apm-agent-nodejs icon indicating copy to clipboard operation
apm-agent-nodejs copied to clipboard

Support mtls connection

Open WhiteKiwi opened this issue 11 months ago • 0 comments

Is your feature request related to a problem? Please describe. Currently, the elastic-apm-node library does not support mTLS (Mutual TLS) connections to the APM server, which is problematic for secure environments that require mTLS for enhanced security.

Describe the solution you'd like Integrate mTLS support into the elastic-apm-node library, allowing users to specify mTLS certificates and keys directly through the configuration.

Describe alternatives you've considered A workaround involves patching the library manually to add mTLS support, but this is not sustainable or secure as it involves modifying library internals.

Additional context Using a patched version with added mTLS support demonstrates the feasibility and need for this feature. This should be integrated into the official library for enhanced security compliance.

pnpm patch sample:

diff --git a/lib/apm-client/http-apm-client/index.js b/lib/apm-client/http-apm-client/index.js
index 24055ba46850b584d6e003e33aa5aea5242e4c96..f2c51498ea8d739f015ea6b367f233364c1b0389 100644
--- a/lib/apm-client/http-apm-client/index.js
+++ b/lib/apm-client/http-apm-client/index.js
@@ -1607,6 +1607,8 @@ function getConfigRequestOptions(opts, agent) {
 function getBasicRequestOptions(method, defaultPath, headers, opts, agent) {
   return {
     agent,
+    pfx: fs.readFileSync(process.env.MTLS_PFX_PATH),
+    passphrase: process.env.MTLS_PASSPHRASE,
     rejectUnauthorized: opts.rejectUnauthorized !== false,
     ca: opts.serverCaCert,
     hostname: opts.serverUrl.hostname,

WhiteKiwi avatar Mar 07 '24 11:03 WhiteKiwi