# Graylog and https and cert

**URL:** <https://community.graylog.org/t/graylog-and-https-and-cert/19439>\
**Category:** Graylog Central (peer support)\
**Created:** [April 12, 2021, 2:48pm UTC](https://community.graylog.org/t/graylog-and-https-and-cert/19439 "2021-04-12T14:48:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tatuh](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@tatuh](https://community.graylog.org/u/tatuh)\
**Post date:** [April 12, 2021, 2:48pm UTC](https://community.graylog.org/t/graylog-and-https-and-cert/19439/1 "2021-04-12T14:48:31Z")

</div>

My head is spinning so, I need to check…  
I have nginx reverse proxy that serves https.  
Is it correct to use that same cert and key for graylog, when enabling tls (for https traffic) ?

So when adding cert and key as serverFiles for enabling the TLS, I only need to make sure that they are in correct format?

Right?

I keep getting “Caused by: java.security.KeyException: No private key found in file: /etc/graylog/server/server.key”  
But file exists. Would the execption be be same if it would be about the format?

And If I add the files as serverFiles, I guess the permissions are correct out of the box?  
([graylog 1.7.9 · KongZ/kong-z](https://artifacthub.io/packages/helm/kong-z/graylog#tls))

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [April 13, 2021, 1:05am UTC](https://community.graylog.org/t/graylog-and-https-and-cert/19439/2 "2021-04-13T01:05:46Z")

</div>

@tatuh  
Hello,

Maybe I can help you on this issue.

> [@tatuh](#):
>
> Is it correct to use that same cert and key for graylog, when enabling tls (for https traffic) ?

Yes its posible to use the same certs, and I have for my lab Graylog 4.0.6 Server.  
I’m using Apache, but I believe you can also use you certs with Nginx.  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0795e309952f015796a5dedbdb51aa415a296528.png)

> [@tatuh](#):
>
> I only need to make sure that they are in correct format?

Yes, also depeneds on where and how you created your certs.

> [@tatuh](#):
>
> I keep getting “Caused by: java.security.KeyException: No private key found in file: /etc/graylog/server/server.key”

Can Graylog access those Certs?  
What method did you use to create you Certs for Graylog?

This may help.  
[Caused by: java.security.KeyException: No private key found in file:](https://community.graylog.org/t/how-to-configure-graylog-3-0-in-https/8232/2)

> [@tatuh](#):
>
> And If I add the files as serverFiles, I guess the permissions are correct out of the box?  
> ([graylog 1.7.9 · KongZ/kong-z](https://artifacthub.io/packages/helm/kong-z/graylog#tls))

I havent used that before so I’m unsure.

---

<div class="post-metadata">

**Author:** ![sohailmeer](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sohailmeer](https://community.graylog.org/u/sohailmeer)\
**Post date:** [April 13, 2021, 5:45am UTC](https://community.graylog.org/t/graylog-and-https-and-cert/19439/3 "2021-04-13T05:45:24Z")

</div>

you can check with this, I’ve done the same setting from Graylog offical page and it worked for me!

server  
{  
listen 443 ssl http2;  
server\_name [graylog.example.org](http://graylog.example.org);  
# ← your SSL Settings here!

```
location /
{
  proxy_set_header Host $http_host;
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Forwarded-Server $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Graylog-Server-URL https://$server_name/;
  proxy_pass http://127.0.0.1:9000;
}

```

}

---

<div class="post-metadata">

**Author:** ![tatuh](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@tatuh](https://community.graylog.org/u/tatuh)\
**Post date:** [April 13, 2021, 6:24am UTC](https://community.graylog.org/t/graylog-and-https-and-cert/19439/4 "2021-04-13T06:24:56Z")

</div>

Thank you so much for advices.

Managed to add cert and key correctly. TLS is now enabled.

But now I’m getting “502 bad gateway - nginx”, for both http and https.

Edit: fixed the 502, needed annotation for nginx:  
[https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-protocol](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-protocol)

---

<div class="post-metadata">

**Author:** ![tatuh](https://avatars.discourse-cdn.com/v4/letter/t/74df32/32.png) [@tatuh](https://community.graylog.org/u/tatuh)\
**Post date:** [April 14, 2021, 2:41pm UTC](https://community.graylog.org/t/graylog-and-https-and-cert/19439/5 "2021-04-14T14:41:03Z")

</div>

Web interface is working now on https. But /api is failing, I quess I need to add cert JVM trust store and use it, as pointed out in documentation.

Just having trouble to add do it on k8s, makes me wonder it would be nice to have ca signed certificate. Atm, trying to follow script over here: [[stable/graylog] elasticsearch and tls · Issue #17399 · helm/charts · GitHub](https://github.com/helm/charts/issues/17399)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 28, 2021, 2:41pm UTC](https://community.graylog.org/t/graylog-and-https-and-cert/19439/6 "2021-04-28T14:41:39Z")

</div>

Closed on April 28, 2021, 2:41pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.