# Graylog-certificate

**URL:** <https://community.graylog.org/t/graylog-certificate/20677>\
**Category:** Graylog Central (peer support)\
**Created:** [July 29, 2021, 8:13am UTC](https://community.graylog.org/t/graylog-certificate/20677 "2021-07-29T08:13:35Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [July 29, 2021, 8:13am UTC](https://community.graylog.org/t/graylog-certificate/20677/1 "2021-07-29T08:13:36Z")

</div>

Hey,

I am currently trying to build a Graylog server. This looks like the following:  
The graylog server does http and works like that without problems. As soon as I let a Nginx-proxy-manager do the HTTPS encryption in front of it, it doesn’t work anymore. So that means it runs and also accepts logs and so. But it can not retrieve any information about the API (see pictures). I have already added the public key to the JKS and also the Docker container has it in its CA store. A CURL goes through without problems, only the Graylog is stubborn^^. I hope someone can help me with this. Thanks a lot in advance.

 ![DeepinBildschirmfoto_Bereich auswählen_20210729101014](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2fe9aaa523edf2b88d9e6cc5a8afc39fd61e8acc.png)

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 29, 2021, 10:59am UTC](https://community.graylog.org/t/graylog-certificate/20677/2 "2021-07-29T10:59:52Z")

</div>

Please post your Nginx configuration and your graylog version.

---

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [July 29, 2021, 11:09am UTC](https://community.graylog.org/t/graylog-certificate/20677/3 "2021-07-29T11:09:07Z")

</div>

Thanks for the quick reply. I use Nginx proxy manager. This is configured via nen web gui. I can only say that I just forward any traffic to port 9000 (This port is listening to the Graylog REST API and also the webinterface). I am currently using Graylog version 2.5.1.

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 29, 2021, 11:16am UTC](https://community.graylog.org/t/graylog-certificate/20677/4 "2021-07-29T11:16:58Z")

</div>

Did you follow official docs for it? Especially required header `X-Graylog-Server-URL`

Anyway, why you use such old graylog version? If you build new system, always use latest build (4.1), because older version are not supported.

[https://docs.graylog.org/en/4.1/pages/faq.html#how-long-do-you-support-older-versions-of-the-graylog-product](https://docs.graylog.org/en/4.1/pages/faq.html#how-long-do-you-support-older-versions-of-the-graylog-product)

---

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [July 29, 2021, 11:23am UTC](https://community.graylog.org/t/graylog-certificate/20677/5 "2021-07-29T11:23:02Z")

</div>

Unfortunately I have to use this version because it can’t be updated yet. If I have understood the header correctly, this is not relevant for me. The reverse proxy is only used for encryption and port mapping. The server itself also has the DNS entry and is also reachable.

---

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [July 29, 2021, 11:25am UTC](https://community.graylog.org/t/graylog-certificate/20677/6 "2021-07-29T11:25:13Z")

</div>

I’m afraid that Graylog doesn’t read the JKS and therefore doesn’t know the certificate. However, I have included and added this when building my Docker Conatiners. Furthermore also in the container the Env: “GRAYLOG\_SERVER\_JAVA\_OPTS=-Xms1g -Xmx1g -Djavax.net.ssl.trustStore=/usr/share/graylog/cacerts.jks -Djavax.net.ssl.trustStorePassword=\*\*\*\*” is set.

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 29, 2021, 1:15pm UTC](https://community.graylog.org/t/graylog-certificate/20677/7 "2021-07-29T13:15:18Z")

</div>

If you use nginx as reverse proxy for graylog web UI, you need to set this special header

[https://docs.graylog.org/en/2.5/pages/configuration/web\_interface.html#nginx](https://docs.graylog.org/en/2.5/pages/configuration/web_interface.html#nginx)

It is required for all reverse proxy software, not only nginx.

Someone in the past have similar problem, maybe this can help.

> [@Changing http\_external\_uri makes Graylog inaccessible inside](https://community.graylog.org/t/changing-http-external-uri-makes-graylog-inaccessible-inside/13338/2):
>
> OVA not for production use if you have nginx, you have to change the graylog URL in the proxy. The web UI use a header field to connect to the GL server. Check the documentation. [https://docs.graylog.org/en/3.1/pages/configuration/web\_interface.html](https://docs.graylog.org/en/3.1/pages/configuration/web_interface.html)

---

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [July 29, 2021, 1:34pm UTC](https://community.graylog.org/t/graylog-certificate/20677/8 "2021-07-29T13:34:49Z")

</div>

Thanks for the answer. Unfortunately this changes nothing. The problem that Graylog does not accept the certificate remains.

---

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [July 30, 2021, 5:49am UTC](https://community.graylog.org/t/graylog-certificate/20677/9 "2021-07-30T05:49:02Z")

</div>

So, I have now switched to Nginx. For this I have also set the header entry as you said. The problem now is that I get a 404 when logging in: “Error - the server returned: 404 - cannot POST https://\*\*\*\*\*/system/sessions (404)”. I have already read the threads about this in the forum and it just all brings nothing. I don’t know what to do. If you have an idea I am open for everything ^^.

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 30, 2021, 10:33am UTC](https://community.graylog.org/t/graylog-certificate/20677/10 "2021-07-30T10:33:02Z")

</div>

If you want only terminate SSL/TLS on nginx (https), don’t setup SSL/TLS on graylog at all.

This simple nginx config redirect from http to https, and expose graylog web ui in https:

```auto
server {
  listen 80;
  server_name logs.server.com;
  return 301 https://logs.server.com$request_uri;
}
 
server {
    listen 443 ssl http2;
 
    server_name logs.server.com;
    ssl on;
    ssl_certificate /etc/pki/web/server.com.crt;
    ssl_certificate_key /etc/pki/web/server.com.key;
 
    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Graylog-Server-URL https://$server_name/;
        proxy_pass http://127.0.0.1:9000;
    }
}

```

---

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [July 30, 2021, 10:46am UTC](https://community.graylog.org/t/graylog-certificate/20677/11 "2021-07-30T10:46:25Z")

</div>

My Config:

```auto
{
    listen 443 ssl http2;
    server_name loghost-test1. *****.de;
    ssl_protocols TLSv1.2;
    ssl_certificate / ***/**** ;
    ssl_certificate_key / ******/***** ; 

    location /
    {
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      #proxy_set_header X-Graylog-Server-URL https://loghost-test1. ****.de/;
      proxy_pass http://10.32.1.159:5000;

    }

}
```

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 30, 2021, 10:59am UTC](https://community.graylog.org/t/graylog-certificate/20677/12 "2021-07-30T10:59:50Z")

</div>

This seem OK, so problem would be probably in graylog server config. I can’t help much, because I don’t use such old version, and the parameters changed a lot.

---

<div class="post-metadata">

**Author:** ![ItsTimetoforget](https://avatars.discourse-cdn.com/v4/letter/i/8e8cbc/32.png) [@ItsTimetoforget](https://community.graylog.org/u/ItsTimetoforget)\
**Post date:** [August 2, 2021, 5:14am UTC](https://community.graylog.org/t/graylog-certificate/20677/13 "2021-08-02T05:14:21Z")

</div>

Thank you very much. Now i would run the Server on http. As soon as possible i try to update Graylog on the latest version.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 16, 2021, 5:14am UTC](https://community.graylog.org/t/graylog-certificate/20677/14 "2021-08-16T05:14:30Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.