syslog TLS error in vector

[LinTechSo]

Hi . i get Connection error. error=TLS handshake failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:ssl/record/rec_layer_s3.c:1544:SSL alert number 42 error_code="connection_failed" error_type="writer_failed" stage="sending" internal_log_rate_secs=10 in vector by adding self signed certificate with openssl .
i test and verify the openssl command and outputs , but everything seems to be ok.
using vector version 0.23.3

[jszwedko]

Hi @LinTechSo !

Can you share:

• Vector configuration
• The openssl commands you are running to verify the certificate

[LinTechSo]

Hi. thanks for the reply. I share them. I'm using cert-manager on the Kubernetes cluster to provide self-signed certificates. my client uses the certificates (public key) by hand and uploads them to open a connection to my vector Syslog server via tls TCP so the validation of the certificate doesn't important in this case and I don't have an idea why this error.

[LinTechSo]

Hi @jszwedko
Yes. this is my vector configuration

sources:
  input_logs:
    type: syslog
    address: 0.0.0.0:5000
    mode: tcp 
    tls:
      enabled: true
      crt_file: "/opt/tls.crt"
      key_file: "/opt/tls.key"
      verify_certificate: false
sinks:
  console_all:
    type: console
    inputs:
      - input_logs
    target: stdout
    encoding:
      codec: json

and this is my self signed certificate request

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: test-selfsigned
spec:
  selfSigned: {}

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: selfsigned-cert
spec:
  dnsNames:
    - example.com
  secretName: selfsigned-cert-tls
  issuerRef:
    name: test-selfsigned

[jszwedko]

You deployed it with verify_certificate: false? Vector shouldn't be doing any client certificate verification in that case 🤔 Or did you add that once you ran into the issue?

Can you share the public part of the certificate details? openssl x509 -in /opt/tls.crt -noout -text.

[jszwedko]

Also, is the client providing a certificate when connecting? It shouldn't need to, in this case.

[LinTechSo]

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:b5:ba:f6:31:19:41:08:62:56:0e:53:00:5c:d6:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: 
        Validity
            Not Before: Sep  1 09:34:06 2022 GMT
            Not After : Nov 30 09:34:06 2022 GMT
        Subject: 
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:95:01:12:af:c4:6e:47:49:b3:40:ce:49:90:
                    74:bf:08:e7:d8:2f:f2:42:14:11:a3:80:b3:1b:c3:
                    c6:ff:4f:5f:d2:9e:53:75:76:9c:09:b7:ac:ea:9a:
                    00:2e:7d:bc:44:a5:99:4c:40:70:22:d9:c7:0f:05:
                    ce:e9:d2:15:3c:93:93:ae:fc:3c:38:9c:7f:c8:0a:
                    1e:c5:d4:36:d2:de:6b:63:60:9b:87:60:d2:91:a1:
                    80:26:55:4c:e6:bd:e6:3a:8e:ce:db:7b:55:27:bc:
                    d1:6b:3c:a0:2e:62:ad:a5:5c:0d:85:84:82:c7:7e:
                    fc:c9:7e:a5:9d:07:e1:48:fa:6f:b2:05:dd:e5:a8:
                    ab:ff:dc:9c:24:e3:32:9f:34:41:d4:1d:0f:c7:7b:
                    64:a6:ed:e8:b9:7a:07:f3:30:d4:2c:12:23:c4:0f:
                    6b:58:4f:91:35:f3:28:31:63:60:a7:c2:7c:49:79:
                    ba:2c:ee:42:94:9b:01:f4:ca:d3:ce:66:de:e7:db:
                    b0:a3:27:7f:20:dd:0b:d3:08:2e:81:c6:a1:14:26:
                    2b:15:1e:75:97:9c:40:6f:91:dc:dc:8f:a4:0c:b6:
                    62:26:3e:b2:65:bf:d1:e0:c6:0b:3e:00:54:c0:00:
                    19:27:d4:6e:1e:74:5c:c5:51:86:59:9a:eb:8f:50:
                    52:0d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Alternative Name: critical
                DNS:example.com
    Signature Algorithm: sha256WithRSAEncryption
         3d:a1:6b:e6:ca:cb:dd:67:40:00:13:e9:5d:19:30:29:24:45:
         a1:d2:42:ce:9e:6e:88:fd:a0:ac:fa:c7:a5:f6:75:4b:50:ba:
         06:63:aa:62:1f:82:20:37:05:70:7a:d0:40:a7:53:8e:0a:e5:
         2f:e7:da:45:16:84:9d:13:d2:8e:59:2f:d3:bf:67:ba:3e:5d:
         fb:32:ab:50:a0:db:ea:96:70:5b:39:4b:49:42:a7:ec:74:df:
         0a:1f:d8:0f:8d:e1:6b:c5:d5:af:af:51:8d:ff:e9:31:f1:71:
         e9:9c:36:67:d9:75:87:75:1c:f7:17:b2:0f:82:ce:15:b1:8a:
         1b:06:7c:2c:76:64:c6:bd:be:b2:5e:6e:3b:eb:f0:41:c7:e0:
         83:f2:0c:7f:57:d4:18:48:90:07:ac:1e:d6:65:2d:3c:d1:5f:
         de:d0:48:61:7a:9f:fe:1b:80:8c:cc:04:30:fc:74:25:e1:34:
         6e:f3:75:26:46:b3:f3:61:b8:c9:46:38:79:f6:de:47:fe:31:
         0b:1f:81:71:d1:1c:51:be:b6:50:01:21:c0:1d:49:58:e6:4b:
         7f:e2:f9:f5:3f:b1:37:be:6c:47:50:69:49:68:d1:82:d0:41:
         cf:54:9e:21:b0:a9:59:bd:27:03:b3:9b:ae:63:9b:04:ca:d8:
         b4:2d:d0:9d

[LinTechSo]

You deployed it with verify_certificate: false? Vector shouldn't be doing any client certificate verification in that case thinking Or did you add that once you ran into the issue?

Can you share the public part of the certificate details? openssl x509 -in /opt/tls.crt -noout -text.

Yes. i try both verify_certificate: false and verify_certificate: true
Hm, this is interesting. i used verify_certificate: false while I got this error.

[jszwedko]

That is odd that you saw it with verify_certificate: false. The certificate output there looks ok to me.

Unfortunately, I think to debug this we might need a full reproduction case including a dummy certificate and key that triggers the behavior.

[LinTechSo]

and also could you please explain this: Also, is the client providing a certificate when connecting? It shouldn't need to, in this case.
If I understand correctly we provide public and private key for the vector Syslog server and give that public key to the client that can use that to start a tls connection with vector Syslog server

[jszwedko]

and also could you please explain this: Also, is the client providing a certificate when connecting? It shouldn't need to, in this case.

Ah, yes, apologies, I miss read your configuration as configuring client certificate authentication as well, but it doesn't appear to be. The configuration you have looks good.