Merge ~freyes/charm-grafana:bug/1872682 into charm-grafana:master

[Felipe Reyes]

Add tls-client layer to support HTTPS

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Felipe Reyes (freyes)]

I've been trying to run the full functional tests (make functional) without success, I'm getting consistently the following error now:

unit-prometheus-0: 15:56:11 WARNING unit.prometheus/0.install subprocess.CalledProcessError: Command '['snap', 'refresh', '--amend', '--channel=stable', 'core']' returned non-zero exit status 1.

a few hours ago the charmstore was giving "error 500" for certain charms (e.g. easyrsa). I will post the results here once I get to full successful run.

[Drew Freiberger (afreiberger)]

we very much have had that problem throughout the release cycle. it's just a poke and hope game until snapstore does the right thing.

[Felipe Reyes (freyes)]

I was running the functional test suite and got into this race condition:

2021-02-11 20:32:54 INFO juju-log certificates:21: Restarting grafana-server
2021-02-11 20:32:54 INFO juju-log certificates:21: Invoking reactive handler: reactive/grafana.py:625:configure_sources
2021-02-11 20:32:54 INFO juju-log certificates:21: Found datasource: {'service_name': 'prometheus', 'type': 'prometheus', 'url': 'http://10.5.0.99:9090', 'description': 'Juju generated source
'}
2021-02-11 20:32:54 INFO juju-log certificates:21: Datasource already exist, updating: prometheus - Juju generated source
2021-02-11 20:32:54 ERROR juju-log certificates:21: Hook error:
...
urllib3.exceptions.NewConnectionError: <urllib3.connection.HTTPSConnection object at 0x7f5e101bcca0>: Failed to establish a new connection: [Errno 111] Connection refused
...
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='127.0.0.1', port=3000): Max retries exceeded with url: /api/search?type=dash-db (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f5e101bcca0>: Failed to establish a new connection: [Errno 111] Connection refused'))

So it seems that the restart of the service is not blocking until it's available to serve requests. I will propose a different patch to improve this.

[Alvaro Uria (aluria)]

Please find a comment inline (re: tls_client.certs.changed decorated handler). Other than that, code review looks good. I'll run all tests and share the output here.

[Alvaro Uria (aluria)]

* make lint failed with:
./tests/unit/test_grafana.py:161:1: D102 Missing docstring in public method

* make unittests failed with:
tests/unit/test_grafana.py::GrafanaTestCase::test_request_certificate FAILED

See output at: https://pastebin.ubuntu.com/p/KsMPg5gHMm/

* make functional failed on the first bundle (tests/bundles/focal.yaml)
2021-03-19 07:31:39 [ERROR] unit-grafana-0.log: 2021-03-19 07:31:37 WARNING install Exception: port 3000 is closed

[Alvaro Uria (aluria)]

Added comment inline re: retry_on_exception not having a delay

review: Needs Fixing

[Felipe Reyes (freyes)]

On Fri, 2021-03-19 at 08:29 +0000, Alvaro Uria wrote:
> * make lint failed with:
> ./tests/unit/test_grafana.py:161:1: D102 Missing docstring in public
> method
>
> * make unittests failed with:
> tests/unit/test_grafana.py::GrafanaTestCase::test_request_certificate
> FAILED
>
> See output at: https://pastebin.ubuntu.com/p/KsMPg5gHMm/
>
> * make functional failed on the first bundle
> (tests/bundles/focal.yaml)
> 2021-03-19 07:31:39 [ERROR] unit-grafana-0.log: 2021-03-19 07:31:37
> WARNING install Exception: port 3000 is closed

This failure happens because there was no base_delay as you pointed out
in the retry_on_exception().

>
--
Felipe Reyes
Software Sustaining Engineer @ Canonical
# Email: <email address hidden> (GPG:0x9B1FFF39)
# Launchpad: ~freyes | IRC: freyes

[Felipe Reyes (freyes)]

Hi Alvaro, I just pushed a new version of the patch. make lint/unittests are OK, I'm running make functional now, but it will take a while :-) . Thanks for reviewing my patch.

[Felipe Reyes (freyes)]

Has anyone been able to run a successful run of grafana functional testing recently?, not necessarily with this patch, but in general, I get different issues all the time (snap store, or the charm store, or stsstack, or just juju timing out)

[Xav Paice (xavpaice)]

Functest run from the candidate/21.04 branch (a copy of master at the time of writing) https://pastebin.canonical.com/p/j8VxbzYNvc/ -> passed for the first bundle. Because I'm using Openstack as a cloud for the tests, latest versions of Zaza require python-openstackclient in order to complete the teardown of the model, and that means my tests only run for the first bundle. I'll look at a separate fix for this (for any of the charms running zaza) and then we can re-test here.

Tests on this branch also passed functests on my environment for the first bundle, however there are a LOT of test runs to complete for this and without automation of the tests this will cause a delay since we're locked into a release cycle right now.

Once this is reviewed and merged to master, it'll be available on cs:~llama-charmers-next/openstack-service-checks in any case.

[Xav Paice (xavpaice)]

Functest failed with:

2021-04-13 10:53:55 [ERROR] {'model_apt_install': 'zaza-2010f9813ac7'}
2021-04-13 10:53:55 [ERROR] Model model_apt_install (zaza-2010f9813ac7)
Traceback (most recent call last):
  File "/home/xav/charms/charm-grafana/src/.tox/func/bin/functest-run-suite", line 8, in <module>
    sys.exit(main())
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/charm_lifecycle/func_test_runner.py", line 308, in main
    func_test_runner(
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/charm_lifecycle/func_test_runner.py", line 242, in func_test_runner
    run_env_deployment(env_deployment, keep_model=preserve_model,
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/charm_lifecycle/func_test_runner.py", line 122, in run_env_deployment
    deploy.deploy(
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/charm_lifecycle/deploy.py", line 385, in deploy
    zaza.model.wait_for_application_states(
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/__init__.py", line 77, in _wrapper
    return run(_run_it())
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/__init__.py", line 62, in run
    return task.result()
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/__init__.py", line 76, in _run_it
    return await f(*args, **kwargs)
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/zaza/model.py", line 1167, in async_wait_for_application_states
    await model.block_until(
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/juju/model.py", line 727, in block_until
    await utils.block_until(done,
  File "/home/xav/charms/charm-grafana/src/.tox/func/lib/python3.8/site-packages/juju/utils.py", line 87, in block_until
    await asyncio.wait_for(_block(), timeout, loop=loop)
  File "/usr/lib/python3.8/asyncio/tasks.py", line 490, in wait_for
    raise exceptions.TimeoutError()
asyncio.exceptions.TimeoutError

Bundle it was deploying: src/tests/functional/tests/bundles/focal-tls.yaml

[Liam Young (gnuoy)]

I've raised a PR against freyes's branch which includes fixes to the TimeoutError mentioned in the previous comment and the dependency on OpenStack clients mentioned before that.

https://code.launchpad.net/~gnuoy/charm-grafana/+git/charm-grafana/+merge/404961

[James Troup (elmo)]

Marking this as rejected to get it out of the review queue. The work done on this branch landed with Liam's MP. Thanks Felipe and Liam!

