PMM Dashboard shows TLS=false despite successful HTTPS configuration

Percona Monitoring and Management (PMM) PMM 3.x
1

Hi,

I have successfully configured my PMM Server to use SSL/TLS certificates. The setup is working correctly - I can view the certificate details in my browser (see attached screenshot).

Following the official documentation, I copied the ca.crt file to my PMM client, adjusted the file permissions, and installed the certificate system-wide as a trusted CA.

When I add a MySQL instance via HTTPS (port 443), the process appears to work without issues:

  • The PMM dashboard shows no errors
  • pmm-admin status displays connection information confirming HTTPS/port 443
  • All agents appear to be communicating successfully

However, in the PMM dashboard under Services/Agents, all MySQL services still show tls=false.

Questions:

  1. Why does the dashboard display tls=false when the actual communication is using HTTPS?
  2. Is this a known display issue, or does it indicate that TLS is not actually being used for data transmission?
  3. Does the tls=false flag refer to the MySQL ↔ PMM Agent connection rather than the PMM PMM Agents ↔ PMM Server connection? Since MySQL also supports TLS connections, could this indicate that the database connection itself is not encrypted?

Configuration details:

  • PMM Server: Docker container with custom SSL certificates
  • PMM Client: Configured with system-wide CA trust
  • Connection: Successfully established via HTTPS on port 443

Any insights would be greatly appreciated!

grafik
grafik822×689 23.3 KB

grafik
grafik1102×431 13.8 KB

grafik
grafik1353×548 77.1 KB

2

Hi, TLS in this case specifies how the mysqld exporter connects to MySQL to get metrics (which is the MySQL ↔ PMM Agent connection you mentioned).

Can you share how the MySQL service was added? Was it via pmm-admin or the PMM UI? And did you select the TLS option?

3

I just used the official documentation via pmm-admin. What are the parameters for tls connection?

Found it:
–tls
–tls-ca=<file_path>
–tls-cert=<file_path>
–tls-key=<file_path>

Thanks for the clarification!