splunk-connect-for-syslog
splunk-connect-for-syslog copied to clipboard
Enhancement request: Support for multiple CA's for Syslog-TLS
At present syslog-tls can use a single CA cert for server authentication. Ideally each of the syslog clients would be singed by the same CA so that a single CA cert would be sufficient, but this isn't always practical. Few or no enterprises are designed perfectly, and bringing down each system to change their certificates in order to onboard them with a syslog server could be a serious inconvenience, or even break existing architecture.
Assume 1000 ESXi hosts, 100 firewalls, or what have you. If they are self signed or signed by a different central CA to that of the CA configured on SC4S that means they can't authenticate with SC4S over syslog-tls.
To address these issues, it would be very helpful if a CA cert for syslog-tls could be configured either per TCP socket on the SC4S instance, or per sourcetype.
For now, this can be worked around by using an instance of the container per TLS cert pair.