opensearch-project / opensearch-project/data-prepper

[FEATURE] Support inline PEM content and multiple trust certificate files for mutual_tls

Open
#6,941 0 comments 0 reactions 1 assignee View on GitHub

@divakarsingh is already working on this.

Since Jun 30, 2026.

enhancement
Dominant language
Java
Stars
374
Forks
354
Avg merge
3d 18h
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.

The mutual_tls authentication plugin (#6916) currently only accepts a single file path for
ssl_trust_certificate_file. This has two limitations:

  1. No inline PEM content support. Other Data Prepper configurations (e.g., http-client-common)
    support inline PEM strings in addition to file paths. The mutual_tls plugin is inconsistent.

  2. No explicit list of multiple CA files. While multiple CAs can be concatenated into a single
    PEM file (which works today), some deployments manage CA certificates as separate files and
    would benefit from a list syntax.

Describe the solution you'd like

Option A: Accept either a file path or inline PEM content in ssl_trust_certificate_file
(auto-detect based on whether the value starts with -----BEGIN).

Option B: Add a new ssl_trust_certificate_files (list) parameter alongside the existing
single-file parameter:

authentication:
  mutual_tls:
    ssl_trust_certificate_files:
      - "/certs/ca1.crt"
      - "/certs/ca2.crt"

Or with inline PEM:

authentication:
  mutual_tls:
    ssl_trust_certificate_file: |
      -----BEGIN CERTIFICATE-----
      MIIBxTCCAW...
      -----END CERTIFICATE-----

Describe alternatives you've considered

  • Concatenating multiple CA certs into a single PEM file (works today, documented as workaround)

Additional context

Identified during review of #6916. The current single-file-path approach was chosen to keep
the initial implementation focused. Multiple CAs already work via PEM concatenation in a
single file.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.