feat: Enterprise 1.x mTLS#7523
Open
gwossum wants to merge 1 commit into
Open
Conversation
Document new configuration settings and command line options to support mTLS. Add instructions on enabled mTLS in an Enterprise 1.x cluster.
Contributor
Vale Style Check Results
✅ Check passed |
Collaborator
|
@gwossum Just FYI, I cut a new |
Contributor
🔗 Link Check Results — Link Check Bot✅ All links are valid
|
| Source File | URL | Issue |
|---|---|---|
content/enterprise_influxdb/v1/administration/configure/config-data-nodes/_index.md |
https://support.influxdata.com/ | Network error: SSL certificate not trusted. Use --insecure if site is trusted (e… |
content/enterprise_influxdb/v1/administration/configure/config-meta-nodes/_index.md |
https://support.influxdata.com/ | Network error: SSL certificate not trusted. Use --insecure if site is trusted (e… |
content/enterprise_influxdb/v1/administration/configure/security/enable_tls/_index.md |
https://support.influxdata.com/ | Network error: SSL certificate not trusted. Use --insecure if site is trusted (e… |
content/enterprise_influxdb/v1/administration/manage/clusters/replacing-nodes/_index.md |
https://support.influxdata.com/ | Network error: SSL certificate not trusted. Use --insecure if site is trusted (e… |
content/enterprise_influxdb/v1/tools/influx-cli/_index.md |
https://support.influxdata.com/ | Network error: SSL certificate not trusted. Use --insecure if site is trusted (e… |
content/enterprise_influxdb/v1/tools/influx-cli/use-influx-cli/_index.md |
https://support.influxdata.com/ | Network error: SSL certificate not trusted. Use --insecure if site is trusted (e… |
content/enterprise_influxdb/v1/tools/influxd-ctl/_index.md |
https://support.influxdata.com/ | Network error: SSL certificate not trusted. Use --insecure if site is trusted (e… |
Full details: workflow run summary and artifact. Last updated: 2026-07-18 02:13:00 UTC
sanderson
approved these changes
Jul 18, 2026
sanderson
left a comment
sanderson
left a comment
Collaborator
There was a problem hiding this comment.
Approved with some syntax suggestions on notes and warnings. We've moved to using GitHub-style alert blocks rather than the shortcode notes and warnings. We still support those for backwards compatibility, but new updates should use the new alert blocks.
Comment on lines
+266
to
+277
| {{% note %}} | ||
| mTLS options require **InfluxDB Enterprise v1.13.0+** and build on the HTTPS | ||
| configuration described above. | ||
| Complete [Set up HTTPS](#set-up-https-in-an-influxdb-enterprise-cluster) before | ||
| enabling mTLS. | ||
|
|
||
| Creating the certificates, private keys, and CA files needed for mTLS is outside | ||
| the scope of this guide. | ||
| The following steps assume you already have a CA certificate (for example, | ||
| `/etc/ssl/cluster-ca.crt`) that signed each node's certificate, plus the server | ||
| certificate and key installed on each node. | ||
| {{% /note %}} |
Collaborator
There was a problem hiding this comment.
We've switched to GitHub-style alert blocks:
Suggested change
| {{% note %}} | |
| mTLS options require **InfluxDB Enterprise v1.13.0+** and build on the HTTPS | |
| configuration described above. | |
| Complete [Set up HTTPS](#set-up-https-in-an-influxdb-enterprise-cluster) before | |
| enabling mTLS. | |
| Creating the certificates, private keys, and CA files needed for mTLS is outside | |
| the scope of this guide. | |
| The following steps assume you already have a CA certificate (for example, | |
| `/etc/ssl/cluster-ca.crt`) that signed each node's certificate, plus the server | |
| certificate and key installed on each node. | |
| {{% /note %}} | |
| > [!Note] | |
| > mTLS options require **InfluxDB Enterprise v1.13.0+** and build on the HTTPS | |
| > configuration described above. | |
| > Complete [Set up HTTPS](#set-up-https-in-an-influxdb-enterprise-cluster) before | |
| > enabling mTLS. | |
| > | |
| > Creating the certificates, private keys, and CA files needed for mTLS is outside | |
| > the scope of this guide. | |
| > The following steps assume you already have a CA certificate (for example, | |
| > `/etc/ssl/cluster-ca.crt`) that signed each node's certificate, plus the server | |
| > certificate and key installed on each node. |
Comment on lines
+290
to
+295
| {{% note %}} | ||
| If you don't set a separate client certificate (`*-client-certificate`), the node | ||
| presents its server certificate (`https-certificate`) when dialing peers. | ||
| Set a separate client certificate only if you use distinct certificates for the | ||
| client and server roles. | ||
| {{% /note %}} |
Collaborator
There was a problem hiding this comment.
