Skip to main content
In this guide you’ll learn how to secure Prometheus scrapes by enabling TLS (HTTPS) and HTTP Basic authentication on a target (Node Exporter). This ensures that:
  • Only authorized clients (Prometheus) can access the metrics endpoint.
  • Scraped metrics are protected from eavesdropping while traversing the network.
Problems we solve:
  • Without authentication, anyone who can reach the metrics endpoint (for example, a Node Exporter) can scrape metrics.
  • Without encryption, captured network packets reveal metrics in plaintext—even if authentication is used.
A dark-themed infographic titled "Authentication & Encryption" showing client/service icons, attacker symbols, and server "Node" boxes connected by dashed lines to a red "Authentication" block and a green "Encryption" block. Padlock and hash icons indicate authentication and encryption steps while a hacker/magnifier icon represents an attack or inspection.
Overview
  • Use TLS (HTTPS) on the metrics endpoint to prevent eavesdropping.
  • Use HTTP Basic authentication to restrict access to trusted clients.
  • Configure Prometheus to verify the server certificate and present credentials when scraping.
TLS (HTTPS) for Node Exporter
  1. Generate a certificate and private key for the Node Exporter host.
You may use an internal PKI, a commercial CA, or Let’s Encrypt. For quick testing, create a self-signed certificate with OpenSSL:
Verify the files exist:
  1. Create a Node Exporter web config file (YAML) that enables TLS.
Example config.yml (place it next to the cert/key for this example):
  1. Start Node Exporter with the --web.config.file flag:
You should see logs indicating TLS is enabled:
  1. Move configuration and certificates to a persistent location and secure them.
Example:
Update the systemd unit (for example: /etc/systemd/system/node_exporter.service) to include:
Then reload systemd and restart the service:
  1. Test the TLS endpoint with curl.
If you used a self-signed certificate, curl will reject it by default. For testing only, skip verification:
If you use a CA-signed certificate trusted by the Prometheus server, you will not need to skip verification (avoid -k or insecure_skip_verify in that case).
Configure Prometheus to scrape over TLS
  1. Copy the Node Exporter certificate (or CA certificate) to the Prometheus server so Prometheus can verify the server certificate:
  1. Update the Prometheus scrape configuration (/etc/prometheus/prometheus.yml) for the Node Exporter job:
Note: If Prometheus has the server certificate or CA file configured in ca_file, it can verify the server certificate without insecure_skip_verify.
  1. Restart Prometheus:
Authentication (HTTP Basic Auth) for Node Exporter Use HTTP Basic authentication to restrict metric access to Prometheus only.
  1. Generate a bcrypt hashed password for the user (example username: prometheus).
Install htpasswd (from apache2-utils) and create a bcrypt hash:
Interactive:
Non-interactive (convenient for examples; avoid passing secrets on the CLI in production):
Example hash:
Save the hash — this goes into Node Exporter’s config (not the plaintext password).
  1. Configure basic auth in Node Exporter’s web config (/etc/node_exporter/config.yml):
  1. Restart Node Exporter:
After enabling basic auth, Prometheus will be unable to scrape until it supplies credentials. The Targets UI will show the endpoint as DOWN with a 401 Unauthorized error:
  1. Configure Prometheus to present credentials for the scrape job.
Edit /etc/prometheus/prometheus.yml and add basic_auth under the job (this uses the plaintext password corresponding to the bcrypt hash):
Storing plaintext credentials in config files is risky. Use a secrets manager or restrict file permissions to the Prometheus user. Ensure /etc/prometheus/prometheus.yml is readable only by the Prometheus service account and, if possible, integrate with a secret backend.
  1. Restart Prometheus:
If TLS and basic_auth are configured correctly, the Prometheus Targets UI should show the Node Exporter endpoint as UP. Quick reference: file locations & permissions Best practices and final notes
  • Use CA-signed certificates in production; avoid self-signed certs and insecure_skip_verify: true.
  • Protect private keys: restrict ownership and file permissions to the service user.
  • Avoid plaintext secrets in code/config when possible — consider integrating a secrets manager.
  • Use strong, unique passwords and rotate credentials periodically.
  • Monitor Prometheus logs and Targets UI for TLS/401 errors to diagnose misconfigurations.
Links and references

Watch Video

Practice Lab