deevnet_certificate (Resource) #

A server certificate for one of the tenant’s own services, for a name in the tenant’s own zone, signed by the site’s Tenant Service CA. It chains to the Deevnet Root CA, which every client on a site already trusts.

You make the key and keep it. This resource takes a signing request, not a key: make both with the tls provider (tls_private_key, tls_cert_request). The key stays in your state and on your workload, and never goes to the API.

The request is read for its public key alone. Its subject and its names are not used. The certificate is for <name>.<tenant zone>, and for each of names in the same zone, whatever the request says.

It expires after a year, and renewing is an apply. Once fewer than sixty days remain, a plan shows this resource changing, and the apply issues a new certificate for the same key. Nothing renews it if you do not apply: run a plan at least every ten months. Whatever serves the certificate then needs the new one.

A certificate cannot be withdrawn. Destroying this resource, or replacing its key, does not revoke the old certificate, which stays valid until it expires wherever its key still is.

Example Usage #

# You make the key, and it stays in your state and on your workload.
# Needs the hashicorp/tls provider.
resource "tls_private_key" "console" {
  algorithm   = "ECDSA"
  ecdsa_curve = "P256"
}

# The request is read for its key alone, so its subject is only a label for
# your own reading.
resource "tls_cert_request" "console" {
  private_key_pem = tls_private_key.console.private_key_pem

  subject {
    common_name = "console"
  }
}

# A certificate for console.<tenant zone>, and for www.<tenant zone> beside it.
resource "deevnet_certificate" "console" {
  tenant  = deevnet_tenant.this.name
  name    = "console"
  names   = ["www"]
  csr_pem = tls_cert_request.console.cert_request_pem
}

# What a server wants: the key, and the certificate with its chain.
output "console_tls_key" {
  value     = tls_private_key.console.private_key_pem
  sensitive = true
}

output "console_tls_fullchain" {
  value = deevnet_certificate.console.fullchain_pem
}

Schema #

Required #

• csr_pem (String) A PEM signing request made with your key: tls_cert_request.<name>.cert_request_pem. The key must be RSA of 2048 bits or more, or ECDSA P-256. A request for a new key issues a new certificate.
• name (String) The certificate’s own name: one DNS label under the tenant’s zone, such as console. A label, not a full name: the API appends the zone.
• tenant (String) The tenant this certificate belongs to: the name of a deevnet_tenant.

Optional #

• names (List of String) Further labels in the tenant’s zone for the certificate to be valid for, beside name. Up to seven. No dots and no wildcards.

Read-Only #

• ca_chain_pem (String) What a server presents after the certificate, PEM: the Tenant Service CA, then the Site CA. Not the root, which a client holds.
• certificate_pem (String) The certificate, PEM.
• dns_names (List of String) Every DNS name the certificate is valid for, in full, its own first.
• fqdn (String) The certificate’s own name in full, and its common name.
• fullchain_pem (String) certificate_pem followed by ca_chain_pem: the one file most servers want beside the key.
• key_fingerprint (String) The SHA-256 of the public key certified, in hex.
• not_after (String) When the certificate expires, RFC 3339.
• not_before (String) When the certificate becomes valid, RFC 3339.
• present (Boolean) Whether the API still holds this certificate.
• renew_after (String) When a plan begins to show a renewal: sixty days before not_after, RFC 3339.
• serial (String) The certificate’s serial number, as hex pairs.