How to secure Grafana using SSL certificate

Here in this article we will try to secure grafana instance using the self sign certificate.

Test Environment

• Fedora 41 Server

Need for Secure Communication

It is important to secure the communication between grafana portal and the end user so that the metrics data and user authentication information is secured and encrypted.

In order to ensure secure traffic over the internet, Grafana must have a key for encryption and a Secure Socket Layer (SSL) Certificate to verify the identity of the site.

Procedure

Step1: Ensure Grafana Running

As a first step ensure that you have Grafana installed and running. Also make sure to get some metrics captured through a datasource configuration and visualize it through a dashboard.

Follow “Raw Metrics to Rich Insights using Prometheus and Grafana” for a sample setup with Prometheus and Grafana for the same.

Step2: Install sscg

Here we will be using the sscg package to generate self sign certificate for our server.

# Install sscg package
admin@linuxser:~$ sudo dnf install sscg

# Generate self sign certificate using sscg
admin@linuxser:~$ cd /etc/grafana
admin@linuxser:/etc/grafana$ sudo /usr/bin/sscg --lifetime=365 --country=IN --state=Maharashtra --locality=Mumbai --organization="Stack Inc." --organizational-unit="Stack" --hostname="linuxser.stack.com" --subject-alt-name linuxser.stack.com --key-strength=2048 --hash-alg="sha256" --ca-file=ca.pem --cert-key-file=grafana_key.pem --cert-file=grafana_cert.pem --cert-mode=0644 --cert-key-mode=0600
...
Wrote service certificate key to /etc/grafana/grafana_key.pem
Wrote service certificate to /etc/grafana/grafana_cert.pem
Wrote CA certificate to /etc/grafana/ca.pem

# Change ownership of generated files
admin@linuxser:/etc/grafana$ sudo chown -R grafana:grafana *.pem

Step3: Configure Grafana

Now that we have generated the self sign certificates, we need to configure the grafana instance to communicate on secure channel. Here is the below sample server configuration section with SSL certificate and key file location configured.

admin@linuxser:/etc/grafana$ sudo cat grafana.ini | grep -A 9 "\[server\]"
[server]
http_addr =
http_port = 3000
domain = stack.com
root_url = https://linuxser.stack.com:3000
cert_key = /etc/grafana/grafana_key.pem
cert_file = /etc/grafana/grafana_cert.pem
enforce_domain = False
protocol = https

Step4: Restart Grafana

Let’s now restart the grafana service as shown below for the certificate changes to take effect.

admin@linuxser:/etc/grafana$ sudo systemctl start grafana-server.service 
admin@linuxser:/etc/grafana$ sudo systemctl status grafana-server.service 

Step5: Validate Grafana

Now, we should be able to access the grafana portal on secure channel (ie. HTTPS) using the below url.

URL: https://linuxser.stack.com:3000/login

Hope you enjoyed reading this aritcle. Thank you..