Note that you have to set the cert-file() and key-file() options only if the Riemann server requires authentication from the clients.

Alternative 1:

type(
	"tls"
	cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem")
	key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key")
	)

Alternative 2:

riemann(
	.
	.
	type("tls")
        tls(
              cert-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.pem")
              key-file("/opt/syslog-ng/etc/syslog-ng/riemann-client-cert.key")
       )