feat: S03.09 mutual TLS — client cert + key for SL4 non-repudiation

.devcontainer/docker-compose.yml

@@ -30,6 +30,7 @@ services:
       - "5514:5514/udp"
       - "5514:5514/tcp"
       - "6514:6514/tcp"
+      - "6515:6515/tcp"
     working_dir: /workspaces/SolidSyslog
     entrypoint: ["bash", "-c"]
     command:

Bdd/features/environment.py

@@ -15,6 +15,7 @@
 RECEIVED_UDP_LOG = "Bdd/output/received_udp.log"
 RECEIVED_TCP_LOG = "Bdd/output/received_tcp.log"
 RECEIVED_TLS_LOG = "Bdd/output/received_tls.log"
+RECEIVED_MTLS_LOG = "Bdd/output/received_mtls.log"
 
 
 def wait_for_tcp_port_open(host="syslog-ng", port=5514, timeout=5):

Bdd/features/mtls_transport.feature

@@ -0,0 +1,12 @@
+@mtls @buffered
+Feature: Mutual TLS message delivery
+  The threaded example authenticates itself to syslog-ng with a client
+  certificate over RFC 5425 TLS, exercising mTLS end-to-end. Satisfies
+  IEC 62443 SL4 CR 2.12 (non-repudiation) — the SIEM cryptographically
+  identifies the sender.
+
+  Scenario: Message delivered over mutual TLS
+    Given syslog-ng is running
+    When the threaded example sends a syslog message with transport mtls
+    Then syslog-ng receives 1 message over mtls
+    And syslog-ng receives a message with priority "134"

Bdd/features/steps/syslog_steps.py

@@ -11,6 +11,7 @@
 
 from behave import given, when, then
 from environment import (
+    RECEIVED_MTLS_LOG,
     RECEIVED_TCP_LOG,
     RECEIVED_TLS_LOG,
     RECEIVED_UDP_LOG,
@@ -22,6 +23,7 @@
     "udp": RECEIVED_UDP_LOG,
     "tcp": RECEIVED_TCP_LOG,
     "tls": RECEIVED_TLS_LOG,
+    "mtls": RECEIVED_MTLS_LOG,
 }
 
 # POSIX-only paths used by the @buffered/threaded scenarios. The cross-platform

Bdd/syslog-ng/syslog-ng-full.conf

@@ -30,6 +30,20 @@ source s_tls {
     );
 };
 
+source s_mtls {
+    syslog(
+        transport("tls")
+        port(6515)
+        keep-hostname(yes)
+        tls(
+            key-file("/etc/syslog-ng/tls/server.key")
+            cert-file("/etc/syslog-ng/tls/server.pem")
+            ca-file("/etc/syslog-ng/tls/ca.pem")
+            peer-verify(required-trusted)
+        )
+    );
+};
+
 destination d_file {
     file(
         "/var/log/syslog-ng/received.log"
@@ -70,10 +84,21 @@ destination d_file_tls {
     );
 };
 
+destination d_file_mtls {
+    file(
+        "/var/log/syslog-ng/received_mtls.log"
+        template("PRIORITY=${PRI} TIMESTAMP=${ISODATE} HOSTNAME=${HOST} APP_NAME=${PROGRAM} PROCID=${PID} MSGID=${MSGID} STRUCTURED_DATA=${SDATA} MSG=${MSG}\n")
+        flush_lines(1)
+        create-dirs(yes)
+        perm(0644)
+    );
+};
+
 log {
     source(s_udp);
     source(s_tcp);
     source(s_tls);
+    source(s_mtls);
     destination(d_file);
 };
 
@@ -91,3 +116,8 @@ log {
     source(s_tls);
     destination(d_file_tls);
 };
+
+log {
+    source(s_mtls);
+    destination(d_file_mtls);
+};

Bdd/syslog-ng/syslog-ng.conf

@@ -30,6 +30,20 @@ source s_tls {
     );
 };
 
+source s_mtls {
+    syslog(
+        transport("tls")
+        port(6515)
+        keep-hostname(yes)
+        tls(
+            key-file("/etc/syslog-ng/tls/server.key")
+            cert-file("/etc/syslog-ng/tls/server.pem")
+            ca-file("/etc/syslog-ng/tls/ca.pem")
+            peer-verify(required-trusted)
+        )
+    );
+};
+
 destination d_file {
     file(
         "/var/log/syslog-ng/received.log"
@@ -70,10 +84,21 @@ destination d_file_tls {
     );
 };
 
