Generating azurerm_key_vault_certificate with non-integrated CA fails

[mbrancato]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.12.12
+ provider.azurerm v1.42.0

Affected Resource(s)

• azurerm_key_vault_certificate

Terraform Configuration Files

resource "azurerm_key_vault_certificate" "test" {
  name         = "generated-cert"
  key_vault_id = azurerm_key_vault.test.id

  certificate_policy {
    issuer_parameters {
      name = "Unknown"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      extended_key_usage = ["1.3.6.1.5.5.7.3.1"]

      key_usage = [
        "digitalSignature",
        "keyEncipherment",
      ]

      subject_alternative_names {
        dns_names = ["test.domain.com"]
      }

      subject            = "CN=test.domain.com"
      validity_in_months = 12
    }
  }
}

Expected Behavior

Based on how this behavior works using the Azure Portal, the private key should be created but the certificate resource will show a disabled / in-progress state. This would be true until the CSR is downloaded and a signed certificate is merged into the certificate. I believe that the provider should just ensure the certificate private key is created. Additionally, I think that the exported attributes should include the CSR (or accessible via a data source) that can be saved / output to the host where Terraform is ran. There is probably not a good flow for merging this, but I could see that support being added.

This seems to be a supported configuration per the documentation, however there are no unit tests for certificate_policy.issuer_parameters.name = "Unknown". Is this a working implementation?

Can the documentation be updated to better explain how this flow should work?

Actual Behavior

Terraform fails to create the certificate - but in the portal it does exist and is waiting for the signing to occur.

azurerm_key_vault_certificate.test: Still creating... [4m10s elapsed]

Error: Error waiting for Certificate "generated-cert" in Vault "https://test000000000.vault.azure.net/" to become available: couldn't find resource (21 retries)

  on test.tf line 68, in resource "azurerm_key_vault_certificate" "test":
  68: resource "azurerm_key_vault_certificate" "test" {

Attempts to run a second time results in:

azurerm_key_vault_certificate.example: Creating...

Error: keyvault.BaseClient#CreateCertificate: Failure responding to request: StatusCode=409 -- Original Error: autorest/azure: Service returned an error. Status=409 Code="Conflict" Message="A new key vault certificate can not be created or imported while a pending key vault certificate's status is inProgress."

  on test.tf line 68, in resource "azurerm_key_vault_certificate" "test":
  68: resource "azurerm_key_vault_certificate" "test" {

Steps to Reproduce

1. terraform apply

[ThomasZeman]

I can confirm this problem. Reason for this is that the terraform resource is waiting for the certificate to have a SID which it will only have once it gets signed by an external CA. So basically the resource is done as soon as a certificate with an 'unknown' issuer has been created. From there on the user needs to download the certificate manually (signing request; csr) and get it signed by an external provider.

[tombuildsstuff]

From what I can see this was fixed in #6979, so I'm going to close this issue for the moment - but please let us know if upgrading to the latest version of the Provider doesn't work and we'll take another look.

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!