---
title: "Configuring mutual TLS authentication on the AxoSyslog clients"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-encrypted-transport-tls/tls-mutualauth/procedure-configuring-mutual-tls-client/"
last_modified: "2026-09-30T13:55:13+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Configuring mutual TLS authentication on the AxoSyslog clients

## Purpose:

Complete the following steps on every AxoSyslog client host. Examples are provided using both the legacy BSD-syslog protocol (using the `network()` driver) and the new IETF-syslog protocol standard (using the `syslog()` driver):

## Steps:

1. Create an X.509 certificate for the AxoSyslog client.
2. Copy the certificate (for example, `client_cert.pem`) and the matching private key (for example, `client.key`) to the AxoSyslog client host, for example, into the `/opt/syslog-ng/etc/syslog-ng/cert.d` directory. The certificate must be a valid X.509 certificate in PEM format. If you want to use a password-protected key, see [Password-protected keys](https://axoflow.com/docs/axosyslog-core/4.28/chapter-encrypted-transport-tls/tls-password-protected-keys/index.md).
3. Copy the CA certificate of the Certificate Authority (for example, `cacert.pem`) that issued the certificate of the AxoSyslog server (or the self-signed certificate of the syslog-ng server) to the AxoSyslog client hosts, for example, into the `/opt/syslog-ng/etc/syslog-ng/ca.d` directory.

   Issue the following command on the certificate: `openssl x509 -noout -hash -in cacert.pem` The result is a hash (for example, `6d2962a8`), a series of alphanumeric characters based on the Distinguished Name of the certificate.

   Issue the following command to create a symbolic link to the certificate that uses the hash returned by the previous command and the `.0` suffix.

   `ln -s cacert.pem 6d2962a8.0`
4. Add a destination statement to the `syslog-ng.conf` configuration file that uses the `tls( ca-dir(path_to_ca_directory) )` option and specify the directory using the CA certificate. The destination must use the `network()` or the `syslog()` destination driver, and the IP address and port parameters of the driver must point to the AxoSyslog server. Include the client’s certificate and private key in the `tls()` options.

   ## Example: A destination statement using mutual authentication

   The following destination encrypts the log messages using TLS and sends them to the `1999/TCP` port of the AxoSyslog server having the `10.1.2.3` IP address. The private key and the certificate file authenticating the client is also specified.

   ```shell
       destination demo_tls_destination {
           network(
               "10.1.2.3" port(1999)
               transport("tls")
               tls(
                   ca-dir("/opt/syslog-ng/etc/syslog-ng/ca.d")
                   key-file("/opt/syslog-ng/etc/syslog-ng/key.d/client.key")
                   cert-file("/opt/syslog-ng/etc/syslog-ng/cert.d/client_cert.pem")
               )
           );
       };
   ```

   ```shell
       destination demo_tls_syslog_destination {
           syslog(
               "10.1.2.3" port(1999)
               transport("tls")
               tls(
                   ca-dir("/opt/syslog-ng/etc/syslog-ng/ca.d")
                   key-file("/opt/syslog-ng/etc/syslog-ng/key.d/client.key")
                   cert-file("/opt/syslog-ng/etc/syslog-ng/cert.d/client_cert.pem")
               )
           );
       };
   ```
5. Include the destination created in Step 2 in a log statement.

   > **Warning:**
   >
   > The encrypted connection between the server and the client fails if the `Common Name` or the `subject_alt_name` parameter of the server certificate does not match the hostname or the IP address (as resolved from the AxoSyslog clients and relays) of the server.
   >
   > Do not forget to update the certificate files when they expire.

Last modified September 30, 2026: [Fix duplicate page titles (9e976150)](https://github.com/axoflow/axosyslog-core-docs/commit/9e976150ffecc6fa60df92f8346a0dc34f03533e)