ResiLien
/
terraform
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
terraform/website/source/docs/providers/tls/r/cert_request.html.md

87 lines
2.6 KiB
Markdown
Raw Normal View History

tls provider As of this commit this provider has only logical resources that allow the creation of private keys, self-signed certs and certificate requests. These can be useful when creating other resources that use TLS certificates, such as AWS Elastic Load Balancers. Later it could grow to include support for real certificate provision from CAs using the LetsEncrypt ACME protocol, once it is stable.
2015-07-18 20:50:13 +02:00
---
layout: "tls"
page_title: "TLS: tls_cert_request"
docs: Fix misspelled words
2016-09-12 08:04:04 +02:00
sidebar_current: "docs-tls-data-source-cert-request"
tls provider As of this commit this provider has only logical resources that allow the creation of private keys, self-signed certs and certificate requests. These can be useful when creating other resources that use TLS certificates, such as AWS Elastic Load Balancers. Later it could grow to include support for real certificate provision from CAs using the LetsEncrypt ACME protocol, once it is stable.
2015-07-18 20:50:13 +02:00
description: |-
Creates a PEM-encoded certificate request.
---
# tls\_cert\_request
Generates a *Certificate Signing Request* (CSR) in PEM format, which is the
typical format used to request a certificate from a certificate authority.
This resource is intended to be used in conjunction with a Terraform provider
for a particular certificate authority in order to provision a new certificate.
Restore tls_cert_request to being a managed resource In c244e5a6 this resource was converted to a data source, but that was a mistake since data sources are expected to produce stable results on each run, and yet certificate requests contain a random nonce as part of the signature. Additionally, using the data source as a managed resource through the provided compatibility shim was not actually working, since "Read" was trying to parse the private key out of a SHA1 hash of the key, which is what we place in state due to the StateFunc on that attribute. By restoring this we restore Terraform's ability to produce all of the parts of a basic PKI/CA, which is useful for creating dev environments and bootstrapping PKI for production environments.
2016-09-24 21:22:07 +02:00
This is a *logical resource*, so it contributes only to the current Terraform
state and does not create any external managed resources.
~> **Compatibility Note** From Terraform 0.7.0 to 0.7.4 this resource was
converted to a data source, and the resource form of it was deprecated. This
turned out to be a design error since a cert request includes a random number
in the form of the signature nonce, and so the data source form of this
resource caused non-convergent configuration. The data source form is no longer
supported as of Terraform 0.7.5 and any users should return to using the
resource form.
tls provider As of this commit this provider has only logical resources that allow the creation of private keys, self-signed certs and certificate requests. These can be useful when creating other resources that use TLS certificates, such as AWS Elastic Load Balancers. Later it could grow to include support for real certificate provision from CAs using the LetsEncrypt ACME protocol, once it is stable.
2015-07-18 20:50:13 +02:00
## Example Usage
```
Restore tls_cert_request to being a managed resource In c244e5a6 this resource was converted to a data source, but that was a mistake since data sources are expected to produce stable results on each run, and yet certificate requests contain a random nonce as part of the signature. Additionally, using the data source as a managed resource through the provided compatibility shim was not actually working, since "Read" was trying to parse the private key out of a SHA1 hash of the key, which is what we place in state due to the StateFunc on that attribute. By restoring this we restore Terraform's ability to produce all of the parts of a basic PKI/CA, which is useful for creating dev environments and bootstrapping PKI for production environments.
2016-09-24 21:22:07 +02:00
resource "tls_cert_request" "example" {
tls provider As of this commit this provider has only logical resources that allow the creation of private keys, self-signed certs and certificate requests. These can be useful when creating other resources that use TLS certificates, such as AWS Elastic Load Balancers. Later it could grow to include support for real certificate provision from CAs using the LetsEncrypt ACME protocol, once it is stable.
2015-07-18 20:50:13 +02:00
key_algorithm = "ECDSA"
private_key_pem = "${file(\"private_key.pem\")}"
subject {
common_name = "example.com"
organization = "ACME Examples, Inc"
}
}
```
## Argument Reference
The following arguments are supported:
* `key_algorithm` - (Required) The name of the algorithm for the key provided
in `private_key_pem`.
* `private_key_pem` - (Required) PEM-encoded private key data. This can be
read from a separate file using the ``file`` interpolation function. Only
an irreversable secure hash of the private key will be stored in the Terraform
state.
* `subject` - (Required) The subject for which a certificate is being requested. This is
a nested configuration block whose structure is described below.
* `dns_names` - (Optional) List of DNS names for which a certificate is being requested.
* `ip_addresses` - (Optional) List of IP addresses for which a certificate is being requested.
The nested `subject` block accepts the following arguments, all optional, with their meaning
corresponding to the similarly-named attributes defined in
[RFC5290](https://tools.ietf.org/html/rfc5280#section-4.1.2.4):
* `common_name` (string)
* `organization` (string)
* `organizational_unit` (string)
* `street_address` (list of strings)
* `locality` (string)
* `province` (string)
* `country` (string)
* `postal_code` (string)
* `serial_number` (string)
## Attributes Reference
The following attributes are exported:
* `cert_request_pem` - The certificate request data in PEM format.