splunk-connect-for-syslog icon indicating copy to clipboard operation
splunk-connect-for-syslog copied to clipboard

Enhancement request: Support for multiple CA's for Syslog-TLS

Open perditi0nspam opened this issue 5 years ago • 1 comments

At present syslog-tls can use a single CA cert for server authentication. Ideally each of the syslog clients would be singed by the same CA so that a single CA cert would be sufficient, but this isn't always practical. Few or no enterprises are designed perfectly, and bringing down each system to change their certificates in order to onboard them with a syslog server could be a serious inconvenience, or even break existing architecture.

Assume 1000 ESXi hosts, 100 firewalls, or what have you. If they are self signed or signed by a different central CA to that of the CA configured on SC4S that means they can't authenticate with SC4S over syslog-tls.

To address these issues, it would be very helpful if a CA cert for syslog-tls could be configured either per TCP socket on the SC4S instance, or per sourcetype.

perditi0nspam avatar Dec 17 '19 09:12 perditi0nspam

For now, this can be worked around by using an instance of the container per TLS cert pair.

ryanfaircloth avatar Dec 17 '19 18:12 ryanfaircloth