Certificate CA

Defined incertificates.hcl

The certificate_ca resource generates Certificate Authority (CA) certificates and private keys. It creates self-signed root certificates that can be used to sign other certificates in PKI (Public Key Infrastructure) scenarios within lab environments.

Use Cases

As a lab author, you can use certificate_ca resources to:

• Custom Root CA: Replace default CAs with lab-specific certificate authorities for controlled environments
• TLS/SSL Certificate Management: Generate root certificates for signing server and client certificates in HTTPS scenarios

Certificate CA resources provide the foundation for PKI-based security scenarios while ensuring consistent certificate generation.

HCL Syntax

Basic Syntax

resource "certificate_ca" "name" {
  output = "./certs"
}

Full Syntax

resource "certificate_ca" "name" {
  output = "./certificates"
}

Fields

Field	Type	Required	Description
output	string	✓	Output directory to write the certificate and key to

Private Key

certificate_ca→Private Key

Private key output

Field	Type	Required	Description
filename	string	—	Filename of the private key
directory	string	—	Directory containing the private key
path	string	—	Full path to the private key
contents	string	—	Contents of the private key

Public Key PEM

certificate_ca→Public Key PEM

Public key PEM output

Field	Type	Required	Description
filename	string	—	Filename of the public key
directory	string	—	Directory containing the public key
path	string	—	Full path to the public key
contents	string	—	Contents of the public key

Public Key SSH

certificate_ca→Public Key SSH

Public key SSH output

Field	Type	Required	Description
filename	string	—	Filename of the SSH public key
directory	string	—	Directory containing the SSH public key
path	string	—	Full path to the SSH public key
contents	string	—	Contents of the SSH public key

Certificate

certificate_ca→Certificate

Certificate output

Field	Type	Required	Description
filename	string	—	Filename of the certificate
directory	string	—	Directory containing the certificate
path	string	—	Full path to the certificate
contents	string	—	Contents of the certificate

File Object Structure

The File object contains information about generated certificate files:

Field	Type	Description
filename	string	The name of the generated file
directory	string	The directory where the file is written
path	string	The full absolute path to the file
contents	string	The contents of the generated file

Examples

Simple CA Certificate

resource "certificate_ca" "root" {
  output = "./certs"
}

output "ca_cert_path" {
  value = resource.certificate_ca.root.certificate.path  # e.g., "./certs/certificate.pem"
}

output "ca_key_path" {
  value = resource.certificate_ca.root.private_key.path  # e.g., "./certs/private_key.pem"
}

CA for Signing Leaf Certificates

resource "certificate_ca" "lab_ca" {
  output = "./ca-certificates"
}

resource "certificate_leaf" "server_cert" {
  ca_key  = resource.certificate_ca.lab_ca.private_key.path      # e.g., "./ca-certificates/private_key.pem"
  ca_cert = resource.certificate_ca.lab_ca.certificate.path      # e.g., "./ca-certificates/certificate.pem"
  output  = "./server-certs"

  dns_names    = ["localhost", "api.lab.local"]
  ip_addresses = ["127.0.0.1", "192.168.1.100"]
}

Multiple Environment CAs

resource "certificate_ca" "production_ca" {
  output = "./prod-ca"
}

resource "certificate_ca" "staging_ca" {
  output = "./staging-ca"
}

resource "certificate_ca" "development_ca" {
  output = "./dev-ca"
}

# Use production CA for production services
resource "certificate_leaf" "prod_api" {
  ca_key  = resource.certificate_ca.production_ca.private_key.path
  ca_cert = resource.certificate_ca.production_ca.certificate.path
  output  = "./prod-api-certs"

  dns_names = ["api.production.local"]
}

# Use development CA for dev services
resource "certificate_leaf" "dev_api" {
  ca_key  = resource.certificate_ca.development_ca.private_key.path
  ca_cert = resource.certificate_ca.development_ca.certificate.path
  output  = "./dev-api-certs"

  dns_names = ["api.development.local"]
}

Template Integration

resource "certificate_ca" "webapp_ca" {
  output = "./webapp-ca"
}

resource "template" "ca_config" {
  source = <<-EOF
    # Certificate Authority Configuration
    ca_certificate: ${resource.certificate_ca.webapp_ca.certificate.path}        # e.g., "./webapp-ca/certificate.pem"
    ca_private_key: ${resource.certificate_ca.webapp_ca.private_key.path}        # e.g., "./webapp-ca/private_key.pem"
    ca_public_key: ${resource.certificate_ca.webapp_ca.public_key_pem.path}      # e.g., "./webapp-ca/public_key.pem"

    # File information
    ca_cert_filename: ${resource.certificate_ca.webapp_ca.certificate.filename}  # e.g., "certificate.pem"
    ca_key_directory: ${resource.certificate_ca.webapp_ca.private_key.directory} # e.g., "./webapp-ca"
  EOF

  destination = "./ca-config.yaml"
}

Certificate Contents Usage

resource "certificate_ca" "api_ca" {
  output = "./api-ca"
}

resource "container" "secure_api" {
  image {
    name = "nginx:alpine"
  }

  environment = {
    # Pass certificate contents as environment variables
    CA_CERTIFICATE = resource.certificate_ca.api_ca.certificate.contents
    CA_PUBLIC_KEY  = resource.certificate_ca.api_ca.public_key_pem.contents
  }

  volume {
    source      = resource.certificate_ca.api_ca.certificate.path
    destination = "/etc/ssl/certs/ca.pem"
    type        = "bind"
    read_only   = true
  }
}

Best Practices

1. Output Organization: Use descriptive output directories to organize different CA certificates
2. File References: Use .path attribute for file system operations and .contents for inline usage
3. Security: Protect CA private keys - they are the root of trust for your certificate hierarchy
4. Naming: Use meaningful names that reflect the CA’s purpose or environment
5. Directory Structure: Organize certificates by environment or purpose for better maintainability
6. Template Integration: Use templates to create configuration files that reference certificate paths
7. Container Usage: Mount certificate files into containers using volume binds when needed