Wazuh Dashboard Troubleshooting: Login, Blank Page, Cert Errors

When the Wazuh dashboard refuses to load, the root cause is usually credentials, certificates or the indexer being unreachable. This guide walks the standard checks.

1. Is the service running?

systemctl status wazuh-dashboard
journalctl -u wazuh-dashboard -n 200 --no-pager

2. Login failed

• Confirm you are using the password from `wazuh-install-files/wazuh-passwords.txt`, not the default `admin`.
• If you rotated passwords with `wazuh-passwords-tool.sh`, the new values must also be set in `/etc/wazuh-dashboard/opensearch_dashboards.yml` for the `kibanaserver` user.
• Test the admin credentials directly against the indexer:

curl -k -u admin:<password> https://<INDEXER_IP>:9200

3. Blank page or endless spinner

Open the browser developer console, look for 502/504 responses from `/api/...`. The dashboard cannot reach the indexer; usually a wrong `opensearch.hosts` in `/etc/wazuh-dashboard/opensearch_dashboards.yml` or a TLS trust error.

4. Certificate errors

For lab installs, the self-signed cert triggers browser warnings, accept the exception. For production, replace `/etc/wazuh-dashboard/certs/dashboard.pem` and `dashboard-key.pem` with a real certificate (Lets Encrypt or internal PKI), then:

systemctl restart wazuh-dashboard

5. Port 443 already in use

ss -tlnp | grep :443

If another service holds 443 (nginx, apache), either stop it or change `server.port` in `opensearch_dashboards.yml` and restart the dashboard.

6. Security index out of sync

After password rotation or cert changes, the dashboard sometimes fails to authenticate to the indexer. Reinitialize the security index from a single indexer node:

/usr/share/wazuh-indexer/bin/indexer-security-init.sh

7. Browser cache

After major version upgrades, force-refresh (Ctrl+Shift+R) or open the dashboard in a private window to bypass stale JS bundles.

Still stuck after this checklist? Our team handles Wazuh dashboard upgrades, custom branding and SSO integration, reach out via contact.