# TLS for an Input
**URL:** https://community.graylog.org/t/tls-for-an-input/32307
**Category:** Graylog Central (peer support)
**Created:** [May 6, 2024, 9:04am UTC](https://community.graylog.org/t/tls-for-an-input/32307 "2024-05-06T09:04:28Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@yardtheyard](https://community.graylog.org/u/yardtheyard)
#### Post date: [May 6, 2024, 9:04am UTC](https://community.graylog.org/t/tls-for-an-input/32307/1 "2024-05-06T09:04:28Z")
Hello,
I have a very simple GrayLog config. I use Syslog TCP and get the logs from 3 other Debian VMs. All I did is created the input and edited the rsyslog.conf on the VMs. Now I want to use TLS.
NOTE: I just need this for some kind of university project and not practical use or personal interest. It really just have to work and not be pretty.
There is not a single good guide on how to implement tls. I dont use beats, apis, sidecars or whatever these things are. I just created an input and already get log input. I create the cert file and key, but when I update the input, GrayLog stop getting in logs.
I also edited this to the bottum of my server.conf:
syslog\_tcp\_tls\_enable = true
syslog\_tcp\_tls\_client\_auth\_enabled = false
syslog\_tcp\_tls\_key\_file = /etc/graylog/server/ssl/private.key
syslog\_tcp\_tls\_cert\_file = /etc/graylog/server/ssl/graylog.p12
syslog\_tcp\_tls\_key\_password = \*\*\*\*
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [May 11, 2024, 12:43am UTC](https://community.graylog.org/t/tls-for-an-input/32307/2 "2024-05-11T00:43:38Z")
Hey @yardtheyard
Those keys also have to be on your remote device that matches you Input certificates. As for Rsyslog I’m not sure what configuration you need. Haven’t used Rsyslog in a while.
---
### Author:  [@accidentaladmin](https://community.graylog.org/u/accidentaladmin)
#### Post date: [May 11, 2024, 2:02pm UTC](https://community.graylog.org/t/tls-for-an-input/32307/3 "2024-05-11T14:02:51Z")
I’m going to give you an answer-non-answer.
I don’t know if Syslog supports TLS … maybe it does? But I think the far easier approach to this is to use Sidecars even for Linux.
For instance:
Set up a Beats Input similar to this:
Note that the TLS cert file and key file are for the Graylog Server NOT the endpoint.
Also note that - at least for my set up - the Graylog Server Cert and the Endpoint certs MUST be signed by the same Root CA/Intermediate CA.
Now, install Graylog Sidecar and Filebeat on the endpoint and make sure the following certs are on the endpoint:
Endpoint.pem
Endpoint.key
RootCA.crt
Here is my sidecar config in relevant part:
```auto
# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}
filebeat.inputs:
- input_type: log
paths:
- /var/log/*.log
- /var/log/syslog
- /var/log/**/*log
type: log
output.logstash:
hosts: ["graylogsvr-0..local:6160"]
ssl_certificate_authorities: '/etc/certs/_ca.crt'
ssl.certificate: '/etc/certs/pve..local.pem'
ssl.key: '/etc/certs/pve..local.key'
path:
data: ${sidecar.spoolDir!"/var/lib/graylog-sidecar/collectors/filebeat"}/data
logs: ${sidecar.spoolDir!"/var/lib/graylog-sidecar/collectors/filebeat"}/log
```
Note that it doesn’t matter where you put the certs and keys on the endpoint just so long as you:
a) know the absolute path
b) have, at minimum, read permissions.
Additional steps I took that may or may not be necessary:
1. the RootCA (\*\_ca.crt, above) must be trusted by both the Graylog Server and the endpoint. Different flavors of Linux have different methods of doing this so I’ll leave that to your personal google-foo.
2. The RootCA MUST be trusted by the Java Key Store (or whatever its called) on the Graylog Server. I forget the process for this but I believe its covered in the Graylog docs.
Hope that helps!
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [May 25, 2024, 2:03pm UTC](https://community.graylog.org/t/tls-for-an-input/32307/4 "2024-05-25T14:03:51Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.