How to Disable Port 8022 and Replace Default Certificate on Dynatrace Nodes?

[HuseynNajafli]

Hello everyone,

Today we received a notification regarding potential vulnerabilities in Dynatrace. It was mentioned that Dynatrace nodes are accessible via the web on port 8022, for example:

https://dyntarce-node01.test.local:8022

It appears that Dynatrace’s own default certificate is being used there. Although the certificate has a long validity period, it is indicated as not secure. Based on this, I have several questions:

1. Is it possible to disable port 8022?

2. Is it possible to block web access via the cluster nodes?

3. Most importantly, can we replace this certificate with our own internal certificate?

To be honest, I am not fully sure which ports are used for which purposes, and whether they all use the same certificate. If all of them use the same certificate, can we replace it with our internal certificate? If yes, how can we do that?

I would appreciate your assistance.

Thank you.

[Mizső · Accepted solution]

Hi @HuseynNajafli 

I think you can diable the 8022 port.

Cluster node ports — Dynatrace Managed Docs

Best regards,

János

[HuseynNajafli]

Oh, thank you. And certificate?

[Julius_Loman]

You should block this port using the node's local firewall (iptables/nftables).

Changing the certificate on the dynatrace server process (the one listening on 8022 tcp port) is not supported. All communication to cluster node is through the NGINX where you are in control the certificate (or you use Dynatrace issued certs if you use *.dynatrace-managed.com domain). 

[HuseynNajafli]

Thank you very much.

Just to clarify: does this mean that I can change the certificate used for communication between the nodes themselves? Do Elasticsearch or other components also communicate using the same certificate? And is the certificate used for communication between Dynatrace nodes and Dynatrace servers the same as well?

mcsvc.dynatrace.com, mcsvc-us.dynatrace.com, mcsvc-eu.dynatrace.com, mcsvc-ap.dynatrace.com

If I replace the certificate with our own local certificate, would that cause any issues? When I change the certificate in NGINX, will it automatically change for all other components as well?

Unfortunately, I’m not able to upload images; otherwise, I could have explained everything more clearly with screenshots. By the way, do you know why I might not be able to upload images? It says that I don’t have permission.

[Julius_Loman · Accepted solution]

@HuseynNajafli, the only supported way of changing certificates is this one. You shall not try to change any certificate manually by editing config files or changing any certificate stores. This replaces the certificate on the NGINX - and all communication to the cluster node goes through it - except communication between cluster nodes.