4. TLS

By default the box's HTTPS certificate is not signed by a public certificate
authority — it's either self-signed or signed by the box's own private CA —
so Grafana will refuse the connection until you address that. You have two
options.

(If your box was installed with QT_CUSTOMER_CERT / QT_CUSTOMER_KEY, it is
serving a certificate you supplied rather than the default one. Where that
certificate already chains to a CA Grafana trusts, none of the guidance below
applies — the connection just works, and you should not disable verification.
Check with your installer if you are not sure which applies to your box.)

• Install the box's certificate in Grafana's trust store. This is the
  right choice whenever Grafana can reach the box over a routable network.
  With verification on, Grafana can detect a server other than the box
  answering on that address; without it, it cannot, and the Bearer token
  from step 1 is exactly what such an interposer would collect.
• Enable "Skip TLS certificate validation." Acceptable only on a link
  you trust end-to-end — for example Grafana and the box on the same
  isolated management network or a direct connection with no routing
  between them. Do not use this as the default setting on a shared or
  routable network.