[Felipe Reyes (freyes)]

Hi James, if by "Liam's MP" you mean https://code.launchpad.net/~gnuoy/charm-grafana/+git/charm-grafana/+merge/404961 , that one was proposed for merge in my branch[0] and it's already merged. My branch was just rebased and pushed it for review.

Is there some other MP in flight or pending to be created and I'm confusing things?

Best,

PS: I'm running "make functional"at the moment, still running, but not failures so far[1]

[0]Proposed branch: ~gnuoy/charm-grafana:bug/1872682-fixes
Merge into: ~freyes/charm-grafana:bug/1872682

[1] $ grep "Deploying bundle" functional.log
2021-08-04 23:03:50 [INFO] Deploying bundle '/home/freyes/Projects/charms/grafana-charm/src/tests/functional/tests/bundles/focal.yaml' on to 'zaza-985edaed9dda' model
2021-08-04 23:27:32 [INFO] Deploying bundle '/home/freyes/Projects/charms/grafana-charm/src/tests/functional/tests/bundles/focal-tls.yaml' on to 'zaza-4fa38806714d' model
2021-08-04 23:51:24 [INFO] Deploying bundle '/home/freyes/Projects/charms/grafana-charm/src/tests/functional/tests/bundles/bionic.yaml' on to 'zaza-7c7752252403' model
2021-08-05 00:14:42 [INFO] Deploying bundle '/home/freyes/Projects/charms/grafana-charm/src/tests/functional/tests/bundles/bionic-tls.yaml' on to 'zaza-763edc3c044f' model
2021-08-05 00:35:21 [INFO] Deploying bundle '/home/freyes/Projects/charms/grafana-charm/src/tests/functional/tests/bundles/xenial.yaml' on to 'zaza-4ed0f8e6798e' model
2021-08-05 00:57:14 [INFO] Deploying bundle '/home/freyes/Projects/charms/grafana-charm/src/tests/functional/tests/bundles/xenial-tls.yaml' on to 'zaza-e26f68ffd00e' model

[Liam Young (gnuoy)]

Looks like src/tox.ini needs fixing

review: Needs Fixing

[Felipe Reyes (freyes)]

Weird, I'm not seeing that merge conflict locally, will give it a try in a fresh git clone.

re: functional tests, they were running fine, but due to a networking issue the full run couldn't complete - https://paste.ubuntu.com/p/3wvHsZsg8f/ - running again from a different node to avoid relying on the VPN.

[Felipe Reyes (freyes)]

This is merge of my branch into master -> https://paste.ubuntu.com/p/QHqcTykB8t/ , I don't see changes to src/tox.ini (nor merge conflicts), the change that is showing Launchpad existed in a previous version of the patch (before the rebase I did yesterday), so I wonder if there is a caching issue since this Merge Proposal is in "rejected" state.

ubuntu@freyes-bastion:~$ git clone -b master https://git.launchpad.net/charm-grafana
Cloning into 'charm-grafana'...
remote: Enumerating objects: 1757, done.
remote: Counting objects: 100% (1757/1757), done.
remote: Compressing objects: 100% (1009/1009), done.
remote: Total 1757 (delta 882), reused 902 (delta 469)
Receiving objects: 100% (1757/1757), 309.80 KiB | 433.00 KiB/s, done.
Resolving deltas: 100% (882/882), done.
ubuntu@freyes-bastion:~$ cd charm-grafana/
ubuntu@freyes-bastion:~/charm-grafana$ git remote -v
origin https://git.launchpad.net/charm-grafana (fetch)
origin https://git.launchpad.net/charm-grafana (push)
ubuntu@freyes-bastion:~/charm-grafana$ git remote add freyes https://git.launchpad.net/~freyes/charm-grafana
ubuntu@freyes-bastion:~/charm-grafana$ git fetch freyes
remote: Enumerating objects: 84, done.
remote: Counting objects: 100% (84/84), done.
 * [new branch] bug/1872682 -> freyes/bug/1872682
 * [new branch] bug/1893137 -> freyes/bug/1893137
ubuntu@freyes-bastion:~/charm-grafana$ git checkout -b bug/1872682 --track freyes/bug/1872682
Branch 'bug/1872682' set up to track remote branch 'bug/1872682' from 'freyes'.
Switched to a new branch 'bug/1872682'
ubuntu@freyes-bastion:~/charm-grafana$ git branch
* bug/1872682
  master
ubuntu@freyes-bastion:~/charm-grafana$ git merge --no-ff --no-commit bug/1872682
Already up to date.
ubuntu@freyes-bastion:~/charm-grafana$ git status
On branch bug/1872682
Your branch is up to date with 'freyes/bug/1872682'.

nothing to commit, working tree clean
ubuntu@freyes-bastion:~/charm-grafana$ git checkout master
Switched to branch 'master'
Your branch is up to date with 'origin/master'.
ubuntu@freyes-bastion:~/charm-grafana$ git merge --no-ff --no-commit bug/1872682
Automatic merge went well; stopped before committing as requested
ubuntu@freyes-bastion:~/charm-grafana$ git status
On branch master
Your branch is up to date with 'origin/master'.

All conflicts fixed but you are still merging.
  (use "git commit" to conclude merge)

Changes to be committed:
        modified: src/actions/create-user
        modified: src/files/dashboards_backup
        modified: src/layer.yaml
        modified: src/lib/charms/layer/grafana.py
        modified: src/reactive/grafana.py
        modified: src/requirements.txt
        modified: src/templates/grafana.ini.j2
        modified: src/templates/juju-dashboards-backup.j2
        new file: src/templates/sync-grafana-snap
        new file: src/tests/functional/tests/bundles/bionic-snap-tls.yaml
        new file: src/tests/functional/tests/bundles/bionic-tls.yaml
        new file: src/tests/functional/tests/bundles/focal-snap-tls.yaml
        new file: src/tests/functional/tests/bundles/focal-tls.yaml
        new file: src/tests/functional/tests/bundles/overlays/bionic-snap...

