# Graylog crashes on startup if HTTPS is enabled

**URL:** <https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133>\
**Category:** Graylog Central (peer support)\
**Created:** [April 24, 2020, 2:33pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133 "2020-04-24T14:33:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 2:33pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/1 "2020-04-24T14:33:01Z")

</div>

I followed all the instructions on [http://docs.graylog.org/en/3.2/pages/configuration/https.html#things-to-consider](http://docs.graylog.org/en/3.2/pages/configuration/https.html#things-to-consider)  
including importing the certificate I issued Graylog into the JVM keystore (I would’ve imported my actual CA’s certificate, but I read that JVM can’t support 4096 bit key lengths?), and everytime Graylog tries starting it crashes with this Java exception:

> java.lang.IllegalStateException: Expected to be healthy after starting. The following services are not running: {FAILED=[JerseyService [FAILED]]}  
> at com.google.common.util.concurrent.ServiceManager$ServiceManagerState.checkHealthy(ServiceManager.java:741) ~[graylog.jar:?]  
> at com.google.common.util.concurrent.ServiceManager$ServiceManagerState.awaitHealthy(ServiceManager.java:553) ~[graylog.jar:?]  
> at com.google.common.util.concurrent.ServiceManager.awaitHealthy(ServiceManager.java:314) ~[graylog.jar:?]  
> at org.graylog2.bootstrap.ServerBootstrap.startCommand(ServerBootstrap.java:161) [graylog.jar:?]  
> at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:210) [graylog.jar:?]  
> at org.graylog2.bootstrap.Main.main(Main.java:50) [graylog.jar:?]  
> Suppressed: com.google.common.util.concurrent.ServiceManager$FailedService: JerseyService [FAILED]  
> Caused by: java.io.IOException: ObjectIdentifier() – data isn’t an object ID (tag = 48)  
> at sun.security.util.ObjectIdentifier.(ObjectIdentifier.java:257) ~[?:1.8.0\_242]  
> at sun.security.util.DerInputStream.getOID(DerInputStream.java:314) ~[?:1.8.0\_242]  
> at com.sun.crypto.provider.PBES2Parameters.engineInit(PBES2Parameters.java:267) ~[sunjce\_provider.jar:1.8.0\_242]  
> at java.security.AlgorithmParameters.init(AlgorithmParameters.java:293) ~[?:1.8.0\_242]  
> at sun.security.x509.AlgorithmId.decodeParams(AlgorithmId.java:132) ~[?:1.8.0\_242]  
> at sun.security.x509.AlgorithmId.(AlgorithmId.java:114) ~[?:1.8.0\_242]  
> at sun.security.x509.AlgorithmId.parse(AlgorithmId.java:372) ~[?:1.8.0\_242]  
> at javax.crypto.EncryptedPrivateKeyInfo.(EncryptedPrivateKeyInfo.java:95) ~[?:1.8.0\_242]  
> at org.graylog2.shared.security.tls.PemKeyStore.generateKeySpec(PemKeyStore.java:69) ~[graylog.jar:?]  
> at org.graylog2.shared.security.tls.PemKeyStore.buildKeyStore(PemKeyStore.java:98) ~[graylog.jar:?]  
> at org.graylog2.shared.initializers.JerseyService.buildSslEngineConfigurator(JerseyService.java:347) ~[graylog.jar:?]  
> at org.graylog2.shared.initializers.JerseyService.startUpApi(JerseyService.java:172) ~[graylog.jar:?]  
> at org.graylog2.shared.initializers.JerseyService.startUp(JerseyService.java:146) ~[graylog.jar:?]  
> at com.google.common.util.concurrent.AbstractIdleService$DelegateService$1.run(AbstractIdleService.java:62) ~[graylog.jar:?]  
> at com.google.common.util.concurrent.Callables$4.run(Callables.java:119) ~[graylog.jar:?]  
> at java.lang.Thread.run(Thread.java:748) ~[?:1.8.0\_242]

I cannot find online what Java means in this case by “data isn’t an object ID”…

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 2:42pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/2 "2020-04-24T14:42:01Z")

</div>

I tried the same for a Input. But still got a similar error.

