Question about generating Graylog CA during preflight

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
After installing Graylog, during the preflight setup, if we select to generate the cert CA directly from Graylog, it defaults to a CA name of “Graylog Org.” Should we accept this default, or do we need to change it to match the host FQDN?

On our first attempt we accepted the default CA name, but the Data Node service is not starting, and the Data Node log shows errors related to invalid CA characters. So before starting over from scratch we wanted to find out if it matters what name we specify for the CA during preflight.

Thank you in advance for any guidance here.

2. Describe your environment:

  • OS Information:
    Oracle Linux 9

  • Package Version:
    6.1

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?
Please see above.

4. How can the community help?
Please see above.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

It shouldn’t be required to change it, you can just keep clicking next and not change a thing if you wanted and it should still work with all the defaults.

3

Is it foreseen to have a CLI utility to perform this ?

4

There is a value in the server.conf file that you can set that will just skip preflight, and its the equivalent of just clicking next.

5

Could you tell us the name of this setting to skip preflight?
I searched the config file reference, closest I could find is “skip_preflight_checks”, whose description does not seem to equal what you are describing as it is just skipping the checks and does not create the CA.

1 Like
6

selfsigned_startup = true

It needs to be set in server.conf of the graylog server not the datanode server or file.

1 Like
7

Thanks! However, seems this is only available from 6.2 Alpha 2 onward.