+destination d_file_mtls {
+    file(
+        "/var/log/syslog-ng/received_mtls.log"
+        template("PRIORITY=${PRI} TIMESTAMP=${ISODATE} HOSTNAME=${HOST} APP_NAME=${PROGRAM} PROCID=${PID} MSGID=${MSGID} STRUCTURED_DATA=${SDATA} MSG=${MSG}\n")
+        flush_lines(1)
+        create-dirs(yes)
+        perm(0644)
+    );
+};
+
 log {
     source(s_udp);
     source(s_tcp);
     source(s_tls);
+    source(s_mtls);
     destination(d_file);
 };
 
@@ -91,3 +116,8 @@ log {
     source(s_tls);
     destination(d_file_tls);
 };
+
+log {
+    source(s_mtls);
+    destination(d_file_mtls);
+};

Bdd/syslog-ng/tls/ca.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAx7LsZX3e+F+FyFqO2epTfguBgXfS1uPwiQOesW5WSBDLuhsk
-FC2THwM/c7vxRQvIZ9hnOpJgi3e8of4lX+rSNg0viYxkrsk/S3SyKp/Qhzu7Eee8
-Cc+NfD+no8uF43gw3XfzX17NWVMTGBJOj3eC4xl/c9u0fApoljYv92Ifsc7TCaud
-OHkUBlEBrR9b6bpy+GPDCe26rtG76NwKf+6B0t8IawNjbLDCovFCC9k8ymlTIktt
-v9P32J1FgZ18M0FBowA1CrLyCoGNa9loyfUz4Qhje3CG/fUeMLoAOvIWsixBVH3X
-MHlGyyJSpK1soBMgs9o+YBnwZatNvl+PQcm3XwIDAQABAoIBAG5Bw3Nlw62uT9cG
-6Mg4MFDvWVl6JtaukyeS8BNWsByp6VGfmpPpdckxqd7kbZmJn+R1/si/+L4IJgXq
-pAgJRnbBYPW4pf467s9iZtxR0HhZ6jdAkvl3ts5a9tvgitPEkHY2vBBz7zzaOTiZ
-IvbjLUjl0xDMxSGXPZdx45nae1VXuLIpvFVGcSs9830TqjK/hGu/rIoO2JC/MfUe
-3roal/xYOatCjGtEM86zO3xdxmMnCP8Ei8xsRBY+ygDAzi+9D6L7l3rjp4gPkixC
-EL6zueOJpYulYWoIQTV9pKfB00MlZdUs5oMkuZcmP5/Mxx5nzILpHBV2Yj9xY26n
-n7lFO4ECgYEA/VqXPAWzREnlHnKxe+gLRNPcRFASvrNFT65JhMRzeUAwvEBCBV15
-1a2ECeBwU2wvGP23usIkYzJD8C4PZ9dne0PTR9lnEFipZ7DyBj9ODBcuP3QRax3c
-XPWgTHbU9A++65XBaLb31khKE/4Wzc20+3qjqnQPLekDnoePcQe/cJcCgYEAycjf
-L8s7fjh+dhUxUY598cjPF2tiaJmiBlGovSLvca+aDIY/P0jimUixAqESS3LZEqZv
-Dy9SwPMT4kM8BIHOWJ/1jgC2NxPEms69hb27EwWKKGf3YfMosWYfzL6w5T7On2tm
-8KdFlImjRrOhuLjK2kQ12WE+Cn87nY4C5j5OgHkCgYEAuS8hQgcsnGqi5VmSL25R
-5lIxO2GIAgoJTI+pPzlU6jioJsGVQFSt/CijTZDWqbN2zX6OcBz9+d/A1urj6dQB
-2JCf+3GGKuWTla45iaV2B9JdxJWzMaeW7f+/1oQ5bdeghpRk1YR/rQoT038y7eVB
-N1vSC4JfogAi3BpcF5NBNCsCgYAfSpIpxDdmnHYn86NhRVqMixpqRFHPbLuuhS1I
