Grafana SSL – How to configure HTTPS

Delve into this step-by-step guide for setting up a self-signed SSL certificate in Grafana. By following these instructions, you can enhance the security of your Grafana server, making it accessible via a secure connection at https://my_grafana_server, all while keeping Grafana SSL in focus.

Grafana SSL

By default, SSL is not installed in the free, self-hosted community edition of Grafana. However, SSL is configured automatically for those who opt for the cloud version. To set up SSL on the self-hosted version, you will require sudo access to the /etc/grafana/grafana.ini file.

Here’s where you should look:

vi /etc/grafana/grafana.ini

HTTP options

In the grafana.ini file, you’ll need to modify two key fields:

[server]
http_addr = dashboard.yourdomain.co.uk
http_port = 3000
domain = yourdomain.co.uk
root_url = https://grafana.yourdomain.co.uk:3000
cert_key = /etc/grafana/grafana.key
enforce_domain = False
protocol = https
socket =
enable_gzip = False
cert_file = /etc/grafana/grafana.crt
static_root_path = public
router_logging = False

Step 1 – Create a Grafana SSL Certificate

Follow the steps below for those on Red Hat Linux (or CentOS). Please refer to its specific documentation if you’re on a different Linux distribution.

Execute the following command:

openssl genrsa -out grafana.key 2048

The expected output should appear as follows:

Step 2 – Generate a certificate signing request

From the command line, type:

openssl req -new -key grafana.key -out grafana.csr

The corresponding output will look something like this:

Step 3 – Output the certificate

Now, from the command line, type:

openssl x509 -req -days 365 -in grafana.csr -signkey grafana.key -out grafana.crt

After which, you’ll see this output:

Step 4 – Set certificate key file ownership

Run the following commands:

sudo chown grafana:grafana grafana.crt
sudo chown grafana:grafana grafana.key
sudo chmod 400 grafana.key grafana.crt

Step 5 – Transfer the certificate and key file to Grafana’s installation directory

Move files using:

sudo mv grafana.crt grafana.key /etc/grafana/

Step 6 – Edit the Grafana.ini file

Open the file with:

sudo vim /etc/grafana/grafana.ini

Search for the #HTTP options and set the properties accordingly:

root_url = https://grafana.yourdomain.co.uk
protocol = https
cert_key = /etc/grafana/grafana.key
cert_file = /etc/grafana/grafana.crt

Once done, save and exit the file. Proceed by restarting the Grafana service:

sudo service grafana-server restart

Step 7 – Access via the server IP

Finally, when you navigate to the server’s IP address using a web browser, you’ll encounter a warning due to the Self Signed Certificate. The prompt will appear as follows:

Note: You will always have to accept this prompt (only once) unless you have purchased a Signed Certificate from a certificate authority vendor such as https://www.digicert.com/

Want to know how to put certs on a Grafana container and how to make a Grafana container HTTPS? Run

docker exec -it containername /bin/bash

and follow the same procedure above.

That’s it; thanks for taking the time to read this article. If you have any questions or feedback, please write them in the comment section below.

What to know more about Grafana SSL? Check out our other posts about it:

Learn:

• What’s the difference between the Grafana Enterprise and Grafana Community editions?
• Why should I use Grafana?
• How do I install Grafana on a Raspberry Pi?
• Your Top Grafana Questions Answered (Q&A)