# Just another user struggling with HTTPS

**URL:** <https://community.graylog.org/t/just-another-user-struggling-with-https/33356>\
**Category:** Graylog Central (peer support)\
**Created:** [August 28, 2024, 8:54am UTC](https://community.graylog.org/t/just-another-user-struggling-with-https/33356 "2024-08-28T08:54:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Motok](https://avatars.discourse-cdn.com/v4/letter/m/ed8c4c/32.png) [@Motok](https://community.graylog.org/u/Motok)\
**Post date:** [August 28, 2024, 8:54am UTC](https://community.graylog.org/t/just-another-user-struggling-with-https/33356/1 "2024-08-28T08:54:55Z")

</div>

Dear community,  
We have a working graylog server but using only HTTP.  
I want to reconfigure it for using HTTPS only.

Environnement :  
Debian 11  
Graylog 6.0.5  
Certificates : using a wildcard with our FQDN, working for other servers, chain is good and using PEM format.

Steps done :

The user with PID (graylog) can read both paths and certificates :  
/etc/ssl/certs/wildcard.our.fqdn.pem  
/etc/ssl/private/wildcard.our.fqdn.key

Imported certificate into /usr/share/graylog-server/jvm/lib/security/cacerts with keytool and default password.

Then changed the server.conf :  
http\_publish\_uri = [httpS://graylog.our.fqdn:9000/](httpS://graylog.our.fqdn:9000/)  
http\_external\_uri = [httpS://graylog.our.fqdn:9000/](httpS://graylog.our.fqdn:9000/)  
http\_enable\_tls = TRUE

no password is needed to open the key.

* * *

## Error : com.github.joschi.jadconfig.ValidationException: Unreadable or missing HTTP private key: /etc/ssl/private/wildcard.our.fqdn.key

I’m probably missing a little something here, but i cannot nail it.

Thank for any hints.

---

<div class="post-metadata">

**Author:** ![duscha](https://avatars.discourse-cdn.com/v4/letter/d/35a633/32.png) [@duscha](https://community.graylog.org/u/duscha)\
**Post date:** [August 28, 2024, 5:05pm UTC](https://community.graylog.org/t/just-another-user-struggling-with-https/33356/2 "2024-08-28T17:05:13Z")

</div>

Hi Motok,

An unaccessible key could be caused by wrong file permissions or wron ownership of the .key-file.

Check, if the key belongs to or is readable by the user in whose context you are starting your graylog-server.

NB: I personally would recommend to implement https-access with a reverse proxy.

Best,

Sven

---

<div class="post-metadata">

**Author:** ![Footlocker](https://avatars.discourse-cdn.com/v4/letter/f/34f0e0/32.png) [@Footlocker](https://community.graylog.org/u/Footlocker)\
**Post date:** [August 29, 2024, 5:50am UTC](https://community.graylog.org/t/just-another-user-struggling-with-https/33356/3 "2024-08-29T05:50:39Z")

</div>

Hi Motok  
sounds like a file permission issue.

I followed the official guide which worked:  
[How-To Guide: Securing Graylog with TLS](https://graylog.org/post/how-to-guide-securing-graylog-with-tls/)

---

<div class="post-metadata">

**Author:** ![Motok](https://avatars.discourse-cdn.com/v4/letter/m/ed8c4c/32.png) [@Motok](https://community.graylog.org/u/Motok)\
**Post date:** [August 29, 2024, 10:36am UTC](https://community.graylog.org/t/just-another-user-struggling-with-https/33356/4 "2024-08-29T10:36:26Z")

</div>

Managed to find it, even if the permission was 644 on /etc/ssl/private/ folder, the user graylog could not read the private key.  
I did used sudo runuser -u graylog cat /etc/ssl/private/wildcard.our.fqdn.key to find the problem.  
Thank you all for helping, the topic can be closed.  
P.S. I will prob now do as Sven suggested, move to an Nginx reverse proxy for better security.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 12, 2024, 10:36am UTC](https://community.graylog.org/t/just-another-user-struggling-with-https/33356/5 "2024-09-12T10:36:55Z")

</div>

Closed on September 12, 2024, 10:36am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.