[syslog-ng] problem configuring syslog-ng with TLS

[Mohsen Alimomeni]

Hi everyone,
I want to configure syslog-ng with TLS, but there are problems in client
connecting to server. This is the error in client side:
{
Jul 16 17:04:10 momeni syslog-ng[31084]: syslog-ng starting up;
version='3.0.3'
Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection established;
fd='7', server='AF_INET(192.168.13.39:1999)', local='AF_INET(0.0.0.0:0)'
Jul 16 17:04:10 momeni syslog-ng[31084]: Certificate validation failed;
subject='emailAddress=momeni at amnafzar.com, CN=momeni, ..to the end! ',
error='invalid CA certificate', depth='1'
Jul 16 17:04:10 momeni syslog-ng[31084]: SSL error while writing stream;
tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
failed'
Jul 16 17:04:10 momeni syslog-ng[31084]: I/O error occurred while writing;
fd='7', error='Broken pipe (32)'
Jul 16 17:04:10 momeni syslog-ng[31084]: Syslog connection broken; fd='7',
server='AF_INET(192.168.13.39:1999)', time_reopen='60'
}

To make sure my certificates are valid I run two commands:
On server: openssl s_server -CApath CA/ -CAfile CA/cacert.pem -cert
Client/clientcert.pem -key Client/clientkeye
em -accept 8080

On client: openssl s_client -connect 192.168.13.39:8080
The result on the client is the server certificate and the last line is:
{
Verify return code: 19 (self signed certificate in certificate chain)
}

The client and server are both syslog-ng_3.0.2 (and 3.0.3) in ubuntu. These
are the steps I configured the client and server:
I used the script CA.sh to genereate X.509 certificates. I created a cacert
using the command:
       CA.sh -newca
created the ca files :cacert.pem, ..
created a request:
       CA.sh -newreq
rename the files created to syslog_cert.pem and syslog_ket.pem
signed it with the ca:
       CA.sh -sign
Then I copied the cacert.pem file to client and created it's hash as
explained in syslog-ng documentation.

configuration files:

Client config:
*destination d_tlsserver {
   tcp("192.168.13.39" port(1999)
     tls(ca_dir("/opt/syslog-ng/certs")
     peer_verify(required-trusted)
   ));
};*


Server config:
*source rezvani_tls {
   tcp(ip(0.0.0.0) port(1999) max-connections(300)
     tls(key_file("/opt/certs/newcerts/syslogs_key.pem")
     cert_file("/opt/certs/newcerts/syslogs_cert.pem")
     peer_verify(optional-untrusted)
  ));
};
*


-- 
__ \ /_\\_-//_ Mohsen Alimomeni
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090716/2926f7d1/attachment.htm