# Control Center - Enabling HTTPS

**URL:** <https://forum.confluent.io/t/control-center-enabling-https/5259>\
**Category:** Graphical tools\
**Created:** [10 June 2022 04:18 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259 "2022-06-10T04:18:12Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [10 June 2022 04:18 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/1 "2022-06-10T04:18:12Z")

</div>

Hi,

I am using confluent platform local Mac setup.

1. I have followed [GitHub - confluentinc/confluent-platform-security-tools: Security tools for the Confluent Platform.](https://github.com/confluentinc/confluent-platform-security-tools)

In the above mentioned script, I just exported the necessary variables and triggered it, it has created key and trust stores

OR

1. I followed this page [Security Tutorial | Confluent Documentation](https://docs.confluent.io/platform/current/security/security_tutorial.html#generate-the-keys-and-certificates)

Same result as in the first step.

In both attempts, I have added the below properties to `etc/control-center.properties`

```auto
confluent.controlcenter.rest.listeners=https://localhost:9021
confluent.controlcenter.rest.ssl.keystore.location=/Users/gibby/Documents/data/certs
confluent.controlcenter.rest.ssl.keystore.password=abcd12
confluent.controlcenter.rest.ssl.key.password=abcd12
confluent.controlcenter.rest.ssl.truststore.location=/Users/gibby/Documents/data/certs
confluent.controlcenter.rest.ssl.truststore.password=abcd12

```

1. Then I restarted the control center

confluent local services control-center stop confluent local services control-center start