-n0lIdPXLqWnXc4MISDiC8t12a8nz1XF1hl4r48YamViOTl7kaXHX4o5fPiaH5zWG
-ruR6z6ocF/tJ6j5OPEsEIjImarX6DNq6yQXGQg3a4fJbRfTXIirDmgvX7uEczq/u
-ao0b6QKBgHRDraREe/cLd05y2X30b7HeBK1SCweHYsOU3TdtHP6Nyn12kgy/Il9w
-e50GEcRci16Km0wfclFtj8QsOqOYcr2P180INoXqeZgnHi2MmoeXTV7LJUEpYSOC
-mPWTDihHP0q0x/RAzd8ynm51qK4Pghs8C5SWOY9Azl9dSKHDBOSe
+MIIEpQIBAAKCAQEAxIv9cfRa/XlJjFyndXLOCm7A0rSeILqYZodGG6rDi/qQLIPc
+UWvyBipzwUhRo0Z8zJfkbqQ1o5QRozZ1RtnLovcGDfbV9uhSCuDLPqGKSk/b5Bk8
+kfbS/oBNwnr1w5Do5kS5ow2M00EHY7GUmw6zuhP4Hexj2eP9FZ+Basvtbr3jWCqA
++LRmk/I3yj6I0EbdbQ5ePSHF9bwG93643g/Tu9SOhqZNlv6WxcvB1GVMK6KNL05M
+1BcT8CCuX5Qo9v4Az2P2endugjTLI21lume8IXA3az3ID4oJWoCsgDKscWO7fHGU
+544DAmVaOifQ+WOJmhfpRugdS0kswY4TCXl8XQIDAQABAoIBAQCchyR7+W/xiANj
+7nJK3fhrZJLZ+5AnXpN6q+bQp+l99DmXyhfPHFmuQWbYmmCx2LQRODJrTwmM0aJO
+SlOR7mf3zCUdP+Rc895K3YXfxkTdM8ZaXSLY2CpnFwVWihhp/GEO6dKxoVvy7koV
+QlqoNkg6PCcQpa9L2v82lkY6KFhaJScjFZhGVbYRwHJTyGf10kgzrQ8pj/20FfIS
+Ps8ZPA/B9VhiGOAuc2I0Sz2IrQsDtDNVMWbKyLAiUCAwZK5v4PRLUwi3ysetgJKO
+QnTrcSfGTdu3MeNwZ8nylWIwVIyJe9BKrc0VKn6YJpdIUlSYPogNbzZP1LHVRHfo
+L3Jyx4AhAoGBAPaXm7752Y/fZk7V81RHjCaXEJzuPbc/m3r1cyA4SBbCLh8l4VyM
+2zWG4slEw5Xw4siuTkq09T4Kpi5O7DnqY+ce+1TZ+m/IfBMqQRIJs7YMCyv823I9
+3d6CpRgjDYl7d5Ntz//O0Afjn0QO+r3WwCBHiH9vkMNF5J9XRiwj3wjpAoGBAMwL
+mn+QdL8nmjyZ0J01NoDVXfXHBm81osuGcC3GbSAoEcCDIa54FUKrnBF7rkUTSI80
+pGyxmqDTX5RxOAZpzWtPSSWS3/LR6UHJTnMA4f7+aEljp3niFAV53nM0Eqze6rry
+I2kf58HE72r26qN/Ykm4d6pQxWdm2KFYaSJeCu9VAoGBALjWA2QvG6kAJ0vIi1AN
+ITx713QKEDCfeQe9m8H27fJBMxkd58LbwiRpKuz6ojBuE0+heAX/hiQvD0l+1wrC
+aof/bRy5F0Na38Xt0kCXDSHT/TvHmSYUwY3cF6vz+l2nMoZLtbFlcAG52NPG9qP9
+qJ2JgQMkuTnl1eyqGmtTqAahAoGAStmi1lK+kPTNHpfqMBE6Ki6bJjLZSGhrjK+H
+bTNSCq7IPE+eRmskmW1sdflh51L4lhfgjULlj0Oa11BlFe0v/sJ5+b+USXX5VDmt
+foB/ZtQam3lkEVD+uTeIg8hBZYrsnqF+neynTqyYiyuCzXFIM/ToaODyWUkgBKfz
+ATlwV3UCgYEApE15bqeauZPWgZ/eR9BlbhbQRB6jsqrbEUmVLLKr1/ae5w30RSw9
+6cGn7mRPOnu8G2FgCblfp/Ok/tPdRe3dDVb8oQP6N+duAZVX+iTdChNo2G2uEwFz
+ORwVoQWnt3W7sD67ufgL3ualO4za4+UB62sn9WMj4auTGkEPFVF2isY=
 -----END RSA PRIVATE KEY-----

