# Struggling with HTTPS & SSL **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [September 21, 2022, 10:20am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832 "2022-09-21T10:20:29Z")\ **Posts on this page:** 13\ **Page:** 2
**Author:** ![gmorin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gmorin/32/12744_2.png) [@gmorin](https://community.graylog.org/u/gmorin)\ **Post date:** [September 22, 2022, 9:43am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/21 "2022-09-22T09:43:31Z")
That’s life… Sometimes things are not going as planned haha 🙃 No problem, I won’t have time to work on this this afternoon so tomorrow is okay for me. I commented the line, and tried putting the password between quotes before commenting but none of this worked out for me. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [September 22, 2022, 9:30pm UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/22 "2022-09-22T21:30:11Z")
Hello, Sorry to see your still having troubles. I went through my personal documentation for issues with Graylog Self-signed certificates. Couple issues I was able to fix was this. ```auto [v3_req] keyUsage = keyEncipherment, dataEncipherment,nonRepudiation ``` File named openssl-graylog.cnf with the following content. ```auto [req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no # Details about the issuer of the certificate [req_distinguished_name] C = US ST = iowa L = cedar rapids O = enseva OU = admin CN = graylog.domain.com [v3_req] keyUsage = keyEncipherment, dataEncipherment,nonRepudiation extendedKeyUsage = serverAuth subjectAltName = @alt_names # IP addresses and DNS names the certificate should include # Use IP.### for IP addresses and DNS.### for DNS names, # with "###" being a consecutive number. [alt_names] IP.1 = 192.168.1.100 DNS.1 = graylog.domain.com ``` Insure JVM to pick up the trust store, it has to be started with the JVM parameter and Graylog has access to keystore and the certificates. I used the Default keystore “cacerts”. `-Djavax.net.ssl.trustStore=/path/to/cacerts.jks` If the keystore has password you may need this config `-Djavax.net.ssl.trustStorePassword=secret` Hope that helps ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [September 23, 2022, 2:34am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/23 "2022-09-23T02:34:40Z")
@gmorin > [@oebhardt](#): > > I think, we might find the reason here; normally, not the Graylog-Certificate, but the CA-certs should be installed into the CA-keystore, as java should trust all certificates coming from that: I beieve @oebhardt is correct. > The resulting PKCS#8 private key (graylog-key.pem) and the X.509 certificate (graylog-certificate.pem) can now be used to enable encrypted connections which will be used on the Input with TCP/TLS. The certificate that will be **install in the keystore** is the one that is created below. ```auto $ openssl req -x509 -days 365 -nodes -newkey rsa:2048 -config openssl-graylog.cnf -keyout pkcs5-plain.pem -out cert.pem ``` Then import that cert called cert.pem ```auto $ keytool -importcert -keystore /path/to/cacerts.jks -storepass changeit -alias graylog-self-signed -file cert.pem ``` In your case I believe it should have been the certificate called “ca.crt”. @gmorin The reason I stated this is from this statement above. > [@gmorin](#): > > successfully added the graylog.crt cert in the Java Keystore with `keytool -importcert -keystore /usr/lib/jvm/java-17-oracle/lib/security/cacerts -alias graylog-ad-signed -file /etc/graylog/server/certificates/graylog.crt` Then I seen this statement > [@gmorin](#): > > installed the ca.crt with `cp ca.crt /usr/local/share/ca-certificates && update-ca-certificates`, ADDED NOTE: If a directory was create in Graylogs home directory, ensure Graylog has permission to that directory. **Example** : ```auto chown graylog:graylog -R /etc/graylog/server/certificates ``` Also after re-reading the server logs I noticed this error. > Caused by: java.util.jar.JarException: The JCE Provider file:/usr/share/graylog-server/graylog.jar is not signed. I found here… - [encryption - JCE cannot authenticate the provider BC in java swing application - Stack Overflow](https://stackoverflow.com/questions/13721579/jce-cannot-authenticate-the-provider-bc-in-java-swing-application/13726570) Hope that helps. ---