OR

1. I tried restarting the entire platform

confluent local services stop confluent local services start

**Analysis:**

I checked the logs, no error in `control-center.stdout`

I noticed that logs in that file doesn’t have the above mentioned properties under control-center-configs.

```auto
2022-06-09 19:43:41,007] INFO [main] ControlCenterConfig values: 
    auth.bearer.roles.claim = 
    bootstrap.servers = [localhost:9092]
    confluent.controlcenter.alert.cluster.down.autocreate = false
    confluent.controlcenter.alert.cluster.down.send.rate = 12
    confluent.controlcenter.alert.cluster.down.to.email = 
    confluent.controlcenter.alert.cluster.down.to.pagerduty.integrationkey = 
    confluent.controlcenter.alert.cluster.down.to.webhookurl.slack = 
    confluent.controlcenter.alert.max.trigger.events = 1000
    confluent.controlcenter.auth.bearer.issuer = Confluent
    confluent.controlcenter.auth.restricted.roles = []
    confluent.controlcenter.auth.session.expiration.ms = 0
    confluent.controlcenter.broker.config.edit.enable = true
    confluent.controlcenter.command.streams.start.timeout = 300000
    confluent.controlcenter.command.topic = _confluent-command
    confluent.controlcenter.command.topic.replication = 1
    confluent.controlcenter.command.topic.retention.ms = 259200000
    confluent.controlcenter.consumer.metadata.timeout.ms = 15000
    confluent.controlcenter.consumers.view.enable = true
    confluent.controlcenter.data.dir = /var/folders/25/3y752g4x77j_ps4gxz27yy8m0000gn/T/confluent.006186/control-center/data
    confluent.controlcenter.deprecated.views.enable = false
    confluent.controlcenter.disk.skew.warning.min.bytes = 1073741824
    confluent.controlcenter.hostedmonitoring.enable = false
    confluent.controlcenter.id = 1
    confluent.controlcenter.internal.streams.start.timeout = 21600000
    confluent.controlcenter.internal.topics.changelog.segment.bytes = 134217728
    confluent.controlcenter.internal.topics.partitions = 2
    confluent.controlcenter.internal.topics.replication = 1
    confluent.controlcenter.internal.topics.retention.bytes = -1
    confluent.controlcenter.internal.topics.retention.ms = 604800000
    confluent.controlcenter.ksql.enable = true
    confluent.controlcenter.license.manager = _confluent-controlcenter-license-manager-6-2-0
    confluent.controlcenter.license.manager.enable = true
    confluent.controlcenter.mail.bounce.address = 
    confluent.controlcenter.mail.enabled = false
    confluent.controlcenter.mail.from = c3@confluent.io
    confluent.controlcenter.mail.host.name = localhost
    confluent.controlcenter.mail.password = 
    confluent.controlcenter.mail.port = 587
    confluent.controlcenter.mail.ssl.checkserveridentity = false
    confluent.controlcenter.mail.starttls.required = false
    confluent.controlcenter.mail.username = 
    confluent.controlcenter.name = _confluent-controlcenter
    confluent.controlcenter.proactive.support.ui.cta.enable = true
    confluent.controlcenter.purge.stale.cluster.enable = false
    confluent.controlcenter.request.buffer.size.bytes = 10000
    confluent.controlcenter.rest.advertised.url = 
    confluent.controlcenter.rest.compression.enable = true
    confluent.controlcenter.rest.csrf.prevention.enable = false
    confluent.controlcenter.rest.csrf.prevention.token.endpoint = /csrf
    confluent.controlcenter.rest.csrf.prevention.token.expiration.minutes = 30
    confluent.controlcenter.rest.hsts.enable = true
    confluent.controlcenter.rest.port = 9021
    confluent.controlcenter.sbk.ui.enable = true
    confluent.controlcenter.schema.registry.enable = true
    confluent.controlcenter.schema.registry.url = [http://localhost:8081]
    confluent.controlcenter.service.healthcheck.interval.sec = 20
    confluent.controlcenter.streams.cache.max.bytes.buffering = 1073741824
    confluent.controlcenter.streams.consumer.session.timeout.ms = 60000
    confluent.controlcenter.streams.num.stream.threads = 12
    confluent.controlcenter.streams.producer.compression.type = lz4
    confluent.controlcenter.streams.producer.delivery.timeout.ms = 2147483647
    confluent.controlcenter.streams.producer.linger.ms = 500
    confluent.controlcenter.streams.producer.max.block.ms = 9223372036854775807
    confluent.controlcenter.streams.producer.retries = 2147483647
    confluent.controlcenter.streams.producer.retry.backoff.ms = 100
    confluent.controlcenter.streams.retries = 2147483647
    confluent.controlcenter.streams.upgrade.from = 2.3
    confluent.controlcenter.topic.inspection.enable = true
    confluent.controlcenter.trigger.active-controller-count.enable = false
    confluent.controlcenter.ui.autoupdate.enable = false
    confluent.controlcenter.ui.controller.chart.enable = false
    confluent.controlcenter.ui.data.expired.threshold = 120
    confluent.controlcenter.ui.replicator.monitoring.enable = true
    confluent.controlcenter.usage.data.collection.enable = true
    confluent.controlcenter.webhook.enabled = true
    confluent.license = 
    confluent.metadata.basic.auth.user.info = [hidden]
    confluent.metadata.bootstrap.server.urls = []
    confluent.metadata.cluster.registry.enable = false
    confluent.metadata.cluster.registry.merge.configuration.enable = true
    confluent.metrics.topic = _confluent-metrics
    confluent.metrics.topic.config.validate = false
    confluent.metrics.topic.max.message.bytes = 10485760
    confluent.metrics.topic.partitions = 12
    confluent.metrics.topic.replication = 1
    confluent.metrics.topic.retention.bytes = -1
    confluent.metrics.topic.retention.ms = 259200000
    confluent.metrics.topic.skip.backlog.minutes = 15
    confluent.monitoring.interceptor.topic = _confluent-monitoring
    confluent.monitoring.interceptor.topic.config.validate = false
    confluent.monitoring.interceptor.topic.partitions = 2
    confluent.monitoring.interceptor.topic.replication = 1
    confluent.monitoring.interceptor.topic.retention.bytes = -1
    confluent.monitoring.interceptor.topic.retention.ms = 259200000
    confluent.monitoring.interceptor.topic.skip.backlog.minutes = 15
    confluent.support.metrics.enable = true
    confluent.support.metrics.segment.id = MORqDG61F2eE5mfxAXVqpEblmFG18nbv
    public.key.path = 
    zookeeper.connect = localhost:2181
 (io.confluent.controlcenter.ControlCenterConfig)

```

But I see SSL related configs under AdminClientConfig but not control-centre-rest related.

**Goal:** I am just trying to get https for Control Center. What am I missing here?

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [10 June 2022 05:50 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/2 "2022-06-10T05:50:36Z")

</div>

Hi @gibby

welcome 🙂

one question did you follow the following to install?

