# Telegraf TLS Client Authentication in Influxdb output

**URL:** <https://community.influxdata.com/t/telegraf-tls-client-authentication-in-influxdb-output/2899>\
**Category:** Telegraf\
**Tags:** influxdb, telegraf\
**Created:** [October 27, 2017, 1:56pm UTC](https://community.influxdata.com/t/telegraf-tls-client-authentication-in-influxdb-output/2899 "2017-10-27T13:56:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cruscio](https://avatars.discourse-cdn.com/v4/letter/c/dc4da7/32.png) [@cruscio](https://community.influxdata.com/u/cruscio)\
**Post date:** [October 27, 2017, 1:56pm UTC](https://community.influxdata.com/t/telegraf-tls-client-authentication-in-influxdb-output/2899/1 "2017-10-27T13:56:21Z")

</div>

What are the ssl\_cert and ssl\_key used for in Telegraf’s InfluxDB Output Plugin? Is this for Client TLS Authentication by InfluxDB? (similar to Kafka: [kafka: Add support for using TLS authentication for the kafka output by Ormod · Pull Request #541 · influxdata/telegraf · GitHub](https://github.com/influxdata/telegraf/pull/541) )

[telegraf/plugins/outputs/influxdb at master · influxdata/telegraf · GitHub](https://github.com/influxdata/telegraf/tree/master/plugins/outputs/influxdb) :`

```
## Optional SSL Config
# ssl_ca = "/etc/telegraf/ca.pem"
# ssl_cert = "/etc/telegraf/cert.pem"
# ssl_key = "/etc/telegraf/key.pem"
## Use SSL but skip chain & host verification
# insecure_skip_verify = false

```

There isn’t any reference to Client TLS Authentication in the influx documentation ([HTTPS Setup | InfluxDB OSS 1.3 Documentation](https://docs.influxdata.com/influxdb/v1.3/administration/https_setup/) ) - but I can’t think of any reason, besides Client auth, to have a key on the client (telegraf) side of the communication.

---

<div class="post-metadata">

**Author:** ![daniel](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/daniel/32/142_2.png) [@daniel](https://community.influxdata.com/u/daniel)\
**Post date:** [October 27, 2017, 6:11pm UTC](https://community.influxdata.com/t/telegraf-tls-client-authentication-in-influxdb-output/2899/2 "2017-10-27T18:11:22Z")

</div>

Most of these options are useful only when you are using nginx or another reverse proxy between Telegraf and InfluxDB, in which case you can client certificate authentication.

---

<div class="post-metadata">

**Author:** ![cruscio](https://avatars.discourse-cdn.com/v4/letter/c/dc4da7/32.png) [@cruscio](https://community.influxdata.com/u/cruscio)\
**Post date:** [October 27, 2017, 7:44pm UTC](https://community.influxdata.com/t/telegraf-tls-client-authentication-in-influxdb-output/2899/3 "2017-10-27T19:44:21Z")

</div>

Already using nginx, and my security team wants something more than plain text passwords (I know; please don’t ask) - this may fit their requirements. Thanks for the clarification!

---

<div class="post-metadata">

**Author:** ![cruscio](https://avatars.discourse-cdn.com/v4/letter/c/dc4da7/32.png) [@cruscio](https://community.influxdata.com/u/cruscio)\
**Post date:** [November 2, 2017, 11:03pm UTC](https://community.influxdata.com/t/telegraf-tls-client-authentication-in-influxdb-output/2899/4 "2017-11-02T23:03:07Z")

</div>

Hey @daniel, is there a way to use a certificate with a passphrase or does the agent only support a blank passphrase?

---

<div class="post-metadata">

**Author:** ![daniel](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/daniel/32/142_2.png) [@daniel](https://community.influxdata.com/u/daniel)\
**Post date:** [November 7, 2017, 1:23am UTC](https://community.influxdata.com/t/telegraf-tls-client-authentication-in-influxdb-output/2899/5 "2017-11-07T01:23:11Z")

</div>

We only have support for unencrypted keyfiles.