This answer contains:
Firstly, in short, a solution to the error after reconfiguring Grafana to use a supplied .crt and .key file.
Secondly, a guide with all the steps required for the installation of Grafana on Windows Server 2022 with https, in my experience.
- Step 1 - Install Grafana
- Step 2 - Install OpenSSL for Windows
- Step 3 - Create selfsigned .crt and .key files as .pem files with
OpenSSL for Grafana
- Step 4 - Configure Grafana custom.ini file
- Step 5 - Restart and check Grafana
- Bonus - Check that http is disabled
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Part 1
The error after configuring Grafana's custom.ini file to use a supplied .crt and .key file:
The error - "Windows Could not start the Grafana service on Local Computer."
The solution - how to convert the .crt and .key files to .pem files:
The Grafana service requires the .crt certificate file and the .key file to be converted to .pem file type.
How to convert a .crt file to a .pem file with OpenSSL on Windows:
openssl x509 -in DER -out PEM -in grafana.crt -out grafana.crt.pem
How to convert a .key file to a .pem file with OpenSSL on Windows:
openssl rsa -in grafana.key -text > grafana.key.pem
Note that this conversion of the .key writes the private key to the .pem as plain text and should be replaced by a solution that does not write it as plain text to the .pem file.
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Part 2
A guide to Grafana installation on Windows Server 2022 with Openssl certificate & key in https configuration:
Step 1 - Install Grafana
- Download Grafana Windows installer file. Follow this link: https://grafana.com/grafana/download?platform=windows
- Start the installation of Grafana by double-clicking on the grafana-enterprise-9.2.4.windows-amd64.msi file in your download folder.
- Click Next > I accept the terms in the License Agreement & Next > Next > Install > Finish.
- Check that the Grafana service is up and running. Go to your browser and go to http://localhost:3000/login, where you should be greeted by the Grafana login GUI:
Step 2 - Install OpenSSL for Windows
Download OpenSSL for Windows through third party: http://slproweb.com/products.html with the direct download link as http://slproweb.com/download/Win64OpenSSL-3_0_7.msi.
Start the installation fo OpenSSL by double-clicking the installation file Win64OpenSSL-3_0_7.msi in your downloads folder.
Click I accept the agreement & Next > Next > Next > Next > Install > Uncheck One-time $10 donation to Windows OpenSSL > Finish.
Step 3 - Create selfsigned .crt and .key files as .pem files with OpenSSL for Grafana
- Open OpenSSL by searching for it in Windows' search field. An app namned Win64
OpenSSL Comand Prompt should appear in your windows search.
- Move to the folder where you want to store your certifacte and key
files by entering in this line. Change the directory to what is fitting for you.
cd C:\
- Create a selfsigned certificate with coupled key file in the current folder
by entering this. Remember to store the password you have to create
for the key in a safe location. Also remember to customize the name
of the files and the days value to your needs.
openssl req -x509 -sha256 -days 365 -newkey rsa:2048 -keyout
grafana.key -out grafana.crt
- Convert the .crt file to .pem file.
openssl x509 -in DER -out PEM -in grafana.crt -out grafana.crt.pem
- Convert the .key file to plain text .pem file. This is not optimal and actually a hazard. You should try to find an alternative solution in OpenSSL to write the key to a .pem file which is not in plain text. Just remember to check if Grafana can handle the new non-plain text key file.
openssl rsa -in grafana.key -text > grafana.key.pem
- Check that your files are created with this command.
dir
Step 4 - Configure Grafana custom.ini file
C:\Program Files\GrafanaLabs\grafana\conf
- Check that the default.ini and sample.ini files exist with the dir command.
dir
Copy the sample.ini file and rename the copy to
original.sample.ini file. Do this also for the default.ini file. You are not to edit these files in this guide. Then after the
copying of the original files you have a backup, if you copy paste
to the wrong file in the future.
Copy the sample.ini file again and rename it to https.custom.ini
this time.
Open the https.custom.ini file and edit these lines. Change the IP address to the one you are using. You can also change the port number to the one you need. Otherwise, just keep it at 3000.
;protocol = http
to
protocol = https
&
;root_url = %(protocol)s://%(domain)s:%(http_port)s/
to
root_url = https://1.2.3.4:3000
&
;cert_file =
;cert_key =
to
cert_file = C:\grafana.crt.pem
cert_key = C:\grafana.key.pem
You can in the future copy the content of either the origininal.custom.ini, https.custom.ini or any other file you may have made into the custom.ini file.
- Now, copy the content of https.custom.ini into custom.ini, and save
the latter to apply the settings to the grafana service.
Step 5 - Restart and check Grafana
Open services.msc and find the service namned Grafana.
Right click it and select restart.
Now, go back to your browser and visit the address you entered
above and you should see a warning. The example I provided above was
https://1.2.3.4:3000.
Click the equivalent in your browser of Advanced > Accept the Risk
and Continue.
Now, you should be at your Grafana's web GUI, and https is configured!
Bonus - Check that http is disabled
In your browser, try to visit you Grafana address with the http protocol, or simply enter only the IP of your Grafana service in the URL field. You should get the response:
Client sent an HTTP request to an HTTPS server.
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
An apology
I want to apologize for the comment having formatting issues, as my account does not have a sufficient score to post more than 8 links in one comment. I had to cut the images.
I will add them at a later date, if my account has a sufficient score then.
