Generates a TLS certificate using a Certificate Signing Request (CSR) and signs it with a provided certificate authority (CA) private key.

Locally-signed certificates are generally only trusted by client software when setup to use the provided CA. They are normally used in development environments or when deployed internally to an organization.

Example Usage

resource "tls_locally_signed_cert" "example" {
    cert_request_pem = "${file(\"cert_request.pem\")}"

    ca_key_algorithm = "ECDSA"
    ca_private_key_pem = "${file(\"ca_private_key.pem\")}"
    ca_cert_pem = "${file(\"ca_cert.pem\")}"

    validity_period_hours = 12

    allowed_uses = [

Argument Reference

The following arguments are supported:

The allowed_uses list accepts the following keywords, combining the set of flags defined by both Key Usage and Extended Key Usage in RFC5280:

Attributes Reference

The following attributes are exported:

Automatic Renewal

This resource considers its instances to have been deleted after either their validity periods ends or the early renewal period is reached. At this time, applying the Terraform configuration will cause a new certificate to be generated for the instance.

Therefore in a development environment with frequent deployments it may be convenient to set a relatively-short expiration time and use early renewal to automatically provision a new certificate when the current one is about to expire.

The creation of a new certificate may of course cause dependent resources to be updated or replaced, depending on the lifecycle rules applying to those resources.

See the source of this document at Terraform.io