> **[Quick Start for Confluent Platform | Confluent Documentation](https://docs.confluent.io/platform/current/quickstart/ce-docker-quickstart.html#quick-start-for-cp)**
>
> Install Confluent and build a real-time Kafka app with streaming data and SQL.

just to understand your starting point.  
what does

```auto
confluent local services status

```

say?

best,  
michael

---

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [10 June 2022 05:53 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/3 "2022-06-10T05:53:15Z")

</div>

Hi,

REST is down, could that be the reason?

```auto
gopir-mac-1:confluent-6.2.0 gopir$ confluent local services status

The local commands are intended for a single-node development environment only,

NOT for production usage. https://docs.confluent.io/current/cli/index.html

Using CONFLUENT_CURRENT: /var/folders/25/3y752g4x77j_ps4gxz27yy8m0000gn/T/confluent.006186

Connect is [UP]

Control Center is [UP]

Kafka is [UP]

Kafka REST is [DOWN]

ksqlDB Server is [UP]

Schema Registry is [UP]

ZooKeeper is [UP]

```

Thanks for your time,  
Gopi.

---

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [10 June 2022 05:56 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/4 "2022-06-10T05:56:52Z")

</div>

I have downloaded confluent-platform 6.2.0 from archives

Started all the services, added mongo-sink connector, produced and consumed 10k+ events.

Thought of exploring SSL/TLS for C3, ended up with the above error. Default logging is enabled for all services, So I could see only INFO+ messages not DEBUG.

---

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [10 June 2022 06:00 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/5 "2022-06-10T06:00:23Z")

</div>

I did the below, REST is UP now.

```auto
confluent local services kafka-rest status

The local commands are intended for a single-node development environment only,

NOT for production usage. https://docs.confluent.io/current/cli/index.html

Using CONFLUENT_CURRENT: /var/folders/25/3y752g4x77j_ps4gxz27yy8m0000gn/T/confluent.006186

Kafka REST is [DOWN]

confluent local services kafka-rest start

The local commands are intended for a single-node development environment only,

NOT for production usage. https://docs.confluent.io/current/cli/index.html

```

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [10 June 2022 06:59 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/6 "2022-06-10T06:59:28Z")

</div>

thanks for providing the details

so just to be sure:  
you would like to make the control center available via tls/https ?  
but no interbroker tls encryption, right?

best,  
michael

---

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [10 June 2022 10:06 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/7 "2022-06-10T10:06:45Z")

</div>

Yes, You are correct. Only HTTPS for C3, No inter broker encryption.

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [10 June 2022 13:16 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/8 "2022-06-10T13:16:21Z")

</div>

ok I see

you changed the config in /etc/kafka/ right?

I think you have to change the conf in  
`/var/folders/25/3y752g4x77j_ps4gxz27yy8m0000gn/T/confluent.006186/`

there should be a subfolder called `control-center` and there should reside a field `control-center.properties`

best,  
michael

---

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [10 June 2022 15:12 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/9 "2022-06-10T15:12:06Z")

</div>

Hi,

Yes, I changed in /etc/kafka.

But the below attempt works

1. modify etc/control-center-dev.properties not control-center.properties
2. When you restart the service, this property file is placed in /var/… folder

Thanks @mmuehlbeyer for your hint.

It shows that certificate is invalid, considers it as self-signed one. But it shows as below when I see it in the browser for certificate details

```auto
Self-signed root certificate
The certificate has not been verified by a third party

```

Kindly shed some light on this.

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [13 June 2022 05:52 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/10 "2022-06-13T05:52:52Z")

</div>

hi @gibby

I think the warning/error message is exptected as its a self signed cert.

are you able to start control center ui?

best,  
michael

---

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [13 June 2022 10:20 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/11 "2022-06-13T10:20:01Z")

</div>

Hi @mmuehlbeyer

Yes, it works as expected. But there is that self-signed cert warning. Is it ok to go to production with this warning in the private network or should I go for other mechanisms like GSSAPI?  
Kindly suggest.

Thanks.

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [13 June 2022 12:15 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/12 "2022-06-13T12:15:27Z")

</div>

Hi @gibby

I would recommend to sign the certificate by your internal CA.

best,  
michael

---

<div class="post-metadata">

**Author:** ![gibby](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@gibby](https://forum.confluent.io/u/gibby)\
**Post date:** [13 June 2022 13:07 UTC](https://forum.confluent.io/t/control-center-enabling-https/5259/13 "2022-06-13T13:07:06Z")

</div>

Thanks @mmuehlbeyer

It helps.