Bdd/syslog-ng/tls/ca.pem

@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDJTCCAg2gAwIBAgIUa9bOdOquPzUXvg4/X1St4bHQuRAwDQYJKoZIhvcNAQEL
-BQAwIjEgMB4GA1UEAwwXU29saWRTeXNsb2cgQkREIFRlc3QgQ0EwHhcNMjYwNDIw
-MTcwODQxWhcNMzYwNDE3MTcwODQxWjAiMSAwHgYDVQQDDBdTb2xpZFN5c2xvZyBC
-REQgVGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMey7GV9
-3vhfhchajtnqU34LgYF30tbj8IkDnrFuVkgQy7obJBQtkx8DP3O78UULyGfYZzqS
-YIt3vKH+JV/q0jYNL4mMZK7JP0t0siqf0Ic7uxHnvAnPjXw/p6PLheN4MN13819e
-zVlTExgSTo93guMZf3PbtHwKaJY2L/diH7HO0wmrnTh5FAZRAa0fW+m6cvhjwwnt
-uq7Ru+jcCn/ugdLfCGsDY2ywwqLxQgvZPMppUyJLbb/T99idRYGdfDNBQaMANQqy
-8gqBjWvZaMn1M+EIY3twhv31HjC6ADryFrIsQVR91zB5RssiUqStbKATILPaPmAZ
-8GWrTb5fj0HJt18CAwEAAaNTMFEwHQYDVR0OBBYEFKvZn0img6757QgOS6J9X79x
-79NZMB8GA1UdIwQYMBaAFKvZn0img6757QgOS6J9X79x79NZMA8GA1UdEwEB/wQF
-MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKfFmKPcsrVxmJZNuWwXPM4M5okzcpNP
-2PQt+lGC7x60FLlfySAKtnyyYSddHRPgNQELmcKYulpDJj5eYrhWUwdqukra1B2s
-bv4bz8UUIYPrc4hvLdLKs5+iLmM9rzioKI9Dq5+r5dlxR5hK2CfOnzyjPb6/rzIy
-nxSRsVrAkGUqfi1BH4poWAtwY00A3zxehcYZNtwgNKqVrj9rE0gLl0DSR3W6dABa
-q0whWUJQsB9cRSLwxrxiLAU95NzdOmgdcrswYptSZHtSXYdS8mBf31cQNHvjAvn8
-yR1xGaLsJ0E6F+z70kx22KzTkvwavcx4mukm6PVJisqVDulz579+7C4=
+MIIDJTCCAg2gAwIBAgIUGF5u3LvQOikVnFUj+PZySvzcMIMwDQYJKoZIhvcNAQEL
+BQAwIjEgMB4GA1UEAwwXU29saWRTeXNsb2cgQkREIFRlc3QgQ0EwHhcNMjYwNDIy
+MDg1NDI0WhcNMzYwNDE5MDg1NDI0WjAiMSAwHgYDVQQDDBdTb2xpZFN5c2xvZyBC
+REQgVGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMSL/XH0
+Wv15SYxcp3VyzgpuwNK0niC6mGaHRhuqw4v6kCyD3FFr8gYqc8FIUaNGfMyX5G6k
+NaOUEaM2dUbZy6L3Bg321fboUgrgyz6hikpP2+QZPJH20v6ATcJ69cOQ6OZEuaMN
+jNNBB2OxlJsOs7oT+B3sY9nj/RWfgWrL7W6941gqgPi0ZpPyN8o+iNBG3W0OXj0h
+xfW8Bvd+uN4P07vUjoamTZb+lsXLwdRlTCuijS9OTNQXE/Agrl+UKPb+AM9j9np3
+boI0yyNtZbpnvCFwN2s9yA+KCVqArIAyrHFju3xxlOeOAwJlWjon0PljiZoX6Ubo
+HUtJLMGOEwl5fF0CAwEAAaNTMFEwHQYDVR0OBBYEFA5hOfpjwqPMWS2fRDWQYWXj
+3kIeMB8GA1UdIwQYMBaAFA5hOfpjwqPMWS2fRDWQYWXj3kIeMA8GA1UdEwEB/wQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggEBALF+Cy+FrhOjzknfO6Wred5kFbOZATMo
+BhTOkDVNSOYyitklI+HYvBgh5DJ5yuvi7j3wegPh2xUWtQhcT+C2gV8Eb1Jh7GWe
+qNqgu06SMkL7jgNMBwAKKS39uByUp0utFbkJ3rpWFUeXTH9Y/0qmirjj5zbQtaRl
+BIXmh/DVo/ZAFDs6gEYiJkgq7IXEMe8K54YgZN6m970RAv+Cjy62PBOgC6CUlC0s
+jMm9P+efzQEyLx4v8w87zI9O36KMs7cKn+mUsd8ij3Tmcogs41dE/3otxZBVDegh
+p1QLnCv99oV4fGncCH5ZJr6hEPIW37zdfCemcv6HliKAIYzAbwfOMzw=
 -----END CERTIFICATE-----

