IBM Support

QRadar: Configuring a Disconnected Log Collector (DLC) with OpenSSL v3



Administrators can experience an issue where DLC services do not start as expected after an OpenSSL v3 certificate is installed. When this issue occurs, the DLC cannot validate the certificate on systems with Red Hat version 9. This issue is due to default encryption algorithm AES-256-CBC with PBKDF2 for key derivation. This technical note provides a procedure on how to use the '-legacy' option to generate the pfx file and resolve the DLC certificate issue.

Resolving The Problem

Before you begin

  1. Use SSH to log in to the Disconnected Log Collector.
  2. Navigate to the /opt/ibm/si/services/dlc/keystore/<UUID>/ directory. The folder contains the signed certificate that was converted and the key file associated with the certificate request.
  3. Optional. Certificates in DER format must be converted to a PEM file with the following command:
    openssl x509 -inform der -in yourcert.crt -out dlc-client.pem
  4. Use the following command to generate the pfx file with the legacy option. For example,
    openssl pkcs12 -export -legacy -out dlc-client.pfx -inkey dlc-client.key -in dlc-client.pem -password pass:your_unencrypted_password
  5. To set the correct owner on the pfx file, type: 
    chown root:dlc dlc-client.pfx
  6. To set read access on the file, type:
    chmod +r dlc-client.pfx
  7. Copy the dlc-client.pfx file to the /opt/ibm/si/services/dlc/keystore folder.
    Note: This file location is one level up from the location in step 2 of this procedure. You must copy the pfx file to the correct directory.
  8. Type the following command to start the DLC service:
    systemctl restart dlc

    After the service restarts, you can setup your destination on the Disconnected Log Collector. If you continue to experience issues with the DLC service, contact QRadar Support for further assistance.

Document Location


[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt9AAA","label":"DLC"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
28 June 2023