# Graylog 3.2 + https - pkix error **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [February 6, 2020, 5:20pm UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832 "2020-02-06T17:20:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![gfcarvalho](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gfcarvalho](https://community.graylog.org/u/gfcarvalho)\ **Post date:** [February 6, 2020, 5:20pm UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832/1 "2020-02-06T17:20:01Z")
Hey guys I now that there are a bunch of question here about Graylog + HTTPs, i had read them and tryed multiple times to set this thing but i coudn’t, can you guys help? Basically my problem is the same that was posted here [Graylog 3.2 https problem](https://community.graylog.org/t/graylog-3-2-https-problem/13421) (not by me) I’m using Graylog 3.2 (original install was 3.0, fter this i did upgrade to 3.1 and now Graylog 3.2.1+dbaac33 on sv (Private Build 1.8.0\_242 on Linux 5.3.0-28-generic)) My OS is " Ubuntu 18.04.4 LTS (Bionic Beaver)", VM on Hyper-V Server 2012 openssl-graylog.cnf is: ##### [req] distinguished\_name = req\_distinguished\_name x509\_extensions = v3\_req prompt = no # Details about the issuer of the certificate [req\_distinguished\_name] C = BR ST = PR L = Matriz O = My Company OU = TI CN = sv [v3\_req] keyUsage = keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt\_names # IP addresses and DNS names the certificate should include # Use IP.### for IP addresses and DNS.### for DNS names, # with “###” being a consecutive number. [alt\_names] IP.1 = 192.168.20.11 ##### I used the documentation for Graylog 3.2 with https and those files were generated: ##### cert.pem openssl-graylog.cnf pkcs5-plain.pem pkcs8-encrypted.pem pkcs8-plain.pem ##### i did a copy of the cacerts file into /etc/graylog/server/cacerts.jks then imported the cert.pem On /etc/defaults/graylog-server i added “-XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Djavax.net.ssl.trustStore=/etc/graylog/server/cacerts.jks -Djavax.net.ssl.trustStorePassword=pass” my server.conff has: ##### http\_enable\_tls = true http\_tls\_cert\_file = /etc/graylog/server/cert.pem http\_tls\_key\_file = /etc/graylog/server/pkcs8-encrypted.pem http\_tls\_key\_password = pass ##### When i restart the graylog service i end up with " Windows Terminal PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" Can you guys help? Thanks ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 9, 2020, 12:21pm UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832/2 "2020-02-09T12:21:31Z")
what is your configruation in Graylog for the `http_*` settings at all? ---
**Author:** ![gfcarvalho](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gfcarvalho](https://community.graylog.org/u/gfcarvalho)\ **Post date:** [February 10, 2020, 5:11pm UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832/3 "2020-02-10T17:11:18Z")
Hi @jan I tested with: http\_bind\_address = 192.168.20.11:9000 http\_external\_uri = https:// 192.168.20.11:9000/ http\_enable\_tls = true http\_tls\_cert\_file = /etc/graylog/server/cert.pem http\_tls\_key\_file = /etc/graylog/server/pkcs8-encrypted.pem http\_tls\_key\_password = pass ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 10, 2020, 5:44pm UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832/4 "2020-02-10T17:44:15Z")
he @gfcarvalho that looks ok - like it should. The question now, how did you import the cacert to the java keystore at all? ---
**Author:** ![gfcarvalho](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gfcarvalho](https://community.graylog.org/u/gfcarvalho)\ **Post date:** [February 10, 2020, 5:53pm UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832/5 "2020-02-10T17:53:17Z")
Well, first i did a copy the ‘cacerts’ file to the graylog server: > Blockquote > cp -a /etc/ssl/certs/java/cacerts /etc/graylog/server/cacerts.jks For somereason the file permission wasn’t ok so i the /etc/graylog/server folder i used: > Blockquote > chmod --reference=server.conf cacerts.jks And finally: > Blockquote > keytool -importcert -keystore /etc/graylog/server/cacerts.jks -storepass pass -alias graylog-self-signed -file cert.pem On /etc/defaults/graylog-server i changed the GRAYLOG\_SERVER\_JAVA\_OPTS to: > Blockquote > “-Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNe > wGC -XX:-OmitStackTraceInFastThrow -Djavax.net.ssl.trustStore=/etc/graylog/server/cacerts.jks -Djavax.net.ssl.trustStorePassword=pass” ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 11, 2020, 7:45am UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832/6 "2020-02-11T07:45:08Z")
he @gfcarvalho to import the CA - did you created a DER file from the capem, like I do here in the ShadowCA: > That might be the reason it is currently not working. That you do not have a x509 certificate - but that is just guessing. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 25, 2020, 7:47am UTC](https://community.graylog.org/t/graylog-3-2-https-pkix-error/13832/7 "2020-02-25T07:47:33Z")
Closed on February 25, 2020, 7:47am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.