Views:

Troubleshooting Guidelines

  • Check firewall.
    • For Syslog Connector SaaS/Cloud, check if connection from our cloud FQDN / public IP is allowed by firewall.
    • For Syslog Connector On-Premises, check if connection from Service Gateway is allowed by firewall.
  • Check DNS if you are connecting Syslog Server with FQDN.
    • For Syslog Connector SaaS/Cloud, check if the FQDN can be resolved on public DNS Server (8.8.8.8).
    • For Syslog Connector On-Premises, check if the FQDN can be resolved by DNS Server configured in Service Gateway (or public DNS Server if no DNS server configured).
  • Check SSL connectivity.
    1. Test if port supports SSL connection. If the target port is NOT listening SSL, you will see some similar error.

      openssl s_client -connect 127.0.0.1:80 -prexit -CAfile selfsigned.crt

      Output:

      CONNECTED(00000003)
4300572204:error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/ssl/ssl_pkt.c:386:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Start Time: 1668760724
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
    2. If the target port is listening to SSL, the connection is successful.

      openssl s_client -connect 127.0.0.1:443 -prexit -CAfile selfsigned.crt

      Output:

      CONNECTED(00000003)
depth=0 C = US, ST = Ohio, L = Columbus, O = Trend Micro, CN = 127.0.0.1, emailAddress = test@example.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Ohio/L=Columbus/O=Trend Micro/CN=127.0.0.1/emailAddress=test@example.com
   i:/C=US/ST=Ohio/L=Columbus/O=Trend Micro/CN=127.0.0.1/emailAddress=test@example.com
---
No client certificate CA names sent
Server Temp Key: ECDH, X25519, 253 bits
---
SSL handshake has read 1521 bytes and written 289 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 32DEC7DB6D7C922F88D1DBE7563579225DCBB7CCF25120B7756FB8BBAB9DB347
    Session-ID-ctx:
    Master-Key: 288BF92C36924536C85739962A03FC42589DA30E8D003A2CBE0A5FEBA0DB3ECCB4D0CA797748C1D1FEA58A138A6AFC08
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 3d f4 2c fe 0a 4d b5 9a-7d 95 62 44 6b 15 6c 8a   =.,..M..}.bDk.l.
    0010 - 59 6d 79 3e fb 0b bc 04-de 37 7c 2e af bc 85 e7   Ymy>.....7|.....
    0020 - a8 17 0e 68 80 50 1a 09-4c 83 9b ad e4 42 3a 00   ...h.P..L....B:.
    0030 - b2 78 69 c4 46 d9 24 1e-9b a4 33 fe 27 e8 9b a7   .xi.F.$...3.'...
    0040 - af 6f 67 d1 1e 24 80 eb-09 c8 0b 35 53 1f 75 f9   .og..$.....5S.u.
    0050 - 6b 19 e7 40 ad 0f 68 4c-2b f8 88 c2 7f 97 46 6a   k..@..hL+.....Fj
    0060 - bb 3e 9a 7a 9b b8 dc 38-2b 1c 7f c6 f9 db 6e a9   .>.z...8+.....n.
    0070 - a9 bb 7b 6b e7 82 ca 35-48 e1 cd e4 77 a8 11 13   ..{k...5H...w...
    0080 - 27 30 01 aa c5 41 70 ad-df 39 8a b8 52 27 b9 16   '0...Ap..9..R'..
    0090 - 17 56 17 7a 92 b5 3b 77-3e ca b7 09 99 06 f0 65   .V.z..;w>......e
    00a0 - ca 8a 06 85 4a 96 69 44-92 f3 08 80 01 b6 d1 1e   ....J.iD........
 
    Start Time: 1668770745
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

Subject Alternative Name (SAN)

  • Checking SAN of current certificate

    Check if your certificate includes any SAN information:

    openssl x509 -noout -text -in server.pem | grep -A 1 'Subject Alternative Name'

    You should see similar outputs like below. If below command has no outputs, then you need to regenerate a certificate with SAN info.

    X509v3 Subject Alternative Name:
    IP Address:127.0.0.1, DNS:example.com

    If there are no outputs, you need to regenerate a certificate with SAN information.

  • Follow the steps on the KB article, Self-Signed SSL Certificate for Syslog server in Trend Vision One.

Test Code

  • Test_ssl.js 
    const tls = require('tls');
 
