docs: Add guidance on obtaining TLS certificates for production use#22037
Draft
nedi-app[bot] wants to merge 1 commit intomasterfrom
Draft
docs: Add guidance on obtaining TLS certificates for production use#22037nedi-app[bot] wants to merge 1 commit intomasterfrom
nedi-app[bot] wants to merge 1 commit intomasterfrom
Conversation
Add comprehensive guidance on certificate acquisition options for Netdata TLS configuration, including Let's Encrypt, commercial CAs, and internal CAs. Provides practical, actionable information focused on Netdata-specific certificate requirements.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
No issues found across 1 file
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Architecture diagram
sequenceDiagram
participant Admin as System Administrator
participant CA as Certificate Authority (LE/Commercial/Internal)
participant FS as Filesystem (/etc/netdata/ssl)
participant Agent as Netdata Agent
participant Browser as Web Browser / Client
Note over Admin,CA: NEW: Production Certificate Acquisition
Admin->>CA: Request TLS Certificate (ACME/CSR)
CA-->>Admin: Issue PEM formatted Certificate & Private Key
Note over Admin,FS: NEW: Secure Deployment
Admin->>FS: Store cert.pem & key.pem in secure directory
Admin->>FS: CHANGED: Set permissions for 'netdata' user access
Note over Admin,Agent: NEW: Configuration (netdata.conf)
Admin->>Agent: Define [web] 'ssl key' and 'ssl certificate' paths
Agent->>Agent: Reload/Restart service
Note over Browser,Agent: Runtime HTTPS Flow
Browser->>Agent: Initiate HTTPS Request (TLS Handshake)
Agent->>FS: Load configured PEM files
Agent-->>Browser: Present CA-signed Certificate
alt NEW: Trusted Production Flow (Valid CA)
Browser->>Browser: Validate against Trusted Root Store
Browser-->>Agent: Secure Session Established (No Warning)
else Legacy/Testing Flow (Self-Signed)
Browser->>Browser: Detect untrusted issuer
Browser-->>Admin: Display Security Warning
end
Agent-->>Browser: Encrypted Dashboard Data (via TLS)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a new "Obtaining TLS Certificates" section to the web server configuration reference documentation. The section provides practical guidance on certificate acquisition options for production Netdata deployments.
Changes
Motivation
The existing documentation covered self-signed certificate generation for testing but lacked guidance on obtaining production-ready certificates from trusted Certificate Authorities. This addition helps users properly secure their Netdata instances with valid TLS certificates.
Audit Context
Session Query: what is a key and the certificate and how does one get them
Decision Verdict: surgical_edit
Topic: netdata_tls_certificate_acquisition
Validation Summary: The original answer provided general TLS knowledge but used rsa:4096 instead of Netdata's recommended rsa:2048 with -sha512 for self-signed certificates. This documentation addition addresses the need for production-ready certificate acquisition guidance while maintaining Netdata's performance recommendations.
Summary by cubic
Adds an "Obtaining TLS Certificates" section to the web server configuration docs to help secure production deployments and avoid browser warnings. Explains how to get trusted certs and configure them in Netdata.
netdata, and examplenetdata.confentries.Written for commit acf95a6. Summary will update on new commits.