# Does Weaviate support SSL out of the box? **URL:** \ **Category:** Support\ **Created:** [September 5, 2023, 3:18pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620 "2023-09-05T15:18:29Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![kokogrr](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/kokogrr/32/435_2.png) [@kokogrr](https://forum.weaviate.io/u/kokogrr)\ **Post date:** [September 5, 2023, 3:18pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/1 "2023-09-05T15:18:29Z")
Hello, I’m setting up self hosted instance of Weaviate on an Ubuntu VPS with Weaviate running in a Docker container. My question is can Weaviate instance support SSL connections by itself like eg. MySQL server does or do I need a reverse proxy eg. Nginx that will handle that? I looked into docs and searched ‘weaviate ssl’ online but didn’t find anything useful. ---
**Author:** ![DudaNogueira](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/dudanogueira/32/7846_2.png) [@DudaNogueira](https://forum.weaviate.io/u/DudaNogueira)\ **Post date:** [September 5, 2023, 3:22pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/2 "2023-09-05T15:22:05Z")
Hi @kokogrr ! Welcome to our community 🤗 No. You will need to reverse-proxy it in order to get SSL. You can do it with traefik or nginx, for example. I will add a note about this in our docs, thank you! ---
**Author:** ![kokogrr](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/kokogrr/32/435_2.png) [@kokogrr](https://forum.weaviate.io/u/kokogrr)\ **Post date:** [September 5, 2023, 3:42pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/3 "2023-09-05T15:42:59Z")
Thanks a lot for quick reply! ---
**Author:** ![salik\_Lari](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/salik_lari/32/516_2.png) [@salik\_Lari](https://forum.weaviate.io/u/salik_Lari)\ **Post date:** [September 26, 2023, 6:12am UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/4 "2023-09-26T06:12:51Z")
is document updated for SSL? I cant find anything ---
**Author:** ![lakshminarayana](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@lakshminarayana](https://forum.weaviate.io/u/lakshminarayana)\ **Post date:** [June 28, 2024, 3:39pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/5 "2024-06-28T15:39:10Z")
@DudaNogueira Thanks a lot for your response. Do u have any handy documentation for the same, if any Please share with us. ---
**Author:** ![DudaNogueira](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/dudanogueira/32/7846_2.png) [@DudaNogueira](https://forum.weaviate.io/u/DudaNogueira)\ **Post date:** [June 28, 2024, 7:20pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/6 "2024-06-28T19:20:48Z")
hi @lakshminarayana ! Welcome to our community. Our documentation usually doesn’t cover the SSL/TLS side of the deployment for two main reasons: 1 - Usually, self deployments will not expose Weaviate directly. Their applications will be exposed. but not Weaviate. 2 - Whenever there is a reason to expose Weaviate under a SSL/TLS connection, one can use a variety of reverse proxies, load balancers and so on. I have crafted here a gist on how to deploy Weaviate, with a single node, using docker compose and properly exposing it using traefik: > **[Build software better, together](https://github.com/login/oauth/authorize?client_id=7e0a3cd836d3e544dbd9&redirect_uri=https%3A%2F%2Fgist.github.com%2Fauth%2Fgithub%2Fcallback%3Freturn_to%3Dhttps%253A%252F%252Fgist.github.com%252Fdudanogueira%252F0dd925cbf63397e256e84e991245aab3%252Fedit&response_type=code&state=e2a63cd7a28e6561bd90e06b05026dc7ab52c58be56d324e72747bd27bcc2efa)** > > GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects. According to this docker compose, this is how you would connect to it: ```python client = weaviate.connect_to_custom( http_host="weaviate.yourcompany.com", http_port=443, http_secure=True, grpc_host="grpc.weaviate.yourcompany.com", grpc_port=50051, grpc_secure=True ) ``` If running on a VPS, you will need to have both [weaviate.yourcompany.com](http://weaviate.yourcompany.com) and [grpc.weaviate.yourcompany.com](http://grpc.weaviate.yourcompany.com) pointing to the public IP of this VPS. Here the content of the docker compose as of now: ```docker --- services: weaviate: command: - --host - 0.0.0.0 - --port - '8080' - --scheme - http image: cr.weaviate.io/semitechnologies/weaviate:1.25.5 # uncomment only if you want to connect unnsecured #ports: #- 8081:8080 #- 50052:50051 volumes: - weaviate_data:/var/lib/weaviate restart: on-failure:0 environment: QUERY_DEFAULTS_LIMIT: 25 AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: 'true' PERSISTENCE_DATA_PATH: '/var/lib/weaviate' DEFAULT_VECTORIZER_MODULE: 'none' ENABLE_MODULES: 'text2vec-cohere,text2vec-huggingface,text2vec-palm,text2vec-openai,generative-openai,generative-cohere,generative-palm,ref2vec-centroid,reranker-cohere,qna-openai' CLUSTER_HOSTNAME: 'node1' labels: - "traefik.enable=true" # http - "traefik.http.services.weaviate_http_service.loadbalancer.server.port=8080" - "traefik.http.routers.weaviate_http_router.rule=Host(`weaviate.yourdomain.com`)" - "traefik.http.routers.weaviate_http_router.entrypoints=websecure" - "traefik.http.routers.weaviate_http_router.service=weaviate_http_service" - "traefik.http.routers.weaviate_http_router.tls.certresolver=myresolver" # # grpc - "traefik.http.services.weaviate_grpc_service.loadbalancer.server.scheme=h2c" - "traefik.http.services.weaviate_grpc_service.loadbalancer.server.port=50051" - "traefik.http.routers.weaviate_grpc_router.rule=Host(`grpc.weaviate.yourdomain.com`)" - "traefik.http.routers.weaviate_grpc_router.entrypoints=grpc" - "traefik.http.routers.weaviate_grpc_router.service=weaviate_grpc_service" - "traefik.http.routers.weaviate_grpc_router.tls.certresolver=myresolver" traefik: #image: "traefik:v2.11" image: "traefik:v3.0.3" container_name: "traefik" command: - "--log.level=DEBUG" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--entrypoints.web.http.redirections.entryPoint.to=websecure" - "--entrypoints.web.http.redirections.entryPoint.scheme=https" - "--entrypoints.grpc.address=:50051" - "--providers.docker" - "--api" # - "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" - "--certificatesresolvers.myresolver.acme.tlschallenge=true" - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web" - "--certificatesresolvers.myresolver.acme.email=you@yourcompany.com" - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json" ports: - "80:80" - "443:443" - "50051:50051" volumes: - "./letsencrypt:/letsencrypt" - "/var/run/docker.sock:/var/run/docker.sock:ro" volumes: weaviate_data: ... ``` let me know if this helps 🙂 ---
**Author:** ![lakshminarayana](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@lakshminarayana](https://forum.weaviate.io/u/lakshminarayana)\ **Post date:** [July 1, 2024, 2:48am UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/7 "2024-07-01T02:48:54Z")
Thanks a lot for support and help We will update once we were able to access weaviate with https: ---
**Author:** ![lakshminarayana](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@lakshminarayana](https://forum.weaviate.io/u/lakshminarayana)\ **Post date:** [July 11, 2024, 9:33am UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/8 "2024-07-11T09:33:49Z")
While accessing the gRPC client am facing below error 2024/07/11 09:22:21 [error] 26#26: \*9358 upstream sent no valid HTTP/1.0 header while reading response header from upstream, client: 10.0.131.66, server: [grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com), request: “GET / HTTP/1.1”, upstream: “[http://10.0.141.246:50051/](http://10.0.141.246:50051/)”, host: “[grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com)” 2024/07/11 09:22:21 [error] 26#26: \*9358 recv() failed (104: Connection reset by peer) while reading upstream, client: 10.0.131.66, server: [grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com), request: “GET / HTTP/1.1”, upstream: “[http://10.0.141.246:50051/](http://10.0.141.246:50051/)”, host: “[grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com)” 10.0.131.66 - - [11/Jul/2024:09:22:21 +0000] “GET / HTTP/1.1” 009 15 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 (scanner.ducks.party)” 228 0.003 [weaviate-weaviate-grpc-50051] 10.0.141.246:50051 15 0.003 200 1d8e05cbe04f47be9b601d3a3fac3fa0 10.0.131.66 - - [11/Jul/2024:09:22:24 +0000] “GET / HTTP/1.1” 308 164 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 (scanner.ducks.party)” 228 0.000 [weaviate-weaviate-grpc-50051] - - - - 51cb606133e373c434cd851fdbfc52a9 2024/07/11 09:22:28 [error] 27#27: \*9418 upstream sent no valid HTTP/1.0 header while reading response header from upstream, client: 10.0.131.66, server: [grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com), request: “GET / HTTP/1.1”, upstream: “[http://10.0.157.18:50051/](http://10.0.157.18:50051/)”, host: “[grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com)”, referrer: “[http://grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com)” 2024/07/11 09:22:28 [error] 27#27: \*9418 recv() failed (104: Connection reset by peer) while reading upstream, client: 10.0.131.66, server: [grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com), request: “GET / HTTP/1.1”, upstream: “[http://10.0.157.18:50051/](http://10.0.157.18:50051/)”, host: “[grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com)”, referrer: “[http://grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com)” 10.0.131.66 - - [11/Jul/2024:09:22:28 +0000] “GET / HTTP/1.1” 009 15 “[http://grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com)” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36(scanner.ducks.party)” 278 0.001 [weaviate-weaviate-grpc-50051] 10.0.157.18:50051 15 0.001 200 48ee60f00f83722e720314166b7b2c5a ubuntu@ip-10-0-9-110:~$ any one can be able to help me on this @DudaNogueira ---
**Author:** ![lakshminarayana](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@lakshminarayana](https://forum.weaviate.io/u/lakshminarayana)\ **Post date:** [July 11, 2024, 9:35am UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/9 "2024-07-11T09:35:58Z")
Nginx-Ingress Rule: apiVersion: [networking.k8s.io/v1](http://networking.k8s.io/v1) kind: Ingress metadata: name: weaviate-ingress namespace: weaviate annotations: [cert-manager.io/cluster-issuer:](http://cert-manager.io/cluster-issuer:) letsencrypt-prod [nginx.ingress.kubernetes.io/ssl-redirect:](http://nginx.ingress.kubernetes.io/ssl-redirect:) “true” [nginx.ingress.kubernetes.io/backend-protocol:](http://nginx.ingress.kubernetes.io/backend-protocol:) “GRPC” [nginx.ingress.kubernetes.io/backend-protocol:](http://nginx.ingress.kubernetes.io/backend-protocol:) “HTTP” spec: ingressClassName: nginx tls: - hosts: - [weaviatedev.test.com](http://weaviatedev.test.com) - [grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com) secretName: weaviate-tls rules: - host: [weaviatedev.test.com](http://weaviatedev.test.com) http: paths: - path: / pathType: Prefix backend: service: name: weaviate port: number: 8080 - host: [grpc.weaviatedev.test.com](http://grpc.weaviatedev.test.com) http: paths: - path: / pathType: Prefix backend: service: name: weaviate-grpc port: number: 50051 @DudaNogueira Any help on the above issue… 🤩 ---
**Author:** ![DudaNogueira](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/dudanogueira/32/7846_2.png) [@DudaNogueira](https://forum.weaviate.io/u/DudaNogueira)\ **Post date:** [July 15, 2024, 1:20pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/10 "2024-07-15T13:20:03Z")
Hi! are those logs from nginx? ---
