Question re: syslog-ng TLS and monitoring of the certificate
Chris Moody <[email protected]> Thu, 4 Jun 2026 15:17:51 -0700
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <[email protected]> |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============6663264064654081267== Content-Language: en-US Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------egZf1o96Jpr409gqOoXKBiEp" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------egZf1o96Jpr409gqOoXKBiEp Content-Type: multipart/mixed; boundary="------------WucC8mxJr0OLYc9S6YUHxZzY"; protected-headers="v1" From: Chris Moody <[email protected]> To: Syslog-ng users' and developers' mailing list <[email protected]> Message-ID: <[email protected]> Subject: Question re: syslog-ng TLS and monitoring of the certificate --------------WucC8mxJr0OLYc9S6YUHxZzY Content-Type: multipart/mixed; boundary="------------XN8MNa5biP0RFPNlvyoz4jZn" --------------XN8MNa5biP0RFPNlvyoz4jZn Content-Type: multipart/alternative; boundary="------------HiExzib20ZwZyR2z8lmLlDxC" --------------HiExzib20ZwZyR2z8lmLlDxC Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64 SGVsbG8gZXZlcnlvbmUuwqAgV2FudGVkIHRvIGZpcnN0IHNlbmQgYSBodWdlIHRoYW5rIHlv dSB0byBldmVyeWJvZHkgZm9yIA0KdGhpcyBraWNrLUAkJCBzb2Z0d2FyZS7CoCBJIGhhdmUg YmVlbiBldmFuZ2VsaXppbmcgaXRzIHVzZSBzaW5jZSBoZWxsLCANCnRoZSBlYXJsaWVzdCBy ZWxlYXNlcyBpbiB0aGUgbGF0ZSA5MCdzLsKgIEJ1aWx0IGV2ZXJ5dGhpbmcgZnJvbSBnbG9i YWwgDQphbnljYXN0IGFnZ3JlZ2F0b3JzIHRvIHNpbmdsZS1pbnN0YW5jZXMgYW5kIGV2ZXJ5 dGhpbmcgYmV0d2VlZW4uDQoNCkkgZG8gaGF2ZSBhIHF1ZXN0aW9uIGhvd2V2ZXIgYWJvdXQg VExTIGhhbmRsaW5nLsKgIEkgaGF2ZSBhIGNsaWVudCB0aGF0IA0KaGFzIGEgcmVxdWVzdCB0 byBoYXZlIGZyZXF1ZW50IGhlYWx0aC1jaGVja3MgZm9yIHRoZSB2YWxpZGl0eSBvZiB0aGVp ciANCmNlcnRpZmljYXRlcyB0aHJvdWdob3V0IHRoZWlyIGluZnJhc3RydWN0dXJlIChPTUQv bmFlbW9uL2N1c3RvbSBwbHVnaW5zIA0KdG8gdGhlIHJlc2N1ZSkuwqAgSSBoYXZlIHRoaXMg d29ya2luZyBncmVhdCBmb3IgY29tbW9uIHNlcnZpY2VzIHRoYXQgY2FuIA0KYmUgY2hlY2tl ZCB2aWEgc29tZSBzY3JpcHRzIHV0aWxpemluZyAnb3BlbnNzbCBzX2NsaWVudCAtY29ubmVj dCcgYW5kIA0KcGFyc2luZyB0aGUgb3V0cHV0Lg0KDQpXaGVyZSBJIGFtIHN0dW1ibGluZyBp bnRvIHNvbWUgdHJvdWJsZSB0aG91Z2ggaXMgaW4gbW9uaXRvcmluZyB0aGUgVExTIA0KY2Vy dGlmaWNhdGUgYmVpbmcgc2VydmVkIHZpYSB0aGVpciBzeXNsb2ctbmcgW3N5c2xvZy1uZyA0 ICg0LjguMSkgb24gDQpEZWJpYW4gMTNdIHRoYXQgaXMgYWdncmVnYXRpbmcvcmVjZWl2aW5n