Input failed to start after https

kvenkat971 · March 6, 2020, 4:09pm

Hi Guys,
I have a setup of graylog on docker which runs perfectly fine on http and recently we had a requirement to move that to https.

version: ‘2’
services:

MongoDB: https://hub.docker.com/_/mongo/

mongodb:
image: mongo:3
volumes:
- mongo_data:/data/db

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.2
volumes:
- es_data:/usr/share/elasticsearch/data
environment:
- http.host=0.0.0.0
- transport.host=localhost
- network.host=10.4.1.3
- “ES_JAVA_OPTS=-Xms512m -Xmx512m”
ulimits:
memlock:
soft: -1
hard: -1
mem_limit: 1g

Graylog: https://hub.docker.com/r/graylog/graylog/

graylog:
image: graylog/graylog:3.1
volumes:
- graylog_journal:/usr/share/graylog/data/journal
volumes:
- ./certs/graylog.crt:/certs/graylog.crt
- ./certs/graylog.key:/certs/graylog.key
environment:
# CHANGE ME (must be at least 16 characters)!
- GRAYLOG_PASSWORD_SECRET=sysnetgraylogserverforaws
# Password: admin
- GRAYLOG_ROOT_PASSWORD_SHA2=c674ad0246d53361ee006b2ab11ae465331d387e7aea1ea4b2a25a75f038b69e
- GRAYLOG_HTTP_EXTERNAL_URI=https://graylog.xxxxx.com:9000/
- GRAYLOG_HTTP_ENABLE_TLS=true
- GRAYLOG_HTTP_TLS_CERT_FILE=/certs/graylog.crt
- GRAYLOG_HTTP_TLS_KEY_FILE=/certs/graylog.key

- GRAYLOG_REST_TLS_CERT_FILE=/certs/graylog.crt

- GRAYLOG_REST_TLS_KEY_FILE=/certs/graylog.key

links:
  - mongodb:mongo
  - elasticsearch
depends_on:
  - mongodb
  - elasticsearch
ports:
  # Graylog web interface and REST API
  - 9000:9000

- 443:443

  - 443:9000
  # Syslog TCP
  - 1514:1514
  # Syslog UDP
  - 1514:1514/udp
  # GELF TCP
  - 12201:12201
  # GELF UDP
  - 12201:12201/udp

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

volumes:
mongo_data:
driver: local
es_data:
driver: local
graylog_journal:
driver: local

And I have configured https in my docker config and it starts fine and was able to access web interface via https. But the input doesn’t start and below is my docker config.

ERROR: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I think it’s related to adding to Keystore I know how to do it regular Graylog server

NOTE: certificate is not self signed

can anyone help me out on how to do this using docker?

kvenkat971 · March 9, 2020, 10:44am

Hi Guys,

Can anyone point me in the right direction for this ?

jan · March 9, 2020, 1:17pm

yes @kvenkat971

I guess that the first non-loopback ip in this setup is not part of your certificate - what means the validation chain is not valid.

kvenkat971 · March 9, 2020, 2:18pm

thanks @jan

I have like two certificates one for web and one for rest tls which includes the IP address but I still get the same error .
And I have imported the self signed for IP into keystore.
Below is my new config

version: ‘2’
services:

MongoDB: https://hub.docker.com/_/mongo/

mongodb:
image: mongo:3
volumes:
- mongo_data:/data/db

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.5
volumes:
- es_data:/usr/share/elasticsearch/data
environment:
- http.host=0.0.0.0
- transport.host=localhost
- network.host=127.0.0.1
- “ES_JAVA_OPTS=-Xms512m -Xmx512m”
ulimits:
memlock:
soft: -1
hard: -1
mem_limit: 1g

Graylog: https://hub.docker.com/r/graylog/graylog/

graylog:
image: graylog/graylog:3.2.2
volumes:
- graylog_journal:/usr/share/graylog/data/journal
volumes:
- ./certs/graylog.crt:/certs/graylog.crt
- ./certs/graylog.key:/certs/graylog.key
- ./certs/ip.crt:/certs/ip.crt
- ./certs/ip.key:/certs/ip.key
environment:
# CHANGE ME (must be at least 16 characters)!
- GRAYLOG_PASSWORD_SECRET=serverforaws
# Password: admin
- GRAYLOG_ROOT_PASSWORD_SHA2=c674ad0246d53361ee006b2ab11ae465331d387e7aea1ea4b2a25a75f038b69e
- GRAYLOG_REST_TRANSPORT_URI=http://:9000/api
- GRAYLOG_HTTP_EXTERNAL_URI=https://graylog.example.com:9000/
- GRAYLOG_HTTP_ENABLE_TLS=true
- GRAYLOG_REST_ENABLE_TLS=true
- GRAYLOG_REST_TLS_CERT_FILE=/certs/ip.crt
- GRAYLOG_REST_TLS_KEY_FILE=/certs/ip.key
- GRAYLOG_REST_TLS_KEY_PASSWORD=secret
- GRAYLOG_HTTP_TLS_CERT_FILE=/certs/graylog.crt
- GRAYLOG_HTTP_TLS_KEY_FILE=/certs/graylog.key
links:
- mongodb:mongo
- elasticsearch
depends_on:
- mongodb
- elasticsearch
ports:
# Graylog web interface and REST API
- 9000:9000
- 443:9000
# Syslog TCP
- 1514:1514
# Syslog UDP
- 1514:1514/udp
# GELF TCP
- 12201:12201
# GELF UDP
- 12201:12201/udp

