This module configures a private certificates engine for a Secrets Manager instance. For more information about enabling Secrets Manager for private certificates, see Preparing to create private certificates.
The module handles the following components:
- Root certificate authorities configuration
- Intermediate certificate authorities configuration
- Certificate templates
These components make up the private_cert
secrets type. The module also signs the intermediate certificate authority (CA) when the engine is created.
module "private_secret_engine" {
source = "terraform-ibm-modules/secrets-manager-private-cert-engine/ibm"
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
secrets_manager_guid = "<secrets_manager_instance_id>"
region = "us-south"
root_ca_name = "My Root CA"
root_ca_common_name = "cloud.ibm.com"
root_ca_max_ttl = "8760h"
intermediate_ca_name = "My Intermediate CA"
certificate_template_name = "My Certificate Template"
}
You need the following permissions to run this module.
- IAM Services
- Secrets Manager service
Administrator
platform accessManager
service access
- Secrets Manager service
Name | Version |
---|---|
terraform | >= 1.3.0 |
ibm | >= 1.62.0, < 2.0.0 |
No modules.
Name | Description | Type | Default | Required |
---|---|---|---|---|
allowed_domains_template | Optional, Allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates | bool |
false |
no |
alt_names | Optional, Alternate names for the certificate to be created | list(string) |
null |
no |
certificate_template_name | Name of the Certificate Template to create for a private_cert secret engine | string |
n/a | yes |
country | Optional, Country (C) values to define in the subject field of the resulting certificate | list(string) |
null |
no |
endpoint_type | The endpoint type to communicate with the provided secrets manager instance. Possible values are public or private |
string |
"public" |
no |
exclude_cn_from_sans | Optional, Set whether the common name is excluded from Subject Alternative Names (SANs). If set to true, the common name is not included in DNS or Email SANs if they apply | bool |
false |
no |
intermediate_ca_common_name | Common name for the intermediate CA | string |
"cloud.ibm.com" |
no |
intermediate_ca_crl_disable | crl_disable for the intermediate CA | bool |
false |
no |
intermediate_ca_crl_distribution_points_encoded | crl_distribution_points_encoded flag for the intermediate CA | bool |
true |
no |
intermediate_ca_crl_expiry | crl_expiry for the intermediate CA | string |
"72h" |
no |
intermediate_ca_issuing_certificates_urls_encoded | issuing_certificates_urls_encoded flag for the intermediate CA | bool |
true |
no |
intermediate_ca_max_ttl | for the intermediate CA | string |
"26300h" |
no |
intermediate_ca_name | Name of the Intermediate CA to create for a private_cert secret engine | string |
n/a | yes |
intermediate_ca_signing_method | Optional, Signing method to use with this certificate authority to generate private certificates | string |
"internal" |
no |
ip_sans | Optional, IP Subject Alternative Names (SANs) to define for the CA certificate, in a comma-delimited list | string |
null |
no |
key_type | Optional, Type of private key to generate | string |
"rsa" |
no |
locality | Optional, Locality (L) values to define in the subject field of the resulting certificate | list(string) |
null |
no |
organization | Optional, Organization (O) values to define in the subject field of the resulting certificate | list(string) |
null |
no |
organizational_unit | Optional, Organizational Unit (OU) values to define in the subject field of the resulting certificate | list(string) |
null |
no |
other_sans | Optional, The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to define for the CA certificate. The alternative names must match the values that are specified in the 'allowed_other_sans' field in the associated certificate template | list(string) |
null |
no |
permitted_dns_domains | Optional, Allowed DNS domains or subdomains for the certificates to be signed and issued by the CA certificate | list(string) |
null |
no |
postal_code | Optional, Street Address values in the subject field of the resulting certificate | list(string) |
null |
no |
private_key_format | Optional, Format of the generated private key | string |
"der" |
no |
province | Optional, Province (ST) values to define in the subject field of the resulting certificate | list(string) |
null |
no |
region | Region of the secrets manager instance | string |
n/a | yes |
return_format | Optional, Format of the returned data | string |
"pem" |
