The verify works fine.

The client gives the following error now that things have been configured to get the verify to return OK

tss4s003 syslog-ng[9739]: Syslog connection accepted; fd='8', client='AF_INET(10.139.64.126:3766)', local='AF_INET(xx.xx.xx.xx:8514)'

Dec 9 16:24:25 tss4s003 syslog-ng[9739]: Certificate validation failed; subject='OU=Class 3 Public Primary Certification Authority, O=VeriSign\, Inc., C=US', issuer='OU=Class 3 Public Primary Certification Authority, O=VeriSign\, Inc., C=US', error='invalid CA certificate', depth='2'

Dec 9 16:24:25 tss4s003 syslog-ng[9739]: SSL error while reading stream; tls_error='SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned'

Dec 9 16:24:25 tss4s003 syslog-ng[9739]: I/O error occurred while reading; fd='8', error='Connection reset by peer (131)'

Dec 9 16:24:25 tss4s003 syslog-ng[9739]: Syslog connection closed; fd='8', client='AF_INET(10.139.64.126:3766)', local='AF_4:27:03 PM: Chris: INET(xx.xx.xx.xx:8514)'

Sent from my iPhone... So expect typos.

On Dec 6, 2009, at 10:24 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:

On Fri, 2009-12-04 at 11:20 -0500, Jimmy McDonald wrote:

I have syslog-ng installed and configured for mutual authentication.

When the client was using a self signed cert it worked. The client now

has a verisign cert.

Imported the CA and an intermediate cert and the public cert so the

chain is complete but the error on authentication says: invalid CA

certificate, depth=2

I have tried putting the pub cert in cert.d with the ca and

intermediate in ca.d. I also tried putting the intermediate in cert.d

I made a hash for the ca and the intermediate.

I'm not really sure what else to try. Any help would be greatly

appreciated.

Can you ensure that "openssl verify" validates your cert in case

syslog-ng doesn't?

--

Bazsi

______________________________________________________________________________

Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng

Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng

FAQ: http://www.campin.net/syslog-ng/faq.html