Not able to set HTTPS

[nhs1925]

Prerequisites

• [X] I read the Deployment and Setup section of the OpenCTI documentation as well as the Troubleshooting page and didn't find anything relevant to my problem.
• [x] I went through old GitHub issues and couldn't find anything relevant
• [X] I googled the issue and didn't find anything relevant

Description

I get errors when I try to set certificates not to be accessed by HTTP but by HTTPS. I have tried with my own configuration and with this one (copied from another post), but I can't get it to support it.

I've been looking in the guide but I find nothing

Environment

1. OS (where OpenCTI server runs): Ubuntu Server 22.04 Virtualized VMware
2. OpenCTI version: opencti/platform:6.3.6
3. OpenCTI client: { e.g. frontend or python }
4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. { e.g. Run ... }
2. { e.g. Click ... }
3. { e.g. Error ... }

Error: Failed to deploy a stack: Network opencti_default Creating Network opencti_default Created Container opencti-elasticsearch-1 Creating Container opencti-redis-1 Creating Container opencti-rabbitmq-1 Creating Container opencti-minio-1 Creating Container opencti-elasticsearch-1 Created Container opencti-redis-1 Created Container opencti-rabbitmq-1 Created Container opencti-minio-1 Created Container opencti-opencti-1 Creating Container opencti-opencti-1 Created Container opencti-connector-import-document-1 Creating Container opencti-connector-import-file-stix-1 Creating Container opencti-connector-export-file-stix-1 Creating Container opencti-worker-3 Creating Container opencti-connector-export-file-csv-1 Creating Container opencti-worker-1 Creating Container opencti-worker-2 Creating Container opencti-connector-analysis-1 Creating Container opencti-connector-export-file-txt-1 Creating Container opencti-connector-import-document-1 Created Container opencti-connector-import-file-stix-1 Created Container opencti-worker-1 Created Container opencti-connector-export-file-csv-1 Created Container opencti-connector-export-file-stix-1 Created Container opencti-connector-analysis-1 Created Container opencti-worker-3 Created Container opencti-connector-export-file-txt-1 Created Container opencti-worker-2 Created Container opencti-rabbitmq-1 Starting Container opencti-redis-1 Starting Container opencti-minio-1 Starting Container opencti-elasticsearch-1 Starting Container opencti-rabbitmq-1 Started Container opencti-elasticsearch-1 Started Container opencti-redis-1 Started Container opencti-minio-1 Started Container opencti-minio-1 Waiting Container opencti-rabbitmq-1 Waiting Container opencti-redis-1 Waiting Container opencti-elasticsearch-1 Waiting Container opencti-redis-1 Healthy Container opencti-minio-1 Healthy Container opencti-elasticsearch-1 Healthy Container opencti-rabbitmq-1 Healthy Container opencti-opencti-1 Starting Container opencti-opencti-1 Started Container opencti-opencti-1 Waiting Container opencti-opencti-1 Waiting Container opencti-opencti-1 Waiting Container opencti-opencti-1 Waiting Container opencti-opencti-1 Waiting Container opencti-opencti-1 Waiting Container opencti-opencti-1 Waiting Container opencti-opencti-1 Error Container opencti-opencti-1 Error Container opencti-opencti-1 Error Container opencti-opencti-1 Error Container opencti-opencti-1 Error Container opencti-opencti-1 Error Container opencti-opencti-1 Error dependency failed to start: container opencti-opencti-1 is unhealthy

Additional information

Configuration .yml services: redis: image: redis:7.4.0 restart: always volumes:

• redisdata:/data healthcheck: test: ["CMD", "redis-cli", "ping"] interval: 10s timeout: 5s retries: 3 elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:8.15.2 volumes:
• esdata:/usr/share/elasticsearch/data environment:

