# Java - certification issue

**URL:** <https://community.graylog.org/t/java-certification-issue/1272>\
**Category:** Graylog Central (peer support)\
**Created:** [May 30, 2017, 10:38am UTC](https://community.graylog.org/t/java-certification-issue/1272 "2017-05-30T10:38:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![David83](https://avatars.discourse-cdn.com/v4/letter/d/22d042/32.png) [@David83](https://community.graylog.org/u/David83)\
**Post date:** [May 30, 2017, 10:38am UTC](https://community.graylog.org/t/java-certification-issue/1272/1 "2017-05-30T10:38:09Z")

</div>

Hello,  
Our graylog running behind Loadbalancer on two nodes.  
Bought trusted certificate is linked to Loadbalancer’s hostname/IP  
Certificate was imported on Loalbalancer + both Graylog nodes.  
Https connection works well (thanks to web\_endpoint\_uri=https://Loadbalancer:9000/api), but due to some Java issues inputs doesn’t works in Graylog.  
I imported plain-text certificate to JVM trust store (cacerts file), and also set Graylog for use this:  
GRAYLOG\_SERVER\_JAVA\_OPTS="-Djavax.net.ssl.trustStore=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.131-2.b11.el7\_3.x86\_64/jre/lib/security/cacerts  
But Graylog still doesn’t works correctly:

2017-05-30T12:08:18.946+02:00 WARN [ProxiedResource] Unable to call [https://FirstNodeHostname:9000/api/system/inputstates](https://FirstNodeHostname:9000/api/system/inputstates) on node   
javax.net.ssl.SSLPeerUnverifiedException: Hostname FirstNodeHostname not verified:

2017-05-30T12:23:49.920+02:00 WARN [ProxiedResource] Unable to call [https://FirstNodeHostname:9000/api/system/metrics/multiple](https://FirstNodeHostname:9000/api/system/metrics/multiple) on node   
javax.net.ssl.SSLPeerUnverifiedException: Hostname FirstNodeHostname not verified:

The same also for SecondNodeHostname

Can you help me how to solve this problem please?  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 30, 2017, 7:10pm UTC](https://community.graylog.org/t/java-certification-issue/1272/2 "2017-05-30T19:10:44Z")

</div>

your certificate in graylog is not valid - because you have one for `Loadbalancer` (as you have written) and not for `FirstNodeHostname`. That is the reason the cert is not able to be verified.

---

<div class="post-metadata">

**Author:** ![David83](https://avatars.discourse-cdn.com/v4/letter/d/22d042/32.png) [@David83](https://community.graylog.org/u/David83)\
**Post date:** [May 31, 2017, 8:13am UTC](https://community.graylog.org/t/java-certification-issue/1272/3 "2017-05-31T08:13:22Z")

</div>

Thanks for information Jan, I thought it.  
If we buy One certificate which will contain Common Name (Loadbalancer’s hostname) and two Subject Alternative Names (SANs) (both Graylog hostnames), will it works correctly please?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 31, 2017, 3:02pm UTC](https://community.graylog.org/t/java-certification-issue/1272/4 "2017-05-31T15:02:39Z")

</div>

that should work. yes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 14, 2017, 3:02pm UTC](https://community.graylog.org/t/java-certification-issue/1272/5 "2017-06-14T15:02:48Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.