fluent / fluent/fluent-bit

TLS: Choose client certificate from Windows Certstore via OID

Open
#11,148 4 comments 0 reactions 0 assignees View on GitHub
enhancement exempt-stale Windows
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 20h
Merged PRs (30d)
71

Description

**Is your feature request related to a problem? Please describe.**

This request is an extension for https://github.com/fluent/fluent-bit/issues/11004 and https://github.com/fluent/fluent-bit/pull/11009.

tls.windows.certstore_name: Root
tls.windows.use_enterprise_store: false
tls.windows.client_thumbprints:

I know in upcoming release, maybe 4.1.2 or 4.2.0 next week, above parameter will take effect to support reading Windows Certstore in Output plugin.
However, in our case, the client certificate on Windows will expire after 6 month and then it will be auto renewed, after that the client_thumbprints will change.
With above client_thumbprints parameter, we need to change the value before it is expired endlessly.

**Describe the solution you'd like**

There is another field could be used to choose one specific certificate named OID which will not be changed after renewal.
For Microsoft CertSrv Infrastructure, we use https://oidref.com/1.3.6.1.4.1.311.21.
So I would like to request to suport this type of parameter such as:
tls.windows.client_OID:

Thanks~

**Describe alternatives you've considered**

**Additional context**

Contributor guide

Open the contributing guide

Research direction

Start by reviewing issue 11004 and pull request 11009, then inspect the Windows Certstore support in the output plugin. Done means a client certificate can be selected by OID and continues working after automatic renewal without changing the thumbprint configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.