Bdd/syslog-ng/tls/client.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAv0Egvga3DayfH/iq3EHFgOEqe0y0oPDfH52j2LkH/RrK36g7
+MLvtJPXypZeoNZfygvvFOTjDcQP6DCxHrvWrnDjAr7EUyKWoD0CKTe+wTSMbuN7W
+MAKHeMFo/J9tOhU2zlWMv6FlDci3sFWKOSVx/FTeCTxYDSc3IexGtC/TjHZG9Vny
+ufI5ARQxnAxeRO8GN+NX5Io5ykVxryu+Jhx5cfZN4O6LoyEredeszFU4gItGbd6I
+qCqAUJ3avqfx/UJyrrbusP8Rq7gL/zFJvYhUtZ51/kaDyqZbB4xLy3BXXe08tXt5
+YZhVvDs71FU4YHKVhyK/sEVcMXdE+iPNjO7u8wIDAQABAoIBAAbAu/E5t3jqIWw1
+kYLZZ6nXSXK1EKOmHZq2LDTYw6lyKrue6wgbepIVhQ3Hvw61YMCzNxGAKZZx94A6
+iAVrczW+4z7Q19UF1FtFghyiW+09UhtC8vka/cGLwrM4xdiJKzg52RBjGHhWH/Y/
+7vN5mP652GUnFkzQl6fA+fYewi9xZgm5n/yTdj3EKW6ZA2MtGm0FF80y7P7DMAEu
+7SGUF57YsVx6SdRBRrZ8t35sNiv94jk+OoOdiaSa95DZmy7blxQaMwoGAduYOfQg
+b87l0rzkzp2gQ2w7HYgtd3C75QbHiAeHz9YxTDr09nMihgsQ5ROpXIChAkuuCt7F
+nc7fuPECgYEA5I4FFfXyiZ6dKeRiXyYWHdcf7b/4T9bvgypxoD7MTWGBx4LLjNgz
+C2xDf6K9xF1cUaRGNg3YYGnmFrwr3XZMUlElCI67Wb2VpOrBLD58abLjrP89mdYg
+yf83W3U6Uxy5BZakkMIBG9EVqUWMcJN0ZFQvlJ4DSVQpOzFNS7PTwXcCgYEA1jh2
+FWLtAjjSuKSWFasSs3uW2aBlazOz4hY236xSeS5Kdk6v57iqFzqO3kRlmp1QV8nE
+KM00jrzU9As0m+NdBS8vT6avQ8/P7AToC95zgkZDzO5XydFIFPucAZKwZqREf8xT
+jJP1qIV0oO3RuMzjn/1bJKfim4cyUdNnl0GX/WUCgYEAjizKfR7CAVnp6mVnzEik
++WsZMYx5qzDJTY7ZoBVwgbJmSPXUKYlUN4bhdkSGR+DLzP2jr3xtXYyC1SG5J8qv
+L4XKw8gGQ4zryes+v4cfXaEqgDNG3quVOhLJHNuPrKPxdMiBFouYpPUrxGC/PEh9
+3ut/rbOd17/C5k+FBdKXp4ECgYEAnG4UhJ99tT6rWdwOIPqQqHIagQboqHTT6cgR
+ABrFCuqrw2LIfyzRQC8pvtMxYst3rPOQg779nzHzS9aW7zMDbVK8eKyelaU+Dvqy
+PGCP9tS6k/6EKsLhoTju/hMRL5LK1ovtgt1U6V+zAAVKPWmY2u7WzJiwGKSMMUZw
+AfsLMyUCgYEA3jYAlCzjLtuEaFcVRMqXqQOnxYqxhplaT+6LiILCTfuyfNzTv/M6
+C/71yIcOSBCnsfEpK8cUjiR+pasvgRFbL98pleXTgO6j3ix07Z/aWMZ8IYpwkCzl
+lMHe7dR3v7/x0ZET+nx6SWfPcMpPpcuwsIEhGPVhGUgr2nIf8ZfW80Q=
+-----END RSA PRIVATE KEY-----

