terraform-provider/docs/resources/cert_manager_ca_certificate.md

page_title, subcategory, description

page_title	subcategory	description
kms_cert_manager_ca_certificate Resource - terraform-provider	Certificate Management	Create and manage CA certificates in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

kms_cert_manager_ca_certificate (Resource)

Create and manage CA certificates in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

Example Usage

resource "kms_project" "pki" {
  name        = "PKI Project"
  slug        = "pki-project"
  description = "Project for PKI certificate management"
  type        = "cert-manager"
}

resource "kms_cert_manager_internal_ca" "root" {
  project_slug = kms_project.pki.slug

  type          = "root"
  name          = "enterprise-root-ca"
  common_name   = "Enterprise Root Certificate Authority"
  organization  = "Example Corp"
  ou            = "IT Security"
  country       = "US"
  locality      = "San Francisco"
  province      = "California"
  key_algorithm = "RSA_2048"
}

resource "kms_cert_manager_internal_ca" "issuing" {
  project_slug = kms_project.pki.slug

  type          = "intermediate"
  name          = "enterprise-issuing-ca"
  common_name   = "Enterprise Issuing Certificate Authority"
  organization  = "Example Corp"
  ou            = "IT Security"
  country       = "US"
  locality      = "San Francisco"
  province      = "California"
  key_algorithm = "RSA_2048"
}

# Generate certificate for the root CA
resource "kms_cert_manager_ca_certificate" "root_cert" {
  ca_id = kms_cert_manager_internal_ca.root.id

  not_before = "2024-01-01T00:00:00Z"
  not_after  = "2034-01-01T00:00:00Z"

  # Root CA can issue intermediate CAs (path length = 1)
  max_path_length = 1
}

# Generate certificate for the intermediate CA
resource "kms_cert_manager_ca_certificate" "issuing_cert" {
  ca_id        = kms_cert_manager_internal_ca.issuing.id
  parent_ca_id = kms_cert_manager_internal_ca.root.id

  not_before = "2024-01-01T00:00:00Z"
  not_after  = "2029-01-01T00:00:00Z"

  # Intermediate CA cannot issue further intermediates (path length = 0)
  max_path_length = 0

  # Ensure root certificate is generated first
  depends_on = [kms_cert_manager_ca_certificate.root_cert]
}

# Example with shorter validity period for testing/development
resource "kms_cert_manager_ca_certificate" "dev_cert" {
  ca_id = kms_cert_manager_internal_ca.root.id

  not_before = "2024-01-01T00:00:00Z"
  not_after  = "2025-01-01T00:00:00Z" # 1 year validity

  # No path length restriction (-1 = unlimited)
  max_path_length = -1
}

# Output the certificate information
output "root_ca_certificate" {
  description = "The root CA certificate"
  value       = kms_cert_manager_ca_certificate.root_cert.certificate
  sensitive   = true
}

output "root_ca_serial_number" {
  description = "The serial number of the root CA certificate"
  value       = kms_cert_manager_ca_certificate.root_cert.serial_number
}

output "issuing_ca_certificate" {
  description = "The issuing CA certificate"
  value       = kms_cert_manager_ca_certificate.issuing_cert.certificate
  sensitive   = true
}

output "issuing_ca_chain" {
  description = "The issuing CA certificate chain"
  value       = kms_cert_manager_ca_certificate.issuing_cert.certificate_chain
  sensitive   = true
}

Schema

Required

• ca_id (String) The ID of the certificate authority to generate a certificate for
• not_after (String) The date and time when the CA expires in RFC3339 format (e.g., '2034-01-01T00:00:00Z')
• not_before (String) The date and time when the CA becomes valid in RFC3339 format (e.g., '2024-01-01T00:00:00Z')

Optional

• max_path_length (Number) The maximum number of intermediate CAs that may follow this CA in the certificate chain. Use -1 for no path limit
• parent_ca_id (String) The ID of the parent CA (required for intermediate CAs)

Read-Only

• certificate (String, Sensitive) The generated CA certificate in PEM format
• certificate_chain (String, Sensitive) The certificate chain of the CA in PEM format
• id (String) The unique identifier for this CA certificate resource
• serial_number (String) The serial number of the CA certificate