{"action":"opened","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2186","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2186/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2186/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2186/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/2186","id":153087386,"number":2186,"title":"Nginx unable to find valid certification path","user":{"login":"avongluck-r1soft","id":12514863,"avatar_url":"https://avatars.githubusercontent.com/u/12514863?v=3","gravatar_id":"","url":"https://api.github.com/users/avongluck-r1soft","html_url":"https://github.com/avongluck-r1soft","followers_url":"https://api.github.com/users/avongluck-r1soft/followers","following_url":"https://api.github.com/users/avongluck-r1soft/following{/other_user}","gists_url":"https://api.github.com/users/avongluck-r1soft/gists{/gist_id}","starred_url":"https://api.github.com/users/avongluck-r1soft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avongluck-r1soft/subscriptions","organizations_url":"https://api.github.com/users/avongluck-r1soft/orgs","repos_url":"https://api.github.com/users/avongluck-r1soft/repos","events_url":"https://api.github.com/users/avongluck-r1soft/events{/privacy}","received_events_url":"https://api.github.com/users/avongluck-r1soft/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-04T18:51:07Z","updated_at":"2016-05-04T18:51:07Z","closed_at":null,"body":"### Problem description\r\nAfter upgrading to Graylog 2.0, we're seeing the following error in the graylog server logs:\r\n\r\n2016-05-04T13:42:34.897-05:00 WARN  [ProxiedResource] Unable to call https://XXX.XXX.net:12900/system/metrics/multiple on node <d2636a89-c572-4717-b7e8-f7cada1266c6>, caught exception: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (class javax.net.ssl.SSLHandshakeException)\r\n\r\n\r\nRandom sections of the graylog web app don't work (although data-processing is running)\r\n\r\n\r\nWe're handling TLS through an nginx proxy. Graylog is listening on localhost via unsecured http.\r\n```\r\nserver {\r\n  listen       443 ssl spdy;\r\n  server_name  XXX.XXX.net;\r\n\r\n  ssl_dhparam          /etc/ssl/certs/dhparams.pem;\r\n  ssl_certificate      /etc/letsencrypt/live/XXX.XXX.net/fullchain.pem;\r\n  ssl_certificate_key  /etc/letsencrypt/live/XXX.XXX.net/privkey.pem;\r\n\r\n  ssl_session_cache shared:SSL:1m;\r\n  ssl_session_timeout  5m;\r\n\r\n  # Some SSL cipher stuff omitted.\r\n\r\n  location / {\r\n    proxy_set_header Host $host;\r\n    proxy_set_header X-Real-IP $remote_addr;\r\n    proxy_pass http://127.0.0.1:9000;\r\n  }\r\n}\r\n\r\nserver {\r\n  listen\tXX.XX.XX.XX:12900 ssl spdy;\r\n  server_name   XXX.XXX.net;\r\n\r\n  ssl_dhparam          /etc/ssl/certs/dhparams.pem;\r\n  ssl_certificate      /etc/letsencrypt/live/XXX.XXX.net/fullchain.pem;\r\n  ssl_certificate_key  /etc/letsencrypt/live/XXX.XXX.net/privkey.pem;\r\n\r\n  location / {\r\n    proxy_set_header Host $host;\r\n    proxy_set_header X-Real-IP $remote_addr;\r\n    proxy_pass http://127.0.0.1:12900;\r\n  }\r\n}\r\n```\r\n\r\n```\r\n# cat /etc/graylog/server/server.conf | egrep \"^web|^rest\"\r\nrest_listen_uri = http://127.0.0.1:12900\r\nrest_transport_uri = https://XXX.XXX.net:12900\r\nweb_listen_uri = http://127.0.0.1:9000/\r\nweb_transport_uri = https://XXX.XXX.net/\r\n```"}}