A Private CA that Can Revoke What It Issues
The DevOps tier does not persist the certificates it issues: no record, no CRL, no revocation - a year-long certificate from it can only answer a key compromise by the CA being distrusted whole. ENTERPRISE tier with the CRL published, a 90-day ceiling on every certificate, RSA below 2048 refused, and deletion protection on because deleting a CA invalidates everything it signed.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "certificate_authority" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-certificate-authority/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-certificate-authority
A private certificate authority that can revoke what it issues. Works with
Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.
The DevOps tier cannot revoke. A CA pool is ENTERPRISE or DEVOPS, and
DevOps does not persist the certificates it issues: no record, no CRL, no
revocation. It is cheaper and built for certificates that live minutes. A
DevOps pool issuing a year-long server certificate can only answer a key
compromise by being distrusted whole. ENTERPRISE here; DevOps needs
accept_no_revocation, as does turning off the CRL.
The pool's issuance policy is the ceiling on every certificate. A pool with no policy issues whatever it is asked for. This module sets a maximum lifetime (90 days by default), refuses RSA below 2048 bits, and can constrain the names the CA may issue for.
Deleting a CA with active certificates invalidates them. Deletion
protection is on and the grace period kept; turning it off needs
accept_deletable_ca.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-certificate-manager
A Certificate Manager certificate map for external HTTPS load balancers, with an optional Google-managed certificate and DNS authorization provisioned when you supply a domain you control.
gcp-kms
Keyrings and rotation-enabled crypto keys with per-key IAM for CMEK across GCS, BigQuery, Cloud SQL and disks.
gcp-secret-manager
Secrets with versions, replication policy, rotation schedules, expiry and accessor IAM.
oci-certificate-authority
The CRL bucket is optional: a CA created without one can mark a certificate revoked and never tell anyone, and every client keeps trusting it until it expires. Required here unless no CRL is accepted by name. Issued certificates renew by rule; one without a renewal rule is a countdown and is listed. Leaf validity is capped at 90 days; the signing key is an HSM key in your vault.
aws-private-ca
A root or subordinate CA with revocation configured, its certificate installed in the same apply, and ACM permitted to issue from it. Documents the two traps: a CA bills through its deletion window, and one without CRL or OCSP can issue certificates it can never revoke.