[Felipe Reyes (freyes)]

I could get a full run of "make functional" succeed, to achieve this I had to fix a race condition on the test_13_grafana_dashboard_backup()[0] test.

summary of the tests execution:

2021-08-06 02:37:18 [INFO] Events:
  Deploy Bundle:
    Start: 1628230469.9741626
    Finish: 1628230580.8524628
    Elapsed Time: 110.87830018997192
    PCT Of Run Time: 2
  Prepare Environment:
    Start: 1628230458.4041638
    Finish: 1628230469.9739351
    Elapsed Time: 11.56977128982544
    PCT Of Run Time: 1
  Test tests.test_grafana.AptGrafanaTest:
    Start: 1628231751.6462507
    Finish: 1628231776.0118518
    Elapsed Time: 24.365601062774658
    PCT Of Run Time: 1
  Test tests.test_grafana.CharmOperationTest:
    Start: 1628231214.4372096
    Finish: 1628231751.6461709
    Elapsed Time: 537.2089612483978
    PCT Of Run Time: 6
  Test tests.test_grafana.SnappedGrafanaTest:
    Start: 1628222783.1681652
    Finish: 1628222887.3098197
    Elapsed Time: 104.14165449142456
    PCT Of Run Time: 2
  Wait for Deployment:
    Start: 1628230580.8525686
    Finish: 1628231212.1852653
    Elapsed Time: 631.3326966762543
    PCT Of Run Time: 8
Metadata: {}

Full output can be found at https://paste.ubuntu.com/p/79nwNB6TKr/

[0] https://git.launchpad.net/~freyes/charm-grafana/commit/?id=229263cbaf7ddc85d1f84a34c15dfed1c5e547a4

[Felipe Reyes (freyes)]

I will re-submit my proposal, the commit ids shown in the "unmerged commits" are invalid

Unmerged commits in Launchpad

6e52a25... by Liam Young on 2021-06-30 Use easyrsa on bionic for xenial tests
5ca8ed8... by Liam Young on 2021-06-30 Bug fixes for enabling TLS
4c7b77b... by Felipe Reyes on 2021-02-05 Add tls-client layer to support HTTPS

versus

$ git log --oneline
229263c (HEAD -> bug/1872682, freyes/bug/1872682) Wait until /etc/cron.d/juju-dashboards-backup appears
817ed45 Replace assertTrue with assertIn, assertNotIn and assertEqual
7108c49 Use easyrsa on bionic for xenial tests
ef9711e Bug fixes for enabling TLS
c9d57f8 Add tls-client layer to support HTTPS

Unmerged commits

6e52a25... by Liam Young on 2021-06-30

Use easyrsa on bionic for xenial tests

Use easyrsa on bionic for xenial tests as easyrsa is currently
failing to install on xenial.

5ca8ed8... by Liam Young on 2021-06-30

Bug fixes for enabling TLS

* Update create-user action to work with https
* Update backup to work with https
* Update functional test requirements to work-around zaza bug *1
* Update tests.yaml to expect easyrsa to come up with a workload
  status message of 'Certificate Authority connected.'
* Do not use f strings as the charm needs to run on xenial.

*1 https://github.com/openstack-charmers/zaza/issues/452

4c7b77b... by Felipe Reyes on 2021-02-05

Add tls-client layer to support HTTPS

This patch adds a new interface provided by the tls-client later. When related
to a certificates provider (e.g. EasyRSA) it will configure the daemon to
serve over HTTPS.

Fixes-Bug: #1893137

diff --git a/src/actions/create-user b/src/actions/create-user
index ab9f96c..916534c 100755
--- a/src/actions/create-user
+++ b/src/actions/create-user
@@ -12,18 +12,24 @@ from charmhelpers.core.hookenv import (
     log,
 )
 
-from charms.layer.grafana import get_admin_password
+from charms.layer.grafana import (
+    get_admin_password,
+    get_protocol,
+)
 
 action = "create-user"
 
 admin_passwd = get_admin_password()
 
+# Talking to ourselves on localhost so don't worry about CAs
+verify_ca = False
+
 if admin_passwd is None:
     action_fail('Unable to retrieve password.')
     sys.exit(0)
 
 port = config('port')
-grafana = "http://localhost:%s" % (port)
+grafana = "{}://localhost:{}".format(get_protocol(), port)
 api_auth = ('admin', admin_passwd)
 
 # http://docs.grafana.org/http_api/admin/#global-users
@@ -57,13 +63,13 @@ user_data = {
 headers = {'Content-Type': 'application/json'}
 
 grafana_api_create_user_url = grafana + api_create_user_url
-
 if requests.utils.urlparse(grafana_api_create_user_url).scheme:
     r_create = requests.post(
         grafana_api_create_user_url,
         auth=api_auth,
         headers=headers,
-        data=json.dumps(user_data)
+        data=json.dumps(user_data),
+        verify=verify_ca,
     )
 else:
     action_fail("Grafana url %s failed to parse!" % (grafana_api_create_user_url))
@@ -90,7 +96,8 @@ grafana_api_org_url = grafana + api_org_url
 if requests.utils.urlparse(grafana_api_org_url).scheme:
     r_org = requests.get(
         grafana_api_org_url,
-        auth=api_auth
+        auth=api_auth,
+        verify=verify_ca
     )
 else:
     action_fail("Grafana url %s failed to parse" % (grafana_api_org_url))
@@ -108,7 +115,8 @@ if r_org.status_code == 200:
             grafana_api_org_user_url,
             auth=api_auth,
             headers=headers,
-            data=json.dumps(org_user_data)
+            data=json.dumps(org_user_data),
+            verify=verify_ca
         )
     else:
         action_fail("Grafana url %s failed to parse" % (grafana_api_org_user_url))
diff --git a/src/files/dashboards_backup b/src/files/dashboards_backup
index 30299a2..88c6310 100755
--- a/src/files/dashboards_backup
+++ b/src/files/dashboards_backup
@@ -18,7 +18,7 @@ def get_backup_filename(directory, org_name, uri):
 
 
 def main(args):
-    base_url = 'http://localhost:{port}/api/'.format(port=args.port)
+    base_url = '{scheme}://localhost:{port}/api/'.format(scheme=args.scheme, port=args.port)
     for key in args.api_keys:
         headers = {'Authorization': 'Bearer {}'.format(key)}
         org_name = requests.get(base_url+'org', headers=headers).json()['name']
@@ -38,6 +38,9 @@ if __name__ == '__main__':
     parser.add_argument('-d', '--directory', help='Directory where to store backups',
                         default='/srv/backups')
     parser.add_argument('-p', '--port', help='Port to access grafana API', default='3000')
+    parser.add_argument('-s', '--scheme',
+                        help='Scheme to use to access grafana API e.g. http or https',
+                        default='http')
     parser.add_argument('api_keys', help='List of API keys to use for backups', nargs='+')
     args = parser.parse_args()
     main(args)
diff --git a/src/layer.yaml b/src/layer.yaml
index 6e51d38..3ddcaa7 100644
--- a/src/layer.yaml
+++ b/src/layer.yaml
@@ -1,4 +1,11 @@
-includes: ['layer:basic', 'layer:snap', 'interface:nrpe-external-master', 'interface:grafana-source', 'interface:http', 'interface:grafana-dashboard']
+includes:
+    - 'layer:basic'
+    - 'layer:snap'
+    - 'layer:tls-client'
+    - 'interface:nrpe-external-master'
+    - 'interface:grafana-source'
+    - 'interface:http'
+    - 'interface:grafana-dashboard'
 ignore: ['.*.swp' ]
 options:
     basic:
diff --git a/src/lib/charms/layer/grafana.py b/src/lib/charms/layer/grafana.py
index d8fc7b8..0acb980 100644
--- a/src/lib/charms/layer/grafana.py
+++ b/src/lib/charms/layer/grafana.py
@@ -15,10 +15,19 @@ from charmhelpers.core.hookenv import (
 )
 
