@@ -42,6 +42,9 @@ class LogStash::Outputs::Tcp < LogStash::Outputs::Base
42
42
# The SSL CA certificate, chainfile or CA path. The system CA path is automatically included.
43
43
config :ssl_cacert , :validate => :path
44
44
45
+ # Do not perform TLS Mutal Authentication, only require a certificate for the client (only with :mode=>"client")
46
+ config :ssl_mutual , :validate => :boolean , :default => true
47
+
45
48
# SSL certificate path
46
49
config :ssl_cert , :validate => :path
47
50
@@ -85,8 +88,11 @@ def setup_ssl
85
88
require "openssl"
86
89
87
90
@ssl_context = OpenSSL ::SSL ::SSLContext . new
88
- @ssl_context . cert = OpenSSL ::X509 ::Certificate . new ( File . read ( @ssl_cert ) )
89
- @ssl_context . key = OpenSSL ::PKey ::RSA . new ( File . read ( @ssl_key ) , @ssl_key_passphrase )
91
+
92
+ if @ssl_mutual
93
+ @ssl_context . cert = OpenSSL ::X509 ::Certificate . new ( File . read ( @ssl_cert ) )
94
+ @ssl_context . key = OpenSSL ::PKey ::RSA . new ( File . read ( @ssl_key ) , @ssl_key_passphrase )
95
+ end
90
96
if @ssl_verify
91
97
@cert_store = OpenSSL ::X509 ::Store . new
92
98
# Load the system default certificate path to the store
@@ -97,7 +103,11 @@ def setup_ssl
97
103
@cert_store . add_file ( @ssl_cacert )
98
104
end
99
105
@ssl_context . cert_store = @cert_store
100
- @ssl_context . verify_mode = OpenSSL ::SSL ::VERIFY_PEER |OpenSSL ::SSL ::VERIFY_FAIL_IF_NO_PEER_CERT
106
+ if @ssl_mutual
107
+ @ssl_context . verify_mode = OpenSSL ::SSL ::VERIFY_PEER |OpenSSL ::SSL ::VERIFY_FAIL_IF_NO_PEER_CERT
108
+ else
109
+ @ssl_context . verify_mode = OpenSSL ::SSL ::VERIFY_PEER
110
+ end
101
111
end
102
112
end # def setup_ssl
103
113
0 commit comments