  Comment-out the line below for a cluster of multiple nodes

• discovery.type=single-node

  Uncomment the line below below for a cluster of multiple nodes

  - cluster.name=docker-cluster

• xpack.ml.enabled=false
• xpack.security.enabled=false
• thread_pool.search.queue_size=5000
• logger.org.elasticsearch.discovery="ERROR"
• "ES_JAVA_OPTS=-Xms${ELASTIC_MEMORY_SIZE} -Xmx${ELASTIC_MEMORY_SIZE}" restart: always ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 healthcheck: test: curl -s http://elasticsearch:9200 >/dev/null || exit 1 interval: 30s timeout: 10s retries: 50 minio: image: minio/minio:RELEASE.2024-05-28T17-19-04Z # Use "minio/minio:RELEASE.2024-05-28T17-19-04Z-cpuv1" to troubleshoot compatibility issues with CPU volumes:
• s3data:/data ports:
• "9000:9000" environment: MINIO_ROOT_USER: ${MINIO_ROOT_USER} MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
  command: server /data restart: always healthcheck: test: ["CMD", "mc", "ready", "local"] interval: 10s timeout: 5s retries: 3 rabbitmq: image: rabbitmq:3.13-management environment:
• RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
• RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
• RABBITMQ_NODENAME=rabbit01@localhost volumes:
• amqpdata:/var/lib/rabbitmq restart: always healthcheck: test: rabbitmq-diagnostics -q ping interval: 30s timeout: 30s retries: 3 opencti: image: opencti/platform:6.3.6 environment:
• NODE_OPTIONS=--max-old-space-size=8096
• APP__PORT=8080
• APP__HTTPS_CERT__KEY=${OPENCTI_KEY_PATH}
• APP__HTTPS_CERT__CRT=${OPENCTI_CRT_PATH}
• APP__HTTPS_CERT__REJECT_UNAUTHORIZED=false
• APP__BASE_URL=${OPENCTI_BASE_URL}
• APPADMINEMAIL=${OPENCTI_ADMIN_EMAIL}
• APPADMINPASSWORD=${OPENCTI_ADMIN_PASSWORD}
• APPADMINTOKEN=${OPENCTI_ADMIN_TOKEN}
• APP__APP_LOGS__LOGS_LEVEL=error
• REDIS__HOSTNAME=redis
• REDIS__PORT=6379
• ELASTICSEARCH__URL=http://elasticsearch:9200
• MINIO__ENDPOINT=minio
• MINIO__PORT=9000
• MINIO__USE_SSL=false
• MINIO__ACCESS_KEY=${MINIO_ROOT_USER}
• MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}
• RABBITMQ__HOSTNAME=rabbitmq
• RABBITMQ__PORT=5672
• RABBITMQ__PORT_MANAGEMENT=15672
• RABBITMQ__MANAGEMENT_SSL=false
• RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}
• RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}
• SMTP__HOSTNAME=${SMTP_HOSTNAME}
• SMTP__PORT=25
• PROVIDERSLOCALSTRATEGY=LocalStrategy
• APP__HEALTH_ACCESS_KEY=${OPENCTI_HEALTHCHECK_ACCESS_KEY} ports:
• "8080:8080" volumes:
• /etc/ssl/certs/opencti/:/etc/ssl/opencti:ro depends_on: redis: condition: service_healthy elasticsearch: condition: service_healthy minio: condition: service_healthy rabbitmq: condition: service_healthy restart: always healthcheck: test: ["CMD", "wget", "-qO-", "http://opencti:8080/health?health_access_key=${OPENCTI_HEALTHCHECK_ACCESS_KEY}"] interval: 10s timeout: 5s retries: 20 worker: image: opencti/worker:6.3.6 environment:
• OPENCTI_URL=https://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• WORKER_LOG_LEVEL=info depends_on: opencti: condition: service_healthy deploy: mode: replicated replicas: 3 restart: always connector-export-file-stix: image: opencti/connector-export-file-stix:6.3.6 environment:
• OPENCTI_URL=https://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_STIX_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
• CONNECTOR_NAME=ExportFileStix2
• CONNECTOR_SCOPE=application/json
• CONNECTOR_LOG_LEVEL=info restart: always depends_on: opencti: condition: service_healthy connector-export-file-csv: image: opencti/connector-export-file-csv:6.3.6 environment:
• OPENCTI_URL=https://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_CSV_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
• CONNECTOR_NAME=ExportFileCsv
• CONNECTOR_SCOPE=text/csv
• CONNECTOR_LOG_LEVEL=info restart: always depends_on: opencti: condition: service_healthy connector-export-file-txt: image: opencti/connector-export-file-txt:6.3.6 environment:
• OPENCTI_URL=https://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_TXT_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
• CONNECTOR_NAME=ExportFileTxt
• CONNECTOR_SCOPE=text/plain
• CONNECTOR_LOG_LEVEL=info restart: always depends_on: opencti: condition: service_healthy connector-import-file-stix: image: opencti/connector-import-file-stix:6.3.6 environment:
• OPENCTI_URL=https://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_IMPORT_FILE_STIX_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_IMPORT_FILE
• CONNECTOR_NAME=ImportFileStix
• CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import
• CONNECTOR_SCOPE=application/json,text/xml
• CONNECTOR_AUTO=true # Enable/disable auto-import of file
• CONNECTOR_LOG_LEVEL=info restart: always depends_on: opencti: condition: service_healthy connector-import-document: image: opencti/connector-import-document:6.3.6 environment:
• OPENCTI_URL=https://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_IMPORT_DOCUMENT_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_IMPORT_FILE
• CONNECTOR_NAME=ImportDocument
• CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import
• CONNECTOR_SCOPE=application/pdf,text/plain,text/html
• CONNECTOR_AUTO=true # Enable/disable auto-import of file
• CONNECTOR_ONLY_CONTEXTUAL=false # Only extract data related to an entity (a report, a threat actor, etc.)
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info
• IMPORT_DOCUMENT_CREATE_INDICATOR=true restart: always depends_on: opencti: condition: service_healthy connector-analysis: image: opencti/connector-import-document:6.3.6 environment:
• OPENCTI_URL=https://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_ANALYSIS_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_ANALYSIS
• CONNECTOR_NAME=ImportDocumentAnalysis
• CONNECTOR_VALIDATE_BEFORE_IMPORT=false # Validate any bundle before import
• CONNECTOR_SCOPE=application/pdf,text/plain,text/html
• CONNECTOR_AUTO=true # Enable/disable auto-import of file
• CONNECTOR_ONLY_CONTEXTUAL=false # Only extract data related to an entity (a report, a threat actor, etc.)
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info restart: always depends_on: opencti: condition: service_healthy

