To safeguard inbound communications to your Leader UI and API (default port 9000), enable Transport Layer Security (TLS) on the Leader.

For Cribl.Cloud deployments, TLS is enabled by default and managed automatically. You only need to enable TLS for Leader UI and API in on-prem deployments.

Prerequisites ​

Before you enable TLS for the Leader UI/API, you need a TLS certificate and private key added to Cribl Stream. For details on generating or adding certificates, see Add TLS Certificates and Keys.

Enable TLS for the Leader UI/API ​

After you have a certificate added at Settings > Global > Security > Certificates, enable TLS for the Leader UI/API listener:

1. In the Leader UI, go to Settings > Global > General Settings > API Server Settings > TLS.
2. Toggle Enabled on.
3. In Certificate, select a certificate you’ve added (for example, leader-ui-tls).
4. (Optional) Adjust any additional TLS options as needed (for example, minimum/maximum TLS versions).
5. Select Save.

After you save, the Leader UI/API will start listening on HTTPS. Access the UI/API using: https://<hostname>:<port>/, for example: https://leader.example.com:9000/settings/system.

After enabling TLS, you must prepend https:// to all Cribl Stream URLs on the Leader Node.

Configure TLS via Config Files ​

Most deployments should configure TLS through the UI. Use this method only when you have a clear config-as-code workflow. Avoid ad-hoc manual edits of local config files on running systems; prefer the UI or a consistent automation pipeline that owns these files.

If you manage Cribl Stream via automation (for example, configuration management, containers, or Cribl as Code), you can configure the Leader UI/API listener in cribl.yml.

Example cribl.yml snippet:

api:
  host: 0.0.0.0
  port: 9000
  disabled: false
  ssl:
    disabled: false
    privKeyPath: /path/to/myKey.pem
    certPath: /path/to/myCert.pem

For details on generating and importing certificates and keys used in this example, see Add TLS Certificates and Keys.