Certificate authorities as code
Declare root and intermediate CAs and reference issuer IDs through Terraform dependencies.
Explore private PKI →Terraform provider for private PKI
Manage certificates and private PKI as infrastructure as code.
The SecuriTLS Terraform provider lets DevOps, platform, and security teams declare certificate authorities, certificate hierarchies, storage, devices, and certificate lifecycle operations alongside the infrastructure they protect.
Build repeatable root → intermediate → leaf PKI relationships in HCL, keep certificate dependencies explicit, and use Terraform changes to drive reissue, renew, and rekey workflows.
Private PKI with Terraform
resource "securitls_certificate" "root" {
type = "root"
common_name = "Example Corp Root"
expire_interval_days = 3650
}
resource "securitls_certificate" "intermediate" {
type = "intermediate"
common_name = "Example Corp Intermediate"
expire_interval_days = 1825
signer = securitls_certificate.root.id
}
resource "securitls_certificate" "leaf" {
type = "leaf"
common_name = "Example Corp Leaf"
expire_interval_days = 47
signer = securitls_certificate.intermediate.id
}Terraform certificate management
Keep PKI relationships in the same workflow as infrastructure.
Instead of passing certificate IDs between scripts or manually recreating CA relationships, reference SecuriTLS Terraform resources directly.
Lifecycle-aware resources
Certificate configuration changes cause reissue, while explicit string triggers can request renew, rekey, or reissue without a boolean reset cycle.
Explore lifecycle automation →Storage and deployment resources
Manage supported SecuriTLS storage providers, storage keys, devices, and certificate attachments from Terraform workflows.
Explore deployment automation →Certificate lineage
Let Terraform follow successor certificate IDs.
SecuriTLS renew, rekey, and reissue operations create successor certificate records. The provider advances the Terraform resource to the successor ID so dependent certificate relationships can follow the active lineage.
Automatic reissue on configuration change
Changing certificate properties such as signer, SANs, validity, or key settings results in a SecuriTLS reissue rather than an unrelated Terraform destroy/create cycle.
Explicit lifecycle triggers
Change renew_trigger, rekey_trigger, or reissue_trigger to request a lifecycle operation. Any new non-null string value can act as the trigger.
Dependency propagation
If a CA receives a successor ID, Terraform can detect the changed signer reference on dependent certificates and update the hierarchy accordingly.
Get started