oci_certificates_management_certificate fails with config_type="IMPORTED"

[jeliker]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version and Provider Version

Terraform v1.0.9
on darwin_amd64
+ provider registry.terraform.io/hashicorp/oci v4.50.0

Affected Resource(s)

affected_resources = oci_certificates_management_certificate

Terraform Configuration Files

resource "oci_certificates_management_certificate" "the_certificate" {
  certificate_config {
    config_type     = "IMPORTED"
    cert_chain_pem  = var.cert_chain_pem
    certificate_pem = var.certificate_pem
    private_key_pem = var.private_key_pem
  }

  compartment_id = var.compartment_id
  name           = var.name
}

Debug Output

│ Error: Unsupported argument
│ 
│   on certs.tf line 4, in resource "oci_certificates_management_certificate" "the_certificate":
│    4:     cert_chain_pem = var.cert_chain_pem
│ 
│ An argument named "cert_chain_pem" is not expected here.
╵
╷
│ Error: Unsupported argument
│ 
│   on certs.tf line 5, in resource "oci_certificates_management_certificate" "the_certificate":
│    5:     certificate_pem = var.certificate_pem
│ 
│ An argument named "certificate_pem" is not expected here.
╵
╷
│ Error: Unsupported argument
│ 
│   on certs.tf line 6, in resource "oci_certificates_management_certificate" "the_certificate":
│    6:     private_key_pem = var.private_key_pem
│ 
│ An argument named "private_key_pem" is not expected here.

Panic Output

Expected Behavior

• I expect IMPORTED certificate script to process properly and create a certificate resource

Actual Behavior

• Certificate with config_type="IMPORTED" throws error as shown above

Steps to Reproduce

1. terraform plan

Important Factoids

References

• Certificates IMPORT API doc
  https://docs.oracle.com/en-us/iaas/api/#/en/certificatesmgmt/20210224/datatypes/CreateCertificateByImportingConfigDetails

[jeliker]

I commented out the above and see this:

Error: expected certificate_config.0.config_type to be one of [ISSUED_BY_INTERNAL_CA MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA], got IMPORTED

I would call that accurate in terms of the source code but wrong in terms of the API which allows for IMPORTED cert types:

https://github.com/terraform-providers/terraform-provider-oci/blob/604b2903b48397f462658ddc22725f8cc370ffa7/oci/certificates_management_certificate_resource.go#L50-L53

• https://docs.oracle.com/en-us/iaas/api/#/en/certificatesmgmt/20210224/datatypes/CreateCertificateConfigDetails

  Allowed values are:

  • ISSUED_BY_INTERNAL_CA (See CreateCertificateIssuedByInternalCaConfigDetails)
  • MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA (See CreateCertificateManagedExternallyIssuedByInternalCaConfigDetails)
  • IMPORTED (See CreateCertificateByImportingConfigDetails)

[riyaz-sk]

Please look into this issue, we are blocked because of this bug

[jeliker]

Have confirmed issue is still present in version 4.55.0 (#1491)

[damtst]

Seems it is till present on 4.67.0

[mahmoudrabie]

Have confirmed issue is still present in version 4.67.0

│ Error: expected certificate_config.0.config_type to be one of [ISSUED_BY_INTERNAL_CA MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA], got IMPORTED
│
│ with oci_certificates_management_certificate.......
.............
│ 6: config_type = "IMPORTED"

[bluedot09]

The issue is persistent in 4.77 as well.

[jeliker]

This is glaringly still broken in 4.79

Error: expected certificate_config.0.config_type to be one of [ISSUED_BY_INTERNAL_CA MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA], got IMPORTED
│ 
│   with module.cert_hbs1_wildcard.oci_certificates_management_certificate.the_certificate,
│   on ../modules/cert/cert.tf line 1, in resource "oci_certificates_management_certificate" "the_certificate":
│    1: resource "oci_certificates_management_certificate" "the_certificate" {

Why is this seemingly ignored since initially reported over seven months back (across 29 releases of the provider)? Respectfully to the OCI certificate service, I have many (many, many) more customers using externally-generated certificates than I do using the OCI CA. Thus, supporting all types except IMPORTED seems entirely backwards.

[NeilDavisNPS]

Apparently, it is not broken, it is by design. If one imports the private key via terraform, it will be in the state. Despite what the documentation states, one cannot import an external certificate using terraform, so says "The Oracle"

[jeliker]

Respectfully, @NeilDavisNPS, that sounds like a theory to make sense of the incomplete/inconsistent behavior more than the final answer. If it were truly “by design” then why hasn’t that very simple reason been used to close this “bug” by an authoritative source over the many months it’s been open and commented on? There have been multiple discussions here about protecting the state file (which may contain privileges information) as has long been the guidance from Hashicorp across multiple providers. Therefore, it shouldn’t be jaw-dropping to find another bit of sensitive information added to the state. If there were truly a movement to cleanse the state of confidential details, let’s talk about the DB system and TDE passwords that are there in clear text plus private key information for Load Balancer certificates, pre-shared keys for IPSec VPN, and so on. Don’t get me wrong—I’d love to find the state file cleaned up like this but it’s very hard to accept that imported certs for the CA service is finally where this starts (notably without explanation and contrary to the documentation). I’d be very happy to find all instances of PRIVATE_KEY and DB_PASSWORD replaced with PRIVATE_KEY_DETAILS {SECRET_ID, SECRET_NAME, VAULT_ID}, DB_PASSWORD_DETAILS { . . . } and so on.

[NeilDavisNPS]

@jeliker , I raised a SR with Oracle, and that was the response. I too have been stumped by the inability to import external certificates using terraform. So the pipeline I have is incomplete; I have to find another way to upload the certificate (portal).

[jeliker]

Ah well definitely moving past anecdote at least. thank you for sharing that. Unfortunately I’ve experienced more than one SR that concludes with the technician’s opinion as to a certain behavior vs. an authoritative conclusion. Meanwhile I’ll keep badgering here until the issue here is formally closed with such explanation or until the documentation is updated to state import intentionally isn’t supported.

[danielwoodz]

This issue is still present in version 4.100.0.

I'll be opening a SR and having my TAM look at it, hopefully that will get it on a roadmap.

Edit: Opened SR 3-31268176681, CS is now waiting on response from Engineering. So at least this will be on their desk to triage.

[jeliker]

It was reported over a year ago: Very frustrating! This is a core use case for the Certificates service for my customers. Many (many, many) more are using the service for imported certificates rather than using the CA features yet.