TLS Certificates

TLS Certificates is the certificate store of the Syslog Watcher Server. Settings that need a certificate select it by name from this store instead of pointing to files:

TLS Certificates Window

In the Server section of the main toolbar, click More More → TLS Certificates TLS Certificates…​

The list shows Name, Type, Issuer, and Subject. Self-signed certificates show Self-signed as the issuer.

Type Meaning

Certificate + Key

Certificate with an unencrypted private key.

Certificate + Encrypted Key

Certificate with a password-protected private key. The password is stored as the secret string PWD_<certificate name>. When you select the certificate in a setting, its Private key password is filled with that secret.

CA

CA certificate without a private key, used to validate peers.

In a remote session, Operator can add certificates and Admin can also delete them. For other users, the window is Read Only.

Generate a Self-signed Certificate

  1. Click Generate.

  2. Check the prefilled Common Name (CN) and SAN entries, and fill in the other settings.

  3. Click Generate.

If you entered a key password, Manager shows the name of the secret that stores it.

Setting Initial Description

Name

Certificate1

Name in the store.

Expiration (days)

3650

Validity period (1–36500 days).

Common Name (CN)

This computer’s full DNS name

Usually the fully qualified host name of the server.

SAN: Subject Alternative Names

This computer’s DNS names and IP addresses (except loopback)

DNS names and IP addresses the certificate is valid for (up to 32). Click Add, choose DNS or IP as Type, and pick a local host name or address, or type one. Clients check the name they connect with against this list.

Optional Subject Fields

—

Country code ©, State or province name (ST), Locality name (L), Organization name (O), Organizational unit (OU).

Key size

2048

RSA key size: 2048 or 4096 bits.

Encrypt key with password, Password confirmation

—

Optional password for the private key. Generate Random fills both fields with a random password. Leave both empty for an unencrypted key.
Add to SAN every name and address that clients use to reach the server. Modern TLS clients check SAN, not CN.
Manager generates the certificate and prefills CN and SAN from the computer it runs on. In a remote session, replace them with the server computer’s names and addresses.

Import a Certificate

  1. Click Import, then From PEM File…​ or From Clipboard…​

  2. In the Import Certificate window, check the Name suggested from the certificate.

  3. For an encrypted private key, enter its Password.

  4. Click Import.

What is imported depends on the PEM content:

  • A certificate and a private key: Certificate + Key or Certificate + Encrypted Key.

  • Only a certificate or only a key: Manager asks for the other part (a second file, or the clipboard).

  • Only a CA certificate: CA.

The PEM data is read on the Manager computer and stored on the server.

Export a Certificate

Select an entry and click Export → Certificate Only (No Private Key) → To PEM File…​ or To Clipboard…​ The private key is never exported.

Export a self-signed or CA certificate to install it as trusted on the clients.

Delete a Certificate

Select an entry, click Delete, and confirm. The secret with its key password is deleted too. Settings that refer to the certificate by name stop working until another certificate is selected.

Related Topics