https://community.dynatrace.com/t5/Troubleshooting/Fixing-SSL-Errors-in-OpenTelemetry-SDKs-when-exporting-to/ta-p/269404 <H1><FONT size="5"><STRONG>Abstract</STRONG></FONT></H1> <P>This article addresses SSL errors encountered when using various OpenTelemetry SDKs (Go, Python, Java, etc.) to communicate with the environment ActiveGate in a Kubernetes (K8s) cluster. The issue arises because the environment ActiveGate uses self-signed certificates, which are not accepted by default by the OpenTelemetry SDKs. This article provides troubleshooting steps and solutions to enable the SDKs to accept these self-signed certificates.</P> <P>&nbsp;</P> <H1><FONT size="5"><STRONG>Problem</STRONG></FONT></H1> <P>When configuring OpenTelemetry SDKs to send telemetry data to Dynatrace ActiveGate in a K8s cluster, users may encounter SSL errors. These errors occur because the environment ActiveGate uses self-signed certificates, which the OpenTelemetry SDKs do not trust by default. As a result, the communication between the SDKs and the ActiveGate fails, preventing data from being sent.</P> <P>&nbsp;</P> <H1><FONT size="5"><STRONG>Troubleshooting Steps</STRONG></FONT></H1> <OL> <LI><STRONG>Verify ActiveGate Configuration</STRONG>:<BR />Ensure that the ActiveGate is correctly configured and accessible. You can test the connection using tools like&nbsp;curl&nbsp;to test whether the ActiveGate is reachable within your cluster. For example, you can execute the following command from within a pod in your cluster:<BR /><LI-CODE lang="markup">curl -v http://&lt;activegate-service&gt;.dynatrace.svc.cluster.local</LI-CODE> <P><SPAN>If the connection fails, check the ActiveGate's configuration and network settings. Especially, check if there is a K8s Service object exposing the ActiveGate within the cluster.</SPAN></P> </LI> <LI> <P><STRONG>Check SDK Configuration</STRONG>:<BR /><SPAN>Review the configuration of your OpenTelemetry SDK to ensure it is set up to communicate with the ActiveGate. Verify the endpoint URL and any authentication tokens required.</SPAN></P> </LI> <LI> <P><STRONG>Identify the SSL Error</STRONG>:<BR /><SPAN>If the ActiveGate endpoint is reachable, and you have verified the correctness of the authentication token, check the logs of your OpenTelemetry SDK for SSL-related error messages. Common errors include </SPAN><FONT face="courier new,courier">"SSLHandshakeException"</FONT><SPAN>, </SPAN><FONT face="courier new,courier">"certificate verify failed"</FONT><SPAN>, or similar messages indicating a problem with certificate validation.<BR /></SPAN><SPAN><BR /></SPAN></P> </LI> </OL> <H1><FONT size="5"><STRONG>Resolution</STRONG></FONT></H1> <P>To resolve the SSL errors, you need to configure the OpenTelemetry SDKs to trust the self-signed certificates used by the ActiveGate. As described in the <A href="https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#configuration-options" target="_blank" rel="noopener">OTLP specification</A>, this can be done by setting the <FONT face="courier new,courier">OTEL_EXPORTER_OTLP_CERTIFICATE</FONT> environment variable to the path of the server certificate file.</P> <P><STRONG>Note:</STRONG>&nbsp;for the JavaScript SDK, this environment variable is currently not supported. In this case, you will have to load the trusted certificate programatically, as in the following example:</P> <P>&nbsp;</P> <LI-CODE lang="javascript">const exporter = new OTLPMetricExporter({ // &lt;any other settings you may have&gt; httpAgentOptions: { ca: fs.readFileSync('/path/to/my/cert.pem'), // reading a file like that may throw an exception, add error handling for reading the file as needed } }</LI-CODE> <P>&nbsp;</P> <P><BR />By following these steps, you can configure your OpenTelemetry SDKs to accept self-signed certificates from the Dynatrace ActiveGate, resolving the SSL errors and enabling successful communication.</P> <P>&nbsp;</P> <H1 id="toc-hId-228093595">What's next</H1> <P>If you have any further questions, or encounter any issues not listed above, please feel free to contact our <A href="https://support.dynatrace.com/" target="_blank" rel="noopener">support team.</A></P> <P>If this article has helped you and provided you with good insight, please make sure to give the article a thumbs up (kudos)</P> Fri, 07 Feb 2025 14:00:00 GMT florian_bacher 2025-02-07T14:00:00Z https://community.dynatrace.com/t5/Troubleshooting/Fixing-SSL-Errors-in-OpenTelemetry-SDKs-when-exporting-to/ta-p/269404 <P>This article helps to troubleshoot SSL certificate validation errors when sending telemetry data to an ActiveGate via OTLP</P> Fri, 07 Feb 2025 14:00:00 GMT https://community.dynatrace.com/t5/Troubleshooting/Fixing-SSL-Errors-in-OpenTelemetry-SDKs-when-exporting-to/ta-p/269404 florian_bacher 2025-02-07T14:00:00Z