Dial-In with two-way TLS
Last updated
Last updated
Continuing from the previous labs, the router should still have the collector’s cert in /misc/config/grpc/dialout/dialout.pem. Copy this to /misc/config/grpc/ca.cert.
Configure two-way TLS for the dial-in session so that the collector also must present its cert to the router for verification.
On the Ubuntu node, enable the following lines in telegraf_dial_in.conf:
Ensure these certs are still loaded via the docker-compose.yaml file:
Stop and start the docker container:
The grpc tls-mutual command requires that TLS verification is preformed in both directions. By default, only the router presents its own cert to the collector for verification during a dial-in session. But with tls-mutual, the collector also presents its own cert to the router for mutual TLS authentication.
The same CA cert can be used that was used for dialout. However, with dial-in mutual TLS, the router does not look at the dialout.pem file. It uses the ca.cert file to authenticate the collector. For this reason, we must copy the dialout.pem file to the ca.cert file.
At this point, we likely need to restart the EMSD process.
We should see that the MDT dial-in session is now TLS-mutual instead of just TLS.
These labs were mostly created using the following tutorial on XRdocs:
