Scrape an HTTPS target with Prometheus

Set scheme: https in the scrape job and put only the host and port in targets. The URL path belongs in metrics_path. Configure certificate trust rather than disabling verification for a self-signed or privately issued certificate.

Configure HTTPS and private CA trust

scrape_configs:
  - job_name: https-app
    scheme: https
    metrics_path: /metrics
    static_configs:
      - targets: ['app.example.com:443']
    tls_config:
      ca_file: /etc/prometheus/certs/ca.crt
      # For mutual TLS, also provide a client certificate and key:
      # cert_file: /etc/prometheus/certs/client.crt
      # key_file: /etc/prometheus/certs/client.key

This requests https://app.example.com:443/metrics. Do not put the full URL into a static target address. With a certificate already trusted by the process's system roots, a custom ca_file may be unnecessary. A private CA file must be mounted into the Prometheus runtime, not merely exist on the machine where you edit the YAML.

For mutual TLS, the client certificate identifies Prometheus to the server; the CA file establishes trust in the server. These roles are separate.

Diagnose certificate and protocol errors

Use the correct DNS name when possible. If connecting to an IP while verifying a known DNS identity is intentional, tls_config.server_name can specify that identity; it does not change the address Prometheus connects to. Relabeling __address__ changes the destination and is not a general certificate repair.

insecure_skip_verify: true disables certificate verification. It can isolate a trust problem in a tightly controlled diagnostic test, but it removes server-identity protection and is not the solution for a private CA. Remove it after the test and restore proper trust.

Common questions

Can I alert before a certificate expires? Probe the HTTPS endpoint with Blackbox Exporter. Its probe_ssl_earliest_cert_expiry value is a Unix timestamp, so a days-remaining expression is:

(probe_ssl_earliest_cert_expiry - time()) / 86400

Also monitor probe_success; a failed probe can mean no usable expiry sample. Choose an alert threshold that fits your certificate renewal process.

Is a client certificate sufficient for mTLS? Supply both cert_file and key_file, and separately configure server trust when required. The server must trust the issuing CA for your client certificate.

References

• Prometheus TLS client configuration
• Blackbox Exporter configuration