Summary
service monitoring telegraf cannot validate the remote endpoint's TLS certificate, and no output plugin can reference the on-box PKI. The connection is encrypted but not authenticated.
CLI
Telegraf's output plugins accept the standard TLS client options (tls_ca, tls_cert, tls_key, tls_server_name, insecure_skip_verify), so:
set service monitoring telegraf influxdb tls ca-certificate <name> set service monitoring telegraf influxdb tls certificate <name> set service monitoring telegraf influxdb tls server-name <fqdn> set service monitoring telegraf influxdb tls no-verify
Resulting output block with tls ca-certificate set:
[[outputs.influxdb_v2]] urls = ["https://collector.example.com:8086"] tls_ca = "/run/telegraf/certs/ca.pem" token = "$INFLUX_TOKEN" ...