From e1ca2305575d4fef50cd0cac539dc50b90b82336 Mon Sep 17 00:00:00 2001
From: Jack Rothrock <jack@scoutapm.com>
Date: Mon, 21 Sep 2026 16:53:09 -0600
Subject: [PATCH] Add core_agent_ca_cert config option to pass --ca-cert to the
 Core Agent

Adds a `core_agent_ca_cert` configuration option that is passed to the
Core Agent as `--ca-cert <path>` when it is launched. This lets the Core
Agent trust an additional CA certificate (e.g. a private/self-signed CA
presented by a corporate TLS-terminating proxy) when reporting over HTTPS.

Mirrors the existing --log-file / --config-file argv handling in
AgentManager via a new maybe_add_ca_cert/1 helper appended to the launch
args. When unset, no flag is added; when set, the path is forwarded
verbatim to the Core Agent.

Ports scout_apm_python#855.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                        |  3 +++
 lib/scout_apm/application.ex        |  1 +
 lib/scout_apm/config/defaults.ex    |  1 +
 lib/scout_apm/core/agent_manager.ex | 12 ++++++++++++
 4 files changed, 17 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b05af89..5caa7b6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # master
 
+* New Configuration Options
+  * `core_agent_ca_cert` (default: `nil`) — Path to an additional CA certificate to pass to the Core Agent as `--ca-cert <path>` when it is launched. Lets the Core Agent trust a private/self-signed CA (e.g. one presented by a corporate TLS-terminating proxy) when reporting over HTTPS. When unset, no flag is added.
+
 # 2.1.0
 
 * License
diff --git a/lib/scout_apm/application.ex b/lib/scout_apm/application.ex
index 6964546..5d8dfb4 100644
--- a/lib/scout_apm/application.ex
+++ b/lib/scout_apm/application.ex
@@ -18,6 +18,7 @@ defmodule ScoutApm.Application do
     :core_agent_log_level,
     :core_agent_log_file,
     :core_agent_config_file,
+    :core_agent_ca_cert,
     :errors_enabled,
     :errors_host,
     :logs_enabled,
diff --git a/lib/scout_apm/config/defaults.ex b/lib/scout_apm/config/defaults.ex
index 45dd878..bd4ad8b 100644
--- a/lib/scout_apm/config/defaults.ex
+++ b/lib/scout_apm/config/defaults.ex
@@ -11,6 +11,7 @@ defmodule ScoutApm.Config.Defaults do
       core_agent_download: true,
       core_agent_launch: true,
       core_agent_version: "v1.5.1",
+      core_agent_ca_cert: nil,
       core_agent_tcp_ip: {127, 0, 0, 1},
       core_agent_tcp_port: 9000,
       collector_module: ScoutApm.Core.AgentManager,
diff --git a/lib/scout_apm/core/agent_manager.ex b/lib/scout_apm/core/agent_manager.ex
index 3bf0f12..12a4531 100644
--- a/lib/scout_apm/core/agent_manager.ex
+++ b/lib/scout_apm/core/agent_manager.ex
@@ -350,6 +350,7 @@ defmodule ScoutApm.Core.AgentManager do
       |> maybe_add_log_level()
       |> maybe_add_log_file()
       |> maybe_add_config_file()
+      |> maybe_add_ca_cert()
 
     ScoutApm.Logger.log(:debug, "Starting Core Agent: #{bin_path} #{Enum.join(args, " ")}")
 
@@ -718,4 +719,15 @@ defmodule ScoutApm.Core.AgentManager do
         args ++ ["--config-file", expanded_path]
     end
   end
+
+  @spec maybe_add_ca_cert(list(String.t())) :: list(String.t())
+  defp maybe_add_ca_cert(args) do
+    case ScoutApm.Config.find(:core_agent_ca_cert) do
+      nil ->
+        args
+
+      path when is_binary(path) ->
+        args ++ ["--ca-cert", path]
+    end
+  end
 end