A Private CA whose Revocations Are Published
The CRL bucket is optional: a CA created without one can mark a certificate revoked and never tell anyone, and every client keeps trusting it until it expires. Required here unless no CRL is accepted by name. Issued certificates renew by rule; one without a renewal rule is a countdown and is listed. Leaf validity is capped at 90 days; the signing key is an HSM key in your vault.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "certificate_authority" {
source = "www.iac-bazaar.com/iac-bazaar/oci-certificate-authority/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-certificate-authority
A private certificate authority whose revocations are published and whose
certificates renew themselves. Works with Terraform and OpenTofu
(>= 1.6), oci provider >= 8.0, < 9.0.
Without a CRL bucket, revoking a certificate changes nothing a client can
see. The revocation list details are optional in the API. A CA created
without them can mark a certificate revoked and never tell anyone; every
client keeps trusting it until it expires. This module publishