# CMF 2.4.2 Unable to Access Flink Web UI over TLS (HTTPS) / Redirected to Internal Kubernetes URL

**URL:** <https://forum.confluent.io/t/cmf-2-4-2-unable-to-access-flink-web-ui-over-tls-https-redirected-to-internal-kubernetes-url/38524>\
**Category:** Apache Flink®\
**Created:** [7 October 2026 16:47 UTC](https://forum.confluent.io/t/cmf-2-4-2-unable-to-access-flink-web-ui-over-tls-https-redirected-to-internal-kubernetes-url/38524 "2026-10-07T16:47:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TinyToons](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/tinytoons/32/5301_2.png) [@TinyToons](https://forum.confluent.io/u/TinyToons)\
**Post date:** [7 October 2026 16:47 UTC](https://forum.confluent.io/t/cmf-2-4-2-unable-to-access-flink-web-ui-over-tls-https-redirected-to-internal-kubernetes-url/38524/1 "2026-10-07T16:47:53Z")

</div>

Hi

I’m having an issue accessing the Flink Web UI when both **CMF** and the **Flink cluster** are secured with **TLS (P-256 certificates)**.

It looks like CMF is not correctly proxying the Flink Web UI and redirects users to the Flink cluster’s internal Kubernetes URL, which is not reachable from the browser.

### Issue Description

When I click on the **Flink Dashboard** from the CMF UI, the following URL is opened:

```plaintext
http://localhost:30080/cmf/api/v1/environments/flink-report-local-test-env/applications/basic-example-tls/flink-web-ui/#/overview

```

CMF then redirects the browser to:

```plaintext
https://basic-example-tls.flink-report-local-test:8081/#/overview

```

This is the internal Kubernetes DNS name of the Flink cluster, so the browser cannot resolve or connect to it.

### CLI Behavior

I also tried using the Confluent CLI:

```bash
confluent flink application web-ui-forward basic-example-tls \
  --environment flink-report-local-test-env \
  --port 8081 \
  --url https://localhost:30080 \
  --certificate-authority-path ./ca.crt

```

Output:

```plaintext
Starting web UI at http://localhost:8081/ ... (Press Ctrl-C to stop)

```

However, opening:

```plaintext
http://localhost:8081

```

results in the same redirect:

```plaintext
https://basic-example-tls.flink-report-local-test:8081

```

### What Works

If I bypass CMF completely and port-forward the Flink REST service directly:

```bash
kubectl -n flink-report-local-test port-forward svc/basic-example-tls-rest 8081:8081

```

Output:

```plaintext
Forwarding from 127.0.0.1:8081 -> 8081
Forwarding from \[::1\]:8081 -> 8081

```

I can successfully access the Flink Dashboard at:

```plaintext
https://localhost:8081

```

without any issue.

### Question

Has anyone encountered this behavior before?

Is there any known limitation or configuration required when using **TLS-enabled Flink clusters with CMF**?

More specifically:

- Is CMF expected to proxy HTTPS traffic to the Flink Web UI?
- Why is the browser being redirected to the internal Kubernetes URL instead of staying behind the CMF/CLI proxy?
- Are there specific Flink or CMF settings required when TLS is enabled on the Flink REST endpoint?

### Environment

- CMF 2.4.2
- Flink Image Version: v2\_0
- CMF secured with TLS (P-256)
- Flink secured with TLS (P-256)

Any troubleshooting tips or guidance would be greatly appreciated.

Thanks in advance!

> **Disclaimer:**  
> I used an AI assistant to help structure and refine this post. The issue, observations, commands, and test results described above come from my own environment.

---

<div class="post-metadata">

**Author:** ![rmetzger](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@rmetzger](https://forum.confluent.io/u/rmetzger)\
**Post date:** [12 October 2026 12:15 UTC](https://forum.confluent.io/t/cmf-2-4-2-unable-to-access-flink-web-ui-over-tls-https-redirected-to-internal-kubernetes-url/38524/2 "2026-10-12T12:15:37Z")

</div>

Thanks for this report – we are looking into it.

---

<div class="post-metadata">

**Author:** ![rmetzger](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@rmetzger](https://forum.confluent.io/u/rmetzger)\
**Post date:** [12 October 2026 12:35 UTC](https://forum.confluent.io/t/cmf-2-4-2-unable-to-access-flink-web-ui-over-tls-https-redirected-to-internal-kubernetes-url/38524/3 "2026-10-12T12:35:01Z")

</div>

This is a known limitation in CMF: We don’t support the Flink UI forwarding when `security.ssl.rest.enabled: true`.

`security.ssl.internal.enabled: true` should work.

We can add an initial implementation / fix for this into the upcoming CP Flink 2.5 release by allowing to configure a single, CMF-wide truststore and client keystore. This is similar to what Flink kubernetes operator does already (which I assume you have configured accordingly). Would that fix work for you?  
If this is a blocker, we can provide you a private preview image of CMF that fixes this issue.

---

<div class="post-metadata">

**Author:** ![TinyToons](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/tinytoons/32/5301_2.png) [@TinyToons](https://forum.confluent.io/u/TinyToons)\
**Post date:** [12 October 2026 14:22 UTC](https://forum.confluent.io/t/cmf-2-4-2-unable-to-access-flink-web-ui-over-tls-https-redirected-to-internal-kubernetes-url/38524/4 "2026-10-12T14:22:46Z")

</div>

Hello,  
Thank you for your response. The proposed fix looks good to me. As this is not a blocking issue, we can wait until the next CP Flink release.