volumes: esdata: s3data: redisdata: amqpdata:

Variables: OPENCTI_ADMIN_EMAIL=admin@opencti.io OPENCTI_ADMIN_PASSWORD=** OPENCTI_ADMIN_TOKEN=95cea3ee-fe44-403b-8571-726a488f366f OPENCTI_BASE_URL=http://localhost:8080 OPENCTI_HEALTHCHECK_ACCESS_KEY= MINIO_ROOT_USER=opencti MINIO_ROOT_PASSWORD=***** RABBITMQ_DEFAULT_USER=opencti RABBITMQ_DEFAULT_PASS=** CONNECTOR_EXPORT_FILE_STIX_ID=d8eba972-a82a-4e10-bf62-4955b7256981 CONNECTOR_EXPORT_FILE_CSV_ID=c46b5f2f-c1e0-4fde-a29a-48a086f89536 CONNECTOR_EXPORT_FILE_TXT_ID=259ee64a-74f1-4f4f-91f1-61b80072e499 CONNECTOR_IMPORT_FILE_STIX_ID=4184c39d-5c22-47a4-9a4a-8801903c3b9d CONNECTOR_IMPORT_DOCUMENT_ID=7e961042-7339-4e84-acc4-4d45c98e6259 CONNECTOR_ANALYSIS_ID=b3528b52-ab81-44fd-bdfc-07e4d63cefd1 SMTP_HOSTNAME=localhost ELASTIC_MEMORY_SIZE=4G OPENCTI_KEY_PATH=/etc/ssl/certs/opencti/ca.key OPENCTI_CRT_PATH=/etc/ssl/certs/opencti/ca.crt

[harboot]

dependency failed to start: container opencti-opencti-1 is unhealthy same issue with me..

fixed by change this OPENCTI_ADMIN_TOKEN=95cea3ee-fe44-403b-8571-726a488f366f follow UUIDv4 format.