--- title: Configure TLS for Telegraf plugins description: 'Reference for the standard TLS options that Telegraf plugins provide: client and server certificate configuration, mutual TLS, cipher suites, and TLS version constraints.' url: https://docs.influxdata.com/telegraf/v1/configuration/tls/ estimated_tokens: 1419 product: Telegraf Enterprise version: v1 publisher: InfluxData canonical: https://docs.influxdata.com/telegraf/v1/configuration/tls/ date: '2026-08-11T17:09:40-06:00' lastmod: '2026-08-11T17:09:40-06:00' --- Telegraf standardizes TLS options across plugins. Plugins that support TLS provide the standard settings on this page. Each plugin’s sample configuration shows which settings apply. Client settings appear on plugins that connect out to services, and server settings appear on plugins that listen for connections. Each setting lists its data type and default value. * [Client configuration](#client-configuration) * [tls\_enable](#tls_enable) * [tls\_ca](#tls_ca) * [tls\_cert](#tls_cert) * [tls\_key](#tls_key) * [tls\_key\_pwd](#tls_key_pwd) * [insecure\_skip\_verify](#insecure_skip_verify) * [tls\_server\_name](#tls_server_name) * [Server configuration](#server-configuration) * [tls\_allowed\_cacerts](#tls_allowed_cacerts) * [tls\_allowed\_dns\_names](#tls_allowed_dns_names) * [Advanced configuration](#advanced-configuration) * [tls\_cipher\_suites](#tls_cipher_suites) * [tls\_min\_version](#tls_min_version) * [tls\_max\_version](#tls_max_version) * [Supported cipher suites](#supported-cipher-suites) * [Supported TLS versions](#supported-tls-versions) ## Client configuration ```toml [[inputs.http]] urls = ["https://server.company.org/metrics"] tls_ca = "/etc/telegraf/ca.pem" tls_cert = "/etc/telegraf/cert.pem" tls_key = "/etc/telegraf/key.pem" ``` ### tls\_enable Enforces TLS on or off for the connection. **Type:** boolean **Default:** Not set. TLS is enabled if any other TLS option is set. ### tls\_ca Path to the root certificates used to verify server certificates, encoded in PEM format. **Type:** string **Default:** Not set. The system certificate pool is used. ### tls\_cert Path to the PEM-encoded public certificate. On client plugins, this is the client certificate. On server plugins, this is the service certificate. May contain intermediate certificates. **Type:** string **Default:** Not set ### tls\_key Path to the PEM-encoded private key that pairs with `tls_cert`. **Type:** string **Default:** Not set ### tls\_key\_pwd Passphrase for an encrypted private key in PKCS#8 format. Encrypted PKCS#1 private keys are not supported. **Type:** string **Default:** Not set ### insecure\_skip\_verify Skips verification of the server’s certificate chain and host name. Use only for testing. Skipping verification makes the connection vulnerable to machine-in-the-middle attacks. **Type:** boolean **Default:** `false` ### tls\_server\_name Sends the specified server name via the TLS Server Name Indication (SNI) extension instead of the name derived from the connection address. **Type:** string **Default:** Not set ## Server configuration Server plugins support TLS mutual authentication in addition to the shared[`tls_cert`](#tls_cert), [`tls_key`](#tls_key), and[`tls_key_pwd`](#tls_key_pwd) settings: ```toml [[inputs.http_listener_v2]] service_address = ":9443" tls_cert = "/etc/telegraf/cert.pem" tls_key = "/etc/telegraf/key.pem" tls_allowed_cacerts = ["/etc/telegraf/clientca.pem"] ``` ### tls\_allowed\_cacerts Paths to one or more allowed client CA certificate files. Setting this enables mutually authenticated TLS. Incoming client certificates must be signed by one of these CAs. **Type:** array of strings **Default:** Not set. Client certificates aren’t required. ### tls\_allowed\_dns\_names Allowed DNS names for verifying incoming client certificates. Telegraf checks each subject alternative name (SAN) in the certificate and accepts the request if any of them matches. **Type:** array of strings **Default:** Not set ## Advanced configuration Plugins that use the standard server configuration also support the following settings. They aren’t included in sample configurations for brevity. ### tls\_cipher\_suites The list of allowed cipher suites. See[Supported cipher suites](#supported-cipher-suites). **Type:** array of strings **Default:** Not set. The default ciphers supported by Go are used. ### tls\_min\_version The minimum acceptable TLS version. See[Supported TLS versions](#supported-tls-versions). **Type:** string **Default:** `"TLS12"` ### tls\_max\_version The maximum acceptable TLS version. See[Supported TLS versions](#supported-tls-versions). **Type:** string **Default:** Not set. The maximum version supported by Go is used. ## Supported cipher suites Use the following values with [`tls_cipher_suites`](#tls_cipher_suites): * `TLS_RSA_WITH_RC4_128_SHA` * `TLS_RSA_WITH_3DES_EDE_CBC_SHA` * `TLS_RSA_WITH_AES_128_CBC_SHA` * `TLS_RSA_WITH_AES_256_CBC_SHA` * `TLS_RSA_WITH_AES_128_CBC_SHA256` * `TLS_RSA_WITH_AES_128_GCM_SHA256` * `TLS_RSA_WITH_AES_256_GCM_SHA384` * `TLS_ECDHE_ECDSA_WITH_RC4_128_SHA` * `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA` * `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA` * `TLS_ECDHE_RSA_WITH_RC4_128_SHA` * `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA` * `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` * `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` * `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256` * `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256` * `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` * `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` * `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` * `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` * `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` * `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` * `TLS_AES_128_GCM_SHA256` * `TLS_AES_256_GCM_SHA384` * `TLS_CHACHA20_POLY1305_SHA256` ## Supported TLS versions Use the following values with [`tls_min_version`](#tls_min_version) or[`tls_max_version`](#tls_max_version): * `TLS10` * `TLS11` * `TLS12` * `TLS13` #### Related * [Use secrets in Telegraf configurations](/telegraf/v1/configuration/secrets/) * [Plugin directory](/telegraf/v1/plugins/)