How to setup SSL in Graylog with valid cert and key files

Ganeshbabu · 2017-12-01 16:59:20 UTC

Hi All,

We are able to setup SSL/TLS configuration in Graylog by creating self signed private key & certificate and It was working fine without any issues, but now I am trying to do the same setup with having proper certificates in place, which are valid and trusted by the clients.

As I followed this documentation for setting up the self signed certificates but unable to do with valid certificate and key file

Please kindly let us know how to setup the valid certificate and key for HTTPS in graylog and kindly share any documentation for reference and it would be very helpful to resolve it.

Thanks,
Ganeshbabu R

Ganeshbabu · 2017-12-01 18:34:50 UTC

Hi All,

As per the documentation the graylog will only work only if the certificate/key files are in the right format, which is X.509 for certificates and PKCS#8 for the private keys. Both must to be stored in PEM format.

Since my valid certificate & key files are in the name of,

graylog.crt
graylog.key

and I tried to change the format to PEM by using the below commands,

openssl x509 -in graylog.crt -outform PEM -out graylog-certificate.pem
openssl pkcs8 -topk8 -inform PEM -outform PEM -in graylog.key -out graylogkey.pem -nocrypt

But however I am getting the below exception in logs files,

2017-12-01T18:27:31.490Z INFO  [LegacyDefaultStreamMigration] Legacy default stream has no connections, no migration needed.
2017-12-01T18:27:31.747Z ERROR [ServiceManager] Service JerseyService [FAILED] has failed in the STARTING state.
java.io.IOException: overrun, bytes = 1194
        at javax.crypto.EncryptedPrivateKeyInfo.<init>(EncryptedPrivateKeyInfo.java:92) ~[?:1.8.0_122]
        at org.graylog2.shared.security.tls.PemKeyStore.generateKeySpec(PemKeyStore.java:69) ~[graylog.jar:?]
        at org.graylog2.shared.security.tls.PemKeyStore.buildKeyStore(PemKeyStore.java:98) ~[graylog.jar:?]
        at org.graylog2.shared.initializers.JerseyService.buildSslEngineConfigurator(JerseyService.java:387) ~[graylog.jar:?]
        at org.graylog2.shared.initializers.JerseyService.startUpApi(JerseyService.java:208) ~[graylog.jar:?]
        at org.graylog2.shared.initializers.JerseyService.startUp(JerseyService.java:141) ~[graylog.jar:?]
        at com.google.common.util.concurrent.AbstractIdleService$DelegateService$1.run(AbstractIdleService.java:62) [graylog.jar:?]
        at com.google.common.util.concurrent.Callables$4.run(Callables.java:122) [graylog.jar:?]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
2017-12-01T18:27:31.754Z INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Failed [LB:DEAD]
2017-12-01T18:27:31.755Z ERROR [InputSetupService] Not starting any inputs because lifecycle is: Failed [LB:DEAD]

Please kindly correct me if I am doing anything wrong in the setup.

Thanks,
Ganeshbabu R

jan · 2017-12-04 08:49:39 UTC

you might want to use the following script to generate the keys:

github.com

jalogisch/bartwickelmaschine/blob/master/create_self_signed_ssl_certs/create_ssl_certs.sh

#!/bin/bash -e

#
# This scrip generate self-signed certificate to be used in development.
# it sets the CN to the first provided hostname and will add all other
# provided names to subjectAltName.
#
# Some Magic is added to the script that tries to find some settings for the
# current host where this script is started.
#
# This script was first created by Jan Doberstein <jd@jalogis.ch> 2017-07-30
#
# This script is tested on CentOS 7, Ubuntu 14.04, Ubuntu 16.04, MacOS 10.12

OPSSLBIN=$(which openssl)

while getopts "d:h:i:m?" opt; do
  case ${opt} in
    h) HNAME+=("${OPTARG}");;
    i) HIP+=("${OPTARG}");;

This file has been truncated. show original

it will also guide you in the commands - when you are unsure what to use.

In addition the error you post is not connected to any ssl certificate error.

We would need to know how you configured your Graylog (what is your server.conf) and what is the error you have (your server.log).

thanks

system · 2017-12-18 08:49:57 UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.