# How to set up Grafana HTTPS for secure web traffic **URL:** \ **Category:** Configuration\ **Created:** [April 13, 2017, 1:26pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524 "2017-04-13T13:26:15Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![alexsmart](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/alexsmart/32/272_2.png) [@alexsmart](https://community.grafana.com/u/alexsmart)\ **Post date:** [April 13, 2017, 1:26pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/1 "2017-04-13T13:26:15Z")
Hi everyone! I’m struggling to configure Grafana to work via https. I have certificates generated by Let’s Encrypt, and grafana.ini configured like this: ``` [server] # Protocol (http or https) protocol = https # The ip address to bind to, empty will bind to all interfaces ;http_addr = # The http port to use http_port = 3000 # The public facing domain name used to access grafana from a browser domain = localhost # Redirect to correct domain if host header does not match domain # Prevents DNS rebinding attacks enforce_domain = false # The full public facing url you use in browser, used for redirects and emails # If you use reverse proxy and sub path specify full url (with sub path) root_url = http://grafana.staged-by-discourse.com # Log web requests router_logging = false # the path relative working path static_root_path = public # enable gzip enable_gzip = false # https certs & key file cert_file = /etc/letsencrypt/live/mysite/fullchain.pem cert_key = /etc/letsencrypt/live/mysite/privkey.pem ``` my openhab running on 443 port, so the question is… Is it possible to run both grafana and openhab on https? ---
**Author:** ![torkel](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/torkel/32/20_2.png) [@torkel](https://community.grafana.com/u/torkel)\ **Post date:** [April 13, 2017, 2:07pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/2 "2017-04-13T14:07:53Z")
you can run https on any port ````auto root_url = http://grafana.staged-by-discourse.com ``` This should be the url you want to use in the browser, so https://my_certififed_domain:3000 (if you want to use port 3000 for https) ```` ---
**Author:** ![alexsmart](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/alexsmart/32/272_2.png) [@alexsmart](https://community.grafana.com/u/alexsmart)\ **Post date:** [April 13, 2017, 2:50pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/3 "2017-04-13T14:50:22Z")
this config leading to an error - grafana-server is failing to start ``` [server] # Protocol (http or https) protocol = https # The ip address to bind to, empty will bind to all interfaces ;http_addr = # The http port to use #http_port = 3000 # The public facing domain name used to access grafana from a browser #domain = localhost # Redirect to correct domain if host header does not match domain # Prevents DNS rebinding attacks #enforce_domain = false # The full public facing url you use in browser, used for redirects and emails # If you use reverse proxy and sub path specify full url (with sub path) root_url = https://community.grafana.com # Log web requests #router_logging = false # the path relative working path #static_root_path = public # enable gzip #enable_gzip = false # https certs & key file cert_file = /etc/letsencrypt/live/mysite/fullchain.pem cert_key = /etc/letsencrypt/live/mysite/privkey.pem ``` is there someone who did such kind of thing? UPD: in grafana log file I found ``` t=2017-04-13T14:48:42+0000 lvl=info msg="Initializing HTTP Server" logger=http.server address=0.0.0.0:3000 protocol=https subUrl= t=2017-04-13T14:48:42+0000 lvl=eror msg="Fail to start server" logger=server error="open /etc/letsencrypt/live/mysite/fullchain.pem: permission denied" t=2017-04-13T14:48:42+0000 lvl=info msg="Shutdown started" logger=server code=1 reason="Startup failed" ``` and that is weird, because ``` root@server:~# stat /etc/letsencrypt/live/mysite/fullchain.pem File: ‘/etc/letsencrypt/live/mysite/fullchain.pem’ -> ‘../../archive/mysite/fullchain1.pem’ Size: 48 Blocks: 0 IO Block: 4096 symbolic link Device: b302h/45826d Inode: 517147 Links: 1 Access: (0777/lrwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2017-04-10 11:38:32.720709836 +0000 Modify: 2017-04-10 11:38:32.720709836 +0000 Change: 2017-04-10 11:38:32.720709836 +0000 Birth: - ``` ---
**Author:** ![torkel](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/torkel/32/20_2.png) [@torkel](https://community.grafana.com/u/torkel)\ **Post date:** [April 13, 2017, 3:19pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/4 "2017-04-13T15:19:12Z")
> [@alexsmart](#): > > open /etc/letsencrypt/live/mysite/fullchain.pem: permission denied Seems there is a permission problem ---
**Author:** ![alexsmart](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/alexsmart/32/272_2.png) [@alexsmart](https://community.grafana.com/u/alexsmart)\ **Post date:** [April 14, 2017, 7:13am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/5 "2017-04-14T07:13:32Z")
problem was solved by placing certificate key file to grafana folder /etc/grafana/ ---
