Support for custom CA path in _get_custom_ca_certificate_location function
- Dominant language
- Python
- Stars
- 19
- Forks
- 9
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
It would be helpful if the CA cert path could be set to a custom location like `/etc/ssl/certs/ca-certificates.crt` or `/etc/pki/tls/certs/ca-bundle.crt` which are common paths for the systems CA cert bundles. Currently the [_get_custom_ca_certificate_location](https://github.com/bitwarden/splunk/blob/main/src/bitwarden_api.py#L41) function only supports placing CA certs in `$SPLUNK_HOME/etc/auth/bitwarden_event_logs_cacerts.pem`. I was also unable to find any documentation regarding the placement of CA certs in the event TLS validation is required. If this is something that can be changed, I can submit a PR. Thank you!
Possible solution using an environment variable called BITWARDEN_APP_CACERTS
```python3
def _get_custom_ca_certificate_location() -> Optional[str]:
path = os.environ.get(
"BITWARDEN_APP_CACERTS",
os.path.join(
os.environ.get("SPLUNK_HOME", ""),
"etc", "auth", "bitwarden_event_logs_cacerts.pem"
)
)
return path if os.path.isfile(path) else None
```
Contributor guide
Research direction
Read src/bitwarden_api.py, starting with _get_custom_ca_certificate_location, then trace where its returned path is used for event TLS validation. Done means a configured custom CA path such as BITWARDEN_APP_CACERTS is supported when the file exists, with the current default behavior preserved when it is not set.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100