SSL/TLS for Input Problem

Hi there,

I use the simple one Node Setup for testing.
Here are some specs of my test environment:
OS: CentOS Linux release 8.1.1911 (Core)
Java: openjdk version “1.8.0_242”
Graylog Server: 3.2.4
I setup a Apache as reverse proxy for SSL for Graylog. But now I try to secure the Input too.

SSL Settings for the Input
Cert is pem and key in encrypted pks8
TLS cert file: /etc/graylog/server/graylog_crt.pem
TLS private key file: /etc/graylog/server/graylog_key.pk8
TLS client authentication: optional
TLS key password: (My Password for the graylog_key.pk8)
TLS Client Auth Trusted Certs: /etc/graylog/server/trusted_clients

As far I “Enable TLS” for the Input I get the following Error.

2020-04-28T12:28:00.796+02:00 INFO  [InputStateListener] Input [Beats/5e849c3447f1ee2b402bb343] is now STOPPING
2020-04-28T12:28:00.807+02:00 INFO  [InputStateListener] Input [Beats/5e849c3447f1ee2b402bb343] is now STOPPED
2020-04-28T12:28:00.809+02:00 INFO  [InputStateListener] Input [Beats/5e849c3447f1ee2b402bb343] is now TERMINATED
2020-04-28T12:28:00.825+02:00 INFO  [AbstractTcpTransport] Enabled TLS for input [Beats/5e849c3447f1ee2b402bb343]. key-file="/etc/graylog/server/graylog_key.pk8" cert-file="/etc/graylog/server/graylog_crt.pem"
2020-04-28T12:28:00.825+02:00 INFO  [InputStateListener] Input [Beats/5e849c3447f1ee2b402bb343] is now STARTING
2020-04-28T12:28:00.827+02:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input Beats2Input{title=Beats,, nodeId=null} (channel [id: 0x2fc87a36, L:/0:0:0:0:0:0:0:0%0:5044]) should be 1048576 but is 425984.
2020-04-28T12:28:00.827+02:00 INFO  [InputStateListener] Input [Beats/5e849c3447f1ee2b402bb343] is now RUNNING
2020-04-28T12:28:11.457+02:00 WARN  [ChannelInitializer] Failed to initialize a channel. Closing: [id: 0xf689d968, L:/ - R:/]
java.lang.IllegalArgumentException: File does not contain valid private key: /etc/graylog/server/graylog_key.pk8
        at io.netty.handler.ssl.SslContextBuilder.keyManager( ~[graylog.jar:?]
        at io.netty.handler.ssl.SslContextBuilder.forServer( ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$3.createSslEngine( ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$ ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$ ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.NettyTransport$1.initChannel( ~[graylog.jar:?]
        at [graylog.jar:?]
        at [graylog.jar:?]
        at [graylog.jar:?]
        at [graylog.jar:?]
        at$100( [graylog.jar:?]
        at$PendingHandlerAddedTask.execute( [graylog.jar:?]
        at [graylog.jar:?]
        at [graylog.jar:?]
        at$AbstractUnsafe.register0( [graylog.jar:?]
        at$AbstractUnsafe.access$200( [graylog.jar:?]
        at$AbstractUnsafe$ [graylog.jar:?]
        at io.netty.util.concurrent.AbstractEventExecutor.safeExecute( [graylog.jar:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks( [graylog.jar:?]
        at [graylog.jar:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor$ [graylog.jar:?]
        at io.netty.util.internal.ThreadExecutorMap$ [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$ [graylog.jar:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker( [?:1.8.0_242]
        at java.util.concurrent.ThreadPoolExecutor$ [?:1.8.0_242]
        at com.codahale.metrics.InstrumentedThreadFactory$ [graylog.jar:?]
        at [?:1.8.0_242]
Caused by: ObjectIdentifier() -- data isn't an object ID (tag = 48)
        at<init>( ~[?:1.8.0_242]
        at ~[?:1.8.0_242]
        at com.sun.crypto.provider.PBES2Parameters.engineInit( ~[sunjce_provider.jar:1.8.0_242]
        at ~[?:1.8.0_242]
        at ~[?:1.8.0_242]
        at<init>( ~[?:1.8.0_242]
        at ~[?:1.8.0_242]
        at javax.crypto.EncryptedPrivateKeyInfo.<init>( ~[?:1.8.0_242]
        at io.netty.handler.ssl.SslContext.generateKeySpec( ~[graylog.jar:?]
        at io.netty.handler.ssl.SslContext.getPrivateKeyFromByteBuffer( ~[graylog.jar:?]
        at io.netty.handler.ssl.SslContext.toPrivateKey( ~[graylog.jar:?]
        at io.netty.handler.ssl.SslContextBuilder.keyManager( ~[graylog.jar:?]
        ... 26 more

Content of the Keyfile is like this


Any Idea what I miss there?

Maybe it depends to this Bug: ?

  1. Try to restart graylog service after setup TLS for Input:
    sudo systemctl restart graylog-server.service

I saw this error after I setup TLS for input. It started worked after graylog server restart.

  1. Another problem can be certificate key file which uses password. Try to convert so it doesn’t use key password:
    openssl rsa -in file1.key -out file2.key

  2. Check if the TLS connection is working using openssl:
    openssl s_client -showcerts -connect

First, thank you for your answers.

No effect.

I will try this, but why do you think this could be the reason?
Edit: with no PW it work… any Idea what goes wrong here? This is a security impact with no PW on the Key file.

This does not work for the input, but this makes sense to me, as long I have this problem.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.