Input failed to start after https

kvenkat971 · March 6, 2020, 4:09pm

Hi Guys,
I have a setup of graylog on docker which runs perfectly fine on http and recently we had a requirement to move that to https.

version: ‘2’
services:

MongoDB: https://hub.docker.com/_/mongo/

mongodb:
image: mongo:3
volumes:
- mongo_data:/data/db

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.2
volumes:
- es_data:/usr/share/elasticsearch/data
environment:
- http.host=0.0.0.0
- transport.host=localhost
- network.host=10.4.1.3
- “ES_JAVA_OPTS=-Xms512m -Xmx512m”
ulimits:
memlock:
soft: -1
hard: -1
mem_limit: 1g

Graylog: https://hub.docker.com/r/graylog/graylog/

graylog:
image: graylog/graylog:3.1
volumes:
- graylog_journal:/usr/share/graylog/data/journal
volumes:
- ./certs/graylog.crt:/certs/graylog.crt
- ./certs/graylog.key:/certs/graylog.key
environment:
# CHANGE ME (must be at least 16 characters)!
- GRAYLOG_PASSWORD_SECRET=sysnetgraylogserverforaws
# Password: admin
- GRAYLOG_ROOT_PASSWORD_SHA2=c674ad0246d53361ee006b2ab11ae465331d387e7aea1ea4b2a25a75f038b69e
- GRAYLOG_HTTP_EXTERNAL_URI=https://graylog.xxxxx.com:9000/
- GRAYLOG_HTTP_ENABLE_TLS=true
- GRAYLOG_HTTP_TLS_CERT_FILE=/certs/graylog.crt
- GRAYLOG_HTTP_TLS_KEY_FILE=/certs/graylog.key

- GRAYLOG_REST_TLS_CERT_FILE=/certs/graylog.crt

- GRAYLOG_REST_TLS_KEY_FILE=/certs/graylog.key

links:
  - mongodb:mongo
  - elasticsearch
depends_on:
  - mongodb
  - elasticsearch
ports:
  # Graylog web interface and REST API
  - 9000:9000

- 443:443

  - 443:9000
  # Syslog TCP
  - 1514:1514
  # Syslog UDP
  - 1514:1514/udp
  # GELF TCP
  - 12201:12201
  # GELF UDP
  - 12201:12201/udp

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

volumes:
mongo_data:
driver: local
es_data:
driver: local
graylog_journal:
driver: local

And I have configured https in my docker config and it starts fine and was able to access web interface via https. But the input doesn’t start and below is my docker config.

ERROR: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I think it’s related to adding to Keystore I know how to do it regular Graylog server

NOTE: certificate is not self signed

can anyone help me out on how to do this using docker?

kvenkat971 · March 9, 2020, 10:44am

Hi Guys,

Can anyone point me in the right direction for this ?

jan · March 9, 2020, 1:17pm

yes @kvenkat971

I guess that the first non-loopback ip in this setup is not part of your certificate - what means the validation chain is not valid.

kvenkat971 · March 9, 2020, 2:18pm

thanks @jan

I have like two certificates one for web and one for rest tls which includes the IP address but I still get the same error .
And I have imported the self signed for IP into keystore.
Below is my new config

version: ‘2’
services:

MongoDB: https://hub.docker.com/_/mongo/

mongodb:
image: mongo:3
volumes:
- mongo_data:/data/db

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.5
volumes:
- es_data:/usr/share/elasticsearch/data
environment:
- http.host=0.0.0.0
- transport.host=localhost
- network.host=127.0.0.1
- “ES_JAVA_OPTS=-Xms512m -Xmx512m”
ulimits:
memlock:
soft: -1
hard: -1
mem_limit: 1g

Graylog: https://hub.docker.com/r/graylog/graylog/

graylog:
image: graylog/graylog:3.2.2
volumes:
- graylog_journal:/usr/share/graylog/data/journal
volumes:
- ./certs/graylog.crt:/certs/graylog.crt
- ./certs/graylog.key:/certs/graylog.key
- ./certs/ip.crt:/certs/ip.crt
- ./certs/ip.key:/certs/ip.key
environment:
# CHANGE ME (must be at least 16 characters)!
- GRAYLOG_PASSWORD_SECRET=serverforaws
# Password: admin
- GRAYLOG_ROOT_PASSWORD_SHA2=c674ad0246d53361ee006b2ab11ae465331d387e7aea1ea4b2a25a75f038b69e
- GRAYLOG_REST_TRANSPORT_URI=http://:9000/api
- GRAYLOG_HTTP_EXTERNAL_URI=https://graylog.example.com:9000/
- GRAYLOG_HTTP_ENABLE_TLS=true
- GRAYLOG_REST_ENABLE_TLS=true
- GRAYLOG_REST_TLS_CERT_FILE=/certs/ip.crt
- GRAYLOG_REST_TLS_KEY_FILE=/certs/ip.key
- GRAYLOG_REST_TLS_KEY_PASSWORD=secret
- GRAYLOG_HTTP_TLS_CERT_FILE=/certs/graylog.crt
- GRAYLOG_HTTP_TLS_KEY_FILE=/certs/graylog.key
links:
- mongodb:mongo
- elasticsearch
depends_on:
- mongodb
- elasticsearch
ports:
# Graylog web interface and REST API
- 9000:9000
- 443:9000
# Syslog TCP
- 1514:1514
# Syslog UDP
- 1514:1514/udp
# GELF TCP
- 12201:12201
# GELF UDP
- 12201:12201/udp

