What System TLS Configuration do?

saitoh — Mon, 06 Oct 2025 05:44:49 GMT

Hi all,

I found presumably newly-added setting, which is System TLS Configuration under System Management > System Logging.

What kind of behaviour can be configured here? I cannot find a detailed document.

Thanks!

Saitoh

Re: What System TLS Configuration do?

Chris_Atkinson — Mon, 06 Oct 2025 12:12:24 GMT

These are the Syslog over TLS settings, please refer: Configuring System Logging in Gaia Portal

Re: What System TLS Configuration do?

the_rock — Mon, 06 Oct 2025 15:14:51 GMT

There you go, my friend...greetings for Japan : - )

Andy

************************************

The System TLS Configuration setting you're referring to—found under System Management > System Logging—likely relates to how Transport Layer Security (TLS) is used to secure system log transmissions, especially when logs are sent to remote servers (e.g., syslog over TLS). While the exact behavior can vary depending on the platform (e.g., Windows Server, Cisco NX-OS, Juniper OS), here's a general overview of what can be configured under such a setting:

🔐 What System TLS Configuration Typically Does

Enable Secure Log Transmission:
- TLS encrypts log messages sent from the system to a remote syslog server, ensuring confidentiality and integrity.
Configure Authentication Modes:
- Server Authentication: The client verifies the identity of the server.
- Mutual Authentication: Both client and server verify each other using certificates.
Certificate Management:
- You can specify which X.509 certificates are used for authentication.
- Configure trusted Certificate Authorities (CAs).
- Set up certificate mapping (e.g., one-to-one or many-to-one user mappings).
TLS Protocol and Cipher Suite Settings:
- Define which versions of TLS are allowed (e.g., TLS 1.2, TLS 1.3).
- Control cipher suite order and availability for secure communication.
Session Caching and Timeout Settings:
- Configure how long TLS sessions are cached to improve performance.
- Adjust cache size and timeout intervals.
OCSP Stapling and Trusted Issuer Lists:
- Enable or disable OCSP stapling for certificate revocation checks.
- Decide whether to send a list of trusted certificate authorities to clients.

🧩 Example Use Case

If you're using Windows Server, these settings are managed via the Schannel Security Support Provider (SSP). You can configure them using:

Registry keys (e.g., HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL)
Group Policy
PowerShell

For example, enabling mutual TLS for syslog might involve:

Installing certificates on both client and server.
Configuring the syslog daemon to use TLS.
Setting registry keys or configuration files to enforce TLS-only connections.

Re: What System TLS Configuration do?

saitoh — Fri, 10 Oct 2025 11:01:03 GMT

Dear @Chris_Atkinson , and @the_rock ,

Thanks for sharing the document, and unbelievably detailed explanation!!

Much appreciated, and big respect for you and the time which it took you to acquire this level of knowledge.

Saitoh

Re: What System TLS Configuration do?

the_rock — Fri, 10 Oct 2025 11:03:10 GMT

Greetings to you and Japan, brother!

Best,

Andy

topic Re: What System TLS Configuration do? in Firewall and Security Management

What System TLS Configuration do?

Re: What System TLS Configuration do?

Re: What System TLS Configuration do?

🔐 What System TLS Configuration Typically Does

🧩 Example Use Case

Re: What System TLS Configuration do?

Re: What System TLS Configuration do?