<p>As per documentation to enable cluster metrics, I should create re-encrypting route as per the below statement</p>

<pre><code>$ oc create route reencrypt hawkular-metrics-reencrypt \
--hostname hawkular-metrics.example.com \ 
--key /path/to/key \ 
--cert /path/to/cert \ 
--ca-cert /path/to/ca.crt \ 
 --service hawkular-metrics
 --dest-ca-cert /path/to/internal-ca.crt 
</code></pre>

<ul>
<li>What exactly should I use for these keys and certificates? </li>
<li>Are these already exists somewhere or I need to create them?</li>
</ul>

<p>Openshift Metrics developer here.</p>

<p>Sorry if the docs were not clear enough.</p>

<p>The route is used to expose Hawkular Metrics, particularly to the browser running the OpenShift console.</p>

<p>If you don't specify any certificates, the system will use a self signed certificate instead. The browser will complain that this self signed certificate is not trusted, but you can usually just click through to accept it anyways. If you are ok with this, then you don't need to do any extra steps.</p>

<p>If you want the browser to trust this connection by default, then you will need to provide your own certificates signed by a trusted certificate authority. This is exactly similar to how you would have to generate your own certificate if you are running a normal site under https.</p>

<p>From the following command:</p>

<blockquote>
  <p>$ oc create route reencrypt hawkular-metrics-reencrypt \ --hostname hawkular-metrics.example.com \ --key /path/to/key \ --cert /path/to/cert \ --ca-cert /path/to/ca.crt \ --service hawkular-metrics --dest-ca-cert /path/to/internal-ca.crt</p>
</blockquote>

<p>'cert' corresponds to your certificate signed by the certificate authority</p>

<p>'key' corresponds to the key for your certificate</p>

<p>'ca-cert' corresponds to the certificate authorities certificate</p>

<p>'dest-ca-cert' corresponds to the certificate authority which signed the self signed certificate generated by the metrics deployer</p>

<p>The docs <a href="https://docs.openshift.com/enterprise/3.2/install_config/cluster_metrics.html#metrics-reencrypting-route" rel="nofollow">https://docs.openshift.com/enterprise/3.2/install_config/cluster_metrics.html#metrics-reencrypting-route</a> should explain how to get the dest-ca-cert from the system</p>
