terraform-provider/docs/resources/cert_manager_certificate.md

page_title, subcategory, description

page_title	subcategory	description
kms_cert_manager_certificate Resource - terraform-provider	Certificate Management	Request and manage certificates from Hanzo KMS certificate profiles. Supports both CSR-based and direct field requests. The resource will poll until the certificate is issued or a timeout is reached. Only Machine Identity authentication is supported for this resource.

kms_cert_manager_certificate (Resource)

Request and manage certificates from Hanzo KMS certificate profiles. Supports both CSR-based and direct field requests. The resource will poll until the certificate is issued or a timeout is reached. Only Machine Identity authentication is supported for this resource.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

# Request a certificate
resource "kms_cert_manager_certificate" "my_cert" {
  profile_id          = "<internal-ca-profile-id>"
  common_name         = "api.example.com"
  alt_names           = ["api.example.com", "api-internal.example.com"]
  organization        = "Example Corp"
  country             = "US"
  key_algorithm       = "RSA_2048"
  signature_algorithm = "RSA-SHA256"
  ttl                 = "90d"
  timeout_seconds     = 300
}


# Request a certificate using a CSR file
resource "kms_cert_manager_certificate" "csr_based_cert" {
  profile_id      = "<profile-id>"
  csr             = file("./my-certificate.csr")
  ttl             = "90d"
  timeout_seconds = 300
}

# Request a certificate using an inline CSR
resource "kms_cert_manager_certificate" "inline_csr_cert" {
  profile_id = "<profile-id>"

  csr = <<-CSR
-----BEGIN CERTIFICATE REQUEST-----
MIICljCCAX4CAQAwGDEWMBQGA1UEAwwNaW5maXNpY2FsLmNvbTCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAL7c6thewe78xVXyBQ0ZgmSjlkYCGeJgxot/
QqB1+z3mlMr/tViy8UFBThO69i532ZgWyuJ24YWVeF67WBQPYXnkXlUMJKYGM6UA
ka6dOjCeSJHNXkxbLHI3yljvXP/Kn6w+WczeSuJXYNH5Uet9TtTEuXIqTgWjnAhD
TAWqtyHPbtw3jVWy7xkSc/JuqVGha05snjPPmF9lkdoztG3gosN0TnwTGaQ382sr
giUBkkfdBK0eGmTwJlG9xLZMm3hDyAFz2/iw6GR57uvp/h9RDZVZcuisUQf2T8NZ
CCVPTSGpfYxbQ4KviDghL2/GDY9NVudHSyeCCA0zOPZW9tg7hAECAwEAAaA5MDcG
CSqGSIb3DQEJDjEqMCgwJgYDVR0RBB8wHYINaW5maXNpY2FsLmNvbYIMaW5maXNp
Y2FsLmVzMA0GCSqGSIb3DQEBCwUAA4IBAQBZy+AYPWeZVs+ZPP/9Zj0cl7BchwZV
phEPIezIdKqDyLcyjCf168rbTEqch9gz5CvyIPL3kBohicI/k+/RYPnRKsTdiYNE
XrpeaarHqlvpGzjsrQUv6iJgrDGZXMVJn+op3cDChNPet9RJ1utH96S6W6Ent4QU
90XNi6fBSja8wThfj0AAl51OycHwfNg5/CtygT0eM16/bZl0knJ884Bf35LNE731
Awp8H6ELyXOX1tRKNZRPMKr2Nw/qn6QK611R9aSA+maa25YZa8K0cvSVAJQOfdei
0A7YVKj492nqnN/xS5kzIidZuaCBLocLo5j615xh/79YgMZjrGo3wvnk
-----END CERTIFICATE REQUEST-----
CSR

  ttl             = "90d"
  timeout_seconds = 300
}

# Outputs
output "cert_details" {
  value = {
    id            = kms_cert_manager_certificate.my_cert.id
    status        = kms_cert_manager_certificate.my_cert.status
    serial_number = kms_cert_manager_certificate.my_cert.serial_number
    not_before    = kms_cert_manager_certificate.my_cert.not_before
    not_after     = kms_cert_manager_certificate.my_cert.not_after
  }
}

output "cert_pem" {
  value = kms_cert_manager_certificate.my_cert.certificate
}

output "cert_chain" {
  value = kms_cert_manager_certificate.my_cert.certificate_chain
}

output "cert_private_key" {
  value     = kms_cert_manager_certificate.my_cert.private_key
  sensitive = true
}

Schema

Required

• profile_id (String) The ID of the certificate profile to use for issuance

Optional

• alt_names (List of String) Subject alternative names (SANs) for the certificate
• common_name (String) The common name (CN) for the certificate. Required when not using CSR
• country (String) The country (C) for the certificate (2-letter code)
• csr (String) Certificate Signing Request (CSR) in PEM format. If provided, the certificate will be issued based on the CSR. Use Terraform's file() function to read from a file (e.g., file("./my-certificate.csr"))
• extended_key_usages (List of String) Extended key usages for the certificate. Supported: client_auth, server_auth, code_signing, email_protection, ocsp_signing, time_stamping
• key_algorithm (String) The key algorithm for the certificate. Supported: RSA_2048, RSA_3072, RSA_4096, ECDSA_P256, ECDSA_P384, ECDSA_P521
• key_usages (List of String) Key usages for the certificate. Supported: digital_signature, key_encipherment, non_repudiation, data_encipherment, key_agreement, key_cert_sign, crl_sign, encipher_only, decipher_only
• locality (String) The locality (L) for the certificate
• organization (String) The organization (O) for the certificate
• ou (String) The organizational unit (OU) for the certificate
• province (String) The state/province (ST) for the certificate
• signature_algorithm (String) The signature algorithm for the certificate. Supported: RSA-SHA256, RSA-SHA384, RSA-SHA512, ECDSA-SHA256, ECDSA-SHA384, ECDSA-SHA512
• timeout_seconds (Number) Maximum time to wait for certificate issuance in seconds. Defaults to 3600 (1 hour)
• ttl (String) Time to live for the certificate (e.g., '30d', '90d', '1y')

Read-Only

• certificate (String) The issued certificate in PEM format
• certificate_chain (String) The certificate chain in PEM format
• certificate_request_id (String) The ID of the certificate request
• id (String) The ID of the certificate
• not_after (String) The not-after (expiration) date of the certificate (RFC3339 format)
• not_before (String) The not-before date of the certificate (RFC3339 format)
• private_key (String, Sensitive) The private key in PEM format (only available for direct field requests, not CSR-based)
• serial_number (String) The serial number of the issued certificate
• status (String) The status of the certificate (pending, issued, failed)