<div dir="ltr">Hi everyone,<br>I want to configure syslog-ng with TLS, but there are problems in client connecting to server. This is the error in client side:<br>{<br><div dir="ltr">Jul 16 17:04:10 momeni syslog-ng[31084]: syslog-ng starting up; version='3.0.3'<br>
Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection established; fd='7', server='AF_INET(192.168.13.39:1999)', local='AF_INET(<a href="http://0.0.0.0:0">0.0.0.0:0</a>)'<br>Jul 16 17:04:10 momeni syslog-ng[31084]: Certificate validation failed; subject='emailAddress=<a href="mailto:momeni@amnafzar.com">momeni@amnafzar.com</a>, CN=momeni, ..to the end! ', error='invalid CA certificate', depth='1'<br>
Jul 16 17:04:10 momeni syslog-ng[31084]: SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed'<br>Jul 16 17:04:10 momeni syslog-ng[31084]: I/O error occurred while writing; fd='7', error='Broken pipe (32)'<br>
Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection broken; fd='7', server='AF_INET(192.168.13.39:1999)', time_reopen='60'<br>}<br><br>To make sure my certificates are valid I run two commands:<br>
On server: openssl s_server -CApath CA/ -CAfile CA/cacert.pem -cert Client/clientcert.pem -key Client/clientkeye<br>em -accept 8080<br><br>On client: openssl s_client -connect <a href="http://192.168.13.39:8080">192.168.13.39:8080</a><br>
The result on the client is the server certificate and the last line is:<br>{<br>Verify return code: 19 (self signed certificate in certificate chain)<br>}<br><br>The client and server are both syslog-ng_3.0.2 (and 3.0.3) in ubuntu. These are the steps I configured the client and server:<br>
I used the script CA.sh to genereate X.509 certificates. I created a cacert using the command:<br> CA.sh -newca<br>created the ca files :cacert.pem, ..<br>created a request:<br> CA.sh -newreq<br>rename the files created to syslog_cert.pem and syslog_ket.pem<br>
signed it with the ca:<br> CA.sh -sign<br>Then I copied the cacert.pem file to client and created it's hash as explained in syslog-ng documentation.<br><br>configuration files:<br><br>Client config:<br><i style="font-family: courier new,monospace;">destination d_tlsserver {<br>
tcp("192.168.13.39" port(1999)<br> tls(ca_dir("/opt/syslog-ng/certs")<br> peer_verify(required-trusted)<br> ));<br>};</i><br><br><br>Server config:<br><i style="font-family: courier new,monospace;">source rezvani_tls {<br>
tcp(ip(0.0.0.0) port(1999) max-connections(300)<br> tls(key_file("/opt/certs/newcerts/syslogs_key.pem")<br>
cert_file("/opt/certs/newcerts/syslogs_cert.pem")<br> peer_verify(optional-untrusted)<br> ));<br>};<br></i></div><br clear="all">
<br>-- <br>__ \ /_\\_-//_ Mohsen Alimomeni<br><br>
</div>