no |
root_ca_common_name | Fully qualified domain name or host domain name for the certificate to be created | string |
n/a | yes |
root_ca_crl_disable | crl_disable flag for the root CA | bool |
false |
no |
root_ca_crl_distribution_points_encoded | crl_distribution_points_encoded flag for the root CA | bool |
true |
no |
root_ca_crl_expiry | Optional, Expiry time for root CA Certificate Revocation List (CRL) | string |
null |
no |
root_ca_issuing_certificates_urls_encoded | issuing_certificates_urls_encoded flag for the root CA | bool |
true |
no |
root_ca_max_ttl | Maximum TTL value for the root CA | string |
n/a | yes |
root_ca_name | Name of the Root CA to create for a private_cert secret engine | string |
n/a | yes |
secrets_manager_guid | GUID of secrets manager instance to create the secret engine in | string |
n/a | yes |
street_address | Optional, Street Address values in the subject field of the resulting certificate | list(string) |
null |
no |
tempalate_key_usage | Optional, List of allowed key usage constraint to define for private certificates | list(string) |
[ |
no |
template_allow_any_name | Optional, Allow clients to request a private certificate that matches any common name | bool |
true |
no |
template_allow_bare_domains | Optional, Allow clients to request private certificates that match the value of the actual domains on the final certificate | bool |
false |
no |
template_allow_glob_domains | Optional, Allow glob patterns in the names that are specified in the allowed_domains field | bool |
false |
no |
template_allow_ip_sans | Optional, Allow clients to request a private certificate with IP Subject Alternative Names | bool |
true |
no |
template_allow_subdomains | Optional, Allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options | bool |
false |
no |
template_allowed_domains | Optional, Domains to define for the certificate template | list(string) |
[] |
no |
template_allowed_other_sans | Optional, The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates | list(string) |
[] |
no |
template_allowed_secret_groups | Optional, Allowed secrets group Ids as a comma-delimited list | string |
null |
no |
template_allowed_uri_sans | Allowed URI SANs for the certificate template | list(string) |
[ |
no |
template_basic_constraints_valid_for_non_ca | Optional, Mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates | bool |
false |
no |
template_client_flag | Optional, Set whether private certificates are flagged for client use | bool |
true |
no |
template_code_signing_flag | Optional, Set whether private certificates are flagged for code signing use | bool |
false |
no |
template_email_protection_flag | Optional, Set whether private certificates are flagged for email protection use | bool |
false |
no |
template_enforce_hostnames | Optional, Set whether to enforce only valid host names for common names, DNS Subject Alternative Names, and the host section of email addresses | bool |
true |
no |
template_ext_key_usage | Optional, List of allowed extended key usage constraint on private certificates | list(string) |
[] |
no |
template_ext_key_usage_oids | Optional, List of extended key usage Object Identifiers (OIDs) | list(string) |
[] |
no |
template_max_ttl | Max TTL for the certificate template | string |
"8760h" |
no |
template_policy_identifiers | Optional, list of policy Object Identifiers (OIDs) | list(string) |
[] |
no |
template_require_common_name | Optional, Set whether to require a common name to create a private certificate | bool |
true |
no |
template_serial_number | Optional, Serial number to assign to the generated certificate | string |
null |
no |
template_server_flag | Optional, Set whether private certificates are flagged for server use | bool |
true |
no |
template_use_csr_cn | Optional, Set whether to use the common name (CN) from a certificate signing request (CSR) instead of the CN that's included in the data of the certificate | bool |
true |
no |
template_use_csr_sans | Optional, Set whether to use the Subject Alternative Names(SANs) from a certificate signing request (CSR) instead of the SANs that are included in the data of the certificate | bool |
true |
no |
ttl | Optional, Time-to-live (TTL) to assign to a private certificate | string |
null |
no |
uri_sans | Optional, URI Subject Alternative Names (SANs) to define for the CA certificate, in a comma-delimited list | string |
null |
no |
No outputs.
You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.
To set up your local development environment, see Local development setup in the project documentation.