Skip to main content
In this lesson we cover how to secure Prometheus scrapes of targets (Node Exporter) using authentication and TLS encryption. We’ll walk through the end-to-end steps so that:
  • only authorized clients (Prometheus) can scrape metrics (authentication), and
  • network traffic is protected from packet sniffers (TLS encryption).
By default, Prometheus can scrape a Node Exporter endpoint without any authentication or encryption. That means anyone who can reach the endpoint can read metrics. Adding authentication restricts access, while TLS prevents eavesdroppers from reading the data, and protects against certain active attacks when properly validated.
This guide shows a practical self-signed example for testing and the recommended approach for production—use CA-signed certificates (or a public CA like Let’s Encrypt) and keep TLS verification enabled.
The image illustrates a network security diagram showing the process of authentication and encryption between nodes, highlighting security elements like firewalls, user authentication, and data encryption.
Below are the steps and example configurations to enable TLS + basic auth for Node Exporter and to configure Prometheus to scrape it securely.

​
1) Generate TLS certificate and key for the target (Node Exporter)

For testing you can generate a self-signed cert with OpenSSL. In production, use your organization CA or Let’s Encrypt. Make sure the certificate’s Common Name (CN) and/or subjectAltName (SAN) includes the hostname or IP address Prometheus will use to reach the Node Exporter (for example node or node.example.com), otherwise TLS name validation will fail. Example OpenSSL command (run on the target host):
This produces node_exporter.key and node_exporter.crt. Example listing after generation:

​
2) Create a Node Exporter web config (TLS + optional basic auth users)

Create a YAML web config for Node Exporter and store it next to the certificate and key (or use absolute paths). Minimal TLS configuration:
Later you can add basic_auth_users: to this file for username/password protection (bcrypt hashes).

​
3) Run Node Exporter with the web config file

Update the Node Exporter systemd unit (or the service file you use) so Node Exporter is started with --web.config.file:
Reload systemd and restart:
Testing note: with a self-signed cert a client like curl will reject the connection by default. To test locally, use:
If you use a CA-trusted certificate, -k is not necessary.

​
4) Move cert/config into a canonical location and set permissions

Best practice: store config and keys under /etc/node_exporter and set appropriate ownership/permissions:

​
5) Configure Prometheus to validate TLS when scraping the target

Copy the Node Exporter certificate or the CA cert to the Prometheus server so Prometheus can validate the target:
Update the Prometheus scrape job to use HTTPS and a tls_config that points to the CA file you copied. This ensures proper verification. For quick testing only, you can set insecure_skip_verify: true (not recommended for production). Example scrape job that validates the target certificate:
Setting insecure_skip_verify: true disables certificate validation and makes TLS vulnerable to man-in-the-middle attacks. Only use this for testing with self-signed certificates. In production, use a CA-signed certificate and keep insecure_skip_verify: false.
After editing prometheus.yml, restart Prometheus:

​
6) Enable basic authentication on Node Exporter

To require basic auth for scraping, add a basic_auth_users map to the Node Exporter web config. Node Exporter expects bcrypt password hashes. Install apache2-utils (provides htpasswd) on the Node Exporter host:
Generate a bcrypt hash for the password (this prompts for the password):
Example bcrypt output (single line):
Add basic_auth_users to /etc/node_exporter/config.yml and include the hash (quote the string to preserve characters):
Restart Node Exporter:
At this point, Prometheus will likely show the target as DOWN and the target page will return HTTP 401 Unauthorized because Prometheus is not yet sending credentials.
The image shows a Prometheus monitoring interface indicating an endpoint is down, with a 401 Unauthorized error. It also mentions that the Prometheus Server will now show as Unauthorized.

​
7) Configure Prometheus to use basic auth when scraping

Update the Prometheus job in prometheus.yml to include basic_auth. Prometheus will send the password over the TLS connection configured earlier.
Replace "your_plaintext_password_here" with the actual password used to create the bcrypt hash earlier (Prometheus requires the plaintext in its config to authenticate when scraping). Restart Prometheus:
After Prometheus restarts, verify on the Targets page in the Prometheus web UI that the target shows as UP. This confirms successful HTTPS connection and basic authentication.

​
Summary checklist

Follow these steps to secure Prometheus scrapes with TLS and basic authentication. For production, prioritize CA-signed certificates and avoid insecure_skip_verify: true.

Watch Video

Practice Lab