IGxvZ3MuDQoNClZpYSBzb21lIGRlYnVnZ2luZyBJIGZvdW5kIHRoYXQgdXNpbmcgJ29wZW5z c2wgc19jbGllbnQnIGNhbiBjYXVzZSBzb21lIA0KJ2h1bmcnIFRMUyBjb21tdW5pY2F0aW9u IGFzIGl0IGRvZXMgbm90IGNsZWFubHkgc2VuZCB0aGUgZXhwZWN0ZWQgJ2VvZicgDQp3aGVu IGNsb3NpbmcgdGhlIGNvbm5lY3Rpb24gYXMgSSBhbSBjaGVja2luZyB2aWEgdGNwLzY1MTQg aW5zdGVhZCBvZiANCnNheSwgb25lIG9mIHRoZSBpbi1idWlsdCB0bHMgaGFuZHNoYWtlcyBp biBvcGVuc3NsIChzbXRwLCBpbWFwLCBsZGFwLCANCmV0YykuwqAgTm90IGF0IGFsbCBzeXNs b2ctbmcncyBwcm9ibGVtLCBJIHVuZGVyc3RhbmQuDQpbcmVmZXJlbmNlOiANCmh0dHBzOi8v aXRoeS5jb20vYXJ0aWNsZS9maXgtb3BlbnNzbC1lcnJvcjBhMDAwMTI2LWZvci1zc2wtOHc4 MTNmdjJdDQoNCkkgaGF2ZSBoYWQgc29tZSBzdWNjZXNzIGluIGluc3RydWN0aW5nIHRoZSB0 aGUgcmVjZWl2ZXIgdG8gbW9yZSANCmdyYWNlZnVsbHkgaGFuZGxlIHRoaXMgY29uZGl0aW9u IGJ5IGFkZGluZyAnT3B0aW9ucyA9IA0KU1NMX09QX0lHTk9SRV9VTkVYUEVDVEVEX0VPRicg dG8gb3BlbnNzbC5jb25mIGFzIHdlbGwgYXMgaW5jbHVkaW5nIHRoZSANCm9wZW5zc2wgb3B0 aW9uICctbm9faWduX2VvZicgaW4gbXkgc29ja2V0IGNoZWNrLsKgIEJ5ICJzb21lIHN1Y2Nl c3MiLCBJIA0KbWVhbiB0aGUgc29ja2V0IHJlc3BvbmRzIGEgbGl0dGxlIGJpdCBsb25nZXIs IGJ1dCBzdGlsbCBmYWlscy7CoCBBZ2FpbiwgDQpzdGlsbCBvcGVuc3NsJ3MgaXNzdWUsIEkg dW5kZXJzdGFuZC7CoCBJIGFtIGludmVzdGlnYXRpbmcgb3RoZXIgbWV0aG9kcyANCnN1Y2gg YXMgZ251dGxzLWNsaSwgZXRjIGJ1dCBoYXZlbid0ICh5ZXQpIGZvdW5kIGFueXRoaW5nIHRo YXQgcmV0dXJucyANCnRoZSBjZXJ0aWZpY2F0ZSBkYXRhIGl0c2VsZiBmb3IgZ3Jva2tpbmcg b3V0IHRoZSAnbm90QWZ0ZXInIHZhbHVlIG9mIHRoZSANCmNlcnRpZmljYXRlLg0KDQpUaGUg cmVhc29uIEkgYW0gYXNraW5nIGhlcmUgaXMgdG8gc2VlIGlmIGFueW9uZSBlbHNlIGhhcyBm b3VuZCBhbmQvb3IgDQpzb2x2ZWQgZm9yIHNpbWlsYXIgYmVoYXZpb3Igc2luY2UgaXQgYXBw ZWFycyB0aHVzIGZhciB0aGF0IGl0IGlzIA0Kc3lzbG9nLW5nIGFuZCB0aGUgJ3Rscycgb3B0 aW9uIHRoYXQgc2VlbSB0byBiZSB3aGF0IGlzIGNlYXNpbmcgdG8gDQpyZXNwb25kIGFmdGVy IHNvbWUgdGltZS7CoCBXaGVuIEkgaGF2ZSBkb25lIHRoZXNlIGNlcnRpZmljYXRlIGNoZWNr cyANCmFnYWluc3Qgb3RoZXIgZGFlbW9ucyB0aGF0IGxhY2sgdGhlIGluLWJ1aWx0IHRscyBo YW5kc2hha2VzIGluIG9wZW5zc2wgDQphbmQgdGhleSBjb250aW51ZSByZXNwb25kaW5nIHdp dGggY2VydGlmaWNhdGUgZGF0YSB3aGVyZWFzIHN5c2xvZy1uZyANCnN0YXJ0cyBjaG9raW5n IG9uIHRoZSAiZXJyb3I6MEEwMDAxMjY6U1NMIHJvdXRpbmVzOjp1bmV4cGVjdGVkIGVvZiB3 aGlsZSANCnJlYWRpbmcgVW5hYmxlIHRvIGVzdGFibGlzaCBTU0wgY29ubmVjdGlvbiIgdW50 aWwgdGhlIGRhZW1vbiBnZXRzIA0KcmVzdGFydGVkLCB0aGVuIGFsbCByZXNwb25kcyBhZ2Fp biBhcHByb3ByaWF0ZWx5LsKgIEkndmUgcnVuIHRoZSANCmZvbGxvd2luZyBhbmQgdGhlIHN5 