Trying again as something completely reformatted my commands.... I never got to the bottom of this, on either squid or tentacle. I have an externally-generated cert/key. As a workaround I do this after each upgrade (most recently to 20.2.3): cp ~/my_grafana_cert.key /var/lib/ceph/`ceph fsid`/grafana.`hostname -s`/etc/grafana/certs/cert_key cp ~/my_grafana_cert.crt /var/lib/ceph/`ceph fsid`/grafana.`hostname -s`/etc/grafana/certs/cert_file ceph orch daemon restart grafana.`hostname -s` --force It would be nice to know what the right way is. Regards, Chris On 07/08/2026 13:51, Robert Sander via ceph-users wrote:

Hi,

how do I set the grafana certificate and key in Ceph 19 that is used on port 3000?

The documentation on https://docs.ceph.com/en/squid/cephadm/services/monitoring/#configuring-ssl-... states:

# ceph config-key set mgr/cephadm/{hostname}/grafana_key -i $PWD/key.pem # ceph config-key set mgr/cephadm/{hostname}/grafana_crt -i $PWD/certificate.pem # ceph orch reconfig grafana

But after doing that grafana still serves a self-signed certificate with the common name containing the hostname of the first MON (which is not correct).

Digging into "ceph config-key dump" shows two entries named mgr/cephadm/cert_store.cert.grafana_cert and mgr/cephadm/cert_store.key.grafana_key which seem to cause this.

AFAIK the certmgr is only available in Ceph 20. But the docs for this version look the same: https://docs.ceph.com/en/tentacle/cephadm/services/monitoring/#configuring-s...

Only the docs for Ceph 21 got an update and mention certmgr: https://docs.ceph.com/en/umbrella/cephadm/services/monitoring/#configuring-s...

The orchestrator in Ceph 19 seems to have something called cert-store:

# ceph orch cert-store no valid command found; 4 closest matches: orch cert-store cert ls [--format {plain|json|json-pretty|yaml|xml-pretty|xml}] orch cert-store key ls [--format {plain|json|json-pretty|yaml|xml-pretty|xml}] orch cert-store get cert <entity> [--service_name <value>] [--hostname <value>] [--no-exception-when-missing] orch cert-store get key <entity> [--service_name <value>] [--hostname <value>] [--no-exception-when-missing] Error EINVAL: invalid command

But there is no help available. "ceph orch cert-store --help" does not return anything specific. Searching for "cert-store" in the Ceph 19 docs also does not return anything.

Regards