# Configuring HTTPS with a docker container **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [November 28, 2017, 2:05pm UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306 "2017-11-28T14:05:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![py.taczynski](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/py.taczynski/32/1031_2.png) [@py.taczynski](https://community.graylog.org/u/py.taczynski)\ **Post date:** [November 28, 2017, 2:05pm UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/1 "2017-11-28T14:05:47Z")
I spent hours reading the documentation and the forum and so far no success. Importing the certificate in the javastore : OK. I was able to get the login page but after the credential input I have a 404 error: Error - the server returned: 404 - cannot POST [http://IP:9000/system/sessions](http://IP:9000/system/sessions) (404) This setting works (no TLS): GRAYLOG\_REST\_TRANSPORT\_URI: [http://IP:9000/api](http://IP:9000/api) GRAYLOG\_WEB\_ENDPOINT\_URI: [http://IP:80/api](http://IP:80/api) Changing the web endpoint to : [https://IP/api](https://IP/api) does not Any advise welcome 🙂 ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 28, 2017, 2:24pm UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/2 "2017-11-28T14:24:38Z")
Please post your complete configuration. ---
**Author:** ![py.taczynski](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/py.taczynski/32/1031_2.png) [@py.taczynski](https://community.graylog.org/u/py.taczynski)\ **Post date:** [November 29, 2017, 9:42am UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/3 "2017-11-29T09:42:17Z")
Here is my docker-compose file: ``` graylog: image: graylog2/server:latest container_name: graylog hostname: graylog environment: GRAYLOG_IS_MASTER: "true" GRAYLOG_PASSWORD_SECRET: somepasswordpepper:) GRAYLOG_ROOT_PASSWORD_SHA2: whocares? GRAYLOG_SERVER_JAVA_OPTS: -Xms2g -Xmx4g -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow GRAYLOG_REST_TRANSPORT_URI: http://IP:9000/api GRAYLOG_WEB_ENDPOINT_URI: http://IP:80/api GRAYLOG_ELASTICSEARCH_HOSTS: http://elasticsearch:9200,http://elasticsearch2:9200 GRAYLOG_MONGODB_URI: mongodb://mongo:27017,mongo2:27017/graylog?replicaSet=graylog GRAYLOG_TRANSPORT_EMAIL_ENABLED: "true" depends_on: - mongo - elasticsearch ports: - "80:9000" - "514:514/tcp" - "514:514/udp" - "1514/udp:1514/udp" - "5044:5044/tcp" - "9000:9000" - "9350:9350" - "12200-12300:12200-12300/tcp" - "12200-12300:12200-12300/udp" - "12900:12900" networks: graylog: aliases: - graylog ``` For HTTPS I add/edit: ``` GRAYLOG_REST_ENABLE_TLS: "true" GRAYLOG_WEB_ENABLE_TLS: "true" GRAYLOG_REST_TLS_CERT_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.cert.pem GRAYLOG_REST_TLS_KEY_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.pkcs8.key.pem GRAYLOG_WEB_TLS_CERT_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.cert.pem GRAYLOG_WEB_TLS_KEY_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.pkcs8.key.pem GRAYLOG_REST_TRANSPORT_URI: https://10.99.107.152:9000/api GRAYLOG_WEB_ENDPOINT_URI: https://10.99.107.152/ - "443:443" ``` I spent so much time tweaking and changing… I’m sure it will be obvious for a fresh eye. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 29, 2017, 9:47am UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/4 "2017-11-29T09:47:36Z")
Please post your complete configuration of the Graylog Docker container (or the complete `docker-compose.yml`) as it is right now. BTW, IP addresses from the 10.0.0.0/8 range are private IP addresses which aren’t routed on the Internet, so you can simply post the configuration as it is without having to redact anything (except for the password secret and root password SHA-256). ---
