Grafana配置https

---

1、Yum安装Grafana

配置grafana-yum源安装grafana最新版本-8.0.3

[root@localhost ~]# cd /etc/yum.repos.d/
[root@localhost yum.repos.d]# vim grafana.repo
[grafana]
name=grafana
baseurl=https://mirrors.tuna.tsinghua.edu.cn/grafana/yum/rpm
repo_gpgcheck=0
enabled=1
gpgcheck=0

[root@localhost yum.repos.d]# yum makecache fast
[root@localhost yum.repos.d]# yum -y install grafana

启动grafana
[root@localhost ~]# systemctl start grafana-server
[root@localhost ~]# systemctl enable --now grafana-server

[root@localhost ~]# netstat -anpt | grep grafana 
tcp        0      0 192.168.8.5:44008       185.199.108.133:443     ESTABLISHED 9250/grafana-server 
tcp        0      0 192.168.8.5:49866       34.120.177.193:443      ESTABLISHED 9250/grafana-server 
tcp6       0      0 :::3000                 :::*                    LISTEN      9250/grafana-server

2、生成自签名证书

在grafanf存放目录下创建ssl目录用于存放证书文件，主目录：/etc/grafana

[root@localhost ~]# mkdir /etc/grafana/ssl
[root@localhost ~]# cd /etc/grafana/ssl
[root@localhost ssl]# yum -y install openssl


**创建CA**
[root@localhost ssl]#  openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt
Generating a 4096 bit RSA private key
.............................................................................................................................................................................................................................................................................++
....................................................................................................++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:**CN**
State or Province Name (full name) []:**bejing**
Locality Name (eg, city) [Default City]:bejing
Organization Name (eg, company) [Default Company Ltd]:**surrender**
Organizational Unit Name (eg, section) []:**surrender**
Common Name (eg, your name or your server's hostname) []:**www.surrender.com**
Email Address []:



**生成证书签名请求**
[root@localhost ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout www.surrender.com.key -out www.surrender.com.csr
Generating a 4096 bit RSA private key
.....................................................................................................................................................................................................................................................................................................................++
...........................................................................................................................................................++
writing new private key to 'www.surrender.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:**CN**
State or Province Name (full name) []:**bejing**
Locality Name (eg, city) [Default City]:**bejing**
Organization Name (eg, company) [Default Company Ltd]:**surrender**
Organizational Unit Name (eg, section) []:**surrender**
Common Name (eg, your name or your server's hostname) []:**www.surrender.com**
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:




**生成注册表主机的证书**
[root@localhost ssl]# openssl x509 -req -days 365 -in www.surrender.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out www.surrender.com.crt
Signature ok
subject=/C=CN/ST=bejing/L=bejing/O=surrender/OU=surrender/CN=www.surrender.com
Getting CA Private Key



**查看证书生成情况**
[root@localhost ssl]# ll
total 24
-rw-r--r--. 1 root root 2045 Jun 27 22:50 ca.crt
-rw-r--r--. 1 root root 3272 Jun 27 22:50 ca.key
-rw-r--r--. 1 root root   17 Jun 27 22:54 ca.srl
-rw-r--r--. 1 root root 1927 Jun 27 22:54 www.surrender.com.crt
-rw-r--r--. 1 root root 1712 Jun 27 22:52 www.surrender.com.csr
-rw-r--r--. 1 root root 3272 Jun 27 22:52 www.surrender.com.key
[root@localhost ssl]# rm -fr ca.* 


**信任自签发证书**
由于CA证书是我们自己签发的，系统本身是不信任的，因此我们需要吧证书导入到我们系统的信任证书里
[root@localhost ssl]# cp www.surrender.com.crt /etc/pki/ca-trust/source/anchors/
[root@localhost ssl]# update-ca-trust extract
[root@localhost ssl]# update-ca-trust enable 

3、Grafana配置https使用自签名证书

在grafana配置文件里，指定证书存放位置及名称

[root@localhost ~]# vim /etc/grafana/grafana.ini 
[server] 
protocol = https                                                //32行，开启https
cert_file = /etc/grafana/ssl/www.surrender.com.crt              //64行，指定证书文件
cert_key = /etc/grafana/ssl/www.surrender.com.key               //65行，指定证书私钥

[root@localhost ~]# systemctl restart grafana-server

4、浏览器访问测试

默认账户：admin
默认密码：admin
首次登录需要修改密码

5、在终端查看连接情况

[root@localhost ~]# netstat -anpt | grep grafana
tcp6       0      0 :::3000                 :::*                    LISTEN      10586/grafana-serve 
tcp6       0      0 192.168.8.5:3000        192.168.8.254:53222     ESTABLISHED 10586/grafana-serve 
tcp6       0      0 192.168.8.5:3000        192.168.8.254:53223     ESTABLISHED 10586/grafana-serve 
tcp6       0      0 192.168.8.5:3000        192.168.8.254:53221     ESTABLISHED 10586/grafana-serve 
tcp6       0      0 192.168.8.5:3000        192.168.8.254:57976     ESTABLISHED 10586/grafana-serve