For remote logging, add an explicit TLS X.509 certificate matching rule to match the remote syslog server by hostname in either the Common Name (CN) field or the subjectAltName (SAN) field.
For strict compliance with the Common Criteria (CC-NDcPP) certification, syslog server certification verification for remote logging fails if the certificate is configured with an IP address instead of a hostname in the Common Name (CN) field. This command configures the certificate verification to check both the CN field and the subjectAltName field and match a hostname in either one.
To add multiple matching hostnames, configure a rule for each hostname separately.
Alternatively, you can add a rule to match the remote server by IP address using the logging <hostname-or-IP-address> tls certificate match-x509-cert-san-ipv4-or-ipv6 <IP address> command or by email address using the logging <hostname-or-IP-address> tls certificate match-x509-cert-san-email <email-addr> command.
Syntax
[no] logging <hostname-or-IP-address> tls certificate match-x509-cert-san-or-cn-hostname <hostname-to-match>
Parameters
<term>no</term>Disable matching the specified hostname in either the CN field or the subjectAltName field of a certificate. This is the default.<term>
hostname-or-IP-address</term>The hostname or IP address of the remote logging server.<term>
hostname-to-match</term>The hostname to match.
Example
The following example enables an explicit X.509 rule to match the hostname to either the CN field or the SAN field of a certificate.
hostname (config) # logging 192.0.2.1 tls certificate match-x509-cert-san-or-cn-hostname logserver.example.com
User role
Admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 9.0.2