TT Stunnel Changes: Removing Certificate Pinning

 

The following comes from TT System Admin News & Updates for September 4, 2026

 

As of Q2 2026 TT no longer provides / updates the stunnel.zip file which customers might be using to perform certificate pinning. The final certificate in the stunnel.zip file expires on Oct 17, 2026.  

Only customers who download the stunnel.zip file from https://library.tradingtechnologies.com/tt-fix/general/stunnel.zip are impacted. Affected customers should start migrating to utilize their local machine’s certificate trust store. Digicert and AWS are both established Certificate Authorities and should be available in the trust stores of modern operating systems.

 

What This Means 

• Clients no longer need to download TTFIX.crt file 
• Clients configure stunnel to use their OS trust store path for CA validation 
• We verify the correct authentication chain rather than a single pinned leaf certificate 

Configuration Changes 

 

Previous (pinned certificate)

[orfix-tcp]  

client = yes  

accept = 127.0.0.1:11702  

connect = FullyQualifiedDomainName:port  

CAfile = TTFIX.crt  

verify = 3 

 

New (OS trust store with chain validation) 

[orfix-tcp]  

client = yes  

accept = 127.0.0.1:11702  

connect = FullyQualifiedDomainName:port  

verifyChain = yes  

CAfile = <OS_SPECIFIC_TRUST_STORE_PATH> 

 

Notes and Additional Guidance 

• The snippet above is a single section of the client configuration.  For the other sections please see our online documentation here 
• Stunnel versions: verifyChain = yes is broadly compatible. If required, verify = 2 provides comparable chain validation. 
• For clients that currently connect to TT FIX using stunnel, we ask that they come into the UAT to test their needed configuration changes.