# HTTPS setup instructions incorrect with CA signed certs

**URL:** <https://community.influxdata.com/t/https-setup-instructions-incorrect-with-ca-signed-certs/6809>\
**Category:** Systems\
**Created:** [September 28, 2018, 9:32pm UTC](https://community.influxdata.com/t/https-setup-instructions-incorrect-with-ca-signed-certs/6809 "2018-09-28T21:32:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![chobbs](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/chobbs/32/1566_2.png) [@chobbs](https://community.influxdata.com/u/chobbs)\
**Post date:** [September 28, 2018, 9:32pm UTC](https://community.influxdata.com/t/https-setup-instructions-incorrect-with-ca-signed-certs/6809/1 "2018-09-28T21:32:16Z")

</div>

I am trying to run influxdb with HTTPS and having trouble with CA certs. I can’t get influxdb to start; it fails with permissions errors (even, insecurely, making permissions as flexible as possible for go/influxdb users).

We can launch it fine with self-signed certs, but that conflicts with our client side applications (the InfluxDB node client doesn’t seem to behave well with custom options for ignoring cert verification).

Note: works with self-signed certs just fine, but those aren’t working in the client-side requests I have to make.

**System info:** [Include InfluxDB version, operating system name, and other relevant details]

Ubuntu 16.04 in AWS EC2, r5d.2xlarge instance, InfluxDB 1.6.2

**Steps to reproduce:**

1. Create suitable DNS name for instance (We are using AWS Route53)
2. Create Let’sEncrypt certificates (for Apache on Ubuntu 16.04) using certbot
3. Edit permissions of certificates basically as described [here](https://docs.influxdata.com/influxdb/v1.6/administration/https_setup/):

```auto
sudo -s
DOMAIN=<your domain name>
chown -R root:root /etc/letsencrypt/archive/${DOMAIN}
chown -R root:root /etc/letsencrypt/live/${DOMAIN}
chmod 644 /etc/letsencrypt/archive/${DOMAIN}/*.pem
chmod 644 /etc/letsencrypt/live/${DOMAIN}/*.pem
chmod 600 /etc/letsencrypt/archive/${DOMAIN}/privkey*.pem
chmod 600 /etc/letsencrypt/live/${DOMAIN}/privkey.pem
chmod go+x /etc/letsencrypt/archive/${DOMAIN}
chmod go+x /etc/letsencrypt/live/${DOMAIN}

```

1. Edit `/etc/influxdb/influxdb.conf` to point to these certs:

```auto
https-enabled = true
https-certificate = "/etc/letsencrypt/live/<your domain name>/cert.pem"
https-private-key = "/etc/letsencrypt/live/<your domain name>/privkey.pem"

```

1. Restart: `sudo systemctl restart influxdb`

**Expected behavior:** [What you expected to happen]

Expect `influxdb` to start successfully and serve over `https`

**Actual behavior:** [What actually happened]

`influxdb` fails repeatedly with no error information, _possibly_ reporting a permissions error opening the certificate.

---

<div class="post-metadata">

**Author:** ![Laszlo\_Laszlo](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/laszlo_laszlo/32/2130_2.png) [@Laszlo\_Laszlo](https://community.influxdata.com/u/Laszlo_Laszlo)\
**Post date:** [September 29, 2018, 10:28am UTC](https://community.influxdata.com/t/https-setup-instructions-incorrect-with-ca-signed-certs/6809/2 "2018-09-29T10:28:17Z")

</div>

Hello,  
I think this isn’t good for you. InfluxDB isn’t run as root user.

> [@chobbs](#):
>
> chmod 600 /etc/letsencrypt/archive/${DOMAIN}/privkey\*.pem chmod 600 /etc/letsencrypt/live/${DOMAIN}/privkey.pem

That’s why InfluxDB can’t read private key.  
Give read permission on privkey to influxdb user.