A TLS network interface requires TLS options to collect syslog messages.
Server Key and Certificate
The server certificate file is in PEM format. A certificate chain must be sorted starting with the actual server certificate, then intermediate CA certificates if applicable, and ending at the highest level (root) CA.
The server private key is in PEM format in Base64 ASCII encoding. Do not forget to specify the password if the key file is encrypted.
If the private key and the server certificate are in the same file, set its path twice in both fields.
Client Certificate Validation
Syslog Watcher can optionally validate client certificates to collect syslog messages from only authorized entities.
A certificate fingerprints file is a text file associating client IP addresses and fingerprints of client certificates. It contains one pair per line: an IP address and a certificate fingerprint. Here is an example with two clients:
How it works
Obtains a client certificate;
Calculate the certificate fingerprint;
Checks if the fingerprint file contains this fingerprint associated with the sender's IP address;
Refuse any connection that has no match in the fingerprint file.
After a connection attempt, Syslog Watcher dumps the refused certificate fingerprint in its own log. To allow that client, copy the fingerprint from there and add it to the fingerprint file.
Certificate Authority (CA) File
A certificate authority (CA) file contains one or more CA certificates for verification purposes. CA certificates are in PEM format and identified by the following sequences:
... (CA certificate in base64 encoding) ...
Certificate Authority (CA) Folder
A certificate authority (CA) folder contains CA certificates in PEM format. Each file contains one CA certificate. The files are looked up by the CA subject name hash value. CA certificates with the same name hash value differ in extension, e.g. 9da13359.0, 9da13359.1 etc.