c2xvZy1uZyB0bHMgb25seSByZXNwb25kcyBwcm9wZXJseSBmb3IgYXBwcm94IDcwIA0Kc2Vj b25kcyBhbmQgc3RhcnRzIGZhaWxpbmcuDQoNCmZvciAoKGk9MTtpPjA7aSsrKSk7IGRvIGVj aG8gIj09PVsgYGRhdGVgIjsgb3BlbnNzbCBzX2NsaWVudCAtY29ubmVjdCANCmRtei1sb2cu RE9NQUlOLmNvbTo2NTE0IC1ub19pZ25fZW9mIDwgL2Rldi9udWxsIDI+JjEgfCBvcGVuc3Ns IHg1MDkgDQotZW5kZGF0ZSAtbm9vdXQ7IHNsZWVwIDEwOyBkb25lDQo9PT09PT09PT09DQo9 PT1bIFRodSBKdW7CoCA0IDAzOjA5OjA4IFBNIFBEVCAyMDI2DQpub3RBZnRlcj1BdWfCoCA4 IDA1OjM3OjEwIDIwMjYgR01UDQo9PT1bIFRodSBKdW7CoCA0IDAzOjA5OjE4IFBNIFBEVCAy MDI2DQpDb3VsZCBub3QgZmluZCBjZXJ0aWZpY2F0ZSBmcm9tIDxzdGRpbj4NCjQwNzcwRThB MjY3RjAwMDA6ZXJyb3I6MTYwODAxMEM6U1RPUkUgDQpyb3V0aW5lczpvc3NsX3N0b3JlX2hh bmRsZV9sb2FkX3Jlc3VsdDp1bnN1cHBvcnRlZDouLi9jcnlwdG8vc3RvcmUvc3RvcmVfcmVz dWx0LmM6MTYwOnByb3ZpZGVyPWRlZmF1bHQNCj09PT09PT09PT0NCg0KQW55Ym9keSB3aXRo IGFueSBpbnNpZ2h0cyBvciB0aGF0IG1heSBoYXZlIGZvdW5kIGEgd2F5IHRvIHNvbHZlIGZv ciANCnRoaXMsIEkgd291bGQgZ3JlYXRseSBhcHByZWNpYXRlIGFueSBoaW50cy4NCg0KVGhh bmtzIHNvIG11Y2gsDQotQ2hyaXMNCg0KLS0gDQpOb2RlLU5pbmUsIEluYy4NCmNocmlzQG5v ZGUtbmluZS5jb20NCjYxOS4zNTQuNjQ2Mw0K --------------HiExzib20ZwZyR2z8lmLlDxC Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE html> <html> <head> <meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF= -8"> </head> <body> <font face=3D"Courier New, Courier, monospace">Hello everyone.=C2=A0 = Wanted to first send a huge thank you to everybody for this kick-@$$ software.=C2=A0 I have been evangelizing its use since hell, the earliest releases in the late 90's.=C2=A0 Built everything from glo= bal anycast aggregators to single-instances and everything betweeen.<br= > <br> I do have a question however about TLS handling.=C2=A0 I have a cli= ent that has a request to have frequent health-checks for the validity of their certificates throughout their infrastructure (OMD/naemon/custom plugins to the rescue).=C2=A0 I have this workin= g great for common services that can be checked via some scripts utilizing 'openssl s_client -connect' and parsing the output.<br> <br> Where I am stumbling into some trouble though is in monitoring the TLS certificate being served via their syslog-ng [syslog-ng 4 (4.8.1) on Debian 13] that is aggregating/receiving logs.