You can edit the vRealize Log Insight agent configuration file to change the SSL configuration, add a path to the trusted root certificates, and define whether certificates are accepted by the agent.
About this task
This procedure applies to the vRealize Log Insight agents for Windows and Linux.
For the vRealize Log Insight Linux agent:
Log in as root or use sudo to run console commands.
Log in to the Linux machine on which you installed the vRealize Log Insight Linux agent, open a console and run pgrep liagent to verify that the vRealize Log Insight Linux agent is installed and running.
For the vRealize Log Insight Windows agent:
Log in to the Windows machine on which you installed the vRealize Log Insight Windows agent and start the Services manager to verify that the vRealize Log Insight agent service is installed.
- Navigate to the folder containing the liagent.ini file.
%ProgramData%\VMware\Log Insight Agent
- Open the liagent.ini file in any text editor.
- Add the following keys to the
[server]section of the liagent.ini file.
Overrides the default storage path for root Certificate Authority-signed certificates, which are used to verify connection peer certificates.
Linux: If no value is specified, the agent attempts to load trusted certificates from /etc/pki/tls/certs/ca-bundle.crt file or from /etc/ssl/certs/ca-certificates.crt file.
Windows: If no value is specified, the vRealize Log Insight Windows agent loads certificates from the Windows root certificate store.
When a path for ssl_ca_path is specified, it overrides the defaults for both Linux and Windows agents. You can specify as a value a file where multiple certificates in PEM format are concatenated or a directory that contains certificates that are in PEM format and have names of the form hash.0 (see -hash option of the x509 utility).
Defines whether any certificates are accepted by the vRealize Log Insight agent. The possible values are
0. When the value is set to yes or 1, the agent accepts any certificate from the server and establish secure connection for sending data. The default value is no.
The possible values are yes, 1, no, or 0. If the vRealize Log Insight agent has a locally stored trusted Certificate Authority-signed certificate and receives a different valid certificate signed by a different trusted Certificate Authority, it checks the configuration option. If the value is set to yes or 1, the agent accepts the new valid certificate. If the value is set to no or 0, it rejects the certificate and terminates the connection. The default value is no.
Common Nameof the self-signed certificate.
The default value is
VMware vCenter Log Insight. You can define a custom
Common Nameto be checked against the certificate
Common Namefield. The vRealize Log Insight agent checks the
Common Namefield of the received certificate against the host name specified for the
hostnamekey in the
[server]section. If ithey do not match, the agent checks the
Common Namefield against the ssl_cn key in the liagent.ini file. If the values match, the vRealize Log Insight agent accepts the certificate.Note:
The keys are used only if the protocol in the
[server]section is set to
cfapiand SSL is enabled.
- Save and close the liagent.ini file.
The following is an example of the SSL configuration.
proto=cfapi port=9543 ssl=yes ssl_ca_path=/etc/pki/tls/certs/ca-bundle.crt ssl_accept_any=no ssl_accept_any_trusted=yes ssl_cn=LOGINSIGHT