<div dir="ltr"><div class="gmail_quote">Hy Michae,</div><div class="gmail_quote"><br></div><div class="gmail_quote">Sorry for the late answer. I try to reproduce the case and inform you about the result</div><div class="gmail_quote"><br></div><div class="gmail_quote">Br,</div><div class="gmail_quote">Laci</div><div class="gmail_quote"><br></div><div class="gmail_quote">2015.03.08. 2:53 ezt írta ("Michael Starks" <<a href="mailto:syslog-ng-list@michaelstarks.com" target="_blank">syslog-ng-list@michaelstarks.com</a>>):<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 03/05/2015 11:50 PM, Laci Mészáros wrote:<br>
> Hello,<br>
><br>
> Have you tried syslog-ng start in forward-mode and verbose (-Fdve)? In<br>
> that case after the first message you can check the SSL error message<br>
> during the authentication. It could show you the problem with the<br>
> certificates.<br>
><br>
> Br,<br>
> Laci<br>
<br>
Thanks for the reply. I tried forward mode and I got these relevant<br>
messages:<br>
<br>
Syslog connection accepted; fd='10', client='AF_INET(1.2.3.4:37464)',<br>
local='AF_INET(<a href="http://0.0.0.0:6514" target="_blank">0.0.0.0:6514</a>)'<br>
Certificate validation failed;<br>
subject='emailAddress=<a href="mailto:address@example.com" target="_blank">address@example.com</a>, CN=<a href="http://sub.example.com" target="_blank">sub.example.com</a>, C=US',<br>
issuer='CN=StartCom Class 1 Primary Intermediate Server CA, OU=Secure<br>
Digital Certificate Signing, O=StartCom Ltd., C=IL', error='unable to<br>
get local issuer certificate', depth='0'<br>
SSL error while reading stream; tls_error='SSL<br>
routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned'<br>
I/O error occurred while reading; fd='10', error='Connection reset by<br>
peer (104)'<br>
Syslog connection closed; fd='10',<br>
client='AF_INET(52.10.218.147:37464)', local='AF_INET(<a href="http://0.0.0.0:6514" target="_blank">0.0.0.0:6514</a>)'<br>
<br>
I am using ca-bundle.pem from <a href="http://startssl.com" target="_blank">startssl.com</a> and the signed certificate<br>
validates on both the client and server using openssl verify.<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
</div>