# Graylog Unable to call https://....:9000/api \[RESOLVED\]

**URL:** <https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469>\
**Category:** Graylog Central (peer support)\
**Created:** [March 15, 2017, 11:06am UTC](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469 "2017-03-15T11:06:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ARogovsky](https://avatars.discourse-cdn.com/v4/letter/a/8edcca/32.png) [@ARogovsky](https://community.graylog.org/u/ARogovsky)\
**Post date:** [March 15, 2017, 11:06am UTC](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469/1 "2017-03-15T11:06:16Z")

</div>

Graylog provides https web-interface but dont able to call api https self  
I was created self-signet certificate and add it to java keystore, but this is not help  
There is sample logs lines:

```auto
2017-03-15_10:41:11.89999 2017-03-15 10:41:11,899 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Unable to call https://10.1.1.20:9000/api/system/metrics/multiple on node <64aef9c9-c5fb-4ee7-b7d3-440a0e24094b>
2017-03-15_10:41:11.90061 javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

```

```auto
/opt/graylog/embedded/jre/bin/keytool -keystore cacerts.jks -storepass changeit -list | grep graylog-self-signed -A1
graylog-self-signed, Mar 14, 2017, trustedCertEntry,
Certificate fingerprint (SHA1): 2A:C3:8A:F3:85:22:87:3B:C9:1D:9E:03:82:18:D8:F5:9C:DC:A3:BB

```

So, certificate is installed.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 15, 2017, 11:54am UTC](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469/2 "2017-03-15T11:54:56Z")

</div>

Please post the complete output of the following commands:

```nohighlight
$ echo -n | openssl s_client -connect 10.1.1.20:9000 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > graylog-cert.pem
$ openssl x509 -noout -in graylog-cert.pem -fingerprint -sha1

```

---

<div class="post-metadata">

**Author:** ![ARogovsky](https://avatars.discourse-cdn.com/v4/letter/a/8edcca/32.png) [@ARogovsky](https://community.graylog.org/u/ARogovsky)\
**Post date:** [March 15, 2017, 12:34pm UTC](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469/3 "2017-03-15T12:34:20Z")

</div>

```auto
root@graylog:~# echo -n | openssl s_client -connect 10.1.1.20:9000 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > graylog-cert.pem
depth=0 C = UA, ST = Odessa, L = Odessa, O = mydomain.com, OU = Graylog, CN = graylog.mydomain.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = UA, ST = Odessa, L = Odessa, O = mydomain.com, OU = Graylog, CN = graylog.mydomain.com
verify return:1
DONE
root@graylog:~# openssl x509 -noout -in graylog-cert.pem -fingerprint -sha1
SHA1 Fingerprint=41:96:FF:35:37:97:11:8C:50:22:9A:68:1E:5E:77:0D:FA:A5:42:DE

```

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 15, 2017, 1:01pm UTC](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469/4 "2017-03-15T13:01:19Z")

</div>

It looks like there are different X.509 certificates in your JVM key store and being used for 10.1.1.20:9000.

If it was the same certificate, the SHA1 fingerprint should be identical.

---

<div class="post-metadata">

**Author:** ![ARogovsky](https://avatars.discourse-cdn.com/v4/letter/a/8edcca/32.png) [@ARogovsky](https://community.graylog.org/u/ARogovsky)\
**Post date:** [March 15, 2017, 1:01pm UTC](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469/5 "2017-03-15T13:01:50Z")

</div>

Thanks for advice!  
I import right cert and executed again  
Now I get new erroror:

```auto
2017-03-15_12:49:36.98375 2017-03-15 12:49:36,982 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Unable to call https://10.1.1.20:9000/api/system/metrics/multiple on node <64aef9c9-c5fb-4ee7-b7d3-440a0e24094b>
2017-03-15_12:49:36.98414 javax.net.ssl.SSLPeerUnverifiedException: Hostname 10.1.1.20 not verified:
2017-03-15_12:49:36.98504 certificate: sha256/KRPAx4meITGjw+fnxl39zeoBUp3sgBANVSxoHYSiHYw=
2017-03-15_12:49:36.98545 DN: CN=graylog.mydomain.com, OU=Graylog, O=mydomain.com, L=Odessa, ST=Odessa, C=UA
2017-03-15_12:49:36.98578 subjectAltNames: []

```

Any advices?

---

<div class="post-metadata">

**Author:** ![ARogovsky](https://avatars.discourse-cdn.com/v4/letter/a/8edcca/32.png) [@ARogovsky](https://community.graylog.org/u/ARogovsky)\
**Post date:** [March 15, 2017, 1:15pm UTC](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469/6 "2017-03-15T13:15:45Z")

</div>

I fix it myself, replace IP by domain in config  
Problem is resolved