None of the TrustManagers trust this certificate chain

Graylog Central (peer support)
1

Dear Team,
I am getting the error while ioc lookup on misp. I have tried all the issue posted on graylog comunity but still getting same error. Kindly provide the solution

2025-05-05T11:05:46.182Z ERROR [HTTPJSONPathDataAdapter] Data adapter : HTTP request error for key <mb4z3nlfyrcjnoqf.onion> from URL https://10.50.201.11/attributes/restSearch/value:mb4z3nlfyrcjnoqf.onion
javax.net.ssl.SSLHandshakeException: None of the TrustManagers trust this certificate chain.
at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source) ~[?:?]
at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) ~[?:?]
at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) ~[?:?]
at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) ~[?:?]

2

Hi @jitendra.sharma
You are trying to communicate over HTTPS with a website that’s using a certificate that your JVM doesn’t trust. The certificate that’s used to encrypt the communication is not trusted by any CA that you have in your truststore.

You have several options:

  • If you control the https://10.50.201.11 website, then use a valid and trusted certificate.
  • If you control the https://10.50.201.11 website, you can maybe disable SSL and use plain HTTP?
  • If you don’t control it but trust it, you can take its certificate and add it to your JVM truststore
  • You can also setup some kind of proxy that will trust the page and serve you responses locally over plaintext.

Can you continue from here?

Best regards,
Tomas

3

How can we use the certificate in trust store. Can you share the process.

4

You need to obtain the certificate that the website is using a command like this (adapt to your addresses and filenames):

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | \
openssl x509 -outform PEM > example_com_cert.pem

Now you have the cert in a PEM file. You need to add it to your truststore, which is distributed with the JVM you are using (either your own or distributed with graylog server installation, depending on your setup). The file is called cacert.

The command to import to add a PEM cert to your truststore will then be:

keytool -importcert -alias example_com_cert -file example_com_cert.pem -keystore cacerts -storepass changeit

There are useful tips how to locate the truststore here: https://graylog.org/post/how-to-guide-securing-graylog-with-tls/ in the section Java Key Store.

The best approach is to make a copy of the truststore, add your certificate and tell graylog server to use this truststore. All of this is described in the guide above.

5

After adding the misp certificate in truststore I am getting this error.
2025-05-06T07:46:49.249Z ERROR [HTTPJSONPathDataAdapter] Data adapter : HTTP request error for key <mb4z3nlfyrcjnoqf.onion> from URL https://10.50.201.11/attributes/restSearch/value:mb4z3nlfyrcjnoqf.onion
javax.net.ssl.SSLPeerUnverifiedException: Hostname 10.50.201.11 not verified:
certificate: sha256/8slf8LSX+3rt7I18AvewcI9HAUcmzYh3nSv4T0cIlcs=
DN: EMAILADDRESS=info@misp.local, CN=misp.local, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=LU
subjectAltNames:

6 
 javax.net.ssl.SSLPeerUnverifiedException: Hostname 10.50.201.11 not verified:

usually means a mismatch between the name you are using to access the server (an IP 10.50.201.11 in your case) and a certificate that’s issued for a hostname (misp.local). You need to unify this - either by accessing the server by its hostname or by issuing a new certificate, adding the IP to the subject alternative names.

7

When I am accessing with name still I am getting error.
2025-05-06T09:18:41.012Z ERROR [HTTPJSONPathDataAdapter] Data adapter : HTTP request error for key <mb4z3nlfyrcjnoqf.onion> from URL https://misp.local/attributes/restSearch/value:mb4z3nlfyrcjnoqf.onion
javax.net.ssl.SSLPeerUnverifiedException: Hostname misp.local not verified:
certificate: sha256/8slf8LSX+3rt7I18AvewcI9HAUcmzYh3nSv4T0cIlcs=
DN: EMAILADDRESS=info@misp.local, CN=misp.local, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=LU
subjectAltNames:

8

I think your certificate is considered invalid, as it has empty subjectAltNames. If you can, try to regenerate the certificate and add the misp.local to the SAN list.