[OTLP] Add mTLS Support for OTLP Exporter #6343

sandy2008 · 2025-06-20T07:13:46Z

Fixes #2009
Design discussion issue #5918

Changes

This PR adds support for mutual TLS (mTLS) configuration to the OTLP exporter on .NET 8 and later. This allows users to specify certificate paths, enable validation, and inject custom server certificate validation logic.

Key changes include:

OtlpMtlsOptions class with properties like ClientCertificatePath, ClientKeyPath, CaCertificatePath, EnableFilePermissionChecks, etc.
OtlpMtlsHttpClientFactory for creating HttpClient instances configured for mTLS.
OtlpMtlsCertificateManager for certificate loading, validation, and file permission checks.
Extended event logging via OpenTelemetryProtocolExporterEventSource for mTLS events.
Unit tests for configuration handling and certificate behavior.
Initial integration and performance test stubs added.

mTLS support is only enabled for builds targeting NET8_0_OR_GREATER.

Merge requirement checklist

[CONTRIBUTING](https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/CONTRIBUTING.md) guidelines followed (license requirements, nullable enabled, static analysis, etc.)
Unit tests added/updated
Appropriate CHANGELOG.md files updated for non-trivial changes
Changes in public API reviewed (if applicable)

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsCertificateManager.cs

martincostello · 2025-06-20T07:30:07Z

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsCertificateManager.cs

+
+            // Configure chain policy
+            chain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
+            chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;


Do we need to support Offline for if a user is running in a closed environment?

@martincostello Does this commit look ok? 7368c9e

I got the same concern as @martincostello, your commit looks fine with me. Why that's not a part of the PR?

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsCertificateManager.cs

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsHttpClientFactory.cs

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/OtlpExporterOptions.cs

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/OtlpMtlsOptions.cs

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsCertificateManager.cs

codecov · 2025-06-20T08:40:40Z

Codecov Report

❌ Patch coverage is 58.54701% with 97 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.12%. Comparing base (d2f8e54) to head (cabc172).
⚠️ Report is 149 commits behind head on main.

Files with missing lines	Patch %	Lines
...tocol/Implementation/OtlpMtlsCertificateManager.cs	47.28%	68 Missing ⚠️
...otocol/Implementation/OtlpMtlsHttpClientFactory.cs	55.93%	26 Missing ⚠️
...tation/OpenTelemetryProtocolExporterEventSource.cs	62.50%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6343      +/-   ##
==========================================
- Coverage   86.67%   86.12%   -0.56%     
==========================================
  Files         258      261       +3     
  Lines       11873    12099     +226     
==========================================
+ Hits        10291    10420     +129     
- Misses       1582     1679      +97

Flag	Coverage Δ
unittests-Project-Experimental	`86.02% <58.54%> (-0.50%)`	⬇️
unittests-Project-Stable	`85.91% <58.54%> (-0.36%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...orter.OpenTelemetryProtocol/OtlpExporterOptions.cs	`99.25% <100.00%> (+0.16%)`	⬆️
....Exporter.OpenTelemetryProtocol/OtlpMtlsOptions.cs	`100.00% <100.00%> (ø)`
...tation/OpenTelemetryProtocolExporterEventSource.cs	`86.04% <62.50%> (+0.14%)`	⬆️
...otocol/Implementation/OtlpMtlsHttpClientFactory.cs	`55.93% <55.93%> (ø)`
...tocol/Implementation/OtlpMtlsCertificateManager.cs	`47.28% <47.28%> (ø)`

... and 2 files with indirect coverage changes

…MtlsCertificateManager

…ostics Co-authored-by: Martin Costello <martin@martincostello.com>

…null reference Co-authored-by: Martin Costello <martin@martincostello.com>

…method

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsHttpClientFactory.cs

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/OtlpExporterOptions.cs

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/OtlpMtlsOptions.cs

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/README.md

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsCertificateManager.cs

Co-authored-by: Martin Costello <martin@martincostello.com>

…ported platforms

sandy2008 · 2025-08-07T00:51:50Z

@alanwest Could you help change the requested change to approve~? Tyvm!

github-actions · 2025-08-14T03:35:53Z

This PR was marked stale due to lack of activity and will be closed in 7 days. Commenting or pushing will instruct the bot to automatically remove the label. This bot runs once per day.

sandy2008 · 2025-08-24T09:46:29Z

@rajkumar-rangaraj Hi! Any updates?

github-actions · 2025-09-01T03:36:30Z

This PR was marked stale due to lack of activity and will be closed in 7 days. Commenting or pushing will instruct the bot to automatically remove the label. This bot runs once per day.

github-actions · 2025-09-10T03:19:50Z

This PR was marked stale due to lack of activity and will be closed in 7 days. Commenting or pushing will instruct the bot to automatically remove the label. This bot runs once per day.

github-actions · 2025-09-24T03:22:35Z

This PR was marked stale due to lack of activity and will be closed in 7 days. Commenting or pushing will instruct the bot to automatically remove the label. This bot runs once per day.

