Skip to main content
Paxos uses mTLS (mutual TLS) to secure FIX server connections. During onboarding, you provide your certificate — signed by yourself or your CA — and Paxos deploys it on the server side. Use the steps below to diagnose connectivity issues.

​
Prerequisites

Confirm you have the following files from Paxos onboarding before proceeding:

​
1. Verify Network Connectivity

Test basic connectivity to confirm the server and port are reachable:
If the connection fails, check for:
  • DNS resolution failures or an incorrect server address
  • Firewall rules blocking outbound traffic on port 4199
  • Your IP address not being allowlisted (see Check Your External IP)

​
2. Verify Server Certificate

Use OpenSSL to confirm the server returns a certificate during the connection attempt:
If the output contains no peer certificate available, contact Support.

​
3. Check Your External IP

Your external IP address may need to be added to the Paxos allowlist. Find it with:
Contact Support to confirm your IP is allowlisted.

​
4. Configure Stunnel

If your FIX client does not support native TLS, use Stunnel as a TLS proxy. Below is a sample configuration:
To enable verbose debug logging, uncomment debug = 7.
Stunnel v4.54 or higher is required. See Verify Software Versions to check your installed version.

​
5. Validate Your Certificate

Confirm your signed certificate validates against your CA:
A successful validation returns your_signed_certificate.crt: OK.

​
6. Test the Connection

Run a full mTLS connection test using all three certificate files:
Review the output for handshake errors or certificate validation failures.

​
7. Verify File Format

Each certificate and key file must use proper PEM formatting. Confirm each file contains the correct BEGIN and END markers: Missing or malformed headers indicate a corrupted or incorrectly formatted file.

​
8. Match Certificate and Private Key

Verify the certificate and private key are a matched pair by comparing their MD5 checksums — both values must be identical:
If the checksums do not match, the certificate and private key were not generated together. Locate the private key file that was generated alongside your certificate, or generate a new key pair and resubmit the certificate to Paxos.

​
9. Check Certificate Expiration

Verify your certificate has not expired:
Contact Support to renew an expired certificate.

​
10. Verify Software Versions

Confirm you are running supported versions of Stunnel and OpenSSL:
Requirements:
  • Stunnel v4.54 or higher
  • OpenSSL with TLS 1.2 support or higher
Questions? Contact Support.