Configure SSL certificate for Cluster ActiveGate

How-to guide
2-min read

To configure the SSL certificate of a Cluster ActiveGate, follow the steps below.

Certificate management options

All communication to a Cluster ActiveGate is encrypted over SSL. For external communication, a Cluster ActiveGate requires a publicly available IP address and a domain name with a valid SSL certificate. This domain must be different from the UI domain.

After installation, a Cluster ActiveGate uses a self-signed certificate generated by Dynatrace. You have two options:

Let Dynatrace manage the domain and certificate

Each Cluster ActiveGate with a public IP address receives a dedicated subdomain of dynatrace-managed.com with a trusted SSL certificate signed by a certificate authority (CA).

Use your own domain and certificate

Turn off automatic management and upload your own certificate via the Cluster Management Console or the Cluster REST API v1.

As of April 17, 2025, Chinese regulations require an Internet Content Provider certification for all publicly accessible services using the dynatrace-managed.com domain. Since Dynatrace holds no Internet Content Provider certificate due to the lack of a legal entity in China, Dynatrace domains have been blocked by the local network providers.

To maintain monitoring capabilities, use one of the following options:

Use internal DNS or IP addresses for Cluster ActiveGate endpoints.
Avoid exposing the Dynatrace UI or endpoints to public Chinese networks.

Let Dynatrace manage the domain and certificate

Sign in to the Cluster Management Console.
Go to Deployment Status > ActiveGates, select the ActiveGate, and provide a publicly available IP address.
Select the Cluster node, go to Settings > Public endpoints, and turn on Enable management of domain name and SSL certificates.

Each Cluster ActiveGate with a public IP address receives a dedicated subdomain of dynatrace-managed.com with a trusted SSL certificate signed by a certificate authority (CA).

Use your own domain and certificate

Prepare the certificate files

Collect the SSL certificate and key files you received from your certificate authority (CA):
- Server certificate (.cer or .cert)
- Root and intermediate certificates (.cer or .cert)
- Private key (.pem)
If your private key is encrypted, decrypt it:
```
openssl rsa -in encrypted.ssl.key -out decrypted.ssl.key
```
- encrypted.ssl.key: your encrypted SSL private key file
- decrypted.ssl.key: the output file for the decrypted key
The command prompts you for the password and saves the decrypted key.

Encrypted private keys
Encrypted private keys are not supported.

Disable automatic certificate management

Sign in to the Cluster Management Console.
Select the Cluster node and go to Settings > Public endpoints.
Turn off Enable management of domain name and SSL certificates, and then select Confirm.

If the Cluster ActiveGate used a certificate that Dynatrace manages, it switches to a self-signed certificate.
Select the edit icon next to Cluster ActiveGate URL, enter your domain name, and then select the checkmark or press Enter to save it.

Upload your certificate

Upload or paste your certificate via the Cluster Management Console or the Cluster REST API v1. To use the Cluster Management Console, follow these steps.

Do not upload certificates directly to the device

Do not configure SSL certificates directly on the Cluster ActiveGate device, because automatic certificate management overwrites any certificate uploaded this way. Always upload your certificate using the Cluster Management Console or the Cluster REST API v1.

Name-mismatch error

Your certificate is tied to a specific hostname. To avoid a name-mismatch error, make sure the common name in the certificate matches the address specified in the Cluster ActiveGate URL field.

Sign in to the Cluster Management Console.
On the Deployment Status page, expand the ActiveGate you want to configure and select Configure.
Select Edit SSL certificate.
Paste or upload the key files you received from your CA.
- Private key: your private key.
- Public key certificate: your server certificate.
- Certificate chain: your root and intermediate certificates.
All keys and certificates must be in PEM format with full BEGIN and END headers.
Key format:
-----BEGIN PRIVATE KEY-----
(Private Key)
-----END PRIVATE KEY-----
Certificate format:
-----BEGIN CERTIFICATE-----
(SSL Certificate)
-----END CERTIFICATE-----
Select Save.

The Cluster Management Console uploads the certificate to the Cluster ActiveGate and then shows the certificate details. Check that Issuer, Subject, and Expires show your certificate. If the page shows Cluster ActiveGate restart is required, restart the Cluster ActiveGate.

Certificate management options

After installation, a Cluster ActiveGate uses a self-signed certificate generated by Dynatrace. You have two options:

To maintain monitoring capabilities, use one of the following options:

Use internal DNS or IP addresses for Cluster ActiveGate endpoints.
Avoid exposing the Dynatrace UI or endpoints to public Chinese networks.

Let Dynatrace manage the domain and certificate

Sign in to the Cluster Management Console.
Go to Deployment Status > ActiveGates, select the ActiveGate, and provide a publicly available IP address.
Select the Cluster node, go to Settings > Public endpoints, and turn on Enable management of domain name and SSL certificates.

Each Cluster ActiveGate with a public IP address receives a dedicated subdomain of dynatrace-managed.com with a trusted SSL certificate signed by a certificate authority (CA).

Use your own domain and certificate

Prepare the certificate files

Collect the SSL certificate and key files you received from your certificate authority (CA):
- Server certificate (.cer or .cert)
- Root and intermediate certificates (.cer or .cert)
- Private key (.pem)
If your private key is encrypted, decrypt it:
```
openssl rsa -in encrypted.ssl.key -out decrypted.ssl.key
```
- encrypted.ssl.key: your encrypted SSL private key file
- decrypted.ssl.key: the output file for the decrypted key
The command prompts you for the password and saves the decrypted key.

Encrypted private keys
Encrypted private keys are not supported.

Disable automatic certificate management

Sign in to the Cluster Management Console.
Select the Cluster node and go to Settings > Public endpoints.
Turn off Enable management of domain name and SSL certificates, and then select Confirm.

If the Cluster ActiveGate used a certificate that Dynatrace manages, it switches to a self-signed certificate.
Select the edit icon next to Cluster ActiveGate URL, enter your domain name, and then select the checkmark or press Enter to save it.

Upload your certificate

Upload or paste your certificate via the Cluster Management Console or the Cluster REST API v1. To use the Cluster Management Console, follow these steps.

Do not upload certificates directly to the device

Name-mismatch error

Your certificate is tied to a specific hostname. To avoid a name-mismatch error, make sure the common name in the certificate matches the address specified in the Cluster ActiveGate URL field.

Sign in to the Cluster Management Console.
On the Deployment Status page, expand the ActiveGate you want to configure and select Configure.
Select Edit SSL certificate.
Paste or upload the key files you received from your CA.
- Private key: your private key.
- Public key certificate: your server certificate.
- Certificate chain: your root and intermediate certificates.
All keys and certificates must be in PEM format with full BEGIN and END headers.
Key format:
-----BEGIN PRIVATE KEY-----
(Private Key)
-----END PRIVATE KEY-----
Certificate format:
-----BEGIN CERTIFICATE-----
(SSL Certificate)
-----END CERTIFICATE-----
Select Save.

The Cluster Management Console uploads the certificate to the Cluster ActiveGate and then shows the certificate details. Check that Issuer, Subject, and Expires show your certificate. If the page shows Cluster ActiveGate restart is required, restart the Cluster ActiveGate.