 from charms.layer import snap
+from charms.reactive.flags import is_flag_set
 
 import requests
 
 
+# When using 'certifi' from the virtualenv, the system-wide certificates store
+# is not used, so installed certificates won't be used to validate hosts.
+# Adding the system CA bundle
+# https://git.launchpad.net/ubuntu/+source/python-certifi/tree/debian/patches/0001-Use-Debian-provided-etc-ssl-certs-ca-certificates.cr.patch
+SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"
+CA_CERT_PATH = "/var/snap/grafana/common/ssl/ca-certificates.crt"
+
+
 class ChangeStatus(enum.Enum):
     """Model Snap channel states."""
 
@@ -42,6 +51,22 @@ def get_admin_password():
     return config("admin_password") or unitdata.kv().get("grafana.admin_password")
 
 
+def get_protocol():
+    """Check if the SSL certificates were configured and return http or https."""
+    if is_flag_set("grafana.certificates.configured"):
+        return "https"
+    else:
+        return "http"
+
+
+def get_ca_cert_path():
+    """Return the path where the CA certificates store is."""
+    if config("install_method") == "snap":
+        return CA_CERT_PATH
+    else:
+        return SYSTEM_CA_BUNDLE
+
+
 def compute_dash_title(title, remote_app=None):
     """Compute title for dashboards.
 
@@ -80,9 +105,10 @@ def compute_dash_title(title, remote_app=None):
 def get_folders():
     """Retrieve all folders."""
     r = requests.get(
-        "http://localhost:{}/api/folders".format(config("port")),
+        "{}://localhost:{}/api/folders".format(get_protocol(), config("port")),
         auth=("admin", get_admin_password()),
         headers={"Accept": "application/json"},
+        verify=get_ca_cert_path(),
     )
     r.raise_for_status()
     folders = r.json()
@@ -93,10 +119,11 @@ def get_folders():
 def create_folder(folder_name):
     """Create a folder through Grafana API."""
     r = requests.post(
-        "http://localhost:{}/api/folders".format(config("port")),
+        "{}://localhost:{}/api/folders".format(get_protocol(), config("port")),
         auth=("admin", get_admin_password()),
         headers={"Accept": "application/json"},
         data={"title": folder_name},
+        verify=get_ca_cert_path(),
     )
     r.raise_for_status()
     folder = r.json()
@@ -129,7 +156,9 @@ def ensure_and_get_dash_folder(remote_model):
 def post_dashboard(name, dashboard):
     """Upload a dashboard to Grafana."""
     headers = {"Content-Type": "application/json"}
-    import_url = "http://localhost:{}/api/dashboards/db".format(config("port"))
+    import_url = "{}://localhost:{}/api/dashboards/db".format(
+        get_protocol(), config("port")
+    )
     passwd = get_admin_password()
     if passwd is None:
         return (False, "Unable to retrieve grafana password.")
@@ -139,6 +168,7 @@ def post_dashboard(name, dashboard):
         auth=api_auth,
         headers=headers,
         data=json.dumps(dashboard),
+        verify=get_ca_cert_path(),
     )
     if r.status_code == 200:
         return (True, None)
diff --git a/src/reactive/grafana.py b/src/reactive/grafana.py
index 37958d3..10a1656 100644
--- a/src/reactive/grafana.py
+++ b/src/reactive/grafana.py
@@ -68,10 +68,13 @@ wipe_nrpe_checks (no nrpe-external-master.available)
 import base64
 import datetime
 import glob
+import grp
 import json
 import os
+import pwd
 import re
 import shutil
+import socket
 import subprocess
 import time
 
@@ -80,18 +83,23 @@ from charmhelpers.contrib.charmsupport import nrpe
 from charmhelpers.core import (
     hookenv,
     host,
+    templating,
     unitdata,
 )
+from charmhelpers.core.decorators import retry_on_exception
 from charmhelpers.core.templating import render
 
-from charms.layer import snap
+from charms.layer import snap, tls_client
 from charms.layer.grafana import (
+    CA_CERT_PATH,
     ChangeStatus,
     check_snap_channel,
     download_file,
     get_admin_password,
+    get_ca_cert_path,
     get_deb_package_version,
     get_installed_package_version,
+    get_protocol,
     import_dashboard,
 )
 from charms.reactive import (
@@ -102,6 +110,7 @@ from charms.reactive import (
     when_any,
     when_not,
 )
+from charms.reactive.flags import is_flag_set
 from charms.reactive.helpers import (
     any_file_changed,
     is_state,
@@ -119,8 +128,16 @@ import six
 SVCNAME = {"snap": "snap.grafana.grafana", "apt": "grafana-server"}
 SNAP_NAME = "grafana"
 SNAP_DATA = "/var/snap/{}/current".format(SNAP_NAME)
-SNAP_COMMON = "/var/snap/{}/common/data".format(SNAP_NAME)
-
+SNAP_COMMON_DIR = "/var/snap/{}/common".format(SNAP_NAME)
+SNAP_COMMON_DATA = "{}/data".format(SNAP_COMMON_DIR)
+CERT_PATH = {
+    "snap": "{}/ssl/server.crt".format(SNAP_COMMON_DIR),
+    "apt": "/etc/grafana/ssl/server.crt",
+}
+CERT_KEY_PATH = {
+    "snap": "{}/ssl/server.key".format(SNAP_COMMON_DIR),
+    "apt": "/etc/grafana/ssl/server.key",
+}
 GRAFANA_INI = {
     "snap": "{}/conf/grafana.ini".format(SNAP_DATA),
     "apt": "/etc/grafana/grafana.ini",
@@ -129,6 +146,7 @@ GRAFANA_INI_TMPL = "grafana.ini.j2"
 GRAFANA_DEPS = ["libfontconfig1"]
 DASHBOARDS_BACKUP_CRON = "/etc/cron.d/juju-dashboards-backup"
 DASHBOARDS_BACKUP_CRON_TMPL = "juju-dashboards-backup.j2"
+CA_CERTIFICATES_HOOK = "/etc/ca-certificates/update.d/sync-grafana-snap"
 
 
 try:
@@ -233,7 +251,7 @@ def install_packages():
 
