elastic / elastic/beats

Support for certificate and key loading from OS stores

Open
#16,267 13 comments 2 reactions 0 assignees View on GitHub
[zube]: Inbox enhancement libbeat Team:Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

Currently, beats only supports providing files for certificate and key for client authentication.

In operations of fleets of endpoints, client certificates are stored in the secure OS space for it: keychain in MacOS, Windows certificate store for Windows.

To extract events securely from these endpoints/systems, these certificates are needed, and exposing them as files in the filesystems poses a challenge in securing device identity.

The use case is for beats to allow the usage of client certificates from the OS secure stores. This might be related to https://github.com/elastic/beats/issues/13591

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how Beats currently loads client certificates and keys from files, then read the related issue #13591. Define which macOS keychain and Windows certificate-store use cases are supported and what secure certificate selection and authentication behavior would count as done.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
operating-systems, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.