Skip to content

docs: Adjust the documentation and add the key policies note #484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 14, 2023
Merged

docs: Adjust the documentation and add the key policies note #484

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
99a1b41
docs: Adjust the documentation and add the key policies note
ZPascal Aug 11, 2023
645243d
grammar fixes
anita-flegg Aug 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion services/log-management.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,11 +92,21 @@ You can create a syslog drain service and bind apps to it using Cloud Foundry Co
$ cf create-user-provided-service my_app_drain -l syslog://logs.example.com:1234?drain-type=all
</pre>

In case of the use of the mTLS feature delivered in [CAPI release 1.143.0](https://github.com/cloudfoundry/capi-release/releases/tag/1.143.0), you can use `-p` flag to define the client certificate and key as credentials, filling in values as follows.
In case of the use of the mTLS feature delivered in [CAPI release 1.143.0](https://github.com/cloudfoundry/capi-release/releases/tag/1.143.0), you can use `-p` flag to define the client certificate and key as credentials, filling in values as follows.</br>

<pre class="terminal">
$ cf create-user-provided-service DRAIN-NAME -l SYSLOG-URL -p '{"cert":"-----BEGIN CERTIFICATE-----\nMIIH...-----END CERTIFICATE-----","key":"-----BEGIN PRIVATE KEY-----\nMIIE...-----END PRIVATE KEY-----"}'
</pre>

</p>
If your certs include the V3 extension `X509v3 Extended Key Usage`, ensure that you are using the right key policies. For TLS you need server. and for mTLS also client authentication. For example, TLS Web Server Authentication for TLS with TLS Web Client Authentication for mTLS.

<pre class="terminal">
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
</pre>

You can also provide a single certificate authority without client certificate and key if you are using a server certificate signed by your private CA.
<pre class="terminal">
$ cf create-user-provided-service DRAIN-NAME -l SYSLOG-URL -p '{"ca":"-----BEGIN CERTIFICATE-----\nMIIH...-----END CERTIFICATE-----"}'
Expand Down