Suggested change
| {{% note %}} | |
| If you don't set a separate client certificate (`*-client-certificate`), the node | |
| presents its server certificate (`https-certificate`) when dialing peers. | |
| Set a separate client certificate only if you use distinct certificates for the | |
| client and server roles. | |
| {{% /note %}} | |
| > [!Note] | |
| > If you don't set a separate client certificate (`*-client-certificate`), the node | |
| > presents its server certificate (`https-certificate`) when dialing peers. | |
| > Set a separate client certificate only if you use distinct certificates for the | |
| > client and server roles. |
Comment on lines
+339
to
+343
| {{% note %}} | ||
| When you verify peer server certificates with `https-root-ca`, you no longer need | ||
| `https-insecure-tls` or `data-insecure-tls` to skip verification. | ||
| Remove those settings (or leave them `false`) to keep server verification enabled. | ||
| {{% /note %}} |
Collaborator
There was a problem hiding this comment.
Suggested change
| {{% note %}} | |
| When you verify peer server certificates with `https-root-ca`, you no longer need | |
| `https-insecure-tls` or `data-insecure-tls` to skip verification. | |
| Remove those settings (or leave them `false`) to keep server verification enabled. | |
| {{% /note %}} | |
| > [!Note] | |
| > When you verify peer server certificates with `https-root-ca`, you no longer need | |
| > `https-insecure-tls` or `data-insecure-tls` to skip verification. | |
| > Remove those settings (or leave them `false`) to keep server verification enabled. |
Comment on lines
+408
to
+413
| {{% warn %}} | ||
| Requiring client certificates on the HTTP API (`[http] https-client-auth-type`) | ||
| means **every** HTTP API client must present a valid certificate. | ||
| Before enabling this setting, ensure all clients—including the `influx` CLI, | ||
| Telegraf, and your applications—are configured to present a client certificate. | ||
| {{% /warn %}} |
Collaborator
There was a problem hiding this comment.
Suggested change
| {{% warn %}} | |
| Requiring client certificates on the HTTP API (`[http] https-client-auth-type`) | |
| means **every** HTTP API client must present a valid certificate. | |
| Before enabling this setting, ensure all clients—including the `influx` CLI, | |
| Telegraf, and your applications—are configured to present a client certificate. | |
| {{% /warn %}} | |
| > [!Important] | |
| > Requiring client certificates on the HTTP API (`[http] https-client-auth-type`) | |
| > means **every** HTTP API client must present a valid certificate. | |
| > Before enabling this setting, ensure all clients—including the `influx` CLI, | |
| > Telegraf, and your applications—are configured to present a client certificate. |
Comment on lines
+434
to
+438
| {{% note %}} | ||
| Enabling or disabling HTTPS (`https-enabled`) always requires a restart. | ||
| Only certificate, CA pool, and client-authentication changes can be applied with | ||
| `SIGHUP`. | ||
| {{% /note %}} |
Collaborator
There was a problem hiding this comment.
Suggested change
| {{% note %}} | |
| Enabling or disabling HTTPS (`https-enabled`) always requires a restart. | |
| Only certificate, CA pool, and client-authentication changes can be applied with | |
| `SIGHUP`. | |
| {{% /note %}} | |
| > [!Note] | |
| > Enabling or disabling HTTPS (`https-enabled`) always requires a restart. | |
| > Only certificate, CA pool, and client-authentication changes can be applied with | |
| > `SIGHUP`. |
Comment on lines
+64
to
+70
| {{% note %}} | ||
| If the cluster requires mutual TLS (mTLS), also pass a client certificate and key | ||
| with `-cert` and `-key` (and `-ca-cert` to verify the meta node's certificate). | ||
| For more information, see the | ||
| [`influxd-ctl` global flags](/enterprise_influxdb/v1/tools/influxd-ctl/#influxd-ctl-global-flags) | ||
| and [Enable mutual TLS (mTLS)](/enterprise_influxdb/v1/administration/configure/security/enable_tls/#enable-mutual-tls-mtls). _v1.13.0+_ | ||
| {{% /note %}} |
Collaborator
There was a problem hiding this comment.
Suggested change
| {{% note %}} | |
| If the cluster requires mutual TLS (mTLS), also pass a client certificate and key | |
| with `-cert` and `-key` (and `-ca-cert` to verify the meta node's certificate). | |
| For more information, see the | |
| [`influxd-ctl` global flags](/enterprise_influxdb/v1/tools/influxd-ctl/#influxd-ctl-global-flags) | |
| and [Enable mutual TLS (mTLS)](/enterprise_influxdb/v1/administration/configure/security/enable_tls/#enable-mutual-tls-mtls). _v1.13.0+_ | |
| {{% /note %}} | |
| > [!Note] | |
| > If the cluster requires mutual TLS (mTLS), also pass a client certificate and key | |
| > with `-cert` and `-key` (and `-ca-cert` to verify the meta node's certificate). | |
| > For more information, see the | |
| > [`influxd-ctl` global flags](/enterprise_influxdb/v1/tools/influxd-ctl/#influxd-ctl-global-flags) | |
| > and [Enable mutual TLS (mTLS)](/enterprise_influxdb/v1/administration/configure/security/enable_tls/#enable-mutual-tls-mtls). _v1.13.0+_ |
Contributor
|
Contributor
📦 PR Preview — Preview Bot
Pages included in this preview
Preview auto-deploys on push. Will be cleaned up when PR closes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Document new configuration settings and command line options to support mTLS. Add instructions on enabled mTLS in an Enterprise 1.x cluster. These features will be available in 1.13.0.
Part of https://github.com/influxdata/DAR/issues/727