Skip to content

[FEATURE] Support inline PEM content and multiple trust certificate files for mutual_tls #6941

Description

@divakarsingh

Is your feature request related to a problem? Please describe.

The mutual_tls authentication plugin (#6916) currently only accepts a single file path for
ssl_trust_certificate_file. This has two limitations:

  1. No inline PEM content support. Other Data Prepper configurations (e.g., http-client-common)
    support inline PEM strings in addition to file paths. The mutual_tls plugin is inconsistent.

  2. No explicit list of multiple CA files. While multiple CAs can be concatenated into a single
    PEM file (which works today), some deployments manage CA certificates as separate files and
    would benefit from a list syntax.

Describe the solution you'd like

Option A: Accept either a file path or inline PEM content in ssl_trust_certificate_file
(auto-detect based on whether the value starts with -----BEGIN).

Option B: Add a new ssl_trust_certificate_files (list) parameter alongside the existing
single-file parameter:

authentication:
  mutual_tls:
    ssl_trust_certificate_files:
      - "/certs/ca1.crt"
      - "/certs/ca2.crt"

Or with inline PEM:

authentication:
  mutual_tls:
    ssl_trust_certificate_file: |
      -----BEGIN CERTIFICATE-----
      MIIBxTCCAW...
      -----END CERTIFICATE-----

Describe alternatives you've considered

  • Concatenating multiple CA certs into a single PEM file (works today, documented as workaround)

Additional context

Identified during review of #6916. The current single-file-path approach was chosen to keep
the initial implementation focused. Multiple CAs already work via PEM concatenation in a
single file.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Fields

No fields configured for issues without a type.

Projects

Status
Unplanned

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions