Hi, we have now removed the mgmt-gateway service. We came to the conclusion that it is not production ready yet. The certificates do not match. I am using this service spec: service_type: mgmt-gateway service_name: mgmt-gateway placement: label: mgmt-gateway spec: port: 443 virtual_ip: ceph.example.com ssl: true ssl_cert: |- -----BEGIN CERTIFICATE----- XXXX -----END CERTIFICATE----- ssl_key: |- -----BEGIN PRIVATE KEY----- XXXX -----END PRIVATE KEY----- --- service_type: ingress service_id: mgmt-gateway placement: label: mgmt-gateway virtual_ip: 10.128.8.255/22 backend_service: mgmt-gateway keepalive_only: true ceph.example.com has an A record that resolves to 10.128.8.255. The provided certificate contains a subjectAlternativeName for ceph.example.com. The browser is able to open https://ceph.example.com ceph dashboard set-grafana-frontend-api-url https://ceph.example.com/grafana/ The browser is able to open Grafana. But Grafana is not able to reach Prometheus. mgr/dashboard/PROMETHEUS_API_HOST is set to https://ceph.example.com:29443/internal/prometheus which works but the certificate at this port does not. Bu the nginx gets an internal certificate configured on Port 29443 that was signed by the certmgr's internal CA and contains the hostname where the daemon is deployed in the subjectAlternativeName attribute. It should have ceph.example.com in subjectAlternativeName as this is the name for the service IP and is set in PROMETHEUS_API_HOST. Regards -- Robert Sander Linux Consultant Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: +49 30 405051 - 0 Fax: +49 30 405051 - 19 Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin