# Unable to get https on graylog to work **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [June 3, 2017, 2:14am UTC](https://community.graylog.org/t/unable-to-get-https-on-graylog-to-work/1331 "2017-06-03T02:14:40Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [June 3, 2017, 2:14am UTC](https://community.graylog.org/t/unable-to-get-https-on-graylog-to-work/1331/1 "2017-06-03T02:14:40Z")
Hello all, Sorry for all the information. Tried to show all the Info available, along with what I tried to resolve this problem. What I’m doing is testing how to configure Graylog to use https before I execute it to our production environment. I create a single Graylog2 server on CentOS 7 minimal install. Two CPU, 4 Gigs Memory and 120 Gig HDD. I have disabled Selinux and cleared the firewall. Using the following install instructions; [http://docs.graylog.org/en/2.2/pages/installation/os/centos.html](http://docs.graylog.org/en/2.2/pages/installation/os/centos.html) After logging in from the web interface, making sure the server was functioning. I proceeded to follow these instructions; [http://docs.graylog.org/en/2.2/pages/configuration/https.html](http://docs.graylog.org/en/2.2/pages/configuration/https.html) After restarting Graylog server I execute the following checks; Checked my Elasticsearch; Root # curl -XGET ‘[http://xxx.xxx.xxx.xxx:9200/\_cluster/health?pretty=true](http://xxx.xxx.xxx.xxx:9200/_cluster/health?pretty=true)’ { “cluster\_name” : “graylog”, “status” : “green”, “timed\_out” : false, “number\_of\_nodes” : 2, “number\_of\_data\_nodes” : 1, “active\_primary\_shards” : 4, “active\_shards” : 4, “relocating\_shards” : 0, “initializing\_shards” : 0, “unassigned\_shards” : 0, “delayed\_unassigned\_shards” : 0, “number\_of\_pending\_tasks” : 0, “number\_of\_in\_flight\_fetch” : 0, “task\_max\_waiting\_in\_queue\_millis” : 0, “active\_shards\_percent\_as\_number” : 100.0 Check the status of Graylog Server [root@localhost server]# systemctl status graylog-server ● graylog-server.service - Graylog server Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2017-06-02 20:09:28 CDT; 14min ago Docs: [http://docs.graylog.org/](http://docs.graylog.org/) Main PID: 4320 (graylog-server) CGroup: /system.slice/graylog-server.service ├─4320 /bin/sh /usr/share/graylog-server/bin/graylog-server └─4321 /usr/bin/java -Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnload… Jun 02 20:09:28 localhost.localdomain systemd[1]: Started Graylog server. Jun 02 20:09:28 localhost.localdomain systemd[1]: Starting Graylog server… Check the status of Mongodb [root@localhost server]# systemctl status mongod ● mongod.service - High-performance, schema-free document-oriented database Loaded: loaded (/usr/lib/systemd/system/mongod.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2017-06-02 19:28:10 CDT; 57min ago Docs: [https://docs.mongodb.org/manual](https://docs.mongodb.org/manual) Process: 809 ExecStartPre=/usr/bin/chmod 0755 /var/run/mongodb (code=exited, status=0/SUCCESS) Process: 805 ExecStartPre=/usr/bin/chown mongod:mongod /var/run/mongodb (code=exited, status=0/SUCCESS) Process: 798 ExecStartPre=/usr/bin/mkdir -p /var/run/mongodb (code=exited, status=0/SUCCESS) Main PID: 1962 (mongod) CGroup: /system.slice/mongod.service └─1962 /usr/bin/mongod --quiet -f /etc/mongod.conf run Jun 02 19:28:10 localhost.localdomain systemd[1]: Starting High-performance, schema-free document-oriented database… Jun 02 19:28:10 localhost.localdomain systemd[1]: Started High-performance, schema-free document-oriented database. Jun 02 19:28:12 localhost.localdomain mongod[815]: about to fork child process, waiting until server is ready for connections. Jun 02 19:28:12 localhost.localdomain mongod[815]: forked process: 1962 Jun 02 19:28:14 localhost.localdomain mongod[815]: child process started successfully, parent exiting Check the status of Elasticsearch [root@localhost server]# systemctl status elasticsearch ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2017-06-02 19:28:10 CDT; 58min ago Docs: [http://www.elastic.co](http://www.elastic.co) Process: 