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

volumes:
mongo_data:
driver: local
es_data:
driver: local
graylog_journal:
driver: local

Can you let me know is there anything wrong with my config ?

jan · March 9, 2020, 3:03pm

I do not know where you get the feeling from that you need to use

- GRAYLOG_REST_ENABLE_TLS=true
- GRAYLOG_REST_TLS_CERT_FILE=/certs/ip.crt
- GRAYLOG_REST_TLS_KEY_FILE=/certs/ip.key
- GRAYLOG_REST_TLS_KEY_PASSWORD=secret

that configuration parameter is not given anymore in Graylog 3.2

you need one certificate that is able to verify the http_external_uri and the http_publish_uri at the same time.

kvenkat971 · March 9, 2020, 3:23pm

@jan,

I tried that configuration only because I had the same error for the below config which my original config is based on

  - GRAYLOG_HTTP_EXTERNAL_URI=https://graylog.sysnetgs.com:9000/
  - GRAYLOG_HTTP_PUBLISH_URI=https://graylog.sysnetgs.com:9000/
  - GRAYLOG_HTTP_ENABLE_TLS=true
  - GRAYLOG_HTTP_TLS_CERT_FILE=/certs/graylog.crt
  - GRAYLOG_HTTP_TLS_KEY_FILE=/certs/graylog.key

let me know if there is anything worng in the above

jan · March 9, 2020, 3:33pm

he @kvenkat971

does graylog.sysnetgs.com resolve to a local ip on that container for the container itself?

kvenkat971 · March 9, 2020, 3:38pm

@jan, yes it does resolve

kvenkat971 · March 12, 2020, 12:07pm

@jan, I can’t seem to find the location for java in docker Graylog. can you help me out with the location?

I’m using Graylog 3.2.2

jan · March 12, 2020, 1:26pm

is this a self signed certificate?

if yes you need to add this to a java keystore and add this keystore to the startup parameters of Graylog.

kvenkat971 · March 12, 2020, 1:43pm

@jan, it is not a self-signed cert.
it was issued by an authorised third party.

have some news on this tried this just a few minutes ago,
I got it working if I do key tool import of the cert inside the container, but I’m looking for a line that I can add to the compose file while starting the container itself.

any suggestions on the config to add the keytool to the compose file so that when the container reboots?

jan · March 12, 2020, 2:17pm

github.com

Graylog2/graylog-docker/blob/3.2/docker-entrypoint.sh#L11-L17


# and add the previos saved settings to our defaults
if [[ ! -z ${__GRAYLOG_SERVER_JAVA_OPTS} ]]
then
  echo "adding environment opts"
  GRAYLOG_SERVER_JAVA_OPTS="${GRAYLOG_SERVER_JAVA_OPTS} ${__GRAYLOG_SERVER_JAVA_OPTS}"
  export GRAYLOG_SERVER_JAVA_OPTS
fi

Add the additional Java server opts to the compose file.

kvenkat971 · March 12, 2020, 4:16pm

@jan thank you. That worked like a charm

system · March 26, 2020, 4:16pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Graylog in HTTPS mode with Docker-Compose Graylog Central (peer support)	3	2810	February 27, 2020
Can't get docker graylog up and running Graylog Central (peer support)	3	6520	January 2, 2019
Graylog not talking to https Elasticsearch Graylog Central (peer support)	18	8409	May 15, 2019
Unable to login after starting docker container Graylog Central (peer support) docker	2	642	December 23, 2022
Graylog not starting via HTTPS Graylog Central (peer support) elastic	9	863	December 1, 2022

Input failed to start after https

MongoDB: https://hub.docker.com/_/mongo/

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

Graylog: https://hub.docker.com/r/graylog/graylog/

- GRAYLOG_REST_TLS_CERT_FILE=/certs/graylog.crt

- GRAYLOG_REST_TLS_KEY_FILE=/certs/graylog.key

- 443:443

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

MongoDB: https://hub.docker.com/_/mongo/

Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html

Graylog: https://hub.docker.com/r/graylog/graylog/

Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/

Related Topics