Graylog 3.1.3 TLS Single Node Issue

Graylog Central (peer support)
1

I’m having an issue with Graylog ova i’ve deployed for testing. I followed the guide here: http://docs.graylog.org/en/latest/pages/configuration/https.html and am having some issues getting this configured. I tried looking over some of the previous forum posts about this issue, but I haven’t found a solution that has worked for me. I have configured the server with a single static IP address and our primary and secondary DNS servers. I have included both the server’s IP address and our DNS servers in the .cnf file when creating the self signed cert.

I tried adding the self-signed certificate to the JVM trust store, but that didn’t seem to help (I returned to a previous snapshot for all the information below). Do I need to add the cert to the JVM trust store for my configuration?

Otherwise, is there anything else I can try?
Thank you,

Graylog: graylog-3.1.3-1.ova
Type: Single Node, Single VM
License: Free Enterprise

server.log: pastebin com/kZt2kM95

server.conf: pastebin com/08qWBLa4

openssl-graylog.cnf:

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = XX
ST = XXXXX
L = XXXXXX
O = XXXXXX
OU = XXX XXXX
CN = XXXXXXXXX.LOCAL

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
IP.1 = XXX.XXX.XXX.XXX
DNS.1 = XXX.XXX.XXX.XXX
DNS.2 = XXX.XXX.XXX.XXX

Commands used to configure TLS:

openssl req -x509 -days 1095 -nodes -newkey rsa:4096 -config openssl-graylog.cnf -keyout pkcs5-plain.pem -out cert.pem
openssl pkcs8 -in pkcs5-plain.pem -topk8 -nocrypt -out pkcs8-plain.pem
openssl pkcs8 -in pkcs5-plain.pem -topk8 -out pkcs8-encrypted.pem -passout pass:XXXXXXXXX
chmod 0644 pkcs8-encrypted.pem

2

he @VaughnSch

I have create the shadowCA - a script https://github.com/graylog-labs/shadowCA - to help with that situation.

You might find this useful or you can sneak in the commands I use to correct your issue.

3

Jan,
I tried using the scripts you provided to recreate my certificates and create a CA, but I am still having the same issue. Instead of using the .ova I installed CentOS and setup Graylog again. I have nginx setup with https, but the Graylog server is still shutting down with the same error. Any hints to what part of the environment might be causing my issue?
Thanks,

4

He @VaughnSch

if you enable tls in the configuration you should explicit set http_publish_uri with https://yourgraylog - that Graylog itself is aware that it needs to connect to itself via https.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.