# How does Dynatrace manage the default Activegate Certificates? **URL:** \ **Category:** Open Q&A\ **Tags:** installation, activegate, documentation\ **Created:** [May 31, 2023, 3:43pm UTC](https://community.dynatrace.com/t/how-does-dynatrace-manage-the-default-activegate-certificates/40014 "2023-05-31T15:43:47Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![JamesD09](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/jamesd09/32/24700_2.png) [@JamesD09](https://community.dynatrace.com/u/JamesD09)\ **Post date:** [May 31, 2023, 3:43pm UTC](https://community.dynatrace.com/t/how-does-dynatrace-manage-the-default-activegate-certificates/40014/1 "2023-05-31T15:43:47Z")
A couple of questions off the back of the subject: - how does DT manage out of date AG certificates? doe they auto renew? (We’re using the default AG cert) - Does Dynatrace have a certificate validity check during install of the AG? Any further information on AG default certificates would be amazing, i can’t seem to find much information in the official docs. ---
**Author:** ![AntonPineiro](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/antonpineiro/32/49_2.png) [@AntonPineiro](https://community.dynatrace.com/u/AntonPineiro)\ **Post date:** [May 31, 2023, 4:13pm UTC](https://community.dynatrace.com/t/how-does-dynatrace-manage-the-default-activegate-certificates/40014/2 "2023-05-31T16:13:34Z")
Hi, Dynatrace has an entry about [Custom SSL certificate for ActiveGate](https://www.dynatrace.com/support/help/shortlink/activegate-configuration-ssl) but I cannot see answers for your questions. Best regards ---
**Author:** ![JamesD09](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/jamesd09/32/24700_2.png) [@JamesD09](https://community.dynatrace.com/u/JamesD09)\ **Post date:** [May 31, 2023, 4:19pm UTC](https://community.dynatrace.com/t/how-does-dynatrace-manage-the-default-activegate-certificates/40014/3 "2023-05-31T16:19:34Z")
Yeah, we’re not intending to use custom ssl certificates. All i can see on the documentation is the following: _Connection to ActiveGate, from OneAgents or REST API, takes place over an encrypted HTTPS channel. ActiveGate presents a self-signed authentication certificate to all connecting clients. While OneAgent instances may ignore the validity of ActiveGate certificates (depending on configuration)._ ---
**Author:** ![Julius\_Loman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/julius_loman/32/51_2.png) [@Julius\_Loman](https://community.dynatrace.com/u/Julius_Loman)\ **Post date:** [May 31, 2023, 5:34pm UTC](https://community.dynatrace.com/t/how-does-dynatrace-manage-the-default-activegate-certificates/40014/4 "2023-05-31T17:34:41Z")
Yes, that’s correct and default behaviour. Dynatrace does not manage the certificates on ActiveGates, only provides you with methods to manage them. Either locally or also using [API](https://www.dynatrace.com/support/help/shortlink/activegate-configuration-ssl#managing-certificates-via-rest-api) (preferred) or even certs can be setup during installation. By default, there is a self-signed certificate issued to \*.clients.dynatrace.org with a 10 year validity. OneAgents can be configured so they connect only to trusted AG (trusted in means of certificate) and it’s not by default. For outgoing connections, AG uses its [truststore](https://www.dynatrace.com/support/help/shortlink/activegate-configuration-trusted-root-certs). ---
**Author:** ![a\_barbera](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/a_barbera/32/824_2.png) [@a\_barbera](https://community.dynatrace.com/u/a_barbera)\ **Post date:** [June 5, 2023, 12:30pm UTC](https://community.dynatrace.com/t/how-does-dynatrace-manage-the-default-activegate-certificates/40014/5 "2023-06-05T12:30:19Z")
Hi [@Julius\_Loman](https://community.dynatrace.com/user/3364) , The default self-signed certificate is this enabled by default, or does the customer need to enable this certificate? After 10 years how the update will happen? Thanks in advance! ---
**Author:** ![LukasNe](https://avatars.discourse-cdn.com/v4/letter/l/e495f1/32.png) [@LukasNe](https://community.dynatrace.com/u/LukasNe)\ **Post date:** [June 6, 2023, 12:42pm UTC](https://community.dynatrace.com/t/how-does-dynatrace-manage-the-default-activegate-certificates/40014/6 "2023-06-06T12:42:49Z")
Hi [@Julius\_Loman](https://community.dynatrace.com/user/3364) , do you have any documentation about the OneAgent configuration? We want to use our own certificates and not the self-signed ones. It only says that an agent “may ignore” the validity depending on the configuration [(Custom SSL certificate for ActiveGate | Dynatrace Docs](https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-activegate/configuration/configure-custom-ssl-certificate-on-activegate)). But I can’t find anything about this configuration ([Customize OneAgent installation on Linux | Dynatrace Docs](https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/installation-and-operation/linux/installation/customize-oneagent-installation-on-linux)). In our company we use .pem files with the public keys on the agents, but I can’t find any more information about that either.