tls.authMode

Selects the mutual authentication strategy for TLS-secured RELP sessions.

This parameter applies to imrelp: RELP Input Module.

Name:

tls.authMode

Scope:

input

Type:

string

Default:

input=none

Required?:

no

Introduced:

Not documented

Description

Sets the mode used for mutual authentication.

Supported values are fingerprint, name, or certvalid.

fingerprint mode basically is what SSH does. It does not require a full PKI to be present, instead self-signed certs can be used on all peers. Even if a CA certificate is given, the validity of the peer cert is NOT verified against it. Only the certificate fingerprint counts.

In name mode, certificate validation happens. Here, the matching is done against the certificate’s subjectAltName and, as a fallback, the subject common name. If the certificate contains multiple names, a match on any one of these names is considered good and permits the peer to talk to rsyslog.

certvalid mode validates the remote peer’s certificate chain but does not check the subject name, so any certificate trusted by the configured CAs is accepted. This mode is therefore weaker than name and typically used only when that reduced verification is acceptable.

Input usage

input(type="imrelp" port="2514" tls="on" tls.authMode="fingerprint")

See also

See also imrelp: RELP Input Module.

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.