Syslog configuration certificate issues

[yato231]

Hello everyone,

I am trying to configure a nexus (nx os 9.3) to send its logs to syslog server over tls.

logging server 10.10.10.1 5 port 6514 secure use-vrf management

 When I try to configure the trustpoint I get the error "certificate is missing basic constraints extension , could not perform CA authentication".

crypto ca authenticate my-ca

I am pasting the root, intermediate and server certificates (pem) after this command. I have checked use openssl that the root and intermediate certs do have the basic constraints extension, and CA=true.

Also if I only paste the root and intermediate certificate then I don't have this error. This leads me to think that in the trustpoint I can only have CA certs, not the server certs. Is this true? and in that case where should I import the server cert? should it work without the server cert? Previous I worked on firewalls and there we had to import the whole chain from the server, intermediate and root.

Thanks in advance.

[balaji.bandi]

Syslog server and nexus device should trust same CA for them to communicate.

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.17/administration-guide/55

[yato231]

Thanks for the link. So if I understand correctly, we don't need to add the certificate of the syslog server. It should work if the CA certificate installed on the nexus device refers to the CA originally used to create the syslog server certificate.

[balaji.bandi · Accepted solution]

yes if the router acting as CA and syslog trust that certs

[MHM Cisco World]

Show crypto ca trustpoint 

Share this 

MHM

[yato231]

#show crypto ca trustpoint
trustpoint: root-ca key-pair:
revokation methods: none