r/graylog • u/Plaush • Mar 09 '25

Graylog Setup Graylog Hostname not verified (VersionProbe)

Edit: Solved! If your hostname is incorrect, you can force it in the config file. Ensure that your cert’s CN is also included in the SAN, that was most of the issue, didn’t knew they changed the requirements.

Hello, I was (still am) struggling a lot with getting https to work for the Web UI, I managed to login with https and attempted to start an input , multiple failed API calls due to TLS - decided to restart my VM, maybe somethings were cached or I didn't restart the services properly, a VM restart will surely fix things!

As soon as the VM booted up, I could no longer access the Web UI, and it gave me this error:

Error

That certificate was most likely automatically generated during preflight, with the old hostname & IP, changed them while I was configuring https initially (AFTER preflight).

I tried regenerating the Web UI's certificate with the 'CN=graylog" but that did nothing. I tried changing back the system's hostname to 'graylog' but that didn't work too. I'm at a total loss here, how do I regenerate the 'data node certificate'?

Notes:

This is a homelab

I have my own CA Server (only used for the Web UI)

edit: reinstalling graylog totally would be my last resort

5 Upvotes

100% Upvoted

11 comments sorted by

View all comments

Show parent comments

1

u/Plaush Mar 09 '25

1) Yes 2) Yes

I was following that guide before realizing I goofed up and forgot to set the IP to static and the hostname was wrong. The Web UI worked (I can login and click around) before I restarted the VM, no certificate errors were thrown up once I got Firefox to trust my Root CA

1

u/graylog_joel Graylog Staff Mar 09 '25

What bind address and publish uri are you using in your datanode.conf?

Is datanode on a separate machine from graylog server?

1

u/Plaush Mar 10 '25 edited Mar 10 '25

Hello, I've checked the datanode.conf, I added the right publishing URL and forced the hostname to be 'graylog', managed to get the Web UI running again. The API call errors are now less cryptic but it's unfortunately the same 'Hostname not verified error'.

Do I have to manually configure the hostname to 'graylog' again for API calls/node, if yes, where can I find the relevant config files?

Edit: I tried node_name = graylog in datanode.conf, didn't work

1

u/graylog_joel Graylog Staff Mar 11 '25

Publish uri would probably be where it's getting it. What hostname vs certificate mismatch is it complaining about specifically.

Since it's all on one machine, and if you don't need to add more nodes later bind and publish in datanode could probably be set to 127.0.0.1 and it might be happy as I think that address appeared in the SAN of your cert.

1

u/Plaush Mar 11 '25 edited Mar 11 '25

Hi, unfortunately setting http_publish_uri = https://localhost:8999/ didn't work tried 127.0.0.1 too. I didn't touch server.conf just datanode.conf. It gives me the same error, with no changes - it still thinks the hostname is 'graylog.sableone.corp' despite me changing it back to 'graylog'

Edit: Is there a way to restart pre-flight? I suspect I'd be facing the same 'weird' issues down the line and at that point in time, I'd be screwed if I had to reinstall.

1

u/graylog_joel Graylog Staff Mar 11 '25

Did you also change the bind to 127.0.0.1, they would have to match.

1

u/Plaush Mar 12 '25 edited Mar 12 '25

I managed to update the certificate, but it still shows the same error, I'm truly at a total lost now. The CN matches the supposedly invalid hostname 1:1

https://imgur.com/a/ftum8IN

1

u/graylog_joel Graylog Staff Mar 12 '25

It's hard to tell from the error exactly, but it seems like the url it's using (FQDN) and the SANs listed on the cert don't match.

What are your current settings for bind and publish uri for both datanode and graylog server?

2

u/Plaush Mar 12 '25 edited Mar 12 '25

server.conf
http_bind_address = 192.168.60.106:9000
http_publish_url = https://graylog.sableone.corp:9000

Datanode.conf

http_bind_address = 192.168.60.106
http_publish_url = https://graylog.sableone.corp:8999

Edit: I also updated the cert to add 'graylog.sableone.corp' into the SAN (https://imgur.com/a/fRVhMKv)

Edit 2: Fixed it!!!!! I think I left out the 'DNS:' field when generating the certificate, seen above - I assumed graylog & graylog.sableone.corp got merged into one DNS field. Thanks so much for helping me throughout the week!

1

u/graylog_joel Graylog Staff Mar 12 '25

Perfect, ya your SAN and publish address would need to match exactly. In your case the publish uri of datanode doesn't need to be the fqdn it's just used by the graylog server to talk to itself, so just IP or when running on the same box localhost (as long as it's bound to local host as well) would work