 def data_path():
     """Retrieve data store depending on install method."""
-    data_dir = {"snap": SNAP_COMMON, "apt": "/var/lib/grafana"}
+    data_dir = {"snap": SNAP_COMMON_DATA, "apt": "/var/lib/grafana"}
     source = get_install_source()
     if not source:
         remove_state("grafana.installed")
@@ -460,7 +478,13 @@ def setup_grafana():
     grafana_ini = GRAFANA_INI[source]
     hookenv.status_set("maintenance", "Configuring grafana")
     config = hookenv.config()
-    settings = {"config": config}
+    settings = {
+        "config": config,
+        "protocol": get_protocol(),
+        "cert_file": CERT_PATH[config["install_method"]],
+        "cert_key": CERT_KEY_PATH[config["install_method"]],
+    }
+
     smtp_auth = config.get("smtp_auth", False)
     if smtp_auth and len(smtp_auth.split(":")) == 2:
         settings["smtp_user"] = smtp_auth.split(":")[0]
@@ -501,6 +525,7 @@ def setup_backup_shedule():
             "directory": config.get("dashboards_backup_dir"),
             "port": config.get("port"),
             "backup_keys": " ".join(add_backup_api_keys()),
+            "scheme": get_protocol(),
         }
         render(
             source=DASHBOARDS_BACKUP_CRON_TMPL,
@@ -536,6 +561,8 @@ def restart_grafana():
         hookenv.log(msg)
         hookenv.status_set("maintenance", msg)
         host.service_restart(svcname)
+
+    _block_until_port_open()
     hookenv.status_set("active", "Ready")
     set_state("grafana.started")
     hookenv.status_set("active", "Started {}".format(svcname))
@@ -562,11 +589,18 @@ def update_nrpe_config():
     nrpe.add_init_service_checks(nrpe_setup, [svcname], current_unit)
 
     # write the http check
-    nrpe_setup.add_check(
-        "grafana_http",
-        "Grafana HTTP check",
-        "check_http -I 127.0.0.1 -p {} -u /login".format(config["port"]),
-    )
+    if get_protocol() == "https":
+        nrpe_setup.add_check(
+            "grafana_http",
+            "Grafana HTTPS check",
+            "check_http -S -I 127.0.0.1 -p {} -u /login".format(config["port"]),
+        )
+    else:
+        nrpe_setup.add_check(
+            "grafana_http",
+            "Grafana HTTP check",
+            "check_http -I 127.0.0.1 -p {} -u /login".format(config["port"]),
+        )
 
     nrpe_setup.write()
     set_state("grafana.nagios-setup.completed")
@@ -747,8 +781,9 @@ def get_current_dashboards(port, passwd):
     https://grafana.com/docs/grafana/latest/http_api/folder_dashboard_search/
     """
     dash_req = requests.get(
-        "http://127.0.0.1:{}/api/search?type=dash-db".format(port),
+        "{}://127.0.0.1:{}/api/search?type=dash-db".format(get_protocol(), port),
         auth=("admin", passwd),
+        verify=get_ca_cert_path(),
     )
     return dash_req.json() if dash_req.status_code == 200 else []
 
@@ -766,8 +801,9 @@ def get_current_dashboard_json(uid, port, passwd):
         return default_dashboard
 
     dash_req = requests.get(
-        "http://127.0.0.1:{}/api/dashboards/uid/{}".format(port, uid),
+        "{}://127.0.0.1:{}/api/dashboards/uid/{}".format(get_protocol(), port, uid),
         auth=("admin", passwd),
+        verify=get_ca_cert_path(),
     )
     if dash_req.status_code != 200:
         return default_dashboard
@@ -856,8 +892,13 @@ def check_and_add_dashboard(
     )
 
     hookenv.log("Using Dashboard Template: {}".format(filename))
-    post_req = "http://127.0.0.1:{}/api/dashboards/db".format(port)
-    r = requests.post(post_req, json=dashboard_json, auth=("admin", gf_adminpasswd))
+    post_req = "{}://127.0.0.1:{}/api/dashboards/db".format(get_protocol(), port)
+    r = requests.post(
+        post_req,
+        json=dashboard_json,
+        auth=("admin", gf_adminpasswd),
+        verify=get_ca_cert_path(),
+    )
 
     if r.status_code != 200:
         hookenv.log(
@@ -1075,8 +1116,9 @@ def get_orgs(port, passwd):
     https://grafana.com/docs/grafana/latest/http_api/org/
     """
     req = requests.get(
-        "http://127.0.0.1:{}/api/orgs".format(port),
+        "{}://127.0.0.1:{}/api/orgs".format(get_protocol(), port),
         auth=("admin", passwd),
+        verify=get_ca_cert_path(),
     )
     return req.json() if req.status_code == 200 else []
 
@@ -1255,3 +1297,83 @@ def import_dashboards(dashboards):
                 req.respond(success, reason)
 
     kv.set("dash_digests", dashboard_digests)
+
+
+@when("certificates.available")
+@when_not("grafana.certificates.configured")
+@when_not("grafana.certificates.requested")
+def tls_request_certificate(tls):
+    """Create a server certificate for this server."""
+    # Use the public ip of this unit as the Common Name for the certificate.
+    common_name = hookenv.unit_public_ip()
+    # Get a list of Subject Alt Names for the certificate.
+    sans = []
+    sans.append(hookenv.unit_public_ip())
+    sans.append(hookenv.unit_private_ip())
+    sans.append(socket.gethostname())
+    sans.append("127.0.0.1")
+    sans.append("localhost")
+    hookenv.log(
+        "Requesting certificate with CN: {common_name}".format(common_name=common_name)
+    )
+    tls_client.request_server_cert(
+        common_name,
+        sans,
+        crt_path=CERT_PATH[hookenv.config("install_method")],
+        key_path=CERT_KEY_PATH[hookenv.config("install_method")],
+    )
+    _maybe_install_ca_certificates_hook()
+    set_state("grafana.certificates.requested")
+
+
+@when("tls_client.certs.changed")
+@when("grafana.certificates.requested")
+def tls_certificate_changed():
+    """Request to reconfigure grafana after the certificates were written."""
+    # the certificates are written in owned by root and 0o770 permissions
+    # which prevents grafana-server process to read them when using the debian
+    # package, so the parent directory needs to allow the access by 'grafana'
+    # group.
+    if hookenv.config("install_method") == "apt":
+        uid = pwd.getpwnam("root").pw_uid
+        gid = grp.getgrnam("grafana").gr_gid
+        ssl_dir = os.path.dirname(CERT_PATH[hookenv.config("install_method")])
+        os.chown(ssl_dir, uid, gid)
+
+    # making sure the hook to update the certificate inside the snap's common
+    # dir is executed if needed.
+    subprocess.check_call(["update-ca-certificates"])
+
+    set_state("grafana.certificates.configured")
+    if is_flag_set("grafana.configured"):
+        remove_state("grafana.configured")
+
+
+def _maybe_install_ca_certificates_hook():
+    # When grafana is running within a snap won't have access to the system's
+    # certificates store, so a hook script is installed to rsync it on any
+    # execution of update-ca-certificates
+    if hookenv.config("install_method") != "snap":
+        # when running from the deb package there is no need to install the
+        # hook, the ca-certificates will take care of everything for us.
+        return
+
+    templating.render(
+        "sync-grafana-snap",
+        CA_CERTIFICATES_HOOK,
+        context={"CA_CERT_PATH": CA_CERT_PATH},
+        perms=0o755,
+    )
+    subprocess.check_call(["update-ca-certificates"])
+
+
+# Block for a not so small period of time, because in hyperconverged
+# environments, specially while a bundle is being deployed, the amount of IOPS
+# in flight may prevent restarts from happening fast enough.
+@retry_on_exception(10, base_delay=2)
+def _block_until_port_open():
+    a_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    port = hookenv.config("port")
+    location = ("127.0.0.1", int(port))
+    if a_socket.connect_ex(location) != 0:
+        raise Exception("port %s is closed" % port)
diff --git a/src/requirements.txt b/src/requirements.txt
index 8462291..236ad65 100644
--- a/src/requirements.txt
+++ b/src/requirements.txt
@@ -1 +1,2 @@
 # Include python requirements here
+rpdb
diff --git a/src/templates/grafana.ini.j2 b/src/templates/grafana.ini.j2
index 06278fc..77d4673 100644
--- a/src/templates/grafana.ini.j2
+++ b/src/templates/grafana.ini.j2
@@ -8,7 +8,13 @@ instance_name = {{ config.instance_name }}
 
 [server]
 # Protocol (http or https)
-;protocol = http
+protocol = {{ protocol }}
+
+{%- if protocol == "https" %}
+# https certs & key file
+cert_file = {{ cert_file }}
+cert_key = {{ cert_key }}
+{%- endif %}
 
 # The ip address to bind to, empty will bind to all interfaces
 http_addr = 0.0.0.0
diff --git a/src/templates/juju-dashboards-backup.j2 b/src/templates/juju-dashboards-backup.j2
index 00f0737..993c48a 100644
--- a/src/templates/juju-dashboards-backup.j2
+++ b/src/templates/juju-dashboards-backup.j2
@@ -1,5 +1,5 @@
 #
 # Please do not edit. Juju will overwrite it.
 #
-{{ schedule }} root /usr/local/bin/dashboards_backup -d {{ directory }} -p {{ port }} {{ backup_keys }}
+{{ schedule }} root /usr/local/bin/dashboards_backup -d {{ directory }} -p {{ port }} -s {{ scheme }} {{ backup_keys }}
 
diff --git a/src/templates/sync-grafana-snap b/src/templates/sync-grafana-snap
new file mode 100644
index 0000000..7bf28b2
--- /dev/null
+++ b/src/templates/sync-grafana-snap
@@ -0,0 +1,7 @@
+#!/bin/sh
+#
+# This file is managed by juju.
+#
+
+set -e
+rsync /etc/ssl/certs/ca-certificates.crt {{ CA_CERT_PATH }}
diff --git a/src/tests/functional/requirements.txt b/src/tests/functional/requirements.txt
index bbe8435..a9af82d 100644
--- a/src/tests/functional/requirements.txt
+++ b/src/tests/functional/requirements.txt
@@ -1,2 +1,8 @@
 git+https://github.com/openstack-charmers/zaza.git#egg=zaza
+<<<<<<< src/tests/functional/requirements.txt
 python-openstackclient
+=======
+# OpenStack tools current;y required when using OpenStack provider.
+python-keystoneclient
+python-novaclient
+>>>>>>> src/tests/functional/requirements.txt
diff --git a/src/tests/functional/tests/bundles/bionic-snap-tls.yaml b/src/tests/functional/tests/bundles/bionic-snap-tls.yaml
new file mode 120000
index 0000000..f81f6ff
--- /dev/null
+++ b/src/tests/functional/tests/bundles/bionic-snap-tls.yaml
@@ -0,0 +1 @@
+base.yaml
\ No newline at end of file
diff --git a/src/tests/functional/tests/bundles/bionic-tls.yaml b/src/tests/functional/tests/bundles/bionic-tls.yaml
new file mode 120000
index 0000000..f81f6ff
--- /dev/null
+++ b/src/tests/functional/tests/bundles/bionic-tls.yaml
@@ -0,0 +1 @@
+base.yaml
\ No newline at end of file
diff --git a/src/tests/functional/tests/bundles/focal-snap-tls.yaml b/src/tests/functional/tests/bundles/focal-snap-tls.yaml
new file mode 120000
index 0000000..f81f6ff
--- /dev/null
+++ b/src/tests/functional/tests/bundles/focal-snap-tls.yaml
@@ -0,0 +1 @@
+base.yaml
\ No newline at end of file
diff --git a/src/tests/functional/tests/bundles/focal-tls.yaml b/src/tests/functional/tests/bundles/focal-tls.yaml
new file mode 120000
index 0000000..f81f6ff
--- /dev/null
+++ b/src/tests/functional/tests/bundles/focal-tls.yaml
@@ -0,0 +1 @@
+base.yaml
\ No newline at end of file
diff --git a/src/tests/functional/tests/bundles/overlays/bionic-snap-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/bionic-snap-tls.yaml.j2
new file mode 100644
index 0000000..e302099
--- /dev/null
+++ b/src/tests/functional/tests/bundles/overlays/bionic-snap-tls.yaml.j2
@@ -0,0 +1,11 @@
+series: bionic
+applications:
+  grafana:
+    options:
+      install_method: snap
+      snap_channel: 6/stable
+  easyrsa:
+    charm: cs:~containers/easyrsa
+    num_units: 1
+relations:
+  - [ grafana:certificates, easyrsa ]
diff --git a/src/tests/functional/tests/bundles/overlays/bionic-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/bionic-tls.yaml.j2
new file mode 100644
index 0000000..e728037
--- /dev/null
+++ b/src/tests/functional/tests/bundles/overlays/bionic-tls.yaml.j2
@@ -0,0 +1,10 @@
+series: bionic
+applications:
+  grafana:
+    options:
+      install_method: apt
+  easyrsa:
+    charm: cs:~containers/easyrsa
+    num_units: 1
+relations:
+  - [ grafana:certificates, easyrsa ]
diff --git a/src/tests/functional/tests/bundles/overlays/focal-snap-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal-snap-tls.yaml.j2
new file mode 100644
index 0000000..259f3c5
--- /dev/null
+++ b/src/tests/functional/tests/bundles/overlays/focal-snap-tls.yaml.j2
@@ -0,0 +1,32 @@
+series: focal
+applications:
+  grafana:
+    num_units: 1
+    options:
+      install_method: snap
+      snap_channel: 6/stable
+  ceph-mon:
+    series: bionic
+  ceph-osd:
+    series: bionic
+  glance:
+    series: bionic
+  keystone:
+    series: bionic
+  mysql:
+    series: bionic
+  rabbitmq-server:
+    series: bionic
+  prometheus:
+    series: bionic
+  prometheus-ceph-exporter:
+    series: bionic
+  prometheus-libvirt-exporter:
+    series: bionic
+  nagios:
+    series: bionic
+  easyrsa:
+    charm: cs:~containers/easyrsa
+    num_units: 1
+relations:
+  - [ grafana:certificates, easyrsa ]
diff --git a/src/tests/functional/tests/bundles/overlays/focal-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal-tls.yaml.j2
new file mode 100644
index 0000000..b6283dc
--- /dev/null
+++ b/src/tests/functional/tests/bundles/overlays/focal-tls.yaml.j2
@@ -0,0 +1,31 @@
+series: focal
+applications:
+  grafana:
+    num_units: 1
+    options:
+      install_method: apt
+  ceph-mon:
+    series: bionic
+  ceph-osd:
+    series: bionic
+  glance:
+    series: bionic
+  keystone:
+    series: bionic
+  mysql:
+    series: bionic
+  rabbitmq-server:
+    series: bionic
+  prometheus:
+    series: bionic
+  prometheus-ceph-exporter:
+    series: bionic
+  prometheus-libvirt-exporter:
+    series: bionic
+  nagios:
+    series: bionic
+  easyrsa:
+    charm: cs:~containers/easyrsa
+    num_units: 1
+relations:
+  - [ grafana:certificates, easyrsa ]
diff --git a/src/tests/functional/tests/bundles/overlays/xenial-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/xenial-tls.yaml.j2
new file mode 100644
index 0000000..86f7ebf
--- /dev/null
+++ b/src/tests/functional/tests/bundles/overlays/xenial-tls.yaml.j2
@@ -0,0 +1,12 @@
+series: xenial
+applications:
+  grafana:
+    options:
+      install_method: apt
+  easyrsa:
+    # Use bionic version as easyrsa is failing to install on xenial
+    series: bionic
+    charm: cs:~containers/easyrsa
+    num_units: 1
+relations:
+  - [ grafana:certificates, easyrsa ]
diff --git a/src/tests/functional/tests/bundles/xenial-tls.yaml b/src/tests/functional/tests/bundles/xenial-tls.yaml
new file mode 120000
index 0000000..f81f6ff
--- /dev/null
+++ b/src/tests/functional/tests/bundles/xenial-tls.yaml
@@ -0,0 +1 @@
+base.yaml
\ No newline at end of file
diff --git a/src/tests/functional/tests/test_grafana.py b/src/tests/functional/tests/test_grafana.py
index d0e54d4..03fe575 100644
--- a/src/tests/functional/tests/test_grafana.py
+++ b/src/tests/functional/tests/test_grafana.py
@@ -1,6 +1,8 @@
 """Encapsulate prometheus-openstack-exporter testing."""
 import json
 import logging
+import os
+import tempfile
 import time
 import unittest
 
@@ -16,7 +18,10 @@ DEFAULT_BACKUP_DIRECTORY = "/srv/backups"
 
 
 class BaseGrafanaTest(unittest.TestCase):
-    """Base for Prometheus-openstack-exporter charm tests."""
+    """Base for Prometheus-openstack-exporter charm tests.
+
+    - Get the CA from easyrsa (when available) and write it on disk.
+    """
 
     _admin_pass = None
 
@@ -32,11 +37,45 @@ class BaseGrafanaTest(unittest.TestCase):
         cls.units = model.get_units(cls.application_name, model_name=cls.model_name)
         cls.grafana_ip = model.get_app_ips(cls.application_name)[0]
 
+        # get the CA certificate from the relation between easy easyrsa and
+        # grafana.
+        if cls.get_protocol() == "https":
+            rel_id = model.get_relation_id(
+                "grafana", "easyrsa", remote_interface_name="client"
+            )
+            easyrsa_unit = model.get_units("easyrsa")[0]
+            cmd = "relation-get -r client:{} ca {}".format(
+                rel_id, easyrsa_unit.entity_id
+            )
+            logging.info(cmd)
+            result = model.run_on_unit(easyrsa_unit.entity_id, cmd)
+
+            with tempfile.NamedTemporaryFile(mode="w", delete=False) as f:
+                f.write(result["Stdout"])
+                f.flush()
+                cls.ca_path = f.name
+        else:
+            cls.ca_path = None
+
+    @classmethod
+    def tearDownClass(cls):
+        """Remove the CA file that was written to disk during the setUp."""
+        if cls.ca_path:
+            os.remove(cls.ca_path)
+
     def get_unit_status(self, unit):
         """Get grafana unit workload status."""
         u = model.get_unit_from_name(unit)
         return u.workload_status_message
 
+    @classmethod
+    def get_protocol(cls):
+        """Get protocol configured to serve Grafana."""
+        if model.get_relation_id("grafana", "easyrsa"):
+            return "https"
+        else:
+            return "http"
+
     @property
     def admin_password(self):
         """Get grafana admin password."""
@@ -58,11 +97,14 @@ class BaseGrafanaTest(unittest.TestCase):
         dashboards = []
         while True:
             req = requests.get(
-                "http://{host}:{port}"
+                "{protocol}://{host}:{port}"
                 "/api/search?dashboardIds".format(
-                    host=self.grafana_ip, port=DEFAULT_API_PORT
+                    protocol=self.get_protocol(),
+                    host=self.grafana_ip,
+                    port=DEFAULT_API_PORT,
                 ),
                 auth=("admin", self.admin_password),
+                verify=self.ca_path,
             )
             self.assertTrue(req.status_code == 200)
             dashboards = json.loads(req.text)
@@ -113,11 +155,19 @@ class CharmOperationTest(BaseGrafanaTest):
         Curl the api endpoint.
         We'll retry until the TEST_TIMEOUT.
         """
+        if self.get_protocol() == "https":
+            # -S instructs the check_http plugin to check the SSL port which
+            # defaults to 443.
+            cmd = "/usr/lib/nagios/plugins/check_http -S"
+        else:
+            cmd = "/usr/lib/nagios/plugins/check_http"
+
         test_command = "{} -I 127.0.0.1 -p {} -u {}".format(
-            "/usr/lib/nagios/plugins/check_http",
+            cmd,
             DEFAULT_API_PORT,
             DEFAULT_API_URL,
         )
+        logging.debug("test api ready command: %s" % test_command)
         timeout = time.time() + TEST_TIMEOUT
         while time.time() < timeout:
             response = model.run_on_unit(self.lead_unit_name, test_command)
@@ -130,9 +180,11 @@ class CharmOperationTest(BaseGrafanaTest):
 
