Hello && Welcome
The above error can be a couple things. Since your able to log on the Graylog Web UI. Here is a list to check for your GELF TCP/TLS input.
- TLS cert file make sure Graylog has access to this cert
/etc/graylog/graylog3-certificate.pem - TLS private key file make sure Graylog has access to this cert
./etc/graylog/graylog3-key.pem - If you’re using a TLS key password, make sure it’s set in the Graylog server.conf file also
Secret
-
Make sure your Keystore in accessible to Graylog
-
Make sure your DNS server has a PTR (Reverse Lookup)for your Graylog server or what you used for the domain.
-
Make sure you have the following. NOTE: IP Address is preferred in the certs that point to your Graylog server etc…
subjectAltName = @alt_names
# IP addresses and DNS names the certificate should include
# Use IP.### for IP addresses and DNS.### for DNS names,
# with "###" being a consecutive number.
[alt_names]
IP.1 = 203.0.113.42
DNS.1 = graylog.example.com
More can be found here
https://docs.graylog.org/v1/docs/https
Sometime Windows have a problem running wild card certs we’ve have experienced this in the past and ended up not using them. Sometimes we were luck and had no problems.
Hope that helps
EDIT: I probably should have shown my setup for better clarity
http_bind_address = graylog.domain.com:9000
http_publish_uri = https://domain.com:9000/
http_enable_cors = true
http_enable_tls = true
http_tls_cert_file = /etc/pki/tls/certs/graylog/graylog-certificate.pem <-- Graylog owns this directory an has access
http_tls_key_file = /etc/pki/tls/certs/graylog/graylog-key.pem <-- Graylog owns this directory an has access
http_tls_key_password = secret
If your not using the default JAVA keystore then the following will apply to you.
In order for the JVM to pick up the new trust store, it has to be started with the JVM parameter -Djavax.net.ssl.trustStore=/path/to/cacerts.jks. If you’ve been using another password to encrypt the JVM trust store than the default changeit, you additionally have to set the JVM parameter -Djavax.net.ssl.trustStorePassword=secret