topic How encryption in transit is enabled over port 9999 from one agent to activegate in Open Q&A

How encryption in transit is enabled over port 9999 from one agent to activegate

tarun_kumar_aga — Fri, 12 Feb 2021 15:22:35 GMT

Hi,

We are frequently getting below question from our network team,Please provide configurations/screenshots showing encryption in transit is enabled over port 9999.

I didn't find any relevant documentation to provide them reference.

Re: How encryption in transit is enabled over port 9999 from one agent to activegate

Julius_Loman — Fri, 12 Feb 2021 15:28:58 GMT

Unless you reconfigured the ActiveGate manually, there is https communication with TLS1.2 between ActiveGate and OneAgents.

Re: How encryption in transit is enabled over port 9999 from one agent to activegate

tarun_kumar_aga — Fri, 12 Feb 2021 15:36:35 GMT

@Július L.

They are asking for some sort of reference documentation.i didn't find any.

Is there any way i can show them proof.

Thanks,

Tarun

Re: How encryption in transit is enabled over port 9999 from one agent to activegate

Julius_Loman — Fri, 12 Feb 2021 15:45:43 GMT

Look here, focus on ssl-protocols:
https://www.dynatrace.com/support/help/shortlink/sgw-configure#section-comcompuwareapmwebserver-

Re: How encryption in transit is enabled over port 9999 from one agent to activegate

Radoslaw_Szulgo — Fri, 12 Feb 2021 16:58:08 GMT

also here:

https://www.dynatrace.com/support/help/shortlink/sgw-types#route-oneagent-traffic-to-dynatrace-monitor-cloud-environments-or-monitor-remote-technologies-with-extensions-

Authentication
ActiveGate authenticates OneAgent requests (SSL handshake and environment ID authentication).

And here:

https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-activegate/configuration/configure-custom-ssl-certificate-on-activegate/

Communication between OneAgents and ActiveGate takes place over an encrypted HTTPS channel. ActiveGate provides an authentication certificate to all connecting clients. While OneAgent instances may ignore the validity of ActiveGate certificates (depending on configuration), connections from browser clients (such as the RUM JavaScript tag) do verify that the hostname listed in the certificate is correct, before they send data.