> 2020-04-24T16:31:18.999+02:00 WARN [ChannelInitializer] Failed to initialize a channel. Closing: [id: 0x86929380, L:/xxx.xxx.xxx.xxx:5044 - R:/xxx.xxx.xxx.xxx:56551]  
> java.lang.IllegalArgumentException: File does not contain valid private key: /etc/graylog/server/pem\_key.pk8  
> at io.netty.handler.ssl.SslContextBuilder.keyManager(SslContextBuilder.java:350) ~[graylog.jar:?]  
> at io.netty.handler.ssl.SslContextBuilder.forServer(SslContextBuilder.java:107) ~[graylog.jar:?]  
> at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$3.createSslEngine(AbstractTcpTransport.java:329) ~[graylog.jar:?]  
> at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$3.call(AbstractTcpTransport.java:305) ~[graylog.jar:?]  
> at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$3.call(AbstractTcpTransport.java:301) ~[graylog.jar:?]  
> at org.graylog2.plugin.inputs.transports.NettyTransport$1.initChannel(NettyTransport.java:105) ~[graylog.jar:?]  
> at io.netty.channel.ChannelInitializer.initChannel(ChannelInitializer.java:129) [graylog.jar:?]  
> at io.netty.channel.ChannelInitializer.handlerAdded(ChannelInitializer.java:112) [graylog.jar:?]  
> at io.netty.channel.AbstractChannelHandlerContext.callHandlerAdded(AbstractChannelHandlerContext.java:956) [graylog.jar:?]  
> at io.netty.channel.DefaultChannelPipeline.callHandlerAdded0(DefaultChannelPipeline.java:609) [graylog.jar:?]  
> at io.netty.channel.DefaultChannelPipeline.access$100(DefaultChannelPipeline.java:46) [graylog.jar:?]  
> at io.netty.channel.DefaultChannelPipeline$PendingHandlerAddedTask.execute(DefaultChannelPipeline.java:1463) [graylog.jar:?]  
> at io.netty.channel.DefaultChannelPipeline.callHandlerAddedForAllHandlers(DefaultChannelPipeline.java:1115) [graylog.jar:?]  
> at io.netty.channel.DefaultChannelPipeline.invokeHandlerAddedIfNeeded(DefaultChannelPipeline.java:650) [graylog.jar:?]  
> at io.netty.channel.AbstractChannel$AbstractUnsafe.register0(AbstractChannel.java:502) [graylog.jar:?]  
> at io.netty.channel.AbstractChannel$AbstractUnsafe.access$200(AbstractChannel.java:417) [graylog.jar:?]  
> at io.netty.channel.AbstractChannel$AbstractUnsafe$1.run(AbstractChannel.java:474) [graylog.jar:?]  
> at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:164) [graylog.jar:?]  
> at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472) [graylog.jar:?]  
> at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:387) [graylog.jar:?]  
> at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) [graylog.jar:?]  
> at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [graylog.jar:?]  
> at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0\_242]  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0\_242]  
> at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]  
> at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_242]  
> Caused by: java.io.IOException: ObjectIdentifier() – data isn’t an object ID (tag = 48)  
> at sun.security.util.ObjectIdentifier.(ObjectIdentifier.java:257) ~[?:1.8.0\_242]  
> at sun.security.util.DerInputStream.getOID(DerInputStream.java:314) ~[?:1.8.0\_242]  
> at com.sun.crypto.provider.PBES2Parameters.engineInit(PBES2Parameters.java:267) ~[sunjce\_provider.jar:1.8.0\_242]  
> at java.security.AlgorithmParameters.init(AlgorithmParameters.java:293) ~[?:1.8.0\_242]  
> at sun.security.x509.AlgorithmId.decodeParams(AlgorithmId.java:132) ~[?:1.8.0\_242]  
> at sun.security.x509.AlgorithmId.(AlgorithmId.java:114) ~[?:1.8.0\_242]  
> at sun.security.x509.AlgorithmId.parse(AlgorithmId.java:372) ~[?:1.8.0\_242]  
> at javax.crypto.EncryptedPrivateKeyInfo.(EncryptedPrivateKeyInfo.java:95) ~[?:1.8.0\_242]  
> at io.netty.handler.ssl.SslContext.generateKeySpec(SslContext.java:1072) ~[graylog.jar:?]  
> at io.netty.handler.ssl.SslContext.getPrivateKeyFromByteBuffer(SslContext.java:1133) ~[graylog.jar:?]  
> at io.netty.handler.ssl.SslContext.toPrivateKey(SslContext.java:1113) ~[graylog.jar:?]  
> at io.netty.handler.ssl.SslContextBuilder.keyManager(SslContextBuilder.java:348) ~[graylog.jar:?]  
> … 26 more

I setup a Apache as a reverse proxy for SSL, this works without any Problem.

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 2:42pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/3 "2020-04-24T14:42:38Z")

</div>

Is there a guide I can follow?

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 2:55pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/4 "2020-04-24T14:55:19Z")

</div>

Here: [https://docs.graylog.org/en/3.2/pages/configuration/https.html#ssl-setup](https://docs.graylog.org/en/3.2/pages/configuration/https.html#ssl-setup)  
But this will not work I think. Or you want Information for reverse proxy config?