Lemorz56 · 2025-09-29T06:50:09Z

Any updates on this?

sandy2008 · 2025-09-29T06:52:27Z

Any updates on this?

Pending @rajkumar-rangaraj 's reviews.

github-actions · 2025-10-08T03:21:04Z

This PR was marked stale due to lack of activity and will be closed in 7 days. Commenting or pushing will instruct the bot to automatically remove the label. This bot runs once per day.

github-actions · 2025-10-16T03:26:18Z

This PR was marked stale due to lack of activity and will be closed in 7 days. Commenting or pushing will instruct the bot to automatically remove the label. This bot runs once per day.

rajkumar-rangaraj · 2025-12-04T17:16:22Z

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/OtlpMtlsOptions.cs

+    /// Gets a value indicating whether mTLS is enabled.
+    /// mTLS is considered enabled if at least the client certificate path is provided.
+    /// </summary>
+    public bool IsEnabled => !string.IsNullOrWhiteSpace(this.ClientCertificatePath);


If a user sets only OTEL_EXPORTER_OTLP_CERTIFICATE (CA cert) without a client certificate, the factory returns a plain HttpClient. The custom CA validation is completely ignored.

Users wanting to trust a private CA for server validation (one-way TLS with custom CA) won't get it unless they also provide a client certificate. Changing as below could help.

Suggested change

public bool IsEnabled => !string.IsNullOrWhiteSpace(this.ClientCertificatePath);

public bool IsEnabled =>

!string.IsNullOrWhiteSpace(this.ClientCertificatePath) ||

!string.IsNullOrWhiteSpace(this.CaCertificatePath);

rajkumar-rangaraj · 2025-12-04T17:23:35Z

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/OtlpMtlsCertificateManager.cs

+                // Try to load as PKCS#12 first, then as PEM
+                try
+                {
+#if NET9_0_OR_GREATER


Users with password-protected PFX/PKCS#12 keystores cannot use it here. Are you planning to follow up on OTEL_EXPORTER_OTLP_CLIENT_KEY_PASSWORD as follow up?

rajkumar-rangaraj · 2025-12-04T17:25:29Z

test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/OtlpMtlsCertificateManagerTests.cs

+        return cert;
+    }
+
+    private static System.Security.Cryptography.X509Certificates.X509Certificate2 CreateExpiredCertificate()


is this used anywhere?

rajkumar-rangaraj · 2025-12-04T17:29:29Z

test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/OtlpMtlsCertificateManagerTests.cs

+
+public class OtlpMtlsCertificateManagerTests
+{
+    private const string TestCertPem =


nit:

Suggested change

private const string TestCertPem =

private const string InvalidCertPem=

rajkumar-rangaraj · 2025-12-04T17:31:39Z

Please plan to increase the test coverage for these areas.

ValidateServerCertificate
Test for CA-only configuration
Negative test for expired certificates despite having CreateExpiredCertificate() defined

sandy2008 requested a review from a team as a code owner June 20, 2025 07:13

github-actions bot added the pkg:OpenTelemetry.Exporter.OpenTelemetryProtocol Issues related to OpenTelemetry.Exporter.OpenTelemetryProtocol NuGet package label Jun 20, 2025

martincostello reviewed Jun 20, 2025

View reviewed changes

sandy2008 force-pushed the main branch 2 times, most recently from bebeff9 to 4b2dc0b Compare June 20, 2025 08:04

feat(): add mtls support

a363508

sandy2008 force-pushed the main branch from 27e1069 to a363508 Compare June 20, 2025 08:34

sandy2008 added 3 commits June 20, 2025 17:46

refactor(mtls): extract repeated string literals to constants in Otlp…

faba6ab

…MtlsCertificateManager

feat(): add mtls support

3044fc3

feat(): add mtls configurations for certs

7368c9e

sandy2008 force-pushed the main branch from de82a1e to 7368c9e Compare June 20, 2025 10:18