<br> <br> Via some debugging I found that using 'openssl s_client' can cause some 'hung' TLS communication as it does not cleanly send the expected 'eof' when closing the connection as I am checking via tcp/6514 instead of say, one of the in-built tls handshakes in openssl (smtp, imap, ldap, etc).=C2=A0 Not at all syslog-ng's probl= em, I understand.<br> [reference: <a href=3D"https://ithy.com/article/fix-openssl-error0a000126-for-ssl-8w813f= v2" class=3D"moz-txt-link-freetext">https://ithy.com/article/fix-open= ssl-error0a000126-for-ssl-8w813fv2</a>]<br> <br> I have had some success in instructing the the receiver to more gracefully handle this condition by adding 'Options =3D SSL_OP_IGNORE_UNEXPECTED_EOF' to openssl.conf as well as including the openssl option '-no_ign_eof' in my socket check.=C2=A0 By "some= success", I mean the socket responds a little bit longer, but still fails.=C2=A0 Again, still openssl's issue, I understand.=C2=A0= I am investigating other methods such as gnutls-cli, etc but haven't (yet) found anything that returns the certificate data itself for grokking out the 'notAfter' value of the certificate.<br> <br> The reason I am asking here is to see if anyone else has found and/or solved for similar behavior since it appears thus far that it is syslog-ng and the 'tls' option that seem to be what is ceasing to respond after some time.=C2=A0 When I have done these certificate checks against other daemons that lack the in-built tls handshakes in openssl and they continue responding with certificate data whereas syslog-ng starts choking on the "error:0A000126:SSL routines::unexpected eof while reading Unable to establish SSL connection" until the daemon gets restarted, then all responds again appropriately.=C2=A0 I've run the following and = the syslog-ng tls only responds properly for approx 70 seconds and starts failing.<br> <br> for ((i=3D1;i>0;i++)); do echo "=3D=3D=3D[ `date`"; openssl s_cl= ient -connect dmz-log.DOMAIN.com:6514 -no_ign_eof < /dev/null 2>&1 | openssl x509 -enddate -noout; sleep 10; done<br> </font><font face=3D"Courier New, Courier, monospace">=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D</font><br> <font face=3D"Courier New, Courier, monospace">=3D=3D=3D[ Thu Jun=C2=A0= 4 03:09:08 PM PDT 2026<br> notAfter=3DAug=C2=A0 8 05:37:10 2026 GMT<br> =3D=3D=3D[ Thu Jun=C2=A0 4 03:09:18 