Support for certificate and key loading from OS stores
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
Currently, beats only supports providing files for certificate and key for client authentication.
In operations of fleets of endpoints, client certificates are stored in the secure OS space for it: keychain in MacOS, Windows certificate store for Windows.
To extract events securely from these endpoints/systems, these certificates are needed, and exposing them as files in the filesystems poses a challenge in securing device identity.
The use case is for beats to allow the usage of client certificates from the OS secure stores. This might be related to https://github.com/elastic/beats/issues/13591
Contributor guide
Research direction
Start by reviewing how Beats currently loads client certificates and keys from files, then read the related issue #13591. Define which macOS keychain and Windows certificate-store use cases are supported and what secure certificate selection and authentication behavior would count as done.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100