Graylog 6.0.4 Active Directory setup

[hebval]

1. Describe your incident:
I can’t configure the Active Directory Authentication Service. When I set up my server address, the username, and the password, I get the following error message :

• An error occurred while attempting to connect to server myserver.com:636: IOException(LDAPException(resultCode=91 (connect error), errorMessage=‘An error occurred while attempting to establish a connection to server myserver.com/X.X.X.X:636: SSLHandshakeException(PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target), ldapSDKVersion=7.0.0, revision=323ff4fd3d622b96522298f300abc6915d0c209b’))

2. Describe your environment:

• OS Information: Debian 12

• Package Version:6.0.4

• Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

I added my root CA to the Debian certificate store, but I guess I need to add it to the JVM store ? But I can’t find it…

4. How can the community help?
Help me finding out how to install my root CA to the JVM certificate store. My install is pretty basic, everything is by default, freshly installed. Thanks !

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[Wine_Merchant]

Hello @hebval,

Graylog ships with java and the keystore can be found here /usr/share/graylog-server/jvm/lib/security/cacerts, it is recommended you make a copy of this keystore to /etc/graylog (or wherever) and use that. Make sure the copy have the correct permissions and ownership.

[drewmiranda-gl (Drew Miranda)]

This article covers the basics of working with the keystore and how to configure graylog to use it: How-To Guide: Securing Graylog with TLS

[hebval]

Hey @Wine_Merchant & @drewmiranda-gl, thanks to both of you ! I didn’t have my root CA added to the Java Key Store. Now it’s all good. Have a nice day.