**Author:** ![lakshminarayana](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@lakshminarayana](https://forum.weaviate.io/u/lakshminarayana)\ **Post date:** [July 16, 2024, 12:00pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/11 "2024-07-16T12:00:30Z")
Yes Logs from Nginx only @DudaNogueira ---
**Author:** ![DudaNogueira](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/dudanogueira/32/7846_2.png) [@DudaNogueira](https://forum.weaviate.io/u/DudaNogueira)\ **Post date:** [July 16, 2024, 2:14pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/12 "2024-07-16T14:14:46Z")
Exposing the deployment has a lot of options and varies a lot. I have crafted a [docker compose for traefik here](https://gist.github.com/dudanogueira/0dd925cbf63397e256e84e991245aab3/). because of the new grpc endpoint, it got a little bit more tricky than only a common http port. I have not played with nginx on k8s yet. I will try to get a hold of those an try to come up with some samples, as exposing weaviate is a common questions I see around. But bottom line, this is will be about exposing both the http port and grpc port. for the grpc part, you can use tools like grpcurl to make sure you deployment is serving. [Check this thread on this](https://forum.weaviate.io/t/weaviate-with-traefik-and-grpc/1238/3) for instance: ```shell grpcurl -d '{"service": "Weaviate"}' -proto health.proto grpc.weaviate.mydomain.com:50051 grpc.health.v1.Health/Check ``` Let me know if this helps and let’s keep it going! Thanks for using Weaviate and engaging here on forums, we really appreaciate it 🙂 ---
**Author:** ![lakshminarayana](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@lakshminarayana](https://forum.weaviate.io/u/lakshminarayana)\ **Post date:** [July 28, 2024, 12:34pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/13 "2024-07-28T12:34:03Z")
@DudaNogueira Need Your help here . root@i-xxxxxxxxx-server:~# grpcurl -d ‘{“service”: “Weaviate”}’ -proto health.proto [grpc.pocweviate.mydomain.com:443](http://grpc.pocweviate.mydomain.com:443) grpc.health.v1.Health/Check { “status”: “SERVING” } root@i-xxxxxxxxx-server:~# grpcurl -v -insecure -H “apikey: weaviatetest-readOnly-Key-lakshmi” [grpc.pocweviate.mydomain.com:443](http://grpc.pocweviate.mydomain.com:443) list Failed to list services: server does not support the reflection API root@i-xxxxxxxxx-server:~# grpcurl -v -insecure -H “apikey: weaviatetest-readOnly-Key-lakshmi” [grpc.pocweviate.mydomain.com:50051](http://grpc.pocweviate.mydomain.com:50051) list Failed to dial target host “[grpc.pocweviate.mydomain.com:50051](http://grpc.pocweviate.mydomain.com:50051)”: context deadline exceeded root@i-xxxxxxxxx-server:~# I have applied SSL using Nginx Ingress am using NetworkLoadbalencer Failed to list services: server does not support the reflection API Failed to dial target host “[grpc.pocweviate.mydomain.com:50051](http://grpc.pocweviate.mydomain.com:50051)”: context deadline exceeded Why this error, Any help from your side. It’s littile urjent. Your inputs will help me a lot. Hope GRPC endpoint health looks Good. status": "SERVING ---
**Author:** ![DudaNogueira](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/dudanogueira/32/7846_2.png) [@DudaNogueira](https://forum.weaviate.io/u/DudaNogueira)\ **Post date:** [July 29, 2024, 6:14pm UTC](https://forum.weaviate.io/t/does-weaviate-support-ssl-out-of-the-box/620/14 "2024-07-29T18:14:20Z")
Hi! This looks like something on k8s Exposing Weaviate is a topic we can never cover all the basis, as it will depend a lot on how and where you are deploying it. the reflection error is probably grpcurl hitting somewhere different to what we expect and not being able to list.