Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support mtls connection #3902

Open
WhiteKiwi opened this issue Mar 7, 2024 · 0 comments
Open

Support mtls connection #3902

WhiteKiwi opened this issue Mar 7, 2024 · 0 comments

Comments

@WhiteKiwi
Copy link

Is your feature request related to a problem? Please describe.
Currently, the elastic-apm-node library does not support mTLS (Mutual TLS) connections to the APM server, which is problematic for secure environments that require mTLS for enhanced security.

Describe the solution you'd like
Integrate mTLS support into the elastic-apm-node library, allowing users to specify mTLS certificates and keys directly through the configuration.

Describe alternatives you've considered
A workaround involves patching the library manually to add mTLS support, but this is not sustainable or secure as it involves modifying library internals.

Additional context
Using a patched version with added mTLS support demonstrates the feasibility and need for this feature. This should be integrated into the official library for enhanced security compliance.

pnpm patch sample:

diff --git a/lib/apm-client/http-apm-client/index.js b/lib/apm-client/http-apm-client/index.js
index 24055ba46850b584d6e003e33aa5aea5242e4c96..f2c51498ea8d739f015ea6b367f233364c1b0389 100644
--- a/lib/apm-client/http-apm-client/index.js
+++ b/lib/apm-client/http-apm-client/index.js
@@ -1607,6 +1607,8 @@ function getConfigRequestOptions(opts, agent) {
 function getBasicRequestOptions(method, defaultPath, headers, opts, agent) {
   return {
     agent,
+    pfx: fs.readFileSync(process.env.MTLS_PFX_PATH),
+    passphrase: process.env.MTLS_PASSPHRASE,
     rejectUnauthorized: opts.rejectUnauthorized !== false,
     ca: opts.serverCaCert,
     hostname: opts.serverUrl.hostname,
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant