Wazuh ships with self-signed certificates so the dashboard works out of the box. For production, replace them with certificates from your internal CA or a public CA like Let's Encrypt.
1. Place your certificate files
cp wazuh.example.com.pem /etc/wazuh-dashboard/certs/dashboard.pem
cp wazuh.example.com.key /etc/wazuh-dashboard/certs/dashboard-key.pem
cp ca.pem /etc/wazuh-dashboard/certs/root-ca.pem
chown wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs/*
chmod 400 /etc/wazuh-dashboard/certs/*2. Update opensearch_dashboards.yml
server.ssl.enabled: true
server.ssl.key: "/etc/wazuh-dashboard/certs/dashboard-key.pem"
server.ssl.certificate: "/etc/wazuh-dashboard/certs/dashboard.pem"
opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"]3. Restart the dashboard
systemctl restart wazuh-dashboardNote: Make sure the certificate CN/SAN matches the URL your users hit, otherwise browsers will still show a warning.
We deploy Wazuh behind nginx with Let's Encrypt and SSO, contact us for a hardening package.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
Wazuh DashboardTLSHardening