Dynatrace SaaS AWS, using EdgeConnect in corporate network over VPC Endpoint/private Link to Dynatrace Service Endpoint

mweber5 — Thu, 27 Nov 2025 11:38:49 GMT

Hello together,

we have a Dynatrace SaaS tenant in AWS and our corporate network is connected over a VPC endpoint/private link to the Dynatrace SaaS Service endpoint.

We now want to place an EdgeConnect in our corporate network and connect over that private link.

So we reach our tenant xyz12345.apps.dynatrace.com over the private link instead of the Internet.

The EdgeConnect should run in a container on an AWS EC2 instance with Redhad 9 and podman installed.

But the container always exits when trying to connect to the Dynatrace tenant with "TLS error - hostname mismatch"

very simple edgeConnect.yaml:

name: my-edgeconnect
api_endpoint_host: xyz12345.apps.dynatrace.com
log_level: debug
oauth:
client_id: dt0s10.xxxxxxxxx
client_secret: dt0s10.xxxxxxxxxxxxxxxx
resource: urn:dtenvironment:xyz12345
endpoint: sso.dynatrace.com/sso/oauth2/token

error when trying to start the EdgeConnect container:

2025-11-27T08:59:36.260710854+0000 info [edge_connect::dt_oauth] OAuth 2.0 Client Credentials flow succeeded. Token with scope app-engine:edge-connects:connect expires in 300s
2025-11-27T08:59:36.270188903+0000 info [edge_connect::websocket::connection] Connection 1: Opening connection to wss://xyz12345.apps.dynatrace.com/platform/app-engine/edge-connect/v1/connect.
2025-11-27T08:59:36.365668392+0000 info [edge_connect::websocket::manager] Beginning shutdown (initial connection attempt failed)
2025-11-27T08:59:36.365704289+0000 error [edge_connect] Exiting due to error: Initial connection attempt failed: Error establishing connection: TLS error: native-tls error: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1889: (hostname mismatch)

I assume, that it depends on the certificate I get when connecting to Dynatrace over the private link.
Here the certificate for xyz12345.apps.dynatrace.com includes "*.live.dynatrace.com" which is different from the certificate when connecting over the Internet.

Server certificate
subject=C=US, ST=Massachusetts, L=Waltham, O=Dynatrace LLC, CN=*.live.dynatrace.com
issuer=C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1

(Connecting an EdgeConnect to our SaaS tenant directly over the Internet works without problems, but we need it in corporate network over private link)

Does somebody managed to connect EdgeConnect over an AWS private link to Dynatrace SaaS?

Re: Dynatrace SaaS AWS, using EdgeConnect in corporate network over VPC Endpoint/private Link to Dynatrace Service Endpoint

AndrasKovacs — Thu, 04 Dec 2025 14:49:30 GMT

For those of you who are interested: we opened a ticket with Dynatrace and were told that EdgeConnect via AWS Privatelink is not currently supported.

No ETA available yet.

topic Re: Dynatrace SaaS AWS, using EdgeConnect in corporate network over VPC Endpoint/private Link to Dynatrace Service Endpoint in Open Q&A

Dynatrace SaaS AWS, using EdgeConnect in corporate network over VPC Endpoint/private Link to Dynatrace Service Endpoint

Re: Dynatrace SaaS AWS, using EdgeConnect in corporate network over VPC Endpoint/private Link to Dynatrace Service Endpoint