PM PDT 2026<br> Could not find certificate from <stdin><br> 40770E8A267F0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:../crypto/store/store_= result.c:160:provider=3Ddefault<br> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br> <br> Anybody with any insights or that may have found a way to solve for this, I would greatly appreciate any hints.<br> <br> Thanks so much,<br> -Chris<br> <br> -- <br> Node-Nine, Inc. <br> <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:chris@node-nin= e.com">[email protected]</a> <br> 619.354.6463</font> </body> </html> --------------HiExzib20ZwZyR2z8lmLlDxC-- --------------XN8MNa5biP0RFPNlvyoz4jZn Content-Type: application/pgp-keys; name="OpenPGP_0xE3B7ECCE88761F0D.asc" Content-Disposition: attachment; filename="OpenPGP_0xE3B7ECCE88761F0D.asc" Content-Description: OpenPGP public key Content-Transfer-Encoding: quoted-printable -----BEGIN PGP PUBLIC KEY BLOCK----- xsBNBFUxXD4BCACkIfP/zjxR22aH8aIYGVTFbAX2CqmZ6vcj3Z2+bYWa47od6diO 2O1osCE4pntb6T++5yVsUWbTP9tmH48JKkmQVwqEUsQ1Qr1MaLsgZt7d8bpZ3yp3 ZmN/o/Txwyio1VujeI5bYXmmj1KxOdJTe5XJ/dYu+DljHkKeHTaW7U84D1HGdarJ lcQl1bl2FdtkLXc428GjrVgTLNHCHS0Z3jJHBbfLarRVv/YGOpxh5xxK0DNVvMRO oEw35dXGkU3enSLR9PSQdxpJjGCDDKaj6dFOOxZqvf04t40PpkZEyN33B17Mbs0Z y3kNABu62ChdL5BLjuQ7Pu0zllWWfy1QitIrABEBAAHNIUNocmlzIE1vb2R5IDxj aHJpc0Bub2RlLW5pbmUuY29tPsLAlAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMB AAIeAQIXgBYhBAZJ0RVaXZ5dnALCoOO37M6Idh8NBQJlJaeEBQkZXD6yAAoJEOO3 7M6Idh8ND+cH/3g9fhH7NpIa/9zSDvQhzbjzIgp0IW0s/VX6JoqSVUabAlgzfpmL hAG8wv1BelhC8YNPziOf5SOE4KREuqnSPWcztF4P+hdLDf53iavi5J1jTxSAYktA a9PdjQWhNaF/l+KSEnPaMNpewNpxFwlUrTBpRq06fA12ndTBG0rgy+dspcOhpJTL JK5EWING64TwkLfvJSg0Y//pOQe0y5cFV9ZrVnhJ3l3fb18mExp3MDnE8EMNVjw3 7bkgjAf1t7HZQ7RWU4CX19Q5/iGIqRrHc9vTnBZ0ximrhbM7EAbXNXGwciRS0sFU PvpvLfNxA7uaWZ8UwLoGUfyKcgNJBFnOYDXCwH0EEwEKACcFAlUxXD4CGwMFCQeG H4AFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ47fszoh2Hw3tXQgAm1A83N4L h92j4N4QTdNXwI7VyE6xNJOzEYXEJzptQ0p1tJ81cyNhBW6DwXDzhm2OfTJPB2SY h0Vk4FYm1tfxzgFZv6IbZhWB/b4dR1GVI+z4xH1a1lVOLUZPKV00HkQWUpifSOiI D9GyP90ryGKp79VWFviAauf3FgZcaQ/IoJwgdF+k322Xoj8cHT5VyBEkEDFOXJRM zcr7VdRDPCr7MSToiD/64bUocaKdm8j56lGOuz37mcavGYjU5T/3wyOkwpKw0+VI olbUxkJXnnwcovCq5cna/p9Dthajj9AFv7BT227ZSSFHLRTAC0xzA0KzgL4nIthk