# Prometheus with TLS 'pkcs12' Certificate is not working

**URL:** <https://discuss.prometheus.io/t/prometheus-with-tls-pkcs12-certificate-is-not-working/1003>\
**Category:** Prometheus server\
**Created:** [May 22, 2022, 6:43am UTC](https://discuss.prometheus.io/t/prometheus-with-tls-pkcs12-certificate-is-not-working/1003 "2022-05-22T06:43:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaproma](https://avatars.discourse-cdn.com/v4/letter/k/35a633/32.png) [@kaproma](https://discuss.prometheus.io/u/kaproma)\
**Post date:** [May 22, 2022, 6:43am UTC](https://discuss.prometheus.io/t/prometheus-with-tls-pkcs12-certificate-is-not-working/1003/1 "2022-05-22T06:43:53Z")

</div>

Hello,  
i am new with prometheus and i am trying to monitor my SpringBoot app.  
My SpringBoot app is using selft-signed pkcs12-Zertificate.  
My application.properties:

> server.ssl.key-store=classpath:skylink.p12  
> server.ssl.key-store-password=\*\*\*\*\*\*  
> server.ssl.key-store-type=pkcs12  
> server.ssl.key-aias=linksky  
> server.ssl.key-password=\*\*\*\*\*

So, i have just a skylink.p12 certificate in my ressources-folder.  
And here is my prometheus.yml

> scrape\_configs:
> 
> - job\_name: ‘linksky\_monitoring’  
> scrape\_interval: 2s  
> metrics\_path: ‘/linksky/actuator/prometheus’  
> static\_configs:  
> - targets: [‘host.docker.internal:5550’]  
> scheme: https  
> tls\_config:  
> cert\_file: ‘/etc/prometheus/skylink.p12’  
> insecure\_skip\_verify: true

Although i set ‘scheme: https’ i can see in my prometheus container:

> ts=2022-05-21T21:31:10.245Z caller=tls\_config.go:195 level=info component=web msg="TLS is disabled.

How can i enable TLS?  
Maybe i need “key\_file” in my prometheus.yml also? but i dont have it, i have just created with java-keytool jks-file and p12-file.  
Please help.

---

<div class="post-metadata">

**Author:** ![roidelapluie](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/roidelapluie/32/6_2.png) [@roidelapluie](https://discuss.prometheus.io/u/roidelapluie)\
**Post date:** [May 22, 2022, 10:25am UTC](https://discuss.prometheus.io/t/prometheus-with-tls-pkcs12-certificate-is-not-working/1003/2 "2022-05-22T10:25:17Z")

</div>

You will need to extract the keys from the p12 for Prometheus to use them.

---

<div class="post-metadata">

**Author:** ![kaproma](https://avatars.discourse-cdn.com/v4/letter/k/35a633/32.png) [@kaproma](https://discuss.prometheus.io/u/kaproma)\
**Post date:** [May 24, 2022, 12:59pm UTC](https://discuss.prometheus.io/t/prometheus-with-tls-pkcs12-certificate-is-not-working/1003/3 "2022-05-24T12:59:48Z")

</div>

thx,  
i’ve created my p12 with java’s keytool.  
Now i’ve extracted private key like this:

> openssl pkcs12 -in skylink.p12 -nocerts -out privateKey.pem

and public key:

> openssl pkcs12 -in skylink.p12 -clcerts -nokeys -out publicCert.pem

Now, i have this prometheus-config:

> scrape\_configs:
> 
> - job\_name: ‘linksky\_monitoring’  
> scrape\_interval: 2s  
> metrics\_path: ‘/jReditt/actuator/prometheus’  
> static\_configs:  
> - targets: [‘host.docker.internal:5550’]  
> scheme: https  
> tls\_config:  
> cert\_file: ‘/etc/prometheus/publicCert.pem’  
> key\_file: ‘/etc/prometheus/privateKey.pem’  
> insecure\_skip\_verify: true

and in my prometheus-container i have error like this:

> ts=2022-05-24T12:48:59.880Z caller=main.go:1199 level=info msg=“Completed loading of configuration file” filename=/etc/prometheus/prometheus.yml totalDuration=9.5176ms db\_storage=2.1µs remote\_storage=2.9µs web\_handler=900ns query\_engine=1.8µs scrape=586.1µs scrape\_sd=81.7µs notify=1.6µs notify\_sd=4.1µs rules=2µs tracing=10.4µs  
> ts=2022-05-24T12:48:59.881Z caller=main.go:930 level=info msg=“Server is ready to receive web requests.”  
> ts=2022-05-24T12:49:04.901Z caller=manager.go:200 level= **error component** =“scrape manager” msg=“error creating new scrape pool” err=“ **error creating HTTP client** : unable to use specified client cert (/etc/prometheus/publicCert.pem) & key (/etc/prometheus/privateKey.pem): tls: failed to parse private key” scrape\_pool=linksky\_monitoring

how should i set privateKey.pem and a publicCert.pem?