topic How does Dynatrace manage the default Activegate Certificates? in Open Q&A

How does Dynatrace manage the default Activegate Certificates?

JamesD09 — Wed, 31 May 2023 15:43:47 GMT

A couple of questions off the back of the subject:

- how does DT manage out of date AG certificates? doe they auto renew? (We're using the default AG cert)
- Does Dynatrace have a certificate validity check during install of the AG?

Any further information on AG default certificates would be amazing, i can't seem to find much information in the official docs.

Re: How does Dynatrace manage the default Activegate Certificates?

AntonPineiro — Wed, 31 May 2023 16:13:34 GMT

Hi,

Dynatrace has an entry about Custom SSL certificate for ActiveGate but I cannot see answers for your questions.

Best regards

Re: How does Dynatrace manage the default Activegate Certificates?

JamesD09 — Wed, 31 May 2023 16:19:34 GMT

Yeah, we're not intending to use custom ssl certificates.

All i can see on the documentation is the following:

Connection to ActiveGate, from OneAgents or REST API, takes place over an encrypted HTTPS channel. ActiveGate presents a self-signed authentication certificate to all connecting clients. While OneAgent instances may ignore the validity of ActiveGate certificates (depending on configuration).

Re: How does Dynatrace manage the default Activegate Certificates?

Julius_Loman — Wed, 31 May 2023 17:35:54 GMT

Yes, that's correct and default behaviour.

Dynatrace does not manage the certificates on ActiveGates, only provides you with methods to manage them. Either locally or also using API (preferred) or even certs can be setup during installation. By default, there is a self-signed certificate issued to *.clients.dynatrace.org with a 10 year validity.

OneAgents can be configured so they connect only to trusted AG (trusted in means of certificate) and it's not by default.

For outgoing connections, AG uses its truststore.

Re: How does Dynatrace manage the default Activegate Certificates?

a_barbera — Mon, 05 Jun 2023 14:32:51 GMT

Hi @Julius_Loman ,

The default self-signed certificate is this enabled by default, or does the customer need to enable this certificate?

After 10 years how the update will happen?

Thanks in advance!

Re: How does Dynatrace manage the default Activegate Certificates?

LukasNe — Tue, 06 Jun 2023 12:42:49 GMT

Hi @Julius_Loman ,

do you have any documentation about the OneAgent configuration? We want to use our own certificates and not the self-signed ones. It only says that an agent "may ignore" the validity depending on the configuration (Custom SSL certificate for ActiveGate | Dynatrace Docs). But I can't find anything about this configuration (Customize OneAgent installation on Linux | Dynatrace Docs).

In our company we use .pem files with the public keys on the agents, but I can't find any more information about that either.