# Graylog HTTPS signature check failed **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [October 31, 2017, 12:23pm UTC](https://community.graylog.org/t/graylog-https-signature-check-failed/2968 "2017-10-31T12:23:45Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jaikumarkrishna](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jaikumarkrishna/32/1101_2.png) [@jaikumarkrishna](https://community.graylog.org/u/jaikumarkrishna)\ **Post date:** [October 31, 2017, 12:23pm UTC](https://community.graylog.org/t/graylog-https-signature-check-failed/2968/1 "2017-10-31T12:23:45Z")
Hi All, I am trying to setup the SSL/TLS in graylog by using the following [documentation](http://docs.graylog.org/en/2.3/pages/configuration/https.html) but however i am getting the following error response and I am unable to proceed further. ``` 2017-10-31T12:07:42.380Z WARN [ProxiedResource] Unable to call https://130.211.227.109:9000/api/system/metrics/multiple on node <9d796bc5-acf0-4383-a933-0d377cbd7edc> javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check fai led at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[?:1.8.0_131] at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) ~[?:1.8.0_131] at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) ~[?:1.8.0_131] at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) ~[?:1.8.0_131] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1514) ~[?:1.8.0_131] at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:1.8.0_131] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026) ~[?:1.8.0_131] at sun.security.ssl.Handshaker.process_record(Handshaker.java:961) ~[?:1.8.0_131] at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) ~[?:1.8.0_131] at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) ~[?:1.8.0_131] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403) ~[?:1.8.0_131] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) ~[?:1.8.0_131] at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:242) ~[graylog.jar:?] at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:200) ~[graylog.jar:?] at okhttp3.internal.connection.RealConnection.buildConnection(RealConnection.java:174) ~[graylog.jar:?] at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:114) ~[graylog.jar:?] at okhttp3.internal.connection.StreamAllocation.findConnection(StreamAllocation.java:196) ~[graylog.jar:?] at okhttp3.internal.connection.StreamAllocation.findHealthyConnection(StreamAllocation.java:132) ~[graylog.jar:?] at okhttp3.internal.connection.StreamAllocation.newStream(StreamAllocation.java:101) ~[graylog.jar:?] at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:42) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67) ~[graylog.jar:?] at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:93) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67) ~[graylog.jar:?] at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92) ~[graylog.jar:?] at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:120) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67) ~[graylog.jar:?] at org.graylog2.rest.RemoteInterfaceProvider.lambda$get$0(RemoteInterfaceProvider.java:59) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92) ~[graylog.jar:?] at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67) ~[graylog.jar:?] at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:179) ~[graylog.jar:?] Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:352) ~[?:1.8.0_131] at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:260) ~[?:1.8.0_131] at sun.security.validator.Validator.validate(Validator.java:260) ~[?:1.8.0_131] at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:1.8.0_131] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) ~[?:1.8.0_131] at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) ~[?:1.8.0_131] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496) ~[?:1.8.0_131] ``` I am using Ubuntu 14.04 + Graylog 2.3 + Elasticsearch 5.x version and I have added the self signed certificate (cert.pem) to the keystore and I used the below command to verified that certificate is added. ``` jaikumarvin@graylogvm-1:~$ keytool -keystore /etc/graylog/cacerts.jks -storepass changeme -list | grep 130.211.227.109 -A1 130.211.227.109, Oct 31, 2017, trustedCertEntry, Certificate fingerprint (SHA1): 21:D2:95:9A:5D:1B:F4:F5:2D:0A:C0:D3:94:4C:07:51:FA:D4:AE:F4 ``` and further I have added the new JVM truststore in the Graylog JAVAOPTS variable in the location **(/etc/default/graylog-server)** Please correct me if I am doing anything wrong and share your thoughts. Regards, Jayakumar ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [November 6, 2017, 8:06am UTC](https://community.graylog.org/t/graylog-https-signature-check-failed/2968/2 "2017-11-06T08:06:23Z")
Hej @jaikumarkrishna looks like your format is not the one Graylog expects … you might want to use this [script](https://github.com/jalogisch/bartwickelmaschine/blob/master/create_self_signed_ssl_certs/create_ssl_certs.sh) to create your certificates in the correct format. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [November 20, 2017, 8:06am UTC](https://community.graylog.org/t/graylog-https-signature-check-failed/2968/3 "2017-11-20T08:06:34Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.