Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Kiwi Syslog NG - Certificate Field empty

frank_m

Dear Thwack's,

I'm migrationg from the legacy cersion to the new NG Syslog.

Everything is working so far, except the certificate...

Under Setup -> HTTPS CERTIFICATES the dropdown is always empty.

How / Where do i need to store the certificate (in which format) ?

I tried the local and user Certificate section (certmgr.msc and certlm.msc)...

Find more posts tagged with

Accepted answers

All comments

ivodlouhy

Certificates are stored / should be placed in windows certificate storage
Press the Windows key + R to bring up the Run command, type certmgr.msc and press Enter

More detailed location

frank_m

Certificates are in that exact location.
Dropdown still empty.

But i could solve the problem:

Browse to ProgramData\SolarWinds\KiwiSyslogService\Settings
and edit the Kiwi.Service.Settings.json file.

TlsServerCertificateThumbPrint need the fingerprint of the desired certificate.

ldelt

So you use the current user instead of the Local Machine store and where is the documentation?

ian.watts

Did you get anything to work in this space? I tried to edit the json directly by adding the thumbprint directly, the web page lists the thumbprint but yields no information. I used the Computer Certificates console to fetch a custom cert from our own CA in this space. Only the vanilla cert lists, not this new custom cert nor the defaults our GPO is rolling out in general.

marlon_b

I have just installed NG Syslog 1.2.0.4 and am having the same issue. i.e. I have imported our internally issued cert into the Windows cert store under both Personal and Trusted Root CAs but it doesn't appear in the drop down list under Setup/Settings/HTTPS Certificates. The only cert. that appears is the self generated/signed Kiwi one.

Has someone worked out how to configure the Cert in Syslog NG ?

tomiannelli

So I deal with certificates a lot and I found it very odd the system could not find my certificate I issued and is in the Computer's local store. I ran Sysinternals' ProcMon to watch the service executable and filtered on the path containing "Certificate." What I found is that the service is not looking in the MY folder at all. It only looks in these folders:

AuthRoot
CA
Disallowed
Root
trust
TrustedPeople
TrustedPublisher

Thus placing it in the Trusted Root would at least make it visible. When it was in the PERSONAL [MY] folder the Kiwi logs said it couldn't find the certificate with the thumbprint. Once I did this and restarted everything, the web site at least started using the certificate. However, like others here, the drop down for HTTPS CERTIFICATES still only shows the self-generated certificate. The DETAILS do show the thumbprint of the domain certificate I want to use.
Drop-Down

I also found another directory that only had the self-generated certificate in it, so I placed my certificate in there too. No luck. ["C:\Program Files (x86)\SolarWinds\Kiwi Syslog Server NG\Certificate"]

As a last resort I tried using the Developer Tools in Edge to see what errors it threw on the page. It does appear there is something not right in the JavaScript because it is closing a connection before it is even open. I can make any sense out of the java functions.

WebSocketClosed

This file also does not seem to contain either certificate of interest: "C:\Program Files (x86)\SolarWinds\Kiwi Syslog Server NG\wwwroot\assets\cert.json"

There is this query inside the main.7f4059a3bdf0ce75.js file, but again the surrounding code gives nothing actionable to me.
query allCertificates($selector: CertificateSelector!) {
certificates(certificateSelector: $selector) {
thumbPrint
friendlyName
issuer
subject
serialNumber
validFrom
validTo
}}

The CertificateSelector is referenced inside these 2 DLL files:

C:\Program Files (x86)\SolarWinds\Kiwi Syslog Server NG\SolarWinds.Kiwi.Service.GraphQL.dll
C:\Program Files (x86)\SolarWinds\Kiwi Syslog Server NG\SolarWinds.Syslog.dll

I tried using Procmon to find what it was looking for when this page tries to populate the drop down. I thought I might have found it in "C:\Program Files (x86)\SolarWinds\Kiwi Syslog Server NG\tempkey.jwk" This seems to be hit every time I refresh the drop down. It gets created again if you stop the service, delete it, and then start the service. But it doesn't contain anything of interest. Although I do not believe that is the purpose of the file. It should be for temporary keys/tokens if I understand things correctly.

mgebauer

Hello @tomiannelli ,

we are looking into the certificate topic last two weeks and will be improving the certificate experience.

We are aware of the inconsistency between trusted root folder and personal folder and it should be fixed in upcoming release.

The expectation is that Kiwi NG will display and use certificates from both places mentioned above.

In the upcoming release, we will not reduce requirements for certificates but we will gather the feedback for future iterations.

Thank you