Here are some specs of my test environment:  
OS: CentOS Linux release 8.1.1911 (Core)  
Java: openjdk version “1.8.0\_242”  
OpenJDK Runtime Environment (build 1.8.0\_242-b08)  
OpenJDK 64-Bit Server VM (build 25.242-b08, mixed mode)  
Graylog Server: 3.2.4

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 2:56pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/5 "2020-04-24T14:56:51Z")

</div>

Hmm, that may be right! I’m using a single node setup, I think the HTTPs instructions are assuming you’re running multiple? haha

If you could share config for reverse proxy I think it’d help a ton. This will be my first time working with proxies and apache. 🙂

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:05pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/6 "2020-04-24T15:05:43Z")

</div>

I use single Node for this test environment too.  
[https://docs.graylog.org/en/3.2/pages/configuration/web\_interface.html#apache-httpd-2-x](https://docs.graylog.org/en/3.2/pages/configuration/web_interface.html#apache-httpd-2-x)  
You can use a simple config like this for Apache.

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:08pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/7 "2020-04-24T15:08:35Z")

</div>

What OS are you using?

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 3:12pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/8 "2020-04-24T15:12:21Z")

</div>

Ubuntu 18.04.4

(empty space cause my comment has to be longer than 20 characters 😂)

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:13pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/9 "2020-04-24T15:13:48Z")

</div>

You can use something like this.

```
ServerName your.host.name
    <VirtualHost *:80>
       ServerName your.host.name
       Redirect / https://your.host.name
    </VirtualHost>
    <VirtualHost *:443>
        ServerName your.host.name
        ProxyRequests Off
        SSLEngine on
        SSLCertificateFile /etc/pki/tls/certs/your.host.name.crt
        SSLCertificateKeyFile /etc/pki/tls/private/your.host.name.key
        SSLCertificateChainFile /etc/pki/tls/certs/ca.crt

        <Proxy *>
            Order deny,allow
            Allow from all
        </Proxy>

        <Location />
            RequestHeader set X-Graylog-Server-URL "https://your.host.name/"
            ProxyPass http://127.0.0.1:9000/
            ProxyPassReverse http://127.0.0.1:9000/
        </Location>
    </VirtualHost>
```

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:16pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/10 "2020-04-24T15:16:58Z")

</div>

But I hope that someone can help for the real Problem with the

> data isn’t an object ID (tag = 48)

issue. I don’t know why my keyfile will not work.  
Maybe @jan can help us?

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 3:18pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/11 "2020-04-24T15:18:38Z")

</div>

Is your .key file not encrypted? If it is, shouldn’t I have to specify the password for it in here?

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:22pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/12 "2020-04-24T15:22:47Z")

</div>

Key file is encrypted, like described in the doc.  
X.509 for certificates and PKCS#8 for the private keys. Both are stored in PEM format.  
And my ca and the cert is in the JKS cacerts for Graylog.

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 3:24pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/13 "2020-04-24T15:24:41Z")

</div>

So, with Apache2 being the reverse proxy, does that mean I disable HTTPs for Graylog? So what’s basically happening is I’m routing secure traffic to Graylog through Apache first?

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:27pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/14 "2020-04-24T15:27:44Z")

</div>

Correct, that is like I set it up. If I try to set it without a reverse proxy, I have the same problem like you.  
So I go with this… but I will secure the Inputs too. So I tried this also, but get this Problem there also.

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 3:31pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/15 "2020-04-24T15:31:50Z")

</div>

Okay. I changed Graylog to HTTP and configured Apache2 (Apache2’s service says it’s running fine" but when I try to access the hostname I get this:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3243fe075dd96b2feb024e5cea481d323bff7216.png)

This is repeating in the Apache2 error log:

> AH01144: No protocol handler was valid for the URL /. If you are using a DSO version of mod\_proxy, make sure the proxy submodules are included in the configuration using LoadModule.

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:41pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/16 "2020-04-24T15:41:47Z")

</div>

You have to use the right names, and the name(s) and IP(s) sould be in your cert.

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 3:42pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/17 "2020-04-24T15:42:59Z")

</div>

Nevermind, got it. Had to enable Apache2 mod proxy\_http.

It’s working!!! Thank you so much @x-wolverine-x!! You don’t know how long I’ve been working on getting Graylog to run HTTPS. You deserve a cookie my friend. 🙂🍪

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:50pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/18 "2020-04-24T15:50:02Z")

</div>

You’re welcome, that’s the way it should be in a community. But I really hope that someone can say something about the real problem. If you want to secure your Inputs too… you will encounter the problem again. ☹

---

<div class="post-metadata">

**Author:** ![Setherz6104](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/setherz6104/32/5996_2.png) [@Setherz6104](https://community.graylog.org/u/Setherz6104)\
**Post date:** [April 24, 2020, 3:52pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/19 "2020-04-24T15:52:48Z")

</div>

Yes, hopefully! I posted something about this months back but didn’t get much help ☹

---

<div class="post-metadata">

**Author:** ![x-wolverine-x](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/x-wolverine-x/32/5009_2.png) [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)\
**Post date:** [April 24, 2020, 3:54pm UTC](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133/20 "2020-04-24T15:54:24Z")

</div>

😮 this is really bad… I hope it will change now 🤞

[Next page](https://community.graylog.org/t/graylog-crashes-on-startup-if-https-is-enabled/15133.md?page=2)