**Author:** ![sanju443ts](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@sanju443ts](https://community.grafana.com/u/sanju443ts)\ **Post date:** [September 11, 2017, 10:35am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/6 "2017-09-11T10:35:05Z")
Can someone help me on configuring the https for grafana? I am running grafana as a windows service in my local host. ---
**Author:** ![samrat](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@samrat](https://community.grafana.com/u/samrat)\ **Post date:** [December 29, 2017, 7:59am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/7 "2017-12-29T07:59:26Z")
how to solve this permission error. please help. Placing cert file to /etc/grafana is not a solution. the solution work for me is to copy the cert and private key to some other location like (/opt or something) and mention the same path in grafana.ini ---
**Author:** ![daniellee](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/daniellee/32/41_2.png) [@daniellee](https://community.grafana.com/u/daniellee)\ **Post date:** [January 8, 2018, 12:47pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/8 "2018-01-08T12:47:56Z")
Do you need help? Is sounds like you have already figured this out? > [@samrat](#): > > the solution work for me is to copy the cert and private key to some other location like (/opt or something) and mention the same path in grafana.ini ---
**Author:** ![samrat](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@samrat](https://community.grafana.com/u/samrat)\ **Post date:** [January 8, 2018, 1:10pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/9 "2018-01-08T13:10:05Z")
Thanks for reply. But I have solved the issue. Thanks again. ---
**Author:** ![ashuw018](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ashuw018](https://community.grafana.com/u/ashuw018)\ **Post date:** [January 23, 2018, 4:34am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/10 "2018-01-23T04:34:36Z")
Hi @torkel , My grafana works perfect with https, the only thing is when i try to check this using online tool it shows “The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate.” I have have verified the same certificate with placing test site with same binding in IIS and then it not shows any chain issue. but don’t know why it is showing for grafana site, is there any configs we need to do for CA and intermediate certs in grafana config ? all these certificates are installed in servers cert repository. Thanks. ---
**Author:** ![ashuw018](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@ashuw018](https://community.grafana.com/u/ashuw018)\ **Post date:** [January 23, 2018, 11:34am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/11 "2018-01-23T11:34:11Z")
Hi, I resolved it by giving cert path to certificates bundle.pem file. Thanks. ---
**Author:** ![alvianno](https://avatars.discourse-cdn.com/v4/letter/a/db5fbb/32.png) [@alvianno](https://community.grafana.com/u/alvianno)\ **Post date:** [August 3, 2018, 4:18am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/12 "2018-08-03T04:18:01Z")
how to create file .pem? ---
**Author:** ![zigobs](https://avatars.discourse-cdn.com/v4/letter/z/e8c25b/32.png) [@zigobs](https://community.grafana.com/u/zigobs)\ **Post date:** [September 23, 2018, 7:00am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/13 "2018-09-23T07:00:55Z")
Hi, You can **manage SSL** (https) with Apache **without modifying anything in your Grafana installation**. This is very useful if you want **Grafana being accessible from Internet without using a port number**. My grafana server is accessible with this kind of URL [https://grafana.domain.tld](https://grafana.domain.tld) but still using port 3000 internally on the server. The only thing you have to do is to use this Apache vhost and replace “grafana.domain.tld” with your subdomain or domain (if grafana is directly accessible with domain.tld). ``` ServerName grafana.domain.tld ServerAdmin me@mydomain.tld RewriteEngine On RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301] ServerName grafana.domain.tld ServerAdmin me@mydomain.tld # Use HTTP Strict Transport Security to force client to use secure connections only. Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" # Referer logging is used to allow websites and web servers to identify where people are visiting them from, for promotional or statistical purposes. Header always set Referrer-Policy "no-referrer" SSLCertificateFile /etc/letsencrypt/live/grafana.domain.tld/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/grafana.domain.tld/privkey.pem SSLEngine on SSLProtocol all -TLSv1 -TLSv1.1 -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCompression off SSLOptions +StrictRequire SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ProxyPreserveHost On ProxyPass / http://127.0.0.1:3000/ ProxyPassReverse / http://127.0.0.1:3000/ ``` Here is how this Virtual Host works : - If someone try to access The user will be redirected to ``` https://grafana.domain.tld ``` This could be improved by rewrite rules to cover any http requested URL… - If someone type **Apache will deal with the Let’s Encrypt Certificate** (so your grafana access is secure) but internally Apache will still call ``` http://127.0.0.1:3000 ``` **That’s clean, secure and you can use this for a lot of other softwares than Grafana.** Enjoy 🙂 ---
