opensearch-project / opensearch-project/data-prepper
[FEATURE] Support inline PEM content and multiple trust certificate files for mutual_tls
@divakarsingh is already working on this.
Since Jun 30, 2026.
- Dominant language
- Java
- Stars
- 374
- Forks
- 354
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 8
Description
Is your feature request related to a problem? Please describe.
The mutual_tls authentication plugin (#6916) currently only accepts a single file path for
ssl_trust_certificate_file. This has two limitations:
-
No inline PEM content support. Other Data Prepper configurations (e.g.,
http-client-common)
support inline PEM strings in addition to file paths. Themutual_tlsplugin is inconsistent. -
No explicit list of multiple CA files. While multiple CAs can be concatenated into a single
PEM file (which works today), some deployments manage CA certificates as separate files and
would benefit from a list syntax.
Describe the solution you'd like
Option A: Accept either a file path or inline PEM content in ssl_trust_certificate_file
(auto-detect based on whether the value starts with -----BEGIN).
Option B: Add a new ssl_trust_certificate_files (list) parameter alongside the existing
single-file parameter:
authentication:
mutual_tls:
ssl_trust_certificate_files:
- "/certs/ca1.crt"
- "/certs/ca2.crt"
Or with inline PEM:
authentication:
mutual_tls:
ssl_trust_certificate_file: |
-----BEGIN CERTIFICATE-----
MIIBxTCCAW...
-----END CERTIFICATE-----
Describe alternatives you've considered
- Concatenating multiple CA certs into a single PEM file (works today, documented as workaround)
Additional context
Identified during review of #6916. The current single-file-path approach was chosen to keep
the initial implementation focused. Multiple CAs already work via PEM concatenation in a
single file.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.