terraform-provider/docs/resources/cert_manager_certificate_profile.md

page_title, subcategory, description

page_title	subcategory	description
kms_cert_manager_certificate_profile Resource - terraform-provider	Certificate Management	Create and manage certificate profiles in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

kms_cert_manager_certificate_profile (Resource)

Create and manage certificate profiles in Hanzo KMS. Only Machine Identity authentication is supported for this resource.

Example Usage

resource "kms_project" "pki" {
  name        = "PKI Project"
  slug        = "pki-project"
  description = "Project for PKI certificate management"
  type        = "cert-manager"
}

resource "kms_cert_manager_internal_ca" "root" {
  project_slug = kms_project.pki.slug

  type          = "root"
  name          = "enterprise-root-ca"
  common_name   = "Enterprise Root Certificate Authority"
  organization  = "Example Corp"
  ou            = "IT Security"
  country       = "US"
  locality      = "San Francisco"
  province      = "California"
  key_algorithm = "RSA_2048"
}

resource "kms_cert_manager_internal_ca" "issuing" {
  project_slug = kms_project.pki.slug

  type          = "intermediate"
  name          = "enterprise-issuing-ca"
  common_name   = "Enterprise Issuing Certificate Authority"
  organization  = "Example Corp"
  ou            = "IT Security"
  country       = "US"
  locality      = "San Francisco"
  province      = "California"
  key_algorithm = "RSA_2048"
}

resource "kms_cert_manager_certificate_policy" "web_server" {
  project_slug = kms_project.pki.slug

  name        = "web-server-policy"
  description = "Policy for web server certificates"

  subject {
    type     = "common_name"
    allowed  = ["*.example.com", "*.internal.example.com"]
    required = ["*.example.com"]
  }

  subject {
    type     = "organization"
    required = ["Example Corp"]
  }

  subject {
    type     = "country"
    required = ["US"]
  }

  sans {
    type     = "dns_name"
    allowed  = ["*.example.com", "*.internal.example.com"]
    required = ["*.example.com"]
  }

  sans {
    type    = "email"
    allowed = ["*@example.com"]
  }

  key_usages {
    allowed = ["digital_signature", "key_encipherment"]
  }

  extended_key_usages {
    allowed = ["server_auth", "client_auth"]
  }

  validity {
    max = "90d"
  }

  algorithms {
    signature     = ["SHA256-RSA", "SHA256-ECDSA", "SHA384-ECDSA"]
    key_algorithm = ["RSA-2048", "RSA-3072", "ECDSA-P256", "ECDSA-P384"]
  }
}

# API enrollment profile for web server certificates
resource "kms_cert_manager_certificate_profile" "web_server_api" {
  project_slug          = kms_project.pki.slug
  ca_id                 = kms_cert_manager_internal_ca.issuing.id
  certificate_policy_id = kms_cert_manager_certificate_policy.web_server.id

  name            = "web-server-api"
  description     = "API enrollment for web server certificates"
  enrollment_type = "api"
  issuer_type     = "ca"

  api_config {
    auto_renew        = true
    renew_before_days = 7
  }
}

# EST enrollment profile for web server certificates
resource "kms_cert_manager_certificate_profile" "web_server_est" {
  project_slug          = kms_project.pki.slug
  ca_id                 = kms_cert_manager_internal_ca.issuing.id
  certificate_policy_id = kms_cert_manager_certificate_policy.web_server.id

  name            = "web-server-est"
  description     = "EST enrollment for web server certificates"
  enrollment_type = "est"
  issuer_type     = "ca"

  est_config {
    passphrase                      = var.est_passphrase
    disable_bootstrap_ca_validation = false
    ca_chain                        = var.encrypted_ca_chain
  }
}

# Self-signed profile for development
resource "kms_cert_manager_certificate_profile" "self_signed_dev" {
  project_slug          = kms_project.pki.slug
  certificate_policy_id = kms_cert_manager_certificate_policy.web_server.id

  name            = "self-signed-dev"
  description     = "Self-signed certificates for development"
  enrollment_type = "api"
  issuer_type     = "self-signed"

  api_config {
    auto_renew        = false
    renew_before_days = 7
  }
}

# ACME profile
resource "kms_cert_manager_certificate_profile" "acme_profile" {
  project_slug          = kms_project.pki.slug
  ca_id                 = var.acme_ca_id
  certificate_policy_id = kms_cert_manager_certificate_policy.web_server.id

  name            = "acme-letsencrypt"
  description     = "Let's Encrypt ACME certificates"
  enrollment_type = "acme"
  issuer_type     = "ca"
}

# ADCS profile (requires external ADCS CA to be configured)
resource "kms_cert_manager_certificate_profile" "adcs_profile" {
  project_slug          = kms_project.pki.slug
  ca_id                 = var.adcs_ca_id # Reference to existing ADCS CA
  certificate_policy_id = kms_cert_manager_certificate_policy.web_server.id

  name            = "adcs-corporate"
  description     = "Corporate ADCS certificates"
  enrollment_type = "api"
  issuer_type     = "ca"

  api_config {
    auto_renew        = true
    renew_before_days = 14
  }

  external_configs {
    template = "WebServerTemplate" # ADCS template name
  }
}

# Variables for sensitive values
variable "est_passphrase" {
  description = "Passphrase for EST enrollment"
  type        = string
  sensitive   = true
}

variable "encrypted_ca_chain" {
  description = "Encrypted CA certificate chain for EST enrollment"
  type        = string
  sensitive   = true
  default     = null
}

variable "acme_ca_id" {
  description = "ID of the ACME CA resource"
  type        = string
  default     = null
}

variable "adcs_ca_id" {
  description = "ID of the ADCS CA resource"
  type        = string
  default     = null
}

Schema

Required

• certificate_policy_id (String) The ID of the certificate policy to use
• enrollment_type (String) The enrollment type for the profile. Supported values: api, est, acme
• name (String) The unique name of the certificate profile
• project_slug (String) The slug of the cert-manager project

Optional

• api_config (Block, Optional) API configuration (required when enrollment_type is 'api') (see below for nested schema)
• ca_id (String) The ID of the certificate authority to use (required unless issuer_type is 'self-signed')
• description (String) The description of the certificate profile
• est_config (Block, Optional) EST configuration (required when enrollment_type is 'est') (see below for nested schema)
• external_configs (Block, Optional) External configuration for external CA types (e.g., ADCS template name) (see below for nested schema)
• issuer_type (String) The issuer type for the profile. Supported values: ca, self-signed. Defaults to 'ca'.

Read-Only

• id (String) The ID of the certificate profile

Nested Schema for api_config

Optional:

• auto_renew (Boolean) Whether to automatically renew certificates
• renew_before_days (Number) Number of days before expiration to renew certificates (1-30)

Nested Schema for est_config

Optional:

• ca_chain (String, Sensitive) The CA certificate chain for EST enrollment
• disable_bootstrap_ca_validation (Boolean) Whether to disable bootstrap CA validation
• passphrase (String, Sensitive) The passphrase for EST enrollment

Nested Schema for external_configs

Optional:

• template (String) Certificate template name for Azure AD CS