Add support for OCSP in certificate resource

[amolari]

Is your feature request related to a problem? Please describe.

We want to be able to configure OCSP stapling. In a first step, the requirement is to configure OCSP for the SSL certificate.
Today it's not possible with TF (resource bigip_ssl_certificate).

Describe the solution you'd like

Add support for OCSP configuration in the SSL certificate object.
We would like to have it implemented along with the new requested resource bigip_ssl_key_certificate (ref: #832)

Describe alternatives you've considered

Additional context

Add any other context or screenshots about the feature request here.

[pgouband]

Hi,

Thanks for reporting. Added to the backlog and internal tracking ID for this request is: INFRAANO-1286.

[amolari]

@RavinderReddyF5 @pgouband
Hi
Testing this with v1.20.0 I do see the following issue:
when I configure the OCSP settings in a bigip_ssl_key_cert resource , it's working fine. Changes too. However, if I re-run with those settings commented, such as:

resource "bigip_ssl_key_cert" "swisssign-cert" {
  partition    = "Common"
  key_name     = "ssign.key"
  key_content  = file("ssign/ssign.key.new")
  cert_name    = "ssign.crt"
  cert_content = file("ssign/ssign.crt.new")
#  cert_monitoring_type = "ocsp"
#  issuer_cert = bigip_ssl_certificate.swisssign-ca-bundle-new.full_path
#  cert_ocsp = bigip_sys_ocsp.swisssign-ocsp-new.name
}

Then the plan/apply are correct but the OCSP configuration on my BIGIP won't be changed (OCSP settings still present).
Consequent plans do detect it and we get continuously:

Terraform will perform the following actions:

  # bigip_ssl_key_cert.swisssign-cert will be updated in-place
  ~ resource "bigip_ssl_key_cert" "swisssign-cert" {
      - cert_monitoring_type = "ocsp" -> null
        id                   = "ssign.key_ssign.crt"
      - issuer_cert          = "/Common/FullChain-SwissSign_RSA_TLS_2022-1" -> null
        # (7 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[pgouband]

Hi @amolari,

There is no default value for OCSP so not adding the parameter can be a revert to default value action.
If you want to set a different value you need to add the parameter in your declaration.