[bug][otel]: OpenTelemetry gRPC exporter sends unencrypted data to HTTPS endpoint

[haivanka]

What version of Codex is running?

0.53.0

What subscription do you have?

Business

Which model were you using?

gpt-5-codex

What platform is your computer?

No response

What issue are you seeing?

Regarding OpenTelemetry export, I observed plain HTTP traffic being sent to my gRPC OpenTelemetry endpoint (using Wireshark), even though my endpoint url explicitly mentions https.

This is related to open-telemetry/opentelemetry-rust#3182.

What steps can reproduce the bug?

1. Set up a gRPC HTTPS endpoint in config.toml https://developers.openai.com/codex/security/#enable-otel-optin
2. Run the Codex CLI
3. Observe unecrypted outgoing traffic in Wireshark

What is the expected behavior?

No response

Additional information

No response

[vyalamar]

Root Cause Analysis

codex-otel builds opentelemetry-otlp without its tls feature. The TLS path in the tonic exporter is behind #[cfg(feature = "tls")] (see opentelemetry-otlp/src/exporter/tonic/mod.rs, also discussed in open-telemetry/opentelemetry-rust#3182). Without that feature, the exporter can’t create a TLS channel and falls back to cleartext, creating the security vulnerability reported.

Proposed Fix

The fix is a one-line change to codex-otel/Cargo.toml to enable the required feature:

--- a/codex-otel/Cargo.toml
+++ b/codex-otel/Cargo.toml
@@ -25,6 +25,7 @@
     "reqwest",
   	 "reqwest-rustls",
+    "tls", # <-- This is the fix to enable TLS for the gRPC (Tonic) exporter
 ], optional = true }
 opentelemetry-semantic-conventions = { workspace = true }
 opentelemetry_sdk = { workspace = true, features = [

@haivanka @codex-maintainers can you please assign this to me?

[etraut-openai]

@haivanka, thanks for the bug report.

@vyalamar, thanks for the confirmation and analysis. We're interested in a fix if you'd like to post a PR.

[vyalamar]

@etraut-openai
I’ll prepare a PR for this shortly.

The patch will add the missing tls feature flag in codex-otel/Cargo.toml:

opentelemetry-otlp = { workspace = true, features = [
    "grpc-tonic",
    "http-proto",
    "http-json",
    "reqwest",
    "reqwest-rustls",
+   "tls",
], optional = true }

Will share the test results as well.

[haivanka]

@vyalamar I did test it like that but it didn't work. Managed to get it working with this approach tensorzero/tensorzero#3708.

[vyalamar]

@haivanka Great catch — thanks for linking the Tensorzero diff.

Looks like both layers are needed:

• Compile-time: enable opentelemetry-otlp/tls and tls-roots so the tonic TLS client can build.
• Runtime: explicitly apply ClientTlsConfig::new().with_enabled_roots() when constructing the exporter (as in your linked PR).

I’ll adjust the PR to include both so the HTTPS OTLP path is fully encrypted out of the box.

[vyalamar]

@etraut-openai Fixed formatting issues.