Hi Eugen, There are some bugs around the Grafana certificate(s) upgrade that PR #73234 is meant to fix: https://github.com/ceph/ceph/pull/73234 For now, I recommend re-applying them manually (using certmgr). Best, Redo. On Tue, Nov 3, 2026 at 11:14 AM Eugen Block <ceph-users@ceph.io> wrote:
Hi,
I just upgraded one of my test clusters to 20.2.5, the upgrade went well except for Grafana. I have my own certificate and key which worked before the upgrade (from 19.2.7).
Now Grafana fails with:
could not load SSL certificate: tls: failed to find any PEM data in certificate input
The certmgr lists the existing cert:
host:~ # ceph orch certmgr cert ls grafana_cert scope: host certificates nautilus subject countryName: DE ... commonName: host.domain ... validity remaining_days: 13
But the files in /var/lib/ceph/{FSID}/grafana.host/etc/grafana/certs/ only contain a comment:
host:~ # cat
/var/lib/ceph/201a2fbc-ce7b-44a3-9ed7-39427972083b/grafana.nautilus/etc/grafana/certs/cert_* # generated by cephadm # generated by cephadm
These config-keys are stored:
"mgr/cephadm/cert_store.cert.grafana_cert", "mgr/cephadm/cert_store.cert.grafana_key", "mgr/cephadm/cert_store.key.grafana_key", "mgr/cephadm/spec.grafana",
I know I could just replace the cert and key in that directory and restart grafana. But if certmgr already knows there's a valid cert, why does it (re-)generate an empty cert + key? I'm not sure if I'm missing something or of this is by design. I couldn't find anything in the release notes for 20.2.5 or in the Tentacle docs that would explain this.
Thanks! Eugen
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io