# Unable to start inputs after implementing HTTPS on Graylog web interface

**URL:** <https://community.graylog.org/t/unable-to-start-inputs-after-implementing-https-on-graylog-web-interface/22261>\
**Category:** Graylog Central (peer support)\
**Created:** [January 6, 2022, 7:37am UTC](https://community.graylog.org/t/unable-to-start-inputs-after-implementing-https-on-graylog-web-interface/22261 "2022-01-06T07:37:37Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![foss4ever](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/foss4ever/32/12179_2.png) [@foss4ever](https://community.graylog.org/u/foss4ever)\
**Post date:** [January 11, 2022, 1:59pm UTC](https://community.graylog.org/t/unable-to-start-inputs-after-implementing-https-on-graylog-web-interface/22261/5 "2022-01-11T13:59:21Z")

</div>

Ok, I finally managed to get TLS encryption working on the web interface while still being able to start my inputs. Next up is figuring out how to actually get a client to send TLS encrypted syslog input to Graylog.

These are the steps I followed to get things working on my Debian 10 box (thanks to user @dickinsonzach who post this solution: [After SSL - Hostname not verified - #12 by dickinsonzach](https://community.graylog.org/t/after-ssl-hostname-not-verified/19010/12)):

Start out by changing directory into /etc/graylog/server

Then do:

`sudo vi openssl-graylog.cnf`

Insert the following:

[req]  
distinguished\_name = req\_distinguished\_name  
x509\_extensions = v3\_req  
prompt = no

[req\_distinguished\_name]  
C = _input countrycode_  
L = _input city_  
O = _input organisation name_  
OU = _insert department name_  
CN = _insert graylog FQDN_ (i.e. [graylog.yourdomain.com](http://graylog.yourdomain.com))

[v3\_req]  
keyUsage = keyEncipherment, dataEncipherment, nonRepudiation, digitalSignature  
extendedKeyUsage = serverAuth  
subjectAltName = @alt\_names

[alt\_names]  
IP.1 = _insert IP-address of graylog server_  
DNS.1 = _insert graylog FQDN_

Save & exit VI.

Now create a certificate using the config we just set up:

`sudo openssl req -x509 -days 1095 -nodes -newkey rsa:4096 -config openssl-graylog.cnf -keyout pkcs5-plain.pem -out cert.pem`

Convert the pkcs5 file into pkcs8 format:  
`sudo openssl pkcs8 -in pkcs5-plain.pem -topk8 -nocrypt -out pkcs8-plain.pem`

Create an encrypted version of the pkcs8 certificate file:  
`sudo openssl pkcs8 -in pkcs5-plain.pem -topk8 -out pkcs8-encrypted.pem -passout pass:*insert a cert passphrase*`

Import the cert.pem created initially, into the keystore:  
`sudo keytool -importcert -keystore /etc/ssl/certs/java/cacerts -storepass changeit -alias *insert graylog FQDN* -file cert.pem`

Give the graylog user ownership of all the certs:  
`sudo chown -R graylog:graylog /etc/graylog/`

Edit the graylog server config to enable TLS encryption:  
`sudo vi /etc/graylog/server/server.conf`

In section “HTTPS settings”, make changes like so:

http\_enable\_tls = true  
http\_tls\_cert\_file = /etc/graylog/cert.pem  
http\_tls\_key\_file = /etc/graylog/pkcs8-encrypted.pem  
http\_tls\_key\_password = [insert cert passphrase]

Finally, do:

`systemctl restart graylog-server.service`

And test that Graylog web interface can now be accessed over https - https://_insert graylog FQDN_:9000/  
Also check that the inputs are still working/running.

---

_[View the full topic](https://community.graylog.org/t/unable-to-start-inputs-after-implementing-https-on-graylog-web-interface/22261)._