Suddenly Can Not Access GUI

[Jimmy]

Hello,

I am getting my wazuh dashboard can not access, that previously it can be accessed normally.
After I check the wazuh dashboard status, I see this error message below that related to SSL certificate.
I've check the certificate used, it is not expired yet
FYI, we don't use 3rd party certificate.

Oct 05 09:33:55 wzh-dbrd opensearch-dashboards[415]: {"type":"error","@timestamp":"2023-10-05T02:33:55Z","tags":["connection","client","error"],"pid":415,"level":"error","error":{"message":"140617755625344:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\n","name":"Error","stack":"Error: 140617755625344:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\n","code":"ERR_SSL_SSLV3_ALERT_CERTIFICATE_UNKNOWN"},"message":"140617755625344:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\n"}

Oct 05 09:33:55 wzh-dbrd opensearch-dashboards[415]: {"type":"response","@timestamp":"2023-10-05T02:33:55Z","tags":[],"pid":415,"method":"get","statusCode":302,"req":{"url":"/","method":"get","headers":{"host":"43.218.32.184","connection":"keep-alive","sec-ch-ua":"\"Google Chrome\";v=\"117\", \"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"117\"","sec-ch-ua-mobile":"?0","sec-ch-ua-platform":"\"macOS\"","upgrade-insecure-requests":"1","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","sec-fetch-site":"none","sec-fetch-mode":"navigate","sec-fetch-user":"?1","sec-fetch-dest":"document","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"61.94.108.16","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36"},"res":{"statusCode":302,"responseTime":2,"contentLength":9},"message":"GET / 302 2ms - 9.0B"}

Can someone help to tell me what's happening and how can I resolve this issue?

Thanks.
Jimmy

[Himanshu Sharma]

Hi Jimmy,

Thanks for using the Wazuh.

Based on the error message you provided, This is common when using a certificate that is not recognized with a standard set of CAs. it seems that there is an issue with the SSL certificate on your Wazuh dashboard. 

Can you please check if the certificate expired then you need to regenerate the certificates and apply them.

If the certificate is not expired, you can try the following steps:

1. Verify the SSL certificate chain: Make sure that the SSL certificate chain is complete and all intermediate certificates are properly configured.

2. Check the certificate installation: Ensure that the SSL certificate is installed correctly on the server hosting the Wazuh dashboard. Double-check the certificate file and its location.

3. Restart the Wazuh dashboard service: Sometimes, a simple restart of the Wazuh dashboard service can resolve SSL-related issues. Try restarting the service and see if the problem persists.

Reference:

https://documentation.wazuh.com/current/user-manual/certificates.html

Regards,