sandy2008 and others added 5 commits June 23, 2025 11:40

fix(mtls): include filePath in FileNotFoundException for better diagn…

c488394

…ostics Co-authored-by: Martin Costello <martin@martincostello.com>

fix(mtls): use string.Equals to safely compare thumbprints and avoid …

472205a

…null reference Co-authored-by: Martin Costello <martin@martincostello.com>

fix(): remove redundant comment

2d69b7c

fix(): remove redundant comment

960037e

fix(): remove redundant comment

6226ac5

sandy2008 requested a review from martincostello June 23, 2025 11:51

sandy2008 added 3 commits June 24, 2025 01:51

feat(): add support for client key w/ password

966d076

refactor(mtls): extract HttpClient default configuration to separate …

879cd6c

…method

refactor(mtls): eliminate magic strings in OtlpMtlsHttpClientFactory

c1405cb

sandy2008 mentioned this pull request Jun 23, 2025

[otlp] Add mTLS Support for OTLP Exporter #5918

Closed

4 tasks

martincostello reviewed Jun 24, 2025

View reviewed changes

sandy2008 and others added 7 commits June 24, 2025 20:35

feat(mtls): adjust error msg

02b9240

Co-authored-by: Martin Costello <martin@martincostello.com>

feat(mtls): adjust error msg

6ae5efe

Co-authored-by: Martin Costello <martin@martincostello.com>

feat(mtls): adjust error msg

eadf9c2

chore(mtls): when mTLS file permission validation is skipped on unsup…

2c759c6

…ported platforms

chore(mtls); Remove preemptive file permission validation from mTLS

87633ba

refactor(mtls): optimize mTLS HttpClient creation to reduce allocations

af26417

fix(mtls): format issue

0bd7c5e

alanwest removed the Stale Issues and pull requests which have been flagged for closing due to inactivity label Aug 5, 2025

Merge branch 'main' into main

cabc172

github-actions bot added the Stale Issues and pull requests which have been flagged for closing due to inactivity label Aug 14, 2025

Kielek removed the Stale Issues and pull requests which have been flagged for closing due to inactivity label Aug 18, 2025

github-actions bot added the Stale Issues and pull requests which have been flagged for closing due to inactivity label Sep 1, 2025

Kielek removed the Stale Issues and pull requests which have been flagged for closing due to inactivity label Sep 2, 2025

github-actions bot added the Stale Issues and pull requests which have been flagged for closing due to inactivity label Sep 10, 2025

Kielek removed the Stale Issues and pull requests which have been flagged for closing due to inactivity label Sep 16, 2025

github-actions bot added the Stale Issues and pull requests which have been flagged for closing due to inactivity label Sep 24, 2025

Kielek removed the Stale Issues and pull requests which have been flagged for closing due to inactivity label Sep 24, 2025

github-actions bot added the Stale Issues and pull requests which have been flagged for closing due to inactivity label Oct 8, 2025

Kielek removed the Stale Issues and pull requests which have been flagged for closing due to inactivity label Oct 8, 2025

github-actions bot added the Stale Issues and pull requests which have been flagged for closing due to inactivity label Oct 16, 2025

Kielek removed the Stale Issues and pull requests which have been flagged for closing due to inactivity label Oct 16, 2025

rajkumar-rangaraj added the keep-open Prevents issues and pull requests being closed as stale label Oct 23, 2025

rajkumar-rangaraj reviewed Dec 4, 2025

View reviewed changes

	private const string TestCertPem =
	private const string InvalidCertPem=

[OTLP] Add mTLS Support for OTLP Exporter #6343

Are you sure you want to change the base?

[OTLP] Add mTLS Support for OTLP Exporter #6343

Conversation

sandy2008 commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Merge requirement checklist

Uh oh!

Uh oh!

Uh oh!

martincostello Jun 20, 2025

Choose a reason for hiding this comment

Uh oh!

sandy2008 Jun 20, 2025

Choose a reason for hiding this comment

Uh oh!

rajkumar-rangaraj Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sandy2008 commented Aug 7, 2025

Uh oh!

github-actions bot commented Aug 14, 2025

Uh oh!

sandy2008 commented Aug 24, 2025

Uh oh!

github-actions bot commented Sep 1, 2025

Uh oh!

github-actions bot commented Sep 10, 2025

Uh oh!

github-actions bot commented Sep 24, 2025

Uh oh!

Lemorz56 commented Sep 29, 2025

Uh oh!

sandy2008 commented Sep 29, 2025

Uh oh!

github-actions bot commented Oct 8, 2025

Uh oh!

github-actions bot commented Oct 16, 2025

Uh oh!

rajkumar-rangaraj Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

rajkumar-rangaraj Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

rajkumar-rangaraj Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

rajkumar-rangaraj Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

rajkumar-rangaraj commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

sandy2008 commented Jun 20, 2025 •

edited

Loading

codecov bot commented Jun 20, 2025 •

edited

Loading