# HTTPS with single node and self signed cert
**URL:** https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888
**Category:** Graylog Central (peer support)
**Created:** [January 22, 2018, 9:20pm UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888 "2018-01-22T21:20:25Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@rvazquez](https://community.graylog.org/u/rvazquez)
#### Post date: [January 22, 2018, 9:20pm UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/1 "2018-01-22T21:20:25Z")
I’m trying to get HTTPS setup on a dev machine. I’m using a `Vagrantfile` from the docs to spin up a VM for testing. I have created a cert and pkcs8 encrypted private key from the commands in the docs.
`openssl req -x509 -days 365 -nodes -newkey rsa:2048 -config openssl-graylog.cnf -keyout pkcs5-plain.pem -out cert.pem`
Then convert the pkcs5 key into a pkcs8 encrypted key using `openssl pkcs8 -in pkcs5-plain.pem -topk8 -nocrypt -out pkcs8-plain.pem` followed by:
`openssl pkcs8 -in pkcs5-plain.pem -topk8 -out pkcs8-encrypted.pem -passout pass:secret`
So now I have a proper key and self signed cert.
In the VM, I don’t have a `/etc/graylog/server/server.conf` file but I do have a `/opt/graylog/conf/graylog.conf` file **and** a `/opt/graylog/server/graylog.conf.example` file. Does graylog use the file in /opt/graylog/conf/graylog.conf by default or do I need to copy the file in `/opt/graylog/server/graylog.conf.example` to `/etc/graylog/server/server.conf`?
After modifying the appropriate configuration file, do I `sudo graylog-ctl reconfigure` then `sudo graylog-ctl restart`?
Do I **also** have to move the self signed keys to `/opt/graylog/conf/nginx/ca` with the appropriate names: graylog.crt and graylog.key?
Why does the documentation use \*.pem files and the configuration files use \*.crt and \*.key files
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [January 23, 2018, 7:32am UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/2 "2018-01-23T07:32:54Z")
as it looks like you use the Graylog OVA. You can and should only use the customization that is possible with the graylog-ctl script.
What you can do is clear documented: [http://docs.graylog.org/en/2.4/pages/configuration/graylog\_ctl.html](http://docs.graylog.org/en/2.4/pages/configuration/graylog_ctl.html)
---
### Author:  [@rvazquez](https://community.graylog.org/u/rvazquez)
#### Post date: [January 23, 2018, 8:29pm UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/3 "2018-01-23T20:29:18Z")
So I should **only** use the `sudo graylog-ctl` script to set everything up?
Does the `graylog-ctl` script modify the config file in `/opt/graylog/config/*.conf`?
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [January 24, 2018, 8:56am UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/4 "2018-01-24T08:56:13Z")
> [@rvazquez](#):
>
> So I should only use the sudo graylog-ctl script to set everything up?
Yes, correct.
> [@rvazquez](#):
>
> Does the graylog-ctl script modify the config file in /opt/graylog/config/\*.conf?
Yes, these files are re-generated from templates every time you run `graylog-ctl reconfigure` (or a command which triggers the “reconfigure” target).
---
### Author:  [@rvazquez](https://community.graylog.org/u/rvazquez)
#### Post date: [January 25, 2018, 1:37am UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/5 "2018-01-25T01:37:57Z")
If I’m only supposed to use graylog-ctl script to implement HTTPS, how do I load the private key and ssl\_cert? Or is their a config file I need to modify manually? **NOTE:** I don’t have a `/etc/graylog/server/server.conf` file
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [January 25, 2018, 7:21am UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/6 "2018-01-25T07:21:41Z")
you should read the documentation: [http://docs.graylog.org/en/2.4/pages/configuration/graylog\_ctl.html](http://docs.graylog.org/en/2.4/pages/configuration/graylog_ctl.html)
if the possible customizations in the OVA does not match your needs, you should install Graylog yourself. Keep in mind the OVA is build as a showcase, not to be run as a production build.
---
### Author:  [@rvazquez](https://community.graylog.org/u/rvazquez)
#### Post date: [January 25, 2018, 7:50pm UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/7 "2018-01-25T19:50:42Z")
So, to understand the setup correctly. The images, OVA, AMI, docker are setup as a showcase of graylog. They aren’t designed to be deployed in production environments and come setup with custom paths for elasticsearch, nginx, etcd, etc and scripts?
After we decide to use graylog, we abandon the AMI, OVA, docker and install/configure all the components manually for a production system?
I was trying to “test” https on my local machine using, in this case, the vagrantfile then deploy my settings onto the graylog AMI we have running in production.
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [February 8, 2018, 7:50pm UTC](https://community.graylog.org/t/https-with-single-node-and-self-signed-cert/3888/8 "2018-02-08T19:50:42Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.