const options = {
    "host": "127.0.0.1",
    "port": 443,
    "ca": `-----BEGIN CERTIFICATE-----
MIIDKzCCAhOgAwIBAgIUUKboTPOcFhGNFOZyKkT99W1uWT4wDQYJKoZIhvcNAQEL
BQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wHhcNMjIxMTIxMDIwNDQxWhcNMjMx
MTIxMDIwNDQxWjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAK/JEeDQvmzQNZRvki96tSR3qi1vXjAp9pzXDq72
MspQXecX/7nyTo+vEUwHxNB6boswoL6vUpsUqlvzhAXx739U0i7xK8TdIsYDBWW1
iwcZ1BI8PGaFRH9n06tMK5Bk9OBASkhcM/LAuSliAHGs+YhXETNRWqT0rjqPgR9C
x2BUJMYcL7wIsOZV3RizlvV9AVMUIx/lIbh1IfzhGlwwT2yfur/D5IYj+qg50+8N
RKdycSK1bUw7K+UjrmJ0XzHjcmWaRNy1L/PnpQ0Pq2VDHnULDY5XaGYG3PS79BAv
cQcmA2ST4y3WSHRD0XgWbbjRrGargC5olGTtGyQzf9Uv96kCAwEAAaNxMG8wHQYD
VR0OBBYEFDNQkPfb2XHw6442pKxy2UVbsUaQMB8GA1UdIwQYMBaAFDNQkPfb2XHw
6442pKxy2UVbsUaQMA8GA1UdEwEB/wQFMAMBAf8wHAYDVR0RBBUwE4ILZXhhbXBs
ZS5jb22HBH8AAAEwDQYJKoZIhvcNAQELBQADggEBADJkBnAHiYH2JYyMiov0y+bH
Z2Vva5+TOa0RFqxTssKDeDKhakSwxFlIHKoq9FlntOfeWlB0lggnWzRTDdoqAR/v
MaEpEmdaZwncRzX6584QtR/AuF5y03tpPVjPClDW5kFbPg4sW3mAZNiZKqT17iB8
h7L7m8zCOTYhxebce+iMhdyuAWFVCJ3+ZxZkDcHwnrQ3bPbotCuRka0FNSbNhEV3
VYsPjog9AWF/Xe2mSK8rVHGewnJOLNwHbmf3QLlhWPWdTtVkylG6HoyDSsC8unp4
iYwHQu8dcz4FzC2JhGOOI05OQjw5/v58fiDLZmIQYfdtEtnWU+zJDXckbTBLATI=
-----END CERTIFICATE-----
`
};
 
(async() => {
    try {
        const tlsClient = await new Promise((resolve, reject) => {
            let client = tls.connect(options, () => {
                resolve(client);
            });
            client.setTimeout(5000);
            client.on('timeout', () => {
                client.destroy();
                reject("timeout");
            });
            client.on('error', err => {
                client.destroy();
                reject(err);
            });
        });
        tlsClient.destroy();
    } catch (err) {
        console.log(err);
    }
})();
  • Test_ssl.py 
    import socket
import ssl
 
 
ca_cert = '''-----BEGIN CERTIFICATE-----
MIIDcDCCAlgCCQDJZblm7x7j3jANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJV
UzENMAsGA1UECAwET2hpbzERMA8GA1UEBwwIQ29sdW1idXMxFDASBgNVBAoMC1Ry
ZW5kIE1pY3JvMRIwEAYDVQQDDAkxMjcuMC4wLjExHzAdBgkqhkiG9w0BCQEWEHRl
c3RAZXhhbXBsZS5jb20wHhcNMjIxMTE4MDkwNTU3WhcNMjMxMTE4MDkwNTU3WjB6
MQswCQYDVQQGEwJVUzENMAsGA1UECAwET2hpbzERMA8GA1UEBwwIQ29sdW1idXMx
FDASBgNVBAoMC1RyZW5kIE1pY3JvMRIwEAYDVQQDDAkxMjcuMC4wLjExHzAdBgkq
hkiG9w0BCQEWEHRlc3RAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQDC+0Ev8V9xkHogcjWPQI+gMDdRyeS1luUQi0iWx6z/h8mtYyXf
W4ZCiBI4YzMBycjO6lUKLIJQhXg3Opw9Iz04lJgleAe7wD3SAHcnCmhAzBTyXHVP
AJJPqSJ1JPdJqqSvACIdf/xdY67lWn45IFHujR7lMvP14CwqumgSEWpnRbwQFjlY
2Iltdb7ey2Sjcmgwvd5w5sVGcU2yziOW8LFpmBEte7NNsFYHZ6YjRSkCXyZqRGxI
zNqY+wsqakj59SJqOfl/EZAK1bo2WXOUd4hCED973HV2dQnNLIy+EyD95HqVMc9Q
RbOqtDZgyWGwUnkDK7dpDKfgvfwmwHAqPQX3AgMBAAEwDQYJKoZIhvcNAQELBQAD
ggEBAItr9s8x1fQ6tk3SPAhwTzxtbzW5yAtpWWEQIX7fapUqskAo4wwiHv6TEOd6
KqHfP+B58uWxrGhuoIHWL8PCsWNtDUA5VD3wDzF/8BOkFhm5T6PDU8Z/QIoU9F7M
Un49U9SbAGWa5EV3c1l2L+Cn9OSgS0CogQLwDvHbJQk7J2wJue9mOr1wr4I+UgEs
IivPHYj2g7mDNCX7HJyAXiau2GhWxOpxceDLA0IL1E7oLuNyNAB2IyZkoYN3K493
16FDd0eK8Us1UL3TLTF4B88J14Za7/22/+Ca1u2RJgg0xsBtXXxUZAK5B+tc1Iyk
GZmdmodEAugyscFe+saEOhTZDo4=
-----END CERTIFICATE-----
'''
 
unsecured_client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH, cadata=ca_cert)
client_socket = context.wrap_socket(unsecured_client_socket, server_hostname='127.0.0.1')
client_socket.connect(('127.0.0.1', 443))
Keywords: SSL troubleshoot, syslog connector, troubleshooting, ssl certificate, troubleshooting self signed ssl certificate, trend vision