In Replication, the Server is the Target engine and the Client is the Source engine.

Replacing or renewing an expired TLS certificate (DSP, HTTPS, or STUNNEL) does not trigger an automatic restart of the Delphix Engine. After uploading a new certificate, you must perform a manual stack restart for the updated certificate to be used by all internal services. Until a restart occurs, the engine may continue using the old, expired certificate, which can cause SSL/TLS handshake failures. This behavior applies only to certificate renewal. For first-time Server or Client Authentication setup, the engine does restart automatically when you click Submit.

Enable server authentication

To enable Server Authentication, do the following:

  1. Replace the desired certificate for DSP (Delphix Session Protocol) in the Target engine KeyStore. For more details, refer to Configure network settings.

  2. Add the full CA chain of the replaced certificate from the Target engine to the TrustStore on the Source engine. The CA chain must match on both engines. For more details, refer to TrustStore Settings.

  3. Select the option Perform Server (target engine) authorization for Replication for both Target and Source engines.

Enable client authentication

To enable Client Authentication, enable Server Authentication (refer to above steps), then do the following:

  1. Replace the desired certificate for DSP in the Source engine KeyStore. For more details, refer to Configure network settings.

  2. Add the full CA chain of the replaced certificate from the Source engine to the TrustStore on the Target engine. The CA chain must match on both engines. For more details, refer to TrustStore Settings.

  3. Select the option Perform Client (source engine) authorization for Replication for both Target and Source engines.

  4. Once the configurations have been set as desired, you will be presented with a summary page. Clicking Submit will trigger a stack restart as that is necessary for the configuration changes to take effect. All jobs will be stopped, but VDBs will continue to run.

    The automatic restart described above applies only to initial Server or Client Authentication configuration. For certificate renewal, the system does not restart automatically. A manual engine restart is required for the new certificate to take effect.
Last updated
Oct 14, 2026