kvGNqqlzVGT8LcLAlAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYh BAZJ0RVaXZ5dnALCoOO37M6Idh8NBQJcvhsrBQkLTsN9AAoJEOO37M6Idh8NcYAH +wQLpu0JSUuTpcA4MOlF1/afVbkcNX7NfZ5Yf8dpkdD9I9kn8TWVqQIAt336zs0I TpzwwhwEyyds/jEP+0qQoT0hcoYgi7FH4WW8hWtwB3K3BFKFGU764LiRsEHFdDnV Z1jrY27v+q/jdR1/TiDLm7T8NbYcTH84LIdl9V5E0Ol9CUhZK4ZdNe+l2JQmM2hJ /c5zjyBnL8VfxfKTTjWPyKs8XdrjVJ9sk4Ih/9fRKHV96PdBPw0aQIDJDJOTOhpd Ox/Ax21JX6CcPknAy9Snm6A4XsdzVsEYfgG4AV79wfYjx8StyFaxJ69pCcLIlfeS iSe33hBEPTdCPj5Y1RtzMK7OwE0EVTFcPgEIAMlFr2vTRyhTtl11WpU7BIjXaKSL T34J8OaG/t/zLVnewklcgKre56CytSBRJ2LfOlN0sjAKjDwL1er4Lr0cNrfcew1T ReKJC8WTmF2FFstW1XPkNhCKZXafMt/6EW2VCvCVdEvvc8RwAfuZEECcrhNHsIuY 5ZsgWA596ldQHtKcXqS0L9nnTh1iC0nyMc/XHAB3wpLRm/MTabq2OQg+O41fe0DQ GquwOpx3mXgb5vI5zgMSERYHmVrdENhm+QVwD4xqB/G2f1NAqg3zrc5lJieEGYuX lq8Kj8k3dO03oZrB+svmrRMTyoO8W5rNR5XiVQxyNkKSa1jMNMMdOA+JpU8AEQEA AcLAhgQYAQoAJgIbDBYhBAZJ0RVaXZ5dnALCoOO37M6Idh8NBQJlJaeEBQkZXD6y ABQJEOO37M6Idh8NCRDjt+zOiHYfDRabCACgWoRDfrFGbuOi+Dzqa3AxHbJuC9wk zyDuoLCbShDzVhFlM3LYKV9tpYht4+5H8GDzYmxOW4kXRL5giRVHzM+s8KmcnDlr vvZsmPS9pzmt6t0m7mYzzJ9QaitILTLVhFRaczDt2CKzhPLVoc9y3HtwmUYrgYwB arBxVuYdVNLBvXaFqYMnKgfhLubwz8eSHwb71YoKEwQ2NH/4dW29QkWCOH+ShMJ4 qs8QjHd41DwI2DMcmjMZXdHTGsyEvUyyERWXJ8+xG37oesPqEoBtEonUXzM/HmHD 4JA2dE2GFdLUilDez7bO0J4x2demCsugUCQDv2OP3I/4Psf4xdcicY35 =3D65Ce -----END PGP PUBLIC KEY BLOCK----- --------------XN8MNa5biP0RFPNlvyoz4jZn-- --------------WucC8mxJr0OLYc9S6YUHxZzY-- --------------egZf1o96Jpr409gqOoXKBiEp Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature.asc" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEBknRFVpdnl2cAsKg47fszoh2Hw0FAmoh+Y8FAwAAAAAACgkQ47fszoh2Hw35 cAf/VbNkWbszXbSso9WYSBRp8sJTkL42/CIOUap7xwU8X7Zuh8Gql08bBYAAsAbUZPllUXqlwG3X oATxZy2nm9MkAtAvze2B1dq88gUO4YLLu+tMUegvLmgkMNNOwYxVgwzSL969G7NJAFuVhKJE10GF HqChFz/DytZzHAKCUgIGmNjHfa8gWZPE7fN+7nMq40VSGoeEXPZRBkoEYvHL+t0S2FxnGnd2Jf+I eMsPusNCrJ2WFqtnrbjahF/EbC1AliB8tPEE1HtazKT+GyACwgPG10CKKkoVxSHbHAw66rllOAPm uYRG5NIb2kArHWMRkeyxEZxpqaZNgCob64qSCCiCjQ== =qHCf -----END PGP SIGNATURE----- --------------egZf1o96Jpr409gqOoXKBiEp-- --===============6663264064654081267== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: %(web_page_url)slistinfo/%(_internal_name)s Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============6663264064654081267==--