Consider an alternate certificate renewal flow that uses CSR

[tigrannajaryan]

The client certificate creation is currently performed by the Server, with Server generating a private/public keypair and sending it to the Agent.

We could change the flow to use a CSR-like flow, where the Agent generates a keypair, a CSR and sends the CSR to the Server. I think this better mirrors the traditional certificate generation flow. The benefit will be that the private key does not leave the Agent.

This adds more complexity to the protocol (one extra roundtrip), but is worth exploring.

[tigrannajaryan]

It may be worth reading and understanding https://spiffe.io/docs/latest/spire-about/spire-concepts/ to see if it is applicable.

[evan-bradley]

It may be worth reading and understanding https://spiffe.io/docs/latest/spire-about/spire-concepts/ to see if it is applicable.

@tigrannajaryan this seems like it would be used in place of the certificate field on ConnectionSettings messages, and would ultimately be something an Agent and Server do to generate certificates for themselves out-of-band from OpAMP. I realize it's been nearly two years since you made that comment, do you still think SPIFFE may have any direct applicability to OpAMP?

[tigrannajaryan]

I realize it's been nearly two years since you made that comment, do you still think SPIFFE may have any direct applicability to OpAMP?

I haven't looked in details of SPIFFE and don't know if/how we can use it. This requires someone to do some research and understand what SPIFFE does and how applicable it is to OpAMP.