[FEED] Support SSL client certificates

[davidclemens]

Please verify first that your feedback is not already reported here.
If possible and useful provide additional information below. This is optional however.

Provide your feedback

It'd be great if all API calls would support SSL client certificates.
As far as I can see, this is already part of the fetch_url method that the checkmk.general collection uses for all API calls. Therefore, I think, this feature would require surfacing these parameters (client_cert) in all the approprieate places in checkmk.general.

Thanks for looking into this!

Component Name

Component Name: all components that call the API

Ansible Version

$ ansible --version
ansible [core 2.17.7]
  config file = None
  configured module search path = [***]
  ansible python module location = /usr/lib/python3.12/site-packages/ansible
  ansible collection location = ***
  executable location = /bin/ansible
  python version = 3.12.9 (main, Feb  4 2025, 14:38:38) [GCC 13.3.0] (/bin/python3)
  jinja version = 3.1.4
  libyaml = True

Collection Version

$ ansible-galaxy collection list
Collection                               Version
---------------------------------------- -------
checkmk.general                          5.10.0

Environment

Screenshots

Additional context

[robin-checkmk]

Hi @davidclemens and thank you for your feedback!
To be frank: I am not very familiar with client certificates at all, so it will need some time and research, what is necessary, what implications it has and frankly what is possible. But I will update you, as soon as I have something.

[davidclemens]

Thanks a lot for the prompt response!
I think, as you are using the underlinying fetch_url provided by Ansible in all your API calls (which in turn uses the open_url method which can already handle SSL client certs), it would be possible to use it analogous to the ansible.builtin.uri module (source).
So I think, this feature could build on existing functionality.

Thanks a lot for looking into this!

[robin-checkmk]

@davidclemens it is my understanding, that client certificates would be relevant between Ansible and the Apache2 web server "in front of" Checkmk. Checkmk itself would not handle client certificates. Is that understanding correct, or am I missing something.

Also, it sounds like you are rather proficient with this, any chance you want to give it a shot yourself? We can finalize the PR together, but it might speed things up, if you can contribute code yourself. Do not feel pressured though. I will keep this open but cannot make any promises if and when someone can pick it up.

[robin-checkmk]

@davidclemens good news! I was able to throw together something in the PR linked above. Do you know how to install a collection from git directly, and can you give it a try? I do neither know if the implementation is sufficient, nor if the code style is okay. But if you can verify functionality, then I can move the PR to code review, and we might be able to release this sooner rather than later. :)