Log4j2 TCP-SSL Appender configuration in log4j2-config.xml - ssl

Question

I am planning to configure a Log4j2 Socket Appender with a TCP-SSL Appender.
Here is the configuration I see in Log4j2 website.
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="warn" name="MyApp" packages="">
<Appenders>
<Socket name="socket" host="localhost" port="9500">
<JsonLayout properties="true"/>
<SSL>
<KeyStore location="log4j2-keystore.jks" password="guessme!"/>
<TrustStore location="truststore.jks" password="guessme!"/>
</SSL>
</Socket>
</Appenders>
<Loggers>
<Root level="error">
<AppenderRef ref="socket"/>
</Root>
</Loggers>
</Configuration>
In this config, what do the Keystore and TrustStore files contain? I don't have these files.
I want to send my logs to Splunk TCP port.
Do I need to create truststore.jks with SSL certs from my Splunk server so that my server trusts Splunk?
What is log4j2-keystore.jks, and where can I download it? Do I need a KeyStore file? What should go in it? Does Splunk need a corresponding public key or trusted certs?

Answer 1

The keystore contains your personal key and public key if you have and want to use them. It can be left out completely.
The truststore contains the server's certificate. You can download and package it as jks like this:
$ echo -n | openssl s_client -connect log-server.tld:5010 -servername log-server.tld \
| sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | tee "server.crt"
$ keytool -import -alias log-server-certificate-alias -keystore log-server-cert.jks -file server.crt
The latter prompts you for the password you will then use in the log configuration.
I had a similar issue with logstash and posted a brief summary of my findings here: https://rekowski.info/home/technical/java/log4j2-socket-appender-logstash-kibana-ssl-tls.md