Bdd/syslog-ng/tls/client.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICyjCCAbICFFdm9qHZK72SJnezGDSejHjVopqlMA0GCSqGSIb3DQEBCwUAMCIx
+IDAeBgNVBAMMF1NvbGlkU3lzbG9nIEJERCBUZXN0IENBMB4XDTI2MDQyMjA4NTQy
+NFoXDTM2MDQxOTA4NTQyNFowITEfMB0GA1UEAwwWc29saWRzeXNsb2ctYmRkLWNs
+aWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9BIL4Gtw2snx/4
+qtxBxYDhKntMtKDw3x+do9i5B/0ayt+oOzC77ST18qWXqDWX8oL7xTk4w3ED+gws
+R671q5w4wK+xFMilqA9Aik3vsE0jG7je1jACh3jBaPyfbToVNs5VjL+hZQ3It7BV
+ijklcfxU3gk8WA0nNyHsRrQv04x2RvVZ8rnyOQEUMZwMXkTvBjfjV+SKOcpFca8r
+viYceXH2TeDui6MhK3nXrMxVOICLRm3eiKgqgFCd2r6n8f1Ccq627rD/Eau4C/8x
+Sb2IVLWedf5Gg8qmWweMS8twV13tPLV7eWGYVbw7O9RVOGBylYciv7BFXDF3RPoj
+zYzu7vMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAgTWldCzQG+H2nKiZBehiafMY
+rXvOiXvxoKdqMja7PDLSHEklRNZk6UO0HWJPjt7U6rt5sLrBNU6ZBPvRVnBGxb97
+V70a8uQaG+TmHWMlJMt/7IKM7h1pOrAb+gGoHFmgKX2oN+NHGmNJ4/jhF8EU21Ou
+HbrEcsF4mNjoirP7nDgCTSyimaRhsuAUX8vUw286zeZHzt2c57ip4FJnGBlhJTm2
+PCv42hwEpVls6GGz55JHotnNtYaHNyCVPJd6TngZgAOsAYaSzuWB84FnQL+HoDcc
+qR1mHXu1S5W/tsBuZleHORjST8E0EEWA5SHxfZRqLklRqI6AHHbXdDwwysehpg==
+-----END CERTIFICATE-----

Bdd/syslog-ng/tls/generate.sh

@@ -17,6 +17,7 @@ cd "$(dirname "$0")"
 DAYS=3650
 SUBJECT_CA="/CN=SolidSyslog BDD Test CA"
 SUBJECT_SRV="/CN=syslog-ng"
+SUBJECT_CLIENT="/CN=solidsyslog-bdd-client"
 SAN="subjectAltName = DNS:syslog-ng, DNS:localhost, IP:127.0.0.1"
 
 # 1. CA key + self-signed CA cert
@@ -33,10 +34,18 @@ openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial \
     -out server.pem -days "$DAYS" -sha256 \
     -extfile <(printf "%s\n" "$SAN")
 
-# Remove the CSR and CA serial — only the keys + certs need to be committed
-rm -f server.csr ca.srl
+# 4. Client key + CSR (mTLS identity for SolidSyslog under test)
+openssl genrsa -out client.key 2048
+openssl req -new -key client.key -subj "$SUBJECT_CLIENT" -out client.csr
 
-chmod 0644 ca.pem server.pem
-chmod 0600 ca.key server.key
+# 5. Sign client cert with the same CA — no SAN needed for client auth
+openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial \
+    -out client.pem -days "$DAYS" -sha256
+
+# Remove the CSRs and CA serial — only the keys + certs need to be committed
+rm -f server.csr client.csr ca.srl
+
+chmod 0644 ca.pem server.pem client.pem
+chmod 0600 ca.key server.key client.key
 
 echo "Regenerated test certs in $(pwd)"

Bdd/syslog-ng/tls/server.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEAshK+rIthQABR1DRYVf9E4yV9nGC3S4VPd2jK64/O0dnqAf1m
-MozRGecilyA9kWO/lOUlK7FniaLMcBzn4CuaCGjDhN6uCVxgfaGPe0NIB6weBbr6
-RcBaqHu2A3ZKqxdF5vNU//Ty8UFVLksHIEd9xY+hN534YcvGEpm4e9C7TKUzf++4
-an0Ow+7utfh/vXIlz1wir3nwHe9b02gUhnl+q2olM1/jLuH4Sjh3Gwga0Mgtxm2R
-ChUIDxBpzTKKA2h0OS+Puz/EiAraHkE6hE1yOtTkMm17LD0t3cMr47m+cLzOZgsK
-nfS7H2UeOJVDFAcxoF9K7IM24KC5rSAD+b0iqQIDAQABAoIBAQCkzBov/rGalHEm
-TOcvdxVejbSowwz+1DnNzWp2BFmn9d7NxqAMyis9qJ1ndQvlgIWtmz8CJ6UlSEeg
-ve+Nk2xyudmwHpC70wTtX1Y1AfgoOY5zSS4S3UhJQmwY2iGSIvCrIqiYVC19PjRB
-qmfG5MKt0hWmLgjPINGHJ0IHPA4KiBFnCKtNHn5QakpaplxFblLtAJMv6Mzfsnnm
-amzflHA+QvFy0mWYK5GAe6LYSYUm2TikqzJbq4hjeiCDQh1hzZuhdQpQL0mLWYpS
-ewj0mIClfWiLdR9Sf3O9RHBP5NczOkJg+QCHwFfOamRWulM9D8GhzJGAxdMRCJI8
-5YpBXx0dAoGBANXiP4KUi2YstRh6gZ5tIDjP2HMqMLDp8UeeOH+NwBA2DQP5sXiX
-t9QpO17dhgugz1R2go53BvajJru7yUZPen3rxRrVy2t82DZ0pGrwuKfmURzMm7bp
-9HwwvNMDnpCYGGnSK+Lb1FZXTSfEDNb0i+tEVCv/HANurE92p6Awn6L3AoGBANUj
-TuAoPCR2A3kXMQEDa/RR51buVLqDgyBujffBvfG/+JpAVplyvOGNiC8DHoRF1JOt
-Pfva+Y3rl4q3cvprom+ug55Ch9QKm0WXiHXO/xiebi9Nr5UuUfhz3oZopGlul0Ja
-lIlhL7RjZCityC/rSDU0HgzV1AQC9+8XnMgPql9fAoGAWlGnViIaV7RLaSHaeKdG
-cxc6JS/MzfiMfhzPaPXYBEB+8I3RpsYSx9H9k0rinyhyRQ2ihjy3QRGWerKLBVjs
-th4I5xMfSq22tBA/mjU7FRPKbunsW6qiJouCQW2G2TKRJKavB6ajHS7SkxdUALXW
-HCyHiui40K48r3XAxYGi9/MCgYBMB4ZRa8jYcMiYX295nxDZXIYbenT6+4LBBO7b
-nF73Z7V0wNKjdkxuYSBdNM2j/YzxCPF9cAVpXMr4DqyTK+YL1MLap3zwZMAyuPVS
