[SVLS-7945] feat: Support TLS certificate for logs/proxy flusher by lym953 · Pull Request #979 · DataDog/datadog-lambda-extension

lym953 · 2026-01-07T22:26:47Z

Problem

A customer reported that their Lambda is behind a proxy, and the Rust-based extension encounters an error when sending logs and metrics to Datadog via the proxy.

A previous PR #961 fixed this for traces and stats, but not for other things because the customer and I didn't see any error with them at that time.

This PR

Applies the env var DD_TLS_CERT_FILE to logs flusher and proxy flusher as well.
Example: DD_TLS_CERT_FILE=/opt/ca-cert.pem, so the when the extension flushes logs or proxied data to Datadog, the HTTP client created can load and use this cert, and connect the proxy properly.

Testing

Create a Lambda in a VPC with a proxy EC2 instance.
Connect to the proxy instance. With the help of ChatGPT, set up a custom-build nginx with ngx_http_proxy_connect_module
Save the CA certificate from the proxy server to local machine
In the CDK stack, add a layer to the Lambda, which includes the CA certificate ca-cert.pem
Set env vars:
- DD_TLS_CERT_FILE=/opt/ca-cert.pem
- DD_PROXY_HTTPS=http://10.0.0.30:3128, where 10.0.0.30 is the private IP of the proxy EC2 instance
- DD_LOG_LEVEL=debug
Invoke the Lambda

Result

Before:
Log flushing failed:

DD_EXTENSION | ERROR | LOGS | Failed to send request after 97 ms and 3 attempts: reqwest::Error { kind: Request, url: "https://http-intake.logs.datadoghq.com/api/v2/logs", source: hyper_util::client::legacy::Error(Connect, ConnectFailed(Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } })) }

After:
No such error

Next steps

Do the same thing for dogstatsd metric flusher. Metric flusher is in a separate repo https://github.com/DataDog/serverless-components, so let's create separate PRs for that change.

Notes

Customer report issue: #919

duncanista · 2026-01-07T22:31:05Z

bottlecap/src/http.rs

    }

+    // Load custom TLS certificate if configured
+    if let Some(cert_path) = &config.tls_cert_file {


file and path are confusing, can a customer load more than 1 certificate or define a folder?

nvm, ignore this, a path can be to a file, but again, my question persist, can a customer load more than 1 cert?

duncanista · 2026-01-07T22:32:47Z

bottlecap/src/http.rs

+        return Err("No certificates found in file".into());
+    }
+
+    // Convert all certificates found in the file


Can a file contain multiple certificates? This confuses me

A pem file can contain multiple certificates:
https://stackoverflow.com/questions/68340665/pem-file-has-two-certificates-what-does-it-mean

And we supported multiple certs for trace and stats flusher: https://github.com/DataDog/datadog-lambda-extension/blob/main/bottlecap/src/traces/trace_flusher.rs#L247-L250

Not sure if there's a real use case, but since it's not hard, I'm supporting it in this PR.

Hi! Appreciate the fix, our customer reached out in the support ticket that they do have many CA bundled in one .crt so the use case is valid. They also share that the PR has fixed the issue for them so really appreciate it, thanks a lot!

@yues7 Nice!

duncanista · 2026-01-07T22:33:16Z

bottlecap/src/http.rs

+    let mut reqwest_certs = Vec::new();
+    for cert in certs {
+        reqwest_certs.push(reqwest::Certificate::from_der(&cert)?);
+    }


Is there a more idiomatic way of doing this?

Good point. Changed to map().

duncanista

Great job on fixing this! 🙇🏽

…er (#984) ## Motivation A customer reported that their Lambda is behind a proxy, and the Rust-based extension encounters an error when sending logs and metrics to Datadog via the proxy. ## Overview Previous PRs in fixed this for traces/stats (#961) and logs/proxy (#979). DataDog/serverless-components#61 in `serverless-components` repo fixed this issue for dogstatsd metrics. This PR upgrades the dependency on `serverless-components` to patch this update. ## Testing #### Steps See #979 #### Result **Before:** Metrics flushing failed: > DD_EXTENSION | DEBUG | Flushing 0 series and 1 distributions DD_EXTENSION | DEBUG | Sending distributions: SketchPayload { ... } DD_EXTENSION | DEBUG | Request to https://api.datadoghq.com/api/beta/sketches took 144ms DD_EXTENSION | ERROR | Error shipping data: None Failed to send request after 3 attempts DD_EXTENSION | ERROR | Failed to flush some metrics due to shipping errors: 0 series and 1 sketches **After:** Metrics flushing succeeded: > DD_EXTENSION | DEBUG | Flushing 0 series and 1 distributions DD_EXTENSION | DEBUG | Sending distributions: SketchPayload { ... } DD_EXTENSION | DEBUG | Request to https://api.datadoghq.com/api/beta/sketches took 619ms DD_EXTENSION | DEBUG | Successfully flushed 0 series and 1 distributions ## Notes Customer report issue: #919

[SVLS-7945] feat: Support custom CA cert file for logs and proxy flusher

e1b62bf

lym953 requested a review from a team as a code owner January 7, 2026 22:26

duncanista reviewed Jan 7, 2026

View reviewed changes

duncanista approved these changes Jan 7, 2026

View reviewed changes

Make loop code idiomatic

00bfa84

lym953 changed the title ~~[SVLS-7934] feat: Support TLS certificate for logs/proxy flusher~~ [SVLS-7945] feat: Support TLS certificate for logs/proxy flusher Jan 7, 2026

lym953 merged commit 8439fda into main Jan 8, 2026
50 checks passed

lym953 deleted the yiming.luo/ssl-3 branch January 8, 2026 19:50

This was referenced Jan 8, 2026

[SVLS-7945] feat: Support TLS certificate for dogstatsd flusher DataDog/serverless-components#61

Merged

[SVLS-7945] feat: Support TLS certificate for dogstatsd metrics flusher #984

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SVLS-7945] feat: Support TLS certificate for logs/proxy flusher#979

[SVLS-7945] feat: Support TLS certificate for logs/proxy flusher#979
lym953 merged 2 commits intomainfrom
yiming.luo/ssl-3

lym953 commented Jan 7, 2026 •

edited

Loading

Uh oh!

duncanista Jan 7, 2026

Uh oh!

duncanista Jan 7, 2026

Uh oh!

duncanista Jan 7, 2026

Uh oh!

lym953 Jan 7, 2026

Uh oh!

yues7 Jan 16, 2026

Uh oh!

lym953 Jan 16, 2026

Uh oh!

duncanista Jan 7, 2026

Uh oh!

lym953 Jan 7, 2026

Uh oh!

duncanista left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

lym953 commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

This PR

Testing

Result

Next steps

Notes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

duncanista left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lym953 commented Jan 7, 2026 •

edited

Loading