0

I have done tls configuration between two nodes (client and server). i want to know what will happen if either one of the certificate ca.pem(CA certificate) or machine certificate get exipred.

rsyslog communication will stop working?

#$DefaultNetstreamDriver gtls

#certificate files for a client
#$DefaultNetstreamDriverCAFile /etc/tlscert/ca.pem
#$DefaultNetstreamDriverCertFile /etc/tlscert/machine-cert.pem
#$DefaultNetstreamDriverKeyFile /etc/tlscert/machine-key.pem

#set up the action
#$ActionSendStreamDriverMode 1
#$ActionSendStreamDriverAuthMode anon
Dheeraj Chawla
  • 13
  • 3

1 Answers1

0

Yes. The rsyslogd server will refuse new syslog packets and the remote logging will stop working. You would see in the /var/log/[messages,syslog] which certificate is causing the problem.

By the way, I always use x509/name as parameter to the directive $ActionSendStreamDriverAuthMode on production environments to ensure the certificate check. I actually don't know what this parameter anon means. It seems that it's use is only suggested to test environments.

Rodrigo B Brasil
  • 1