-oP5ad9lyQlIJ8zYGXL7aT2Wmvm5ymwE1aFeuD25hHGy2u0VMxUSa64Pv0mdDALdK
-nlv2HQKBgQC4u3+cyw+cimCc1gMTXB7Lc9ZfxXZvjhnnrHIDjvTSPG5Gipnwv5Yy
-q94XuvevNMNWjTUAFubcA+aYa8XMWjcfHqVaatS1gQQkZV11Y2R1JJNjW5dcVtR4
-tfI15/6fnr7LhbsFeRqE6dRKbThaj9jbH4rfqBT/t25os4TfiQtU8A==
+MIIEpAIBAAKCAQEAvrH/h5AeKkm6KYWsCY8H1IbqYl/GmUaEYT1qd59ysMrfvedv
+Z2CtKzDxYp+2TUKj5CNWMS/RBW15bTpCXZRAopmfpUz0hdoQdjCZuclbpNHeNm6M
+xhuB2n27i6gu8OPJsu5D0WwId3TKHC6/4r7IxZ8tJEmMXBjp+gid2CudcPGD17Jy
+ClP0z07LLPiz5Le1qgr77KhWfvqFpTZ4vxLXef+MU2SnfEzr2RNAY0SZLv+J19WV
+Rkp1BQOxhs742FfqSId1WB7EJ1eScoPoT3vtlEn6hTyjwLXZ1D+wemq9kLu4phA1
+Tp0Zjbk0kvqw4UqZPK31iNZhA+X0eav5Dhm8GwIDAQABAoIBAGvUNsuvAH+lBPFp
+tqgJCsJwL6TEx4XwS/a4RbWyoaW6cd3uOh5YmlLr7/J2oRz667WbDafug+Dv0FOl
+N9W2eP34pD9STopJjjlmreZSJ9IBIgfhZxS2hSzJH/2OckygYXMeK5cF4Zu6nHZn
+MPXEL78fjOUR+Z4yMEvEB40uzG4KCRc8VdqiUe2SUf8nRqURotnIAvWkOSVQWvsR
+3CjiPcVMAH05DoszXIqOvt+/sqMw5jQw9ODiE9LPgT6Ei7Y/HY+GeNsGNe7owNku
+Z5JN9kpDbKcGsW7UtEbs89t/ce3eetyAk+UWkYO/u6KDzupvpmDqsZrP4cEp/t79
+YV0N7qECgYEA5X7h5RiFp/RRsgRwtNrBkO0vfSwnRPMVkj/jh6MMe285u4uSRa9p
+1gW2IinBXJenHf73VKXUA6+7cDpyzbYNM+oZCDTjrCg8tQbxXmRrqipPmxEI+xL2
+gtTR6nGB7uUaen7YwcoqwRjRjHrKNuc9IWipBgGAb3bM1NNvWRYbGqMCgYEA1Lf4
+fFEmbgPXZZtczuourgwEpf4IhFWguXRny7e+hlKh2n+pvIeHzbSrSz+IVQopOrkc
+Tq3Q+apBowGTEokiPwGnzWJ1ysUntzSBm9U5LsjsvmjO1szm5tcwBg5NcsUao/i+
+K4mRu1KzhMPKSDkXiNF0tHfIQTVBsAyc69STKCkCgYEAlz+gMRSQQbjLfr9eaFMj
+7xfijGRlHRP3y4M/uUzEFTWgnvHFXRfWcK8i8jECtrtb8HDxIGCJ8kQHDFf5AYpR
++Tz3cmkpA3UhTU1eFg+oxWVNQa1gddhxjpgkIJbeQ0vKv6CJym4q70gkEql6S+Tq
+bPJFMygaNVvecwVGBTiEdHECgYBbsKUKKQyQlVVONcauZeETIpkKV9KiACrUZamr
+9RrJ2WpsvWSToDPYZk0DlXIVfdjBuDLMcz3FsC60raQQdE3vrK4A6LTvX0Y8QQSx
+ABqy4OazOIgXrKDG1fCcW6PkmbNfBIQsThMkFITO8HoL4ZgUYHyWoZ8PBH64/ObS
+/IEl6QKBgQC1QhfWeCixR+Xo/fE6UhDQOssfUkKoWNgfbb+UsMsoU6unolh1/8Fu
+OsvlKmXyS9PY3ZQm74QczNK12NydfyzCTJBU+x0Sjcp8Om4LuDIVj2sJoYCf7WkQ
+cVSMPzbJ+kzRwTNAEKrN7t+RZqEXEOXhxDGZxmSngOPM6rJaPeNAFA==
 -----END RSA PRIVATE KEY-----