What is the correct way to handle Root and Developer certificates for signing Dynatrace extensions?

[Eyad]

Hi all,
What is the correct way to handle Root and Developer certificates for signing Dynatrace extensions? if more than 2 developers are working on the extensions.

[Mike_L · Accepted solution]

Generate the developer certificates as leaf certificates of the root certificate. Place the public root certificate on the ActiveGate/OneAgent (and upload it to Dynatrace). If a developer does something that requires a revoke, you don't have to revoke the whole root certificate, you only have to mark the developer leaf certificate in the certificate revocation list.

[Eyad]

Thank you, Mike!