804 ExecStartPre=/usr/share/elasticsearch/bin/elasticsearch-systemd-pre-exec (code=exited, status=0/SUCCESS) Main PID: 812 (java) CGroup: /system.slice/elasticsearch.service └─812 /bin/java -Xms256m -Xmx1g -Djava.awt.headless=true -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseC… Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) Jun 02 20:10:38 localhost.localdomain elasticsearch[812]: at java.lang.Thread.run(Thread.java:748) No problems in the log file/s after Service restart. Using Chrome I tried to login executing following URL [https://graylog-server:9000/](https://graylog-server:9000/) I received the following ERROR; This site can’t be reached unexpectedly closed the connection. Try: Checking the connection Checking the proxy and the firewall Running Windows Network Diagnostics ERR\_CONNECTION\_CLOSED My Server configuration file as follow; is\_master = true node\_id\_file = /etc/graylog/server/node-id password\_secret = FxwOFsKdr3D2fDEmFRqqbgn1vCwuMB6pf21EWD3KGJ8PUFhJKV0oYLrE1LyINLsOhQB7DhkUDDMNtAwHLsoCoRWfXVW8YA0S root\_password\_sha2 = 89e01536ac207279409d4de1e5253e01f4a1769e696db0d6062ca9b8f56767c8 plugin\_dir = /usr/share/graylog-server/plugin rest\_listen\_uri = [https://graylog-server:9000/api/](https://graylog-server:9000/api/) rest\_transport\_uri = [http://graylog-server:9000/api/](http://graylog-server:9000/api/) rest\_enable\_tls = true rest\_tls\_cert\_file = /etc/graylog/server/cert/graylog-certificate.pem rest\_tls\_key\_file = /etc/graylog/server/cert/graylog-key.pem rest\_tls\_key\_password = secret web\_listen\_uri = [https://graylog-server:9000/](https://graylog-server:9000/) web\_enable\_tls = true web\_tls\_cert\_file = /etc/graylog/server/cert/graylog-certificate.pem web\_tls\_key\_file = /etc/graylog/server/cert/graylog-key.pem web\_tls\_key\_password = secret rotation\_strategy = count elasticsearch\_max\_docs\_per\_index = 20000000 elasticsearch\_max\_number\_of\_indices = 20 retention\_strategy = delete elasticsearch\_shards = 4 elasticsearch\_replicas = 0 elasticsearch\_index\_prefix = graylog allow\_leading\_wildcard\_searches = false allow\_highlighting = false elasticsearch\_discovery\_zen\_ping\_unicast\_hosts = graylog-server:9300 elasticsearch\_network\_host = 10.200.6.49 elasticsearch\_analyzer = standard outputbuffer\_processors. output\_flush\_interval = 1 output\_fault\_count\_threshold = 5 output\_fault\_penalty\_seconds = 30 processbuffer\_processors = 5 outputbuffer\_processors = 3 processor\_wait\_strategy = blocking ring\_size = 65536 inputbuffer\_ring\_size = 65536 inputbuffer\_processors = 2 inputbuffer\_wait\_strategy = blocking message\_journal\_enabled = true message\_journal\_dir = /var/lib/graylog-server/journal lb\_recognition\_period\_seconds = 3 mongodb\_uri = mongodb://localhost/graylog mongodb://grayloguser:secret@localhost:27017/graylog mongodb://grayloguser:secret@localhost:27017,localhost:27018,localhost:27019/graylog mongodb\_max\_connections = 1000 mongodb\_threads\_allowed\_to\_block\_multiplier = 5 content\_packs\_dir = /usr/share/graylog-server/contentpacks content\_packs\_auto\_load = grok-patterns.json proxied\_requests\_thread\_pool\_size = 32 Trying to resolve this error,I have looked at the following resources; > [@Cant get HTTPS working on graylog](https://community.graylog.org/t/cant-get-https-working-on-graylog/1215): > > We have a problem with our setup getting it to work with https. As soon as we configure this in the server.conf en enable tls the server isnt starting and the webpage isnt showed anymore. When we uncomment the sections mentioning the tls / certificates it is working again. SETUP: Graylog 2.2.3 server with MongoDB running on Ubuntu 16.04 LTS. Elasticsearch: 2.4.5, Ubuntu 16.04 LTS. Network: Graylog = 10.201.1.16 Elasticsearch = 10.201.1.21 CONFIG: Graylog: is\_master = true rest\_listen\_… > [@HTTPS login working but need help adding cert to JVM trust store](https://community.graylog.org/t/https-login-working-but-need-help-adding-cert-to-jvm-trust-store/1019): > > I wish for my graylog server to work with https so I