# TLS between prometheus and node exporters with EC PKI

**URL:** <https://discuss.prometheus.io/t/tls-between-prometheus-and-node-exporters-with-ec-pki/433>\
**Category:** Prometheus server\
**Created:** [August 5, 2021, 12:37pm UTC](https://discuss.prometheus.io/t/tls-between-prometheus-and-node-exporters-with-ec-pki/433 "2021-08-05T12:37:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tumbleweed](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/tumbleweed/32/224_2.png) [@tumbleweed](https://discuss.prometheus.io/u/tumbleweed)\
**Post date:** [August 5, 2021, 12:37pm UTC](https://discuss.prometheus.io/t/tls-between-prometheus-and-node-exporters-with-ec-pki/433/1 "2021-08-05T12:37:14Z")

</div>

I’m using a ECDSA CA for my setup and issue ed25519 certificates for internal TLS endpoints. My CA has these specs:

```auto
        Signature Algorithm: ecdsa-with-SHA512
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: brainpoolP384r1

```

Unfortunately, I couldn’t make TLS work between my node exporters and the prometheus server. The server cannot even load the CA:

```auto
caller=manager.go:188 component="scrape manager" msg="error creating new scrape pool" err="error creating HTTP client: unable to use specified CA cert /etc/prometheus/ca.crt" scrape_pool=qa-metrics-1

```

I guessed that’s due to missing elliptic curve support in the underlying client/runtime, as I’ve seen it before in some java applications. So I temporarily added a RSA CA to my PKI and replaced the certificates on the node exporters and made the prometheus server load the RSA CA with the result that everything works as expected.

Is EC PKI supposed to be working for prometheus? Can I make it work with appropriate configuration? I’m using the official docker container `prom/prometheus`.

---

<div class="post-metadata">

**Author:** ![tumbleweed](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/tumbleweed/32/224_2.png) [@tumbleweed](https://discuss.prometheus.io/u/tumbleweed)\
**Post date:** [March 1, 2022, 3:02pm UTC](https://discuss.prometheus.io/t/tls-between-prometheus-and-node-exporters-with-ec-pki/433/2 "2022-03-01T15:02:49Z")

</div>

Opened a ticket for this now: [Support for elliptic curve cryptography · Issue #10378 · prometheus/prometheus · GitHub](https://github.com/prometheus/prometheus/issues/10378)