🟡 Medium   ⏱ 5–30 min  Last verified: 20 May 2026
Affected versions: RHEL 10.0 RHEL 10.1

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution – Primary Fix
  7. Solution – Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

Admins cannot access web console for host management tasks.

Environment & Reproduction

Cockpit package installed but service disabled or blocked by firewall.

rpm -q cockpit
systemctl status cockpit.socket

Root Cause Analysis

cockpit.socket not active, firewalld not permitting cockpit service, or certificate issue.

Quick Triage

Check listener and network path on port 9090.

ss -tulpn | grep 9090
firewall-cmd --list-services

Step-by-Step Diagnosis

Collect cockpit logs and TLS-related messages.

journalctl -u cockpit* -n 200 --no-pager
openssl s_client -connect localhost:9090 -brief </dev/null
Illustrative mockup for rhel-10 — cockpit_port_closed
Cockpit port 9090 inaccessible — Illustrative mockup — Progressive Robot

Solution – Primary Fix

Enable cockpit socket and open service in firewalld.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

systemctl enable --now cockpit.socket
firewall-cmd --permanent --add-service=cockpit
firewall-cmd --reload
Illustrative mockup for rhel-10 — cockpit_port_open
Cockpit reachable after fix — Illustrative mockup — Progressive Robot

Solution – Alternative Approaches

Proxy cockpit via existing reverse proxy with enterprise certificates.

systemctl restart cockpit.socket

Verification & Acceptance Criteria

HTTPS access to port 9090 succeeds and login prompt appears.

curl -kI https://localhost:9090

Rollback Plan

Remove cockpit service exposure if security review requires temporary closure.

firewall-cmd --permanent --remove-service=cockpit
firewall-cmd --reload

Prevention & Hardening

Restrict management source ranges and rotate certificates.

firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/24 service name=cockpit accept'

Connection timed out on 9090, cockpit-ws failed to start.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Cockpit deployment and secure access recommendations.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.