bitwarden / bitwarden/splunk

Support for custom CA path in _get_custom_ca_certificate_location function

Open
#111 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
19
Forks
9
PR merge metrics
No merged PRs in 30d

Description

Hi,

It would be helpful if the CA cert path could be set to a custom location like `/etc/ssl/certs/ca-certificates.crt` or `/etc/pki/tls/certs/ca-bundle.crt` which are common paths for the systems CA cert bundles. Currently the [_get_custom_ca_certificate_location](https://github.com/bitwarden/splunk/blob/main/src/bitwarden_api.py#L41) function only supports placing CA certs in `$SPLUNK_HOME/etc/auth/bitwarden_event_logs_cacerts.pem`. I was also unable to find any documentation regarding the placement of CA certs in the event TLS validation is required. If this is something that can be changed, I can submit a PR. Thank you!

Possible solution using an environment variable called BITWARDEN_APP_CACERTS

```python3
def _get_custom_ca_certificate_location() -> Optional[str]:
path = os.environ.get(
"BITWARDEN_APP_CACERTS",
os.path.join(
os.environ.get("SPLUNK_HOME", ""),
"etc", "auth", "bitwarden_event_logs_cacerts.pem"
)
)
return path if os.path.isfile(path) else None
```

Contributor guide

Open the contributing guide

Research direction

Read src/bitwarden_api.py, starting with _get_custom_ca_certificate_location, then trace where its returned path is used for event TLS validation. Done means a configured custom CA path such as BITWARDEN_APP_CACERTS is supported when the file exists, with the current default behavior preserved when it is not set.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.