Hello @jgutie45
Just a reminder, commands and configuration may not work for you because everyone environment is a little different, keep that in mind.
Depends on the System and what JAVA version you have. First, find your version your using.
java -version
Then look for “CACERTS”
root # locate cacerts
Results
[root@graylog graylog_user]# java -version
openjdk version "11.0.17" 2022-10-18 LTS
OpenJDK Runtime Environment (Red_Hat-11.0.17.0.8-2.el7_9) (build 11.0.17+8-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-11.0.17.0.8-2.el7_9) (build 11.0.17+8-LTS, mixed mode, sharing)
[root@graylog graylog_user]# locate cacerts
/etc/pki/ca-trust/extracted/java/cacerts
/etc/pki/java/cacerts
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7_6.x86_64/jre/lib/security/cacerts.backup
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.352.b08-2.el7_9.x86_64/jre/lib/security/cacerts
/usr/lib/jvm/java-11-openjdk-11.0.17.0.8-2.el7_9.x86_64/lib/security/cacerts
/usr/share/elasticsearch/jdk/lib/security/cacerts
/usr/share/opensearch/jdk/lib/security/cacerts
[root@graylog graylog_user]#
My default key store is located as shown below
/usr/lib/jvm/java-11-openjdk-11.0.17.0.8-2.el7_9.x86_64/lib/security/cacerts
Example of the steps needed. I remind you this alos depend on your setup you may want to adjust it to your needs.
1. mkdir /etc/ssl/certs/graylog/ && cd /etc/ssl/certs/graylog/
2. openssl req -x509 -days 1095 -nodes -newkey rsa:2048 -config openssl-graylog.cnf -keyout pkcs5-plain.pem -out cert.pem
3. openssl pkcs8 -in pkcs5-plain.pem -topk8 -nocrypt -out pkcs8-plain.pem
4. openssl pkcs8 -in pkcs5-plain.pem -topk8 -out pkcs8-encrypted.pem -passout pass:secret
5. openssl req -config openssl-graylog.cnf -out graylog.csr -new -newkey rsa:2048 -nodes -keyout graylog.key
6. openssl req -x509 -sha512 -nodes -days 1095 -newkey rsa:2048 -config openssl-graylog.cnf -keyout graylog.key -out graylog.crt
7. openssl req -config openssl-graylog.cnf -out graylog.csr -key graylog.key -new
8. openssl x509 -x509toreq -in graylog.crt -out graylog.csr -signkey graylog.key
9. openssl pkcs12 -export -in graylog.crt -inkey graylog.key -out keystore.pfx
10. openssl pkcs12 -in keystore.pfx -nokeys -out graylog-certificate.pem
11. openssl pkcs12 -in keystore.pfx -nocerts -out graylog-pkcs5.pem
12. openssl pkcs8 -in graylog-pkcs5.pem -topk8 -out graylog-key.pem
13. keytool -import -trustcacerts -file graylog.crt -alias graylog.enseva-labs.net -keystore graylog_keystore.jks -storepass secret
14. keytool -list -v -keystore graylog_keystore.jks -alias graylog.enseva-labs.net
15. keytool -importkeystore -srckeystore graylog_keystore.jks -destkeystore keystore.p12 -deststoretype PKCS12
16. openssl pkcs12 -in keystore.p12 -nokeys -out graylog-certificate.pem
17. openssl pkcs8 -in graylog-pkcs5.pem -topk8 -out graylog-key.pem
18. cp -a “/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-7.b10.el7.x86_64/jre/lib/security/cacerts” /etc/ssl/certs/graylog/graylog-key.jks
19. keytool -importcert -keystore graylog.jks -storepass changeit (secret) -alias graylog.domain.com -file cert.pem
OR if you want to use the JAVA default keystore then you would want to use this command,
and again you need to change this for your setup.
keytool -importcert -keystore /usr/lib/jvm/java-11-openjdk-11.0.17.0.8-2.el7_9.x86_64/lib/security/cacerts -storepass changeit (secret) -alias graylog.domain.com -file cert.pem
If your new at creating self-sign certificates and Graylog then make sure your full path to certs are all the same configuration.
EXample:
Graylog configuration file
http_bind_address = graylog.domain.com:9000
http_publish_uri = https://graylog.domain.com:9000/
http_enable_cors = true
http_enable_tls = true
http_tls_cert_file = /etc/graylog/graylog-certificate.pem
http_tls_key_file = /etc/graylog/graylog-key.pem
http_tls_key_password = secret
Side Note:
In order for the JVM to pick up the new trust store, it has to be started with the JVM parameter -Djavax.net.ssl.trustStore=/path/to/cacerts.jks.
Do you notice it say "NEW " keystore, then if your using the default there is no need for this configuration. you can put in the Full-path to cacerts for testing/troubleshooting.
NOTE: If you do put the passphrase on the certificates , ensure they are correct.
Next is the INPUT.
Once completed restart graylog service to ensure the certs get picked up.
First, There is no need to send a email to community members for this type of issue , please be patient, we do this for free to help others.
Second, when you are configuring HTTPS and/or TCP/TLS look at your logs, see what’s going on. For example, Restart Graylog service and tail -f /var/log/graylog.log file then watch what’s going on, there is probably a clue on what you need to do or google.
Third, there are a lot ( i.e., many) posts here about HTTPS and examples. Talk a look it may help also showing your work will help us help you, the copy & paste probably not a good idea here.
Hope that helps
