Resource to generate a PKCS #12 archive file out of PKI components

[ebekker]

It would be useful to support generating a PKCS #12 (PKCS12 or also known as PFX) archive file out of PKI components, including an optional private key, and a chain of one or more certificates. The current set of TLS resources support generating/exporting to PEM format files, but there are many cases where a PFX archive file is preferred or required such as Windows host environments, Azure provider or Oracle OCI provider.

I recommend supporting this resource in a more general-purpose manner, such that you can give it an optional private key PEM, and one or more certificates (i.e. an array of certificate PEM clobs). By doing so, the resource would be usable in tandem with other resources of this provider, as well as alternate providers, such as the third-party ACME cert provider.

An example usage might look like this:

## Generate a self-signed cert using a private key stored on disk
resource "tls_self_signed_cert" "example" {
  key_algorithm   = "ECDSA"
  private_key_pem = "${file(\"private_key.pem\")}"

  subject {
    common_name  = "example.com"
    organization = "HCTF Examples, Inc"
  }

  validity_period_hours = 12

  allowed_uses = [
    "key_encipherment",
    "digital_signature",
    "server_auth",
  ]
}

## Produce a PKCS #12 archive of the self-signed cert (private key included)
resource "tls_pkcs12_archive" "example_pfx" {
  private_key_pem = "${file(\"private_key.pem\")}"
  certificate_pem = [
    "${tls_self_signed_cert.example.cert_pem}"
  ]
}

## Save the PKCS #12 archive to an S3 bucket
resource "aws_s3_bucket_object" "example_pfx_s3obj" {
    bucket = "${aws_s3_bucket.example_s3_bucket.id}"
    key    = "pki/example.pfx"

    content = <<EOF
${tls_pkcs12_archive.example_pfx.archive_blob}
EOF
}

Terraform Version

Terraform v0.11.3

Affected Resource(s)

provider.tls v1.1.0

[digiwhite1980]

I guess a password option in some way is also needed...

[vadimkuznetsov]

#69

[rajatrawat99]

is there any update on this issue?

[elliotchaim]

Hi guys any update on this?

[chilicat]

I have created a provider that helps to create PKCS12 from PEM files:

https://registry.terraform.io/providers/chilicat/pkcs12/latest/docs/resources/from_pem

[Poil]

I have created a provider that helps to create PKCS12 from PEM files:

https://registry.terraform.io/providers/chilicat/pkcs12/latest/docs/resources/from_pem

It will be nice to also have a datasource to read a PFX and allow to get his private key and cert
Regards

[detro]

Superseded by #205.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.