anchor.diff:  ----
   ====
   
  +[[reencrypting-route]]
  +== Using a Re-encrypting Route
  +
  +[NOTE]
  +====
  +The following section is not required if the *hawkular-metrics.pem* secret was specified
  +as a link:../install_config/cluster_metrics.html#metrics-deployer-secrets[deployer secret].
  +====
  +
  +By default the Hawkular Metrics server will be using self-signed certificate which will not
  +be trusted by a browser or other external services. If you wish to provide your own trusted
  +certificate to be used for external access you can do so using a route with a 
  +link:../architecture/core_concepts/routes.html#secured-routes[re-encryption termination].
  +
  +The creating this new route you will require that the default route which uses self-signed
  +certificates be deleted.
  +
  +[options="nowrap"]
  +----
  +$ oc delete route hawkular-metrics
  +----
  +
  +A new route with a link:../architecture/core_concepts/routes.html#secured-routes[re-encryption termination]
  +will then need to be created.
  +
  +[source,yaml]
  +----
  +apiVersion: v1
  +kind: Route
  +metadata:
  +  name: hawkular-metrics-reencrypt
  +spec:
  +  host: hawkular-metrics.example.com <1>
  +  port:
  +    targetPort: 8443
  +  to:
  +    kind: Service
  +    name: hawkular-metrics
  +  tls:
  +    termination: reencrypt       
  +    key: |-
  +      -----BEGIN PRIVATE KEY-----
  +      [...] <2>
  +      -----END PRIVATE KEY-----
  +    certificate: |-
  +      -----BEGIN CERTIFICATE-----
  +      [...] <2>
  +      -----END CERTIFICATE-----
  +    caCertificate: |-
  +      -----BEGIN CERTIFICATE-----
  +      [...] <2>
  +      -----END CERTIFICATE-----
  +    destinationCaCertificate: |-  
  +      -----BEGIN CERTIFICATE-----
  +      [...] <3>
  +      -----END CERTIFICATE-----
  +----
  +<1> The value specified in the *HAWKULAR_METRICS_HOSTNAME* template parameter.
  +<2> These need to define the custom certificate you wish to provide.
  +<3> This needs to correspond to the CA used to sign the internal Hawkular Metrics certificate
  +
  +The CA used to sign the internal Hawkular Metrics certificate can be found from the 
  +*hawkular-metrics-certificate* secret:
  +
  +[options="nowrap"]
  +----
  +$ base64 -d <<< `oc get -o yaml secrets hawkular-metrics-certificate | grep -i hawkular-metrics-ca.certificate | awk '{print $2}'`
  +----
  +
  +
  +
   [[configuring-openshift-metrics]]
   
   == Configuring OpenShift
  
positive.code: === Metrics Deployer Secrets
  
  By default, the *metrics deployer* auto-generates self-signed certificates for
  use between components. To provide your own certificates, you can pass these
  values as link:../dev_guide/secrets.html[secrets] to the *metrics deployer*.
  
  [WARNING]
  ====
  By default, the Hawkular Metrics service uses self-signed certificates, which
  can cause problems when the console accesses it in a web browser. As an
  alternative, you can specify your own *_hawkular-metrics.pem_* secret to use a
  certificate that is trusted by the browser.
  
  When supplying your own certificate for the Hawkular Metrics service, it must
  contain both the host name specified for the route as well as the internally
  used *hawkular-metrics* host name.
  ====
  
  Optionally, provide your own certificate that is configured to be trusted by
  
negative.code: 
  |*_hawkular-metrics.pem_*
  |The *_pem_* file to use for the Hawkular Metrics certificate. This certificate
  must contain the *'hawkular-metrics'* host name as well as the publicly available
  host name used by the route. This file is auto-generated if unspecified.
  
  |*_hawkular-metrics-ca.cert_*
  