**Author:** ![oebhardt](https://avatars.discourse-cdn.com/v4/letter/o/e274bd/32.png) [@oebhardt](https://community.graylog.org/u/oebhardt)\ **Post date:** [September 23, 2022, 6:39am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/24 "2022-09-23T06:39:44Z")
Hello @gmorin, @gsmith, the exception about unsigned classes is kind of interesting (I missed that completely…), but would indicate some of the Graylog classes would be unsigned. If so, I guess we all should have run into that problem. (Well, theoretically; unfortunately, practis and theory do not always match.) Right now, I suspect there is something wrong with the certificate, because - after comparing @gsmith and my own notes, it relay seems the setup should be clean by now. So, @gmorin, could you please share the output of `openssl x509 -in *YourCertificate-File* -noout -text` so we could see if there is something wrong with it? ---
**Author:** ![H077E](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h077e/32/15231_2.png) [@H077E](https://community.graylog.org/u/H077E)\ **Post date:** [September 23, 2022, 8:06am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/25 "2022-09-23T08:06:56Z")
Hi, it’s possible to use [NGINX or Apache as a reverse proxy](https://graylog-docs-demo.document360.io/v1/docs/web-interface#nginx) ---
**Author:** ![gmorin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gmorin/32/12744_2.png) [@gmorin](https://community.graylog.org/u/gmorin)\ **Post date:** [September 23, 2022, 8:58am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/26 "2022-09-23T08:58:41Z")
Hi @H077E, That’s my current setup ! 🙂 But it’s not suited for my usecase… 😕 That’s why I’m trying to get the ‘official way’ working 😛 ---
**Author:** ![H077E](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h077e/32/15231_2.png) [@H077E](https://community.graylog.org/u/H077E)\ **Post date:** [September 23, 2022, 9:21am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/27 "2022-09-23T09:21:23Z")
I understand that. I’m looking forward to the solution to your problem. Unfortunately I can’t help you here. 🙉 ---
**Author:** ![oebhardt](https://avatars.discourse-cdn.com/v4/letter/o/e274bd/32.png) [@oebhardt](https://community.graylog.org/u/oebhardt)\ **Post date:** [September 23, 2022, 12:17pm UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/28 "2022-09-23T12:17:39Z")
Hi @gmorin, did You have time to do the SSL, so we could check the certificate? `openssl x509 -in *YourCertificate-File* -noout -text` ---
**Author:** ![gmorin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gmorin/32/12744_2.png) [@gmorin](https://community.graylog.org/u/gmorin)\ **Post date:** [September 26, 2022, 6:32am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/29 "2022-09-26T06:32:39Z")
Hi @oebhardt, @gsmith, I finally managed to make HTTPS working the official way ! 🥳 I think it was a java-related issue, due to my java 17 installation on Debian 10. I know that Debian 11 is not officially supported by Graylog for now, but that’s the way I went. I created a new server this weekend and reinstalled Graylog from scratch. Thanks to Debian 11, I have now access to the OpenJDK 17. I reused the certs files I made, following the tutorial and your tips and it now works. Many thanks !! Next step is to reimport the previous server configuration (pipelines, streams and inputs). Is it any way to export/reimport it, or do I have to do it by hands ? (not a big deal if not ^^) ---
**Author:** ![oebhardt](https://avatars.discourse-cdn.com/v4/letter/o/e274bd/32.png) [@oebhardt](https://community.graylog.org/u/oebhardt)\ **Post date:** [September 26, 2022, 7:58am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/30 "2022-09-26T07:58:52Z")
Hey, these are great news! Nice to hear it is running now; about the export I’m afraid I can’t help - I know it is possible to export extractors as jason-Files, but have no idea about the rest. ---
**Author:** ![gmorin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gmorin/32/12744_2.png) [@gmorin](https://community.graylog.org/u/gmorin)\ **Post date:** [September 26, 2022, 8:56am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/31 "2022-09-26T08:56:37Z")
Well, I found a way to export the whole configuration as a content pack. I’ll test importing that later today ^^ ---
**Author:** ![H077E](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h077e/32/15231_2.png) [@H077E](https://community.graylog.org/u/H077E)\ **Post date:** [September 26, 2022, 9:05am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/32 "2022-09-26T09:05:08Z")
If you need the complete config, you can create a Database-Dump. (Also recommended before any GL upgrade.) > **[mongodump — MongoDB Database Tools](https://www.mongodb.com/docs/database-tools/mongodump/#bin.mongodump)** ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [October 10, 2022, 9:05am UTC](https://community.graylog.org/t/struggling-with-https-ssl/25832/33 "2022-10-10T09:05:24Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed. [Previous page](https://community.graylog.org/t/struggling-with-https-ssl/25832.md?page=1)