**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\ **Post date:** [September 23, 2018, 11:17am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/14 "2018-09-23T11:17:28Z")
> [@zigobs](#): > > That’s clean, secure You can still improve your TLS security: - disable insecure TLS versions `-TLSv1 -TLSv1.1` unless you have to support them - disable SSLSessionTickets `SSLSessionTickets off` to ensure Perfect Forward Secrecy It is also good to mention, that your cipher list supports only modern clients. Some older clients won’t be able to connect - oldest compatible clients: Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, and Java 8. A good reference for secure TLS configuration is [Redirecting to ssl-config.mozilla.org...](https://mozilla.github.io/server-side-tls/ssl-config-generator/) ---
**Author:** ![zigobs](https://avatars.discourse-cdn.com/v4/letter/z/e8c25b/32.png) [@zigobs](https://community.grafana.com/u/zigobs)\ **Post date:** [September 28, 2018, 1:19pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/15 "2018-09-28T13:19:15Z")
> [@jangaraj](#): > > disable SSLSessionTickets `SSLSessionTickets off` to ensure Perfect Forward Secrecy In my case this cause a browser error " SSL\_ERROR\_RX\_UNEXPECTED\_NEW\_SESSION\_TICKET" Anyway I get A+ with this test : [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/) ---
**Author:** ![jimmyneutron](https://avatars.discourse-cdn.com/v4/letter/j/a88e4f/32.png) [@jimmyneutron](https://community.grafana.com/u/jimmyneutron)\ **Post date:** [February 4, 2019, 9:44pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/16 "2019-02-04T21:44:25Z")
Yup this worked for me … Thanks !! ---
**Author:** ![graf92](https://avatars.discourse-cdn.com/v4/letter/g/a587f6/32.png) [@graf92](https://community.grafana.com/u/graf92)\ **Post date:** [November 25, 2019, 3:29pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/17 "2019-11-25T15:29:51Z")
When I have the \*.conf file ready, where do I execute the include within the httpd.conf file? thanks ---
**Author:** ![zigobs](https://avatars.discourse-cdn.com/v4/letter/z/e8c25b/32.png) [@zigobs](https://community.grafana.com/u/zigobs)\ **Post date:** [November 25, 2019, 5:51pm UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/18 "2019-11-25T17:51:01Z")
Hi, What is your OS and version ? What is your Webserver and version ? How do you want to access grafana ? grafana.domain.tld ? ---
**Author:** ![graf92](https://avatars.discourse-cdn.com/v4/letter/g/a587f6/32.png) [@graf92](https://community.grafana.com/u/graf92)\ **Post date:** [November 26, 2019, 9:21am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/19 "2019-11-26T09:21:36Z")
CentOS 7 apache 2.4.41 (CPanel) I would like to access grafana using subdomain.domain.report without using port number 3000. It is currently running on port number 3000 ---
**Author:** ![zigobs](https://avatars.discourse-cdn.com/v4/letter/z/e8c25b/32.png) [@zigobs](https://community.grafana.com/u/zigobs)\ **Post date:** [November 26, 2019, 10:30am UTC](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524/20 "2019-11-26T10:30:10Z")
Sorry, I’m not familiar with CentOS because I work with Debian, anyway there is a good doc here : [How To Install the Apache Web Server on CentOS 7 | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-install-the-apache-web-server-on-centos-7) > [@graf92](#): > > It is currently running on port number 3000 That’s a good thing. The trick is not to modify grafana ports and create a Apache vhost that say “if someone ask for [https://subdomain.domain.report](https://subdomain.domain.report) from the Internet then I will handlle the SSL (https) and redirect the request internally to [http://127.0.0.1:3000/](http://127.0.0.1:3000/)” This part of the vhost file do the trick: ``` ProxyPass / http://127.0.0.1:3000/ ProxyPassReverse / http://127.0.0.1:3000/ ``` You have to create the vhost file ```auto sudo vi /etc/httpd/sites-available/subdomain.domain.report.conf ``` Now that you have created the virtual host files, you will enable them so that Apache knows to serve them to visitors. To do this, create a symbolic link for each virtual host in the sites-enabled directory: ```auto sudo ln -s /etc/httpd/sites-available/subdomain.domain.report.conf /etc/httpd/sites-enabled/subdomain.domain.report.conf ``` Then you can restart Apache ```auto sudo systemctl restart httpd ``` I hope this will help [Next page](https://community.grafana.com/t/how-to-set-up-grafana-https-for-secure-web-traffic/524.md?page=2)