# Nxlog for Windows in SSL/TLS not working

**URL:** <https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, nxlog, nodatanx\
**Created:** [June 15, 2018, 8:45am UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618 "2018-06-15T08:45:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\
**Post date:** [June 15, 2018, 8:45am UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618/1 "2018-06-15T08:45:16Z")

</div>

Heelo,

I tried to send the log of Windows in SSL/TLS, but it doesn’t works.

It’s my configuration of the nxlog.conf on Windows :

```plaintext
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

<Extension _syslog>
    Module xm_syslog
</Extension>

<Extension _charconv>
    Module xm_charconv
    #AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>

<Extension _exec>
    Module xm_exec
</Extension>

<Input in>
    Module im_msvistalog
# For windows 2003 and earlier use the following:
# Module im_mseventlog
<QueryXML> 
<QueryList>
  <Query Id="0">
    <Select Path="Security">*[System[(EventID=4624 or EventID=4634)]]</Select>
    <Select Path="System">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
</Query>
</QueryList>
</QueryXML> 
</Input>

<Extension gelf>
    Module xm_gelf
</Extension>

<Output out>
    Module om_ssl
    Host IP_address
    Port 12201
    Exec to_syslog_snare();
    CertFile %CERTDIR%\cert.pem
    CertKeyFile %CERTDIR%\pkcs8-encrypted.pem
    AllowUntrusted TRUE
    KeyPass password
    OutputType GELF_TCP
</Output>

<Route 1>
    Path in => out
</Route>

```

and on my graylog input, I have this :

> Port 12201  
> TLS cert file /etc/graylog/server/certificats/cert.pem  
> TLS private key file /etc/graylog/server/certificats/pkcs8-encrypted.pem  
> Enable TLS  
> TLS key password password

And I have this error message :

ERROR SSL certificate verification failed: unable to get local issuer certificate (err: 20)  
Thanks

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 15, 2018, 9:24am UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618/2 "2018-06-15T09:24:09Z")

</div>

You have to add your self-signed certificates to the local machine’s/runtime environment’s trust store.

The Graylog documentation includes a section about adding self-signed certificates to the JVM trust store:  
[http://docs.graylog.org/en/2.4/pages/configuration/https.html#adding-a-self-signed-certificate-to-the-jvm-trust-store](http://docs.graylog.org/en/2.4/pages/configuration/https.html#adding-a-self-signed-certificate-to-the-jvm-trust-store)

---

<div class="post-metadata">

**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\
**Post date:** [June 15, 2018, 9:30am UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618/3 "2018-06-15T09:30:27Z")

</div>

Yes, I’ve add the certificat, in the JVM trust store. The certificate is already present in the JVM trust store

---

<div class="post-metadata">

**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\
**Post date:** [June 15, 2018, 10:11am UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618/4 "2018-06-15T10:11:26Z")

</div>

I already have the certificate present in the JVM trust store.

I try to import the jvm store in windows, but it’s not works

---

<div class="post-metadata">

**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\
**Post date:** [June 15, 2018, 11:55am UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618/5 "2018-06-15T11:55:25Z")

</div>

Do you have an idea for solve the problem ?

Thanks

---

<div class="post-metadata">

**Author:** ![ale1](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@ale1](https://community.graylog.org/u/ale1)\
**Post date:** [June 15, 2018, 1:16pm UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618/6 "2018-06-15T13:16:08Z")

</div>

I found a solve of problem put I’m not sure about the configuration. In fact, I change the nxlog configuration file :

> Module om\_ssl Host IP\_address Port 12201 CertFile %CERTDIR%\cert.pem #CertKeyFile %CERTDIR%\pkcs8-encrypted.pem AllowUntrusted TRUE #KeyPass password OutputType GELF\_TCP

And in graylogs, I configured my input with that :

> Port 12201  
> TLS cert file /etc/graylog/server/certificats/cert.pem  
> Enable TLS

And now, I see that the traffic between windows server and Graylog is encrypted. It’s the good method ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 29, 2018, 1:16pm UTC](https://community.graylog.org/t/nxlog-for-windows-in-ssl-tls-not-working/5618/7 "2018-06-29T13:16:12Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.