Try it free

Add certificate to truststore

  • How-to guide
  • 1-min read

To add an SSL certificate to the Managed Cluster truststore when the Managed Cluster can't verify SSL connections, follow the steps below. You typically need this when you send email or webhook notifications with a self-signed certificate.

Step 1 Check for certificate rejection

  1. Look for files that match the name pattern Server.*.*.log in the log directory of your Cluster node installation if the Managed Cluster has trouble sending notifications.

  2. Search the matching log files for the following entry.

    sun.security.validator.ValidatorException: PKIX path building failed:
    sun.security.provider.certpath.SunCertPathBuilderException

Certificate rejection typically occurs when the certificate provided by the notification receiver isn't accepted by the Cluster node. The reason is usually that the certificate isn't trusted.

Step 2 Add certificate to truststore

Use the PEM certificate (.crt, .pem, .cer) and run the reconfiguration script on every node in the Managed Cluster using the --update-cert and --network-proxy-cert-file parameters. Use the nohup command to prevent interruption of script execution (such as session disconnect) during important operations.

nohup <PRODUCT_PATH>/installer/reconfigure.sh --update-cert --network-proxy-cert-file <cert_file>.cer &

Replace <PRODUCT_PATH> with the Dynatrace Managed installation path (default: /opt/dynatrace-managed) and <cert_file> with the name of your certificate file.

The script restarts the Dynatrace processes on the Cluster node, except Elasticsearch and Cassandra.

Proxy parameter

The --network-proxy-cert-file parameter supplies a proxy certificate for Dynatrace Managed, but you can also use it to supply the certificate for any secure connection to the Managed Cluster.

Step 3 Confirm that the certificate is accepted

  1. After the script finishes on every Cluster node, trigger a notification that previously failed, such as an email or webhook notification.

  2. Search the Server.*.*.log files for new PKIX path building failed entries. The certificate is accepted when the notification is delivered and no new entry appears.