{"id":4340,"date":"2023-02-25T00:46:00","date_gmt":"2023-02-25T06:46:00","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=4340"},"modified":"2023-02-25T00:46:28","modified_gmt":"2023-02-25T06:46:28","slug":"setting-up-https-ssl-tls-certificate-for-grafana","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/setting-up-https-ssl-tls-certificate-for-grafana\/","title":{"rendered":"Setting up HTTPS SSL\/TLS Certificate for Grafana"},"content":{"rendered":"\n

Prerequisites <\/p>\n\n\n\n

    \n
  1. Grafana Installed (Install guide<\/a>)<\/li>\n\n\n\n
  2. SSL\/TLS Certificate<\/li>\n<\/ol>\n\n\n\n

    In this example, the server is already using Let’s Encrypt to create the certificate for a LibreNMS server. So all we are doing is copying the certificate to a Grafana directory, putting the correct permissions on it, and updating the Grafana config file to use the certificate.<\/p>\n\n\n\n

    Steps<\/strong><\/p>\n\n\n\n

      \n
    1. Copy Certificate to Grafana Directory<\/li>\n\n\n\n
    2. Configure Grafana Config File<\/li>\n\n\n\n
    3. Automate Certificate Copy to Grafana Directory<\/li>\n<\/ol>\n\n\n\n

      <\/p>\n\n\n\n

      Copy Certificate files<\/h2>\n\n\n\n

      In the following commands, change librenms.incredigeek.com to the directory that Let’s Encrypt is using for your fully qualified domain name (FQDN). Usually it is just your FQDN, but could also have -0001 or something appended to the end.<\/p>\n\n\n\n

      cp -f \/etc\/letsencrypt\/live\/librenms.incredigeek.com\/privkey.pem \n\/etc\/grafana\/ \ncp -f \/etc\/letsencrypt\/live\/librenms.incredigeek.com\/fullchain.pem \/etc\/grafana\/ \nchown root:grafana \/etc\/grafana\/*.pem\nchmod 640 \/etc\/grafana\/*.pem Enable grafana on system bootup<\/pre>\n\n\n\n
      In the above, we are copying the privkey.pem and fullchain.pem to \/etc\/grafana.  We are then setting the correct owner\/permissions on the files so that the Grafana service can read the certificate.<\/p>\n\n\n\n
      <\/p>\n\n\n\n
      Configure Grafana Config File<\/h2>\n\n\n\n
      This is super easy.  Open up the Grafana config file in \/etc\/grafana.ini<\/p>\n\n\n\n
      vi \/etc\/grafana.ini<\/pre>\n\n\n\n
      Find the following variables and configure them like so<\/p>\n\n\n\n
      protocol = https
      cert_file = \/etc\/grafana\/fullchain.pem
      cert_key = \/etc\/grafana\/privkey.pem<\/pre>\n\n\n\n
      Restart Grafana<\/p>\n\n\n\n
      systemctl restart grafana-server.service<\/pre>\n\n\n\n
      You should now have a working SSL certificate for the site.  <\/p>\n\n\n\n
      Automate Certificate Copy<\/h2>\n\n\n\n
      Let’s Encrypt certificates need to be updated frequently.  This means that we should automate the above steps to avoid any down time.  After all, a monitoring tool with down time defeats the purpose of monitoring.<\/p>\n\n\n\n
      We’ll need to create a root crontab <\/p>\n\n\n\n
      sudo crontab -e<\/pre>\n\n\n\n
      Add the following changing out the FQDN to your FQDN.  <\/p>\n\n\n\n
      0 0 1 * * cp -f \/etc\/letsencrypt\/live\/librenms.incredigeek.com<\/strong>\/privkey.pem \/etc\/grafana\/ && cp -f \/etc\/letsencrypt\/live\/librenms.incredigeek.com<\/strong>\/fullchain.pem \/etc\/grafana\/ && chown root:grafana \/etc\/grafana\/*.pem && chmod 640 \/etc\/grafana\/<\/em>*.pem <\/pre>\n\n\n\n
      This is set to run once a month.  Change if desired.  Also change out librenms.incredigeek.com with your FQDN.<\/p>\n\n\n\n
      Note about domain name and IP addresses.  Let’s Encrypt will not create a certificate for an IP address.  You should be using a domain name instead (i.e. networkmonitoring.yourdomain.com)  If the certificate is installed, and you access it via the IP address, you will receive a HTTPS error in your browser.<\/p>\n","protected":false},"excerpt":{"rendered":"
      Prerequisites In this example, the server is already using Let’s Encrypt to create the certificate for a LibreNMS server. So all we are doing is copying the certificate to a Grafana directory, putting the correct permissions on it, and updating … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[352],"tags":[358,359,1284,389,356],"class_list":["post-4340","post","type-post","status-publish","format-standard","hentry","category-librenms","tag-cert","tag-certificate","tag-grafana","tag-nms","tag-ssl"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=4340"}],"version-history":[{"count":4,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4340\/revisions"}],"predecessor-version":[{"id":4849,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4340\/revisions\/4849"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=4340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=4340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=4340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}