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

volumes:
mongo_data:
driver: local
es_data:
driver: local
graylog_journal:
driver: local

Can you let me know is there anything wrong with my config ?

jan · March 9, 2020, 3:03pm

I do not know where you get the feeling from that you need to use

- GRAYLOG_REST_ENABLE_TLS=true
- GRAYLOG_REST_TLS_CERT_FILE=/certs/ip.crt
- GRAYLOG_REST_TLS_KEY_FILE=/certs/ip.key
- GRAYLOG_REST_TLS_KEY_PASSWORD=secret

that configuration parameter is not given anymore in Graylog 3.2

you need one certificate that is able to verify the http_external_uri and the http_publish_uri at the same time.

kvenkat971 · March 9, 2020, 3:23pm

@jan,

I tried that configuration only because I had the same error for the below config which my original config is based on

  - GRAYLOG_HTTP_EXTERNAL_URI=https://graylog.sysnetgs.com:9000/
  - GRAYLOG_HTTP_PUBLISH_URI=https://graylog.sysnetgs.com:9000/
  - GRAYLOG_HTTP_ENABLE_TLS=true
  - GRAYLOG_HTTP_TLS_CERT_FILE=/certs/graylog.crt
  - GRAYLOG_HTTP_TLS_KEY_FILE=/certs/graylog.key

let me know if there is anything worng in the above

jan · March 9, 2020, 3:33pm

he @kvenkat971

does graylog.sysnetgs.com resolve to a local ip on that container for the container itself?

kvenkat971 · March 9, 2020, 3:38pm

@jan, yes it does resolve

kvenkat971 · March 12, 2020, 12:07pm

@jan, I can’t seem to find the location for java in docker Graylog. can you help me out with the location?

I’m using Graylog 3.2.2

jan · March 12, 2020, 1:26pm

is this a self signed certificate?

if yes you need to add this to a java keystore and add this keystore to the startup parameters of Graylog.

kvenkat971 · March 12, 2020, 1:43pm

@jan, it is not a self-signed cert.
it was issued by an authorised third party.

have some news on this tried this just a few minutes ago,
I got it working if I do key tool import of the cert inside the container, but I’m looking for a line that I can add to the compose file while starting the container itself.

any suggestions on the config to add the keytool to the compose file so that when the container reboots?

jan · March 12, 2020, 2:17pm

github.com

Graylog2/graylog-docker/blob/3.2/docker-entrypoint.sh#L11-L17


# and add the previos saved settings to our defaults
if [[ ! -z ${__GRAYLOG_SERVER_JAVA_OPTS} ]]
then
  echo "adding environment opts"
  GRAYLOG_SERVER_JAVA_OPTS="${GRAYLOG_SERVER_JAVA_OPTS} ${__GRAYLOG_SERVER_JAVA_OPTS}"
  export GRAYLOG_SERVER_JAVA_OPTS
fi

Add the additional Java server opts to the compose file.

kvenkat971 · March 12, 2020, 4:16pm

@jan thank you. That worked like a charm

system · March 26, 2020, 4:16pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Run Graylog with Docker over HTTPS on AWS Graylog Central (peer support)	1	1083	December 3, 2019
Graylog in HTTPS mode with Docker-Compose Graylog Central (peer support)	3	3030	February 27, 2020
Https Setup Error Graylog Central (peer support)	5	1223	February 25, 2020
Cant get HTTPS working on graylog Graylog Central (peer support)	12	4657	June 7, 2017
Can't get docker graylog up and running Graylog Central (peer support)	3	7577	January 2, 2019

Input failed to start after https

MongoDB: https://hub.docker.com/_/mongo/

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

Graylog: https://hub.docker.com/r/graylog/graylog/

- GRAYLOG_REST_TLS_CERT_FILE=/certs/graylog.crt

- GRAYLOG_REST_TLS_KEY_FILE=/certs/graylog.key

- 443:443

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

MongoDB: https://hub.docker.com/_/mongo/

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

Graylog: https://hub.docker.com/r/graylog/graylog/

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

Related topics