A newly created TLS Syslog log source fails the self-test during the SSL handshake on port 6514. The test connection error is as below.

The self-test fails with:

Initiating SSL handshake to [127.0.0.1:6514] with a timeout of 10000 ms
Error: Unable to connect to host [127.0.0.1] on port [6514]:
Received fatal alert: handshake_failure

The /var/log/qradar.error log reports:

javax.net.ssl.SSLHandshakeException: no cipher suites in common

The installed TLS Syslog protocol version was two versions behind the latest version.

Update the TLS Syslog protocol package, perform a Full Deploy, and restart ecs-ec-ingress on the impacted Managed Host.

• Copy PROTOCOL-TLSSyslog-7.5-20260429092030.noarch.rpm.zip to /storetmp on the JSA Console.
• SSH to the Console and run:
  • cd /storetmp
  • unzip PROTOCOL-TLSSyslog-7.5-20260429092030.noarch.rpm.zip
  • yum -y install /storetmp/PROTOCOL-TLSSyslog-7.5-20260429092030.noarch.rpm
• Perform a Full Deploy from the JSA UI.
• SSH to the impacted Managed Host and restart the service:
  • systemctl restart ecs-ec-ingress
• Run the TLS Syslog self-test again.

If the issue persists,

Use a PKCS#12 (.pfx/.p12) bundle containing the certificate chain and private key. Update the TLS Syslog log source with the PKCS#12 bundle and allow a few minutes for the configuration to propagate to the Managed Host.

If the certificate and key are available as separate files, a PKCS#12 bundle can be created using:

openssl pkcs12 -export -out /opt/qradar/conf/trusted_certificates/cert.pfx -inkey /opt/qradar/conf/trusted_certificates/key.der -in /opt/qradar/conf/trusted_certificates/certpem.cert

Modify the configuration of the log source to use the PKCS#12 format and the new file cert.pfx and proceed with the "Test Connection"