# Bro for Beginners/Logging SSL Certificate **URL:** \ **Category:** Zeek\ **Created:** [August 9, 2011, 5:43pm UTC](https://community.zeek.org/t/bro-for-beginners-logging-ssl-certificate/1975 "2011-08-09T17:43:15Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Alvin\_Huang](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Alvin\_Huang](https://community.zeek.org/u/Alvin_Huang)\ **Post date:** [August 9, 2011, 5:43pm UTC](https://community.zeek.org/t/bro-for-beginners-logging-ssl-certificate/1975/1 "2011-08-09T17:43:15Z")
Hey everyone, This is my first time using Linux as well as using Bro so it has taken a while for me to get it installed and up and running, but finally I think I have it. I am running Bro 1.5.3 on Ubuntu and I have gotten BroCtl to start but I have a couple questions: 1. Where are the rules written that Bro is supposed to alert on? I came from Snort so I know a bit about IDS but I don’t know how Bro is set up. 2. Where are the logs produced? /spool/broctl.dt? What I really want to do is to log the packet(s) from an SSL handshake that contain a certificate. I was sort of able to do this in Snort. Snort gave me the right packets but the wrong data. I got the TCP Segment Data rather than the reassembled TCP packet of the whole certificate itself. I was told Bro could do this out of the box so hopefully this will work here. Is this possible? How should I go about doing this. I am a true beginner with Linux and I am having some trouble understanding what is going on. Thanks in advance Alvin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 9, 2011, 6:11pm UTC](https://community.zeek.org/t/bro-for-beginners-logging-ssl-certificate/1975/2 "2011-08-09T18:11:58Z")
This isn't quite ready for you then. The next release has greatly improved certificate logging and we will likely have a script specifically for that that task once we have the next release available.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-for-beginners-logging-ssl-certificate/1975/3 "2022-05-06T15:39:45Z")