nsd
nsd copied to clipboard
Update log levels for Mutual TLS
Currently errors related to certificates for Mutual TLS are logged via DEBUG. Which means they are not available in release builds. Use a method, like normal log at level 5 or so to allow for more convenient debugging. See #362 for more details.
Notes:
Some common certificate errors I believe we should log in normal logging (5 or something else) with an clear message explaining the exact problem to the operator:
- certificate CN/SAN mismatch with tls-auth auth-domain-name
- certificate expired
- tls-cert-bundle does not verify certificate given by client (server side)
- tls-cert-bundle does not verify certificate given by server (client side)
- possible connection errors on tls-auth-port
- maybe better output when client requests tls XFR on non tls-auth-port
- certificate/key open file errors or permissions problem/warning checks
- other certificate errors?
Maybe some of them are already covered, I just wanted to document all possible (common) scenarios.