         # we didn't get rc=0 in the allowed time, fail the test
         self.fail(
-            "http port didn't respond to the command \n"
+            "{protocol} port didn't respond to the command \n"
             "'{test_command}' as expected.\n"
-            "Result: {result}".format(test_command=test_command, result=response)
+            "Result: {result}".format(
+                protocol=self.get_protocol(), test_command=test_command, result=response
+            )
         )
 
     def test_02_nrpe_http_check(self):
@@ -140,10 +192,19 @@ class CharmOperationTest(BaseGrafanaTest):
         logging.debug(
             "Verify the nrpe check is created and has the required content..."
         )
-        expected_nrpe_check = (
-            "command[check_grafana_http]=/usr/lib/nagios/plugins/check_http "
-            "-I 127.0.0.1 -p 3000 -u /login"
-        )
+        if self.get_protocol() == "https":
+            expected_nrpe_check = (
+                "command[check_grafana_http]="
+                "/usr/lib/nagios/plugins/check_http "
+                "-S -I 127.0.0.1 -p 3000 -u /login"
+            )
+        else:
+            expected_nrpe_check = (
+                "command[check_grafana_http]="
+                "/usr/lib/nagios/plugins/check_http "
+                "-I 127.0.0.1 -p 3000 -u /login"
+            )
+
         cmd = "cat /etc/nagios/nrpe.d/check_grafana_http.cfg"
         result = model.run_on_unit(self.lead_unit_name, cmd)
         code = result.get("Code")
@@ -213,10 +274,13 @@ class CharmOperationTest(BaseGrafanaTest):
         self.assertTrue(action.data["results"]["Code"] == "0")
         time.sleep(30)  # Dirty hack to overcome race condition
         req = requests.get(
-            "http://{host}:{port}/api/org/".format(
-                host=self.grafana_ip, port=DEFAULT_API_PORT
+            "{protocol}://{host}:{port}/api/org/".format(
+                protocol=self.get_protocol(),
+                host=self.grafana_ip,
+                port=DEFAULT_API_PORT,
             ),
             auth=("foouser", "sikkrit"),
+            verify=self.ca_path,
         )
         self.assertTrue(req.status_code == 200)
         self.assertTrue("name" in req.json())
diff --git a/src/tests/functional/tests/tests.yaml b/src/tests/functional/tests/tests.yaml
index 909b776..736607f 100644
--- a/src/tests/functional/tests/tests.yaml
+++ b/src/tests/functional/tests/tests.yaml
@@ -1,10 +1,15 @@
 charm_name: grafana
 gate_bundles:
   - model_apt_install: focal
+  - model_apt_install: focal-tls
   - model_apt_install: bionic
+  - model_apt_install: bionic-tls
   - model_apt_install: xenial
+  - model_apt_install: xenial-tls
   - model_snap_install: bionic-snap
+  - model_snap_install: bionic-snap-tls
   - model_snap_install: focal-snap
+  - model_snap_install: focal-snap-tls
 smoke_bundles:
   - model_snap_install: bionic-snap
 dev_bundles:
@@ -25,3 +30,5 @@ target_deploy_status:
     workload-status-message: Monitoring
   prometheus-libvirt-exporter:
     workload-status-message: "Exporter installed and connected to libvirt slot"
+  easyrsa:
+    workload-status-message: Certificate Authority connected.
diff --git a/src/tests/unit/test_grafana.py b/src/tests/unit/test_grafana.py
index 663fa17..2e460ef 100644
--- a/src/tests/unit/test_grafana.py
+++ b/src/tests/unit/test_grafana.py
@@ -1,4 +1,6 @@
 """Unit tests module."""
+import os
+import socket
 import sys
 import unittest
 from os.path import isfile
@@ -7,6 +9,8 @@ from unittest.mock import call
 
 from charmhelpers.core import unitdata
 
+tls_client_mock = mock.Mock()
+sys.modules["charms.layer.tls_client"] = tls_client_mock
 sys.modules["charms.layer.snap"] = mock.Mock()
 
 
@@ -148,3 +152,47 @@ class GrafanaTestCase(unittest.TestCase):
             "dash-name",
             {"dashboard": {"title": "[juju-foo-app] test-title"}, "folderId": 0},
         )
+
+    @mock.patch("charmhelpers.core.hookenv.charm_dir", auto_spec=True)
+    @mock.patch("reactive.grafana.templating.render", auto_spec=True)
+    @mock.patch("reactive.grafana.hookenv.config", auto_spec=True)
+    @mock.patch("reactive.grafana.hookenv.unit_public_ip", auto_spec=True)
+    @mock.patch("reactive.grafana.hookenv.unit_private_ip", auto_spec=True)
+    @mock.patch("subprocess.check_call", auto_spec=True)
+    def test_request_certificate(
+        self,
+        mock_check_call,
+        mock_private_ip,
+        mock_public_ip,
+        mock_config,
+        mock_render,
+        mock_charm_dir,
+    ):
+        """Test request certificate."""
+        charm_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "../../")
+        mock_charm_dir.return_value = charm_dir
+
+        config = {"install_method": "snap"}
+
+        def fake_config(key):
+            return config[key]
+
+        mock_config.side_effect = fake_config
+        mock_public_ip.return_value = "1.2.3.4"
+        mock_private_ip.return_value = "5.6.7.8"
+
+        mock_tls = mock.Mock()
+        grafana_reactive.tls_request_certificate(mock_tls)
+        tls_client_mock.request_server_cert.assert_called_with(
+            "1.2.3.4",
+            ["1.2.3.4", "5.6.7.8", socket.gethostname(), "127.0.0.1", "localhost"],
+            crt_path=grafana_reactive.CERT_PATH["snap"],
+            key_path=grafana_reactive.CERT_KEY_PATH["snap"],
+        )
+
+        mock_render.assert_called_with(
+            "sync-grafana-snap",
+            grafana_reactive.CA_CERTIFICATES_HOOK,
+            context={"CA_CERT_PATH": grafana_reactive.CA_CERT_PATH},
+            perms=0o755,
+        )
diff --git a/src/tox.ini b/src/tox.ini
index 5845e03..72d33e7 100644
--- a/src/tox.ini
+++ b/src/tox.ini
@@ -21,6 +21,7 @@ passenv =
   NO_PROXY
   SNAP_HTTP_PROXY
   SNAP_HTTPS_PROXY
+<<<<<<< src/tox.ini
   OS_REGION_NAME
   OS_AUTH_VERSION
   OS_AUTH_URL
@@ -31,6 +32,9 @@ passenv =
   OS_USER_DOMAIN_NAME
   OS_PROJECT_NAME
   OS_IDENTITY_API_VERSION
+=======
+  OS_*
+>>>>>>> src/tox.ini
 
 [testenv:lint]
 commands =