TLS settings in secops forwarder collector

[yasinmnk]

Hi,
I need to add tls certificate to my collector, in secops forwarder, there should be tls server key path given, but i dont know where should i keep it, in my computer locally or where excatly?

Any help would be invaluable, thanks in advance!

[cbryant]

That file needs to be kept on the forwarder itself so that the configuration can reference it. I would recommend putting it in the /opt/chronicle/config directory along with the forwarder auth and configuration files.

[nahatx]

The cert files need to be kept in a specifically named certs folder on the forwarder server.

So within your server /opt/chronicle/config/certs/ is where you put them. The forwarder config/auth files remain within the config folder.

You must add the following to any log source within your configuration file that is using TLS. Change the cert names, cert extensions, and minimum tls version as appropriate.

    certificate: "/opt/chronicle/external/certs/cert_name.crt"
    certificate_key: "/opt/chronicle/external/certs/cert_name.key"
    minimum_tls_version: "TLSv1_2"

Do not alter the above paths as these are the container file paths (not the path to where you put the certs on the server). The forwarder automatically checks /opt/chronicle/config/certs/ to find them.