**Author:** ![py.taczynski](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/py.taczynski/32/1031_2.png) [@py.taczynski](https://community.graylog.org/u/py.taczynski)\ **Post date:** [November 29, 2017, 10:40am UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/5 "2017-11-29T10:40:07Z")
Hi, I know for the 10. range, but I’m a contractor and sometimes this kind of detail is not understood by a manager 🕶 ``` graylog: image: graylog2/server:latest container_name: graylog hostname: graylog environment: GRAYLOG_IS_MASTER: "true" GRAYLOG_PASSWORD_SECRET: somepasswordpepper:) GRAYLOG_ROOT_PASSWORD_SHA2: whocares? GRAYLOG_SERVER_JAVA_OPTS: -Xms2g -Xmx4g -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow GRAYLOG_REST_ENABLE_TLS: "true" GRAYLOG_WEB_ENABLE_TLS: "true" GRAYLOG_REST_TLS_CERT_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.cert.pem GRAYLOG_REST_TLS_KEY_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.pkcs8.key.pem GRAYLOG_WEB_TLS_CERT_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.cert.pem GRAYLOG_WEB_TLS_KEY_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.pkcs8.key.pem GRAYLOG_REST_TRANSPORT_URI: https://10.99.107.152:9000/api GRAYLOG_WEB_ENDPOINT_URI: https://10.99.107.152/ GRAYLOG_ELASTICSEARCH_HOSTS: http://elasticsearch:9200,http://elasticsearch2:9200 GRAYLOG_MONGODB_URI: mongodb://mongo:27017,mongo2:27017/graylog?replicaSet=graylog depends_on: - mongo - elasticsearch ports: - "80:9000" - "443:443" - "514:514/tcp" - "514:514/udp" - "1514/udp:1514/udp" - "5044:5044/tcp" - "9000:9000" - "9350:9350" - "12200-12300:12200-12300/tcp" - "12200-12300:12200-12300/udp" - "12900:12900" networks: graylog: aliases: - graylog ``` ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 29, 2017, 11:01am UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/6 "2017-11-29T11:01:20Z")
> [@py.taczynski](#): > > ```plaintext > GRAYLOG_WEB_ENDPOINT_URI: https://10.99.107.152/ > > ``` The `web_endpoint_uri` setting has to point to the public URI of the Graylog REST API. > > [@py.taczynski](#): > > ```plaintext > - "80:9000" > - "443:443" > > ``` This is most likely wrong and should be: ```plaintext - "443:9000" ``` ---
**Author:** ![py.taczynski](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/py.taczynski/32/1031_2.png) [@py.taczynski](https://community.graylog.org/u/py.taczynski)\ **Post date:** [November 30, 2017, 10:15am UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/7 "2017-11-30T10:15:13Z")
Thank you for pointing me out in the right direction. My mistake was to take for granted a working configuration made by someone else and even reading the web interface doc did not help me to understand the web\_endpoint\_uri problem. Removing this variable made it works now. Here is the final working configuration. > graylog: > image: graylog2/server:latest > container\_name: graylog > hostname: graylog > environment: > GRAYLOG\_IS\_MASTER: “true” > GRAYLOG\_PASSWORD\_SECRET: somepasswordpepper:) > GRAYLOG\_ROOT\_PASSWORD\_SHA2: whoreallycares? > GRAYLOG\_SERVER\_JAVA\_OPTS: -Xms2g -Xmx4g -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow > GRAYLOG\_REST\_ENABLE\_TLS: “true” > GRAYLOG\_WEB\_ENABLE\_TLS: “true” > GRAYLOG\_REST\_TLS\_CERT\_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.cert.pem > GRAYLOG\_REST\_TLS\_KEY\_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.pkcs8.key.pem > GRAYLOG\_WEB\_TLS\_CERT\_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.cert.pem > GRAYLOG\_WEB\_TLS\_KEY\_FILE: /usr/share/graylog/data/config/ssl/graylog.prod.lan.pkcs8.key.pem > GRAYLOG\_REST\_TRANSPORT\_URI: [https://graylog.prod.lan:9000/api](https://graylog.prod.lan:9000/api) > GRAYLOG\_ELASTICSEARCH\_HOSTS: [http://elasticsearch:9200](http://elasticsearch:9200),[http://elasticsearch2:9200](http://elasticsearch2:9200) > GRAYLOG\_MONGODB\_URI: mongodb://mongo:27017,mongo2:27017/graylog?replicaSet=graylog > depends\_on: > - mongo > - elasticsearch > ports: > - “443:9000” > - “514:514/tcp” > - “514:514/udp” > - “1514/udp:1514/udp” > - “5044:5044/tcp” > - “9000:9000” > - “9350:9350” > - “12200-12300:12200-12300/tcp” > - “12200-12300:12200-12300/udp” > - “12900:12900” > networks: > graylog: > aliases: > - graylog ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [December 14, 2017, 10:15am UTC](https://community.graylog.org/t/configuring-https-with-a-docker-container/3306/8 "2017-12-14T10:15:14Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.