# TLS-store enabled but no certificate data collected in folder /var/log/suricata/certs

**URL:** <https://forum.suricata.io/t/tls-store-enabled-but-no-certificate-data-collected-in-folder-var-log-suricata-certs/5987>\
**Category:** Uncategorized\
**Created:** [August 29, 2025, 2:46pm UTC](https://forum.suricata.io/t/tls-store-enabled-but-no-certificate-data-collected-in-folder-var-log-suricata-certs/5987 "2025-08-29T14:46:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_49100](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/alex_49100/32/2822_2.png) [@alex\_49100](https://forum.suricata.io/u/alex_49100)\
**Post date:** [August 29, 2025, 2:46pm UTC](https://forum.suricata.io/t/tls-store-enabled-but-no-certificate-data-collected-in-folder-var-log-suricata-certs/5987/1 "2025-08-29T14:46:14Z")

</div>

Hello to the Suricata community,

**Running :**

- Suricata version 7.0.11 RELEASE
- installed from packages on Oracle Linux 9.6 and Debian 13

**Topic:**

I would like to collect the certificate data via the tls store feature. The suricata.yaml file has been configured as follows (extract) :

```auto

- tls-log:
      enabled: yes # Log TLS connections.
      filename: tls.log # File to store TLS logs.

- tls-store:
      enabled: yes
      certs-log-dir: /var/log/suricata/certs # directory to store the certificates files

```

As a result, the certs folder has been created but no certificate data are being collected.

**Steps done (on both OL9 and Debian 13):**

Having tried relative path “certs” and full path for the name of the folder, checked permissions, which are as follows (extract) :

```auto
$ ls -lh /var/log/suricata/
total 86M
drwxr-x---. 2 suricata suricata 4.0K Aug 27 18:04 certs
-rw-rw-r--. 1 suricata suricata 21M Aug 29 16:39 eve.json
...

```

Any suggestion please ?

Kind regards.

---

<div class="post-metadata">

**Author:** ![alex\_49100](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/alex_49100/32/2822_2.png) [@alex\_49100](https://forum.suricata.io/u/alex_49100)\
**Post date:** [September 9, 2025, 1:51pm UTC](https://forum.suricata.io/t/tls-store-enabled-but-no-certificate-data-collected-in-folder-var-log-suricata-certs/5987/2 "2025-09-09T13:51:37Z")

</div>

Hi everyone,  
Just a quick add-on on this post : I read the following note in the Suricata 8 documentation :

> tls-log is deprecated in Suricata 8.0 and will be removed in Suricata 9.0.

This section in the Suricata user guide states that `tls-log` is deprecated in version 8.0 and, although the same paragraphs speaks a bit later about the configuration of `tls-store`, there is no mention that tls-store being also deprecated.  
Does this imply that both `tls.log` and `tls-store` would be deprecated or is it only `tls.log` ?

Many thanks.