Enabling HTTPS with InfluxDB

Enable TLS to encrypt communication between clients and the InfluxDB server.When configured with a signed certificate, TLS also allows clients to verify the authenticity of the InfluxDB server.

InfluxData strongly recommends enabling HTTPS, especially if you plan to send requests to InfluxDB over a network.

If setting up HTTPS for InfluxDB Enterprise, follow the InfluxDB Enterprise HTTPS setup guide.

Requirements

To enable HTTPS with InfluxDB, you need a Transport Layer Security (TLS) certificate, also known as a Secured Sockets Layer (SSL) certificate.InfluxDB supports three types of TLS certificates:

Single domain certificates provide cryptographic security to HTTPS requests and allow clients to verify the identity of the InfluxDB server.These certificates are signed and issued by a trusted, third-party Certificate Authority (CA).With this certificate option, every InfluxDB instance requires a unique single domain certificate.

  • Wildcard certificates signed by a Certificate Authority

Wildcard certificates provide cryptographic security to HTTPS requests and allow clients to verify the identity of the InfluxDB server.Wildcard certificates can be used across multiple InfluxDB instances on different servers.

  • Self-signed certificates

Self-signed certificates are not signed by a trusted, third-party CA.Self-signed certificates provide cryptographic security to HTTPS requests but don’t allow clients to verify the identity of the InfluxDB server.With this kind of certificate, every InfluxDB instance requires a unique self-signed certificate.You can generate a self-signed certificate on your own machine.

Configure InfluxDB to use TLS

  • Download or generate certificate files

If using a certificate provided by a CA, follow their instructions to download the certificate files.

If using a self-signed certificate, use the openssl utility to create a certificate.

Use the following command to generate a private key file (.key) and a self-signed certificate file (.crt) and save them to /etc/ssl/.Set NUMBER_OF_DAYS to specify the amount of time the files will remain valid.

  1. sudo openssl req -x509 -nodes -newkey rsa:2048 \
  2.   -keyout /etc/ssl/influxdb-selfsigned.key \
  3.   -out /etc/ssl/influxdb-selfsigned.crt \
  4.   -days <NUMBER_OF_DAYS>

The command will prompt you for more information.You can choose to fill out these fields or leave them blank; both actions generate valid certificate files.

  • Set certificate file permissions

The user running InfluxDB must have read permissions on the TLS certificate.

You may opt to set up multiple users, groups, and permissions. Ultimately, make sure all users running InfluxDB have read permissions for the TLS certificate.

Run the following command to give InfluxDB read and write permissions on the certificate files.

  1. sudo chmod 644 /etc/ssl/<CA-certificate-file>
  2. sudo chmod 600 /etc/ssl/<private-key-file>
  • Enable HTTPS in the configuration file

HTTPS is disabled by default.Enable HTTPS in the [http] section of the configuration file (/etc/influxdb/influxdb.conf) by setting:

  • https-enabled to true
  • https-certificate to /etc/ssl/influxdb-selfsigned.crt
  • https-private-key to /etc/ssl/influxdb-selfsigned.key
  1. [http]
  3.   [...]
  5.   # Determines whether HTTPS is enabled.
  6.   https-enabled = true
  8.   [...]
  10.   # The TLS or SSL certificate to use when HTTPS is enabled.
  11.   https-certificate = "/etc/ssl/influxdb-selfsigned.crt"
  13.   # Use a separate private key location.
  14.   https-private-key = "/etc/ssl/influxdb-selfsigned.key"
  • Verify TLS connection

Verify that HTTPS is working by connecting to InfluxDB with the CLI tool:

  1. influx -ssl -host <domain_name>.com

If using a self-signed certificate, add the -unsafeSsl flag to the above command.

A successful connection returns the following:

  1. Connected to https://<domain_name>.com:8086 version 1.x.x
  2. InfluxDB shell version: 1.x.x
  3. >

That’s it! You’ve successfully set up HTTPS with InfluxDB.

Connect Telegraf to a secured InfluxDB instance

Connecting Telegraf to an InfluxDB instance that’s usingHTTPS requires some additional steps.

In the Telegraf configuration file (/etc/telegraf/telegraf.conf), edit the urlssetting to indicate https instead of http and change localhost to therelevant domain name.If you’re using a self-signed certificate, uncomment the insecure_skip_verifysetting and set it to true.

  1.     ###############################################################################
  2.     #                            OUTPUT PLUGINS                                   #
  3.     ###############################################################################
  4. >
  5.     # Configuration for InfluxDB server to send metrics to
  6.     [[outputs.influxdb]]
  7.       ## The full HTTP or UDP endpoint URL for your InfluxDB instance.
  8.       ## Multiple urls can be specified as part of the same cluster,
  9.       ## this means that only ONE of the urls will be written to each interval.
  10.       # urls = ["udp://localhost:8089"] # UDP endpoint example
  11.       urls = ["https://<domain_name>.com:8086"]
  12. >
  13.     [...]
  14. >
  15.       ## Optional SSL Config
  16.       [...]
  17.       insecure_skip_verify = true # <-- Update only if you're using a self-signed certificate

Next, restart Telegraf and you’re all set!