Is your feature request related to a problem? Please describe.
The mutual_tls authentication plugin (#6916) currently only accepts a single file path for
ssl_trust_certificate_file. This has two limitations:
-
No inline PEM content support. Other Data Prepper configurations (e.g., http-client-common)
support inline PEM strings in addition to file paths. The mutual_tls plugin is inconsistent.
-
No explicit list of multiple CA files. While multiple CAs can be concatenated into a single
PEM file (which works today), some deployments manage CA certificates as separate files and
would benefit from a list syntax.
Describe the solution you'd like
Option A: Accept either a file path or inline PEM content in ssl_trust_certificate_file
(auto-detect based on whether the value starts with -----BEGIN).
Option B: Add a new ssl_trust_certificate_files (list) parameter alongside the existing
single-file parameter:
authentication:
mutual_tls:
ssl_trust_certificate_files:
- "/certs/ca1.crt"
- "/certs/ca2.crt"
Or with inline PEM:
authentication:
mutual_tls:
ssl_trust_certificate_file: |
-----BEGIN CERTIFICATE-----
MIIBxTCCAW...
-----END CERTIFICATE-----
Describe alternatives you've considered
- Concatenating multiple CA certs into a single PEM file (works today, documented as workaround)
Additional context
Identified during review of #6916. The current single-file-path approach was chosen to keep
the initial implementation focused. Multiple CAs already work via PEM concatenation in a
single file.
Is your feature request related to a problem? Please describe.
The
mutual_tlsauthentication plugin (#6916) currently only accepts a single file path forssl_trust_certificate_file. This has two limitations:No inline PEM content support. Other Data Prepper configurations (e.g.,
http-client-common)support inline PEM strings in addition to file paths. The
mutual_tlsplugin is inconsistent.No explicit list of multiple CA files. While multiple CAs can be concatenated into a single
PEM file (which works today), some deployments manage CA certificates as separate files and
would benefit from a list syntax.
Describe the solution you'd like
Option A: Accept either a file path or inline PEM content in
ssl_trust_certificate_file(auto-detect based on whether the value starts with
-----BEGIN).Option B: Add a new
ssl_trust_certificate_files(list) parameter alongside the existingsingle-file parameter:
Or with inline PEM:
Describe alternatives you've considered
Additional context
Identified during review of #6916. The current single-file-path approach was chosen to keep
the initial implementation focused. Multiple CAs already work via PEM concatenation in a
single file.