Replacing or renewing an expired TLS certificate (DSP, HTTPS, or STUNNEL) does not trigger an automatic restart of the Delphix Engine. After uploading a new certificate, you must perform a manual stack restart for the updated certificate to be used by all internal services. Until a restart occurs, the engine may continue using the old, expired certificate, which can cause SSL/TLS handshake failures. This behavior applies only to certificate renewal. For first-time Server or Client Authentication setup, the engine does restart automatically when you click Submit.

Enable server authentication

To enable Server Authentication, do the following:

  1. If using the engine to engine tests, follow the steps for Replication Server Authentication.

  2. If using the engine to host tests, follow the steps for Remote Connections Server Authentication.

  3. Select the option Perform Server (this engine) authorization for remote connections.

Enable client authentication

To enable Client Authentication, enable Server Authentication (refer to above steps), then do the following:

  1. If using the engine to engine tests, follow the steps for Replication Client Authentication.

  2. If using the engine to host tests, follow the steps for Remote Connections Client Authentication.

  3. Select the option Perform Client (target engine or host) authorization for remote connections.

  4. Once the configurations have been set as desired, you will be presented with a summary page. Clicking Submit will trigger a stack restart as that is necessary for the configuration changes to take effect. All jobs will be stopped, but VDBs will continue to run.

    The automatic restart described above applies only to initial Server or Client Authentication configuration. For certificate renewal, the system does not restart automatically. A manual engine restart is required for the new certificate to take effect.
Delphix Engine generates alerts when certificates in the Keystore or truststore are expired or about to expire:
  • A warning level alert is generated if certificates are expiring in 60 days.

  • Critical level alerts are generated if certificates expire in 14 days or have already expired.

Last updated
Oct 9, 2026