChain and OCSPaia.