read the below instructions… [http://docs.graylog.org/en/2.2/pages/configuration/https.html](http://docs.graylog.org/en/2.2/pages/configuration/https.html) I am able to login to the web interface using https but the Cisco input (from [https://marketplace.graylog.org/addons/92c7e8b5-8f9b-44c1-9b36-7bc41685d2fe](https://marketplace.graylog.org/addons/92c7e8b5-8f9b-44c1-9b36-7bc41685d2fe)) is no longer working. I am wondering if it is because I could not figure out how to add the cert to the JVM trust store. From the instructions… "In order for the JVM to pick up the new trust store… > [@Help please with using HTTPS on clustered Graylog](https://community.graylog.org/t/help-please-with-using-https-on-clustered-graylog/1004): > > Hello, I need help with using HTTPS on clustered Graylog please. According to manual below I created certificate and keys (cert.pem, pkcs5-plain.pem , pkcs8-encrypted.pem, pkcs8-plain.pempkcs5-plain.pem) in path /etc/graylog/server/certificates/. [http://docs.graylog.org/en/2.2/pages/configuration/https.html?highlight=https](http://docs.graylog.org/en/2.2/pages/configuration/https.html?highlight=https) On first node I configured required parameters: rest\_enable\_tls = true rest\_tls\_cert\_file = /etc/graylog/server/certificates/cert.pem rest\_tls\_key\_file = /etc/graylog/ser… > [@Graylog Unable to call https://....:9000/api \[RESOLVED\]](https://community.graylog.org/t/graylog-unable-to-call-https-9000-api-resolved/469/3): > > root@graylog:~# echo -n | openssl s\_client -connect 10.1.1.20:9000 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' \> graylog-cert.pem depth=0 C = UA, ST = Odessa, L = Odessa, O = mydomain.com, OU = Graylog, CN = graylog.mydomain.com verify error:num=18:self signed certificate verify return:1 depth=0 C = UA, ST = Odessa, L = Odessa, O = mydomain.com, OU = Graylog, CN = graylog.mydomain.com verify return:1 DONE root@graylog:~# openssl x509 -noout -in graylog-cert.pem -fingerprint -sha1 SHA… It seems everything is running right on the server, but unable to connect through the web interface, any help would be appreciated, Thanks again ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [June 3, 2017, 2:58am UTC](https://community.graylog.org/t/unable-to-get-https-on-graylog-to-work/1331/2 "2017-06-03T02:58:07Z")
Found something interesting, unsure if this might be the problem; [root@localhost elasticsearch]# curl [https://graylog-server:9000](https://graylog-server:9000) curl: (60) Issuer certificate is invalid. More details here: [http://curl.haxx.se/docs/sslcerts.html](http://curl.haxx.se/docs/sslcerts.html) curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn’t adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you’d like to turn off curl’s verification of the certificate, use the -k (or --insecure) option. [root@localhost elasticsearch]# ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [June 3, 2017, 4:34am UTC](https://community.graylog.org/t/unable-to-get-https-on-graylog-to-work/1331/3 "2017-06-03T04:34:32Z")
I fixed my certification problem. Went back to [http://docs.graylog.org/en/2.2/pages/configuration/https.html](http://docs.graylog.org/en/2.2/pages/configuration/https.html) and finished the section called "Adding a self-signed certificate to the JVM trust store " I executed the following command again: [root@localhost ~]# curl [https://graylog-server:9000/](https://graylog-server:9000/) curl: (7) Failed connect to graylog-server:9000; Connection refused Think I’m getting closer, not sure yet. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 7, 2017, 12:37pm UTC](https://community.graylog.org/t/unable-to-get-https-on-graylog-to-work/1331/4 "2017-06-07T12:37:30Z")
hej @gsmith please format your config/logs as code block with: ```` ``` TEXT ``` ```` currently this is not readable. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [June 21, 2017, 12:38pm UTC](https://community.graylog.org/t/unable-to-get-https-on-graylog-to-work/1331/5 "2017-06-21T12:38:12Z")
Closed on June 21, 2017, 12:38pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.