A Certificate Uploaded to Certificate Management Service, with the SM2 Pair Checked
A certificate uploaded into Certificate Management Service for SLB, ALB, CDN and API Gateway to reference. The private key is an argument, so it lands in the Terraform state and the README says so plainly. SM2 is a signing pair plus an encryption pair and the module refuses a half-filled set, which would upload something no client can handshake with.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "ssl_certificate" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-ssl-certificate/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-ssl-certificate
Managed TLS certificates on Alibaba Cloud Certificate Management Service. Works with Terraform and OpenTofu
(>= 1.6), alicloud provider >= 1.0, < 2.0.
The private key is in the Terraform state. There is no way around it for this resource, so the state backend has to be remote, encrypted and access-controlled, and a plan file has to be treated as a secret.
SM2 is two certificates, not one, and the module refuses a half-filled set rather than uploading something no client can handshake with.
Uploading is not renewing. Nothing here watches the expiry date; issuance and renewal are the order flow, which is a purchase.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-kms-key
automatic_rotation defaults to Disabled, so today's key material encrypts everything for the life of the account; a key scheduled for deletion is gone after its window with everything encrypted under it; and deletion_protection, the switch that refuses the schedule, defaults to off. Rotation on at your interval, deletion protection on and off by name, the maximum pending window, and an alias.
alicloud-kms-secret
A secret in Alibaba Cloud KMS Secrets Manager whose value is a sensitive variable supplied at apply time and never output, encrypted with a KMS key of yours rather than the service key (the service key by name), with a version label that rotates the value when changed and a recovery window of up to thirty days before a deleted secret is gone; force deletion is accepted by name.
tencent-ssl-certificate
A free domain-validated certificate from Tencent Cloud SSL. DNS_AUTO writes the record for you and silently only works when the domain is on DNSPod, so the module refuses it unless you confirm that. The issued private key is a computed attribute and therefore in state, and the resource finishes before the certificate is issued, so read the status output.
ibm-public-certificate
A publicly-trusted certificate issued into Secrets Manager, validated over DNS through Cloud Internet Services, with both configurations created here rather than left to a console. Staging issues a certificate no browser trusts while looking like success, so it is refused by name; auto-rotation and key rotation are on, because a ninety-day certificate nothing renews is a dated outage.
aws-acm
Requests a public, DNS-validated ACM TLS certificate that ACM auto-renews forever, outputting the validation records to publish - CT logging on, wildcards and SANs supported.
akamai-cps-dv-certificate
Automated Domain Validated TLS enrollment with DNS/HTTP challenge outputs wired for Edge DNS.