Troubleshooting TLS Encrypted Message Transfer

If your configuration fails when configuring a syslog integration within Omnissa Access, syslog-ng generates an error message on both the client side and the server side. Check the common error messages below to determine how to correct your configuration.

Root CA returns as unknown

Client-side error message:

SSL error while writing stream; tls_error='SSL routines:ssl3_get_server_certificate:certificate verify failed'

Server-side error message

SSL error while reading stream; tls_error='SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca'

Cause: The server or client is configured with a certificate from an unknown CA.

Resolution:The certificate should be placed in the directory set by the ca-dir() configuration option. Additionally, the hash link has to be created.

Certificate or key file is missing

Client-side error message:

SSL error while writing stream; tls_error='SSL routines:ssl3_read_bytes:sslv3 alert handshake failure'

Server-side error message

SSL error while reading stream; tls_error='SSL routines:ssl3_get_client_certificate:peer did not return a certificate'

Cause: The configuration file does not include a cert-file or key-file.

Resolution: Verify that the required values are assigned to the cert-file() and key-file().

Client certificate is not present

Client-side error message:

SSL error while writing stream; tls_error='SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure'

Server-side error message

SSL error while reading stream; tls_error='SSL routines:ssl3_get_client_hello:no shared cipher'

Cause: The configuration file does not include a client certificate.

Resolution: Verify that the required values are assigned to the cert-file() and key-file().

Cipher suite does not match

Client-side error message:

SSL error while writing stream; tls_error='SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure'

Server-side error message

SSL error while reading stream; tls_error='SSL routines:ssl3_get_client_hello:no shared cipher'

Cause: The cipher on the client and server do not match. This may be because the client and server are running different versions of syslog-ng, or because of a configuration error.

Resolution:

• Use the same version of syslog-ng on the client and server.
• If both are running the same version of syslog-ng, check the cipher-suite() or ssl-options() values to ensure matching cipher suites between the client and server.

Certificate validation failed

Client-side error message:

Certificate subject does not match configured hostname; hostname='XXX.XXX.X.X', certificate='XXX.XXX.X.X' SSL error while writing stream; tls_error='SSL routines:ssl3_get_server_certificate:certificate verify failed'

Server-side error message

SSL error while reading stream; tls_error='SSL routines:ssl3_read_bytes:tlsv1 alert internal error'

Cause: The certificate is generated for a different host. Alternatively, the certificate is generated for the value of CN= field, where the expected value is a DNS name but the destination is configured with an IP address.

Resolution(s):

• Check the certificate, using the following command:

  openssl x509 -text -noout -in CERT
  

• Check the client TLS connection, using the following command:

  openssl s_client -connect IP:PORT -CApath ca-dir()
  

Automatic Retries

To support temporary outages of your SIEM system, if an event cannot be successfully delivered to the SIEM system it will be retried four more times, with a 15-minute delay between each try. After all the retries are exhausted, the event will not be delivered.