TLS: Choose client certificate from Windows Certstore via OID
- Dominant language
- C
- Stars
- 8.1k
- Forks
- 2k
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 71
Description
**Is your feature request related to a problem? Please describe.**
This request is an extension for https://github.com/fluent/fluent-bit/issues/11004 and https://github.com/fluent/fluent-bit/pull/11009.
tls.windows.certstore_name: Root
tls.windows.use_enterprise_store: false
tls.windows.client_thumbprints:
I know in upcoming release, maybe 4.1.2 or 4.2.0 next week, above parameter will take effect to support reading Windows Certstore in Output plugin.
However, in our case, the client certificate on Windows will expire after 6 month and then it will be auto renewed, after that the client_thumbprints will change.
With above client_thumbprints parameter, we need to change the value before it is expired endlessly.
**Describe the solution you'd like**
There is another field could be used to choose one specific certificate named OID which will not be changed after renewal.
For Microsoft CertSrv Infrastructure, we use https://oidref.com/1.3.6.1.4.1.311.21.
So I would like to request to suport this type of parameter such as:
tls.windows.client_OID:
Thanks~
**Describe alternatives you've considered**
**Additional context**
Contributor guide
Research direction
Start by reviewing issue 11004 and pull request 11009, then inspect the Windows Certstore support in the output plugin. Done means a client certificate can be selected by OID and continues working after automatic renewal without changing the thumbprint configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100