Configuring PowerConnect Cloud Connections

Applies to: 9.2.0 and later · Role required: administrator

Overview

A connection profile is a named set of outbound HTTP settings - proxy, TLS
verification, client certificate, pool sizing, timeout, and retries - that inputs and
outputs select between. They are managed under Configuration → Connections.

Before 9.2.0 these settings were engine-wide, now a profile scopes those settings
to the inputs and outputs that select it, so one endpoint's requirements stay with that
endpoint.

Two profiles are built in and cannot be deleted:

On upgrade these are seeded from the engine's existing HTTP settings (HTTP_INPUT_* /
HTTP_OUTPUT_* and anything persisted in engine.edn), so an upgraded deployment behaves
as it did before. You only need to create a profile when some endpoint needs treatment the
default does not give it.

Two things worth knowing before you start:

• Changes apply without a restart. Saving a profile rebuilds its HTTP client, and the
  next connection uses the new settings. Polls already running are not interrupted.

• Profiles replicate across a cluster. Create or edit a profile on any node and every
  node picks it up. Proxy passwords are held in the keystore, never in connections.edn.

Creating a connection profile

1. Go to Configuration → Connections and press +.

2. Enter an ID. This identifies the profile in the input and output forms and cannot be
   changed afterwards. Only letters, numbers, underscore and hyphen are accepted. Pick
   something that names the endpoint or the reason the profile exists, such as
   activegate or via-corp-proxy.

3. Enter a Name. This is the label operators see; it can be changed at any time.

4. Set the fields you need. Everything not set takes the default in the table below.

5. Press Save.

The profile appears in the table straight away and is immediately selectable on inputs and
outputs.

Field reference

On disabling TLS verification. This turns off both certificate trust and hostname
matching for every endpoint the profile reaches, which means the connection can no longer
tell the endpoint from anything sitting in front of it. Where an endpoint uses a
self-signed or private-CA certificate, import the certificate instead. The two sections
below cover it. If you do disable verification, do it on a profile used by that one
input or output and nothing else.

Assigning a profile to an input or output

1. Edit the input or output.

2. Open the Advanced tab.

3. Pick the profile from the Connection list.

4. Save, then use the Test tab to confirm the endpoint is reachable through it.

The Connection list appears only where it applies: inputs that collect over HTTP, and
outputs that send over HTTP. Inputs that use another transport, JDBC and the Datasphere
inputs for example, do not show it. An input or output with nothing selected uses the
built-in default for its type.

Common tasks

Route one endpoint through a proxy

Create a profile with Proxy URL set (and Proxy User / Proxy Password if the
proxy authenticates), then assign it to the inputs and outputs for that endpoint. Anything
still on the default profile continues to connect directly.

Connect to an endpoint with a self-signed or private-CA certificate

This is the usual reason a connection fails after upgrading to 9.2.0, and the fix is
normally an import rather than a profile change:

1. Edit the affected input or output and press Test.

2. The test fails and a Certificate tab appears, showing what the endpoint presented -
   subject, issuer, alternative names, expiry, SHA-256 fingerprint and why it was
   rejected.

3. Check the fingerprint against the endpoint, then press Import Certificate.

4. Press Test again.

The certificate is trusted in addition to the public CAs, replicated across the cluster,
and picked up without a restart. Where the connection goes through a proxy the certificate
cannot be read this way, upload it under Configuration → Certificates → Import
Certificate instead.

Accept a certificate issued to a different hostname

Some endpoints present a certificate issued to a name they do not answer on. A Dynatrace
ActiveGate using its shipped certificate is the common case: it is issued to
*.clients.dynatrace.org whatever hostname you reach it on, so importing establishes trust
but hostname matching still fails.

For those, import the certificate as above, then create a profile with Accept an imported
certificate on any hostname ticked and assign it to that input or output.

Use a profile dedicated to the endpoint. The setting applies to every certificate you have
imported, so a profile carrying it should reach as few endpoints as possible and it is
why the setting is per profile rather than a single global switch.

Present a client certificate (mutual TLS)

Import the client certificate and its private key under Configuration → Certificates,
then tick Present client certificate (mutual TLS) on the profile the input or output
uses. The certificate is offered only when the endpoint requests one, and an expired
certificate is withheld rather than offered and rejected.

Give a demanding endpoint its own pool

Where one endpoint is slow, rate-limited, or high-volume, create a profile with its own
Max Connections, Max Connections Per Route and Connection Timeout, and assign it
to that endpoint's inputs and outputs. The defaults stay where they are for everything else.

Editing and deleting profiles

Edit a profile with the pencil icon. Built-in profiles can be edited but not deleted, the
delete icon is disabled on them.

Deleting a profile also deletes its stored proxy password. Inputs and outputs still
referencing a deleted profile fall back to the built-in default for their type and keep
running, so a delete does not stop collection but it does silently change how those
connections are made. Check what is using a profile before deleting it.

Troubleshooting