This answer contains:
Firstly, in short, a solution to the error after reconfiguring Grafana to use a supplied .crt and .key file.
Secondly, a guide with all the steps required for the installation of Grafana on Windows Server 2022 withhttps, in my experience.
- Step 1 - Install Grafana
- Step 2 - Install OpenSSL for Windows
- Step 3 - Create selfsigned .crt and .key files as .pem files with
OpenSSL for Grafana
- Step 4 - Configure Grafana custom.ini file
- Step 5 - Restart and check Grafana
- Bonus - Check that http is disabled
The solution to the error when applying certificate and key file in Grafanacustom.ini:
The Grafana service requires the.crtcertificate file and the.keyfile to be converted to.pemfile type.
How to convert a.crtfile to a.pemfile with OpenSSL on Windows:
openssl x509 -in DER -out PEM -in grafana.crt -out grafana.crt.pem
How to convert a.keyfile to a.pemfile with OpenSSL on Windows:
openssl rsa -in grafana.key -text > grafana.key.pem
Note that this conversion of the.keywrites the private key to the.pemasplain textand should be replaced by a solution that does not write it as plain text to the.pemfile.
A guide to Grafana installation on Windows Server 2022 with Openssl certificate & key inhttpsconfiguration:
Step 1 - Install Grafana
- Download Grafana Windows installer file. Follow this link: https://grafana.com/grafana/download?platform=windows
- Start the installation of Grafana by double-clicking on thegrafana-enterprise-9.2.4.windows-amd64.msifile in your download folder.
- ClickNext > I accept the terms in the License Agreement & Next > Next > Install > Finish.
- Check that the Grafana service is up and running. Go to your browser and go tohttp://localhost:3000/login, where you should be greeted by the Grafana login GUI:
Step 2 - Install OpenSSL for Windows
Step 3 - Create selfsigned.crtand.keyfiles as.pemfiles with OpenSSL for Grafana
- Open OpenSSL by searching for it in Windows' search field. An app namnedWin64
OpenSSL Comand Promptshould appear in your windows search.
-
Move to the folder where you want to store your certifacte and key
files by entering in this line. Change the directory to what is fitting for you. This directory will be referenced to as the certificate or key location.
cd C:
-
Create a selfsigned certificate with coupled key file in the current folder
by entering this. Remember to store the password you have to create
for the key in a safe location. Also remember to customize the name
of the files and the days value to your needs.
openssl req -x509 -sha256 -days 365 -newkey rsa:2048 -keyout grafana.key -out grafana.crt
-
Convert the .crt file to .pem file.
openssl x509 -in DER -out PEM -in grafana.crt -out grafana.crt.pem
-
Convert the .key file to plain text .pem file. This is not optimal and actually ahazard. You should try to find an alternative solution in OpenSSL to write the key to a .pem file which is not in plain text. Just remember to check if Grafana can handle the new non-plain text key file.
openssl rsa -in grafana.key -text > grafana.key.pem
-
Check that your files are created with this command.
dir
Step 4 - Configure Grafanacustom.inifile
-
In file explorer, go to.
C:Program FilesGrafanaLabsgrafanaconf
-
Check that thedefault.iniandsample.inifiles exist with the dir command.
dir
-
Copy thesample.inifile and rename the copy tooriginal.sample.inifile. Do this also for the default.ini file. You are not to edit these files in this guide. Then after the
copying of the original files you have a backup, if you copy paste
to the wrong file in the future.
-
Copy thesample.inifile again and rename it tohttps.custom.inithis time.
-
Open thehttps.custom.inifile and edit these lines. Change the IP address to the one you are using. You can also change the port number to the one you need. Otherwise, just keep it at 3000.
;protocol = http
to
protocol = https
;root_url = %(protocol)s://%(domain)s:%(http_port)s/
to
root_url = https://1.2.3.4:3000
;cert_file =
;cert_key =
to
cert_file = C:grafana.crt.pem
cert_key = C:grafana.key.pem
-
Save thehttps.custom.inifile.
-
Copy the content ofhttps.custom.iniintocustom.ini, and save
the latter.
Step 5 - Restart and check Grafana
-
Openservices.mscand find the service namnedGrafana.
-
Right click it and select restart.
-
Now, go back to your browser and visit the address you entered
above and you should see a warning. The example I provided above was
https://1.2.3.4:3000.
-
Click the equivalent in your browser ofAdvanced > Accept the Risk
and Continue.
Now, you should be at your Grafana's web GUI,and https is configured!
Bonus - Check that http is disabled
In your browser, try to visit you Grafana address with the http protocol, or simply enter only the IP of your Grafana service in the URL field. You should get the response:
Client sent an HTTP request to an HTTPS server.
An apology
I want to apologize for the comment having formatting issues, as my account does not have a sufficient score to post more than 8 links in one comment. I had to cut the images.
I will add them at a later date, if my account has a sufficient score then.