We could suggest providing a cert in the osquery configuration as a workaround. This would prevent the MITM attack that is possible due to the bug.

I’m not sure what you mean?

As of now, if a cert is not specified, an attacker can use any cert that is trusted by the system root. The cert doesn't have to match the domain the agent is trying to connect to.

Right. I’m not sure what you mean by providing a cert.

Correct

--tls_server_certs

does seem like a reasonable mitigation.

What mitigation do you recommend for osquery agents communicating with an AWS endpoint and managed certs by Amazon?

Can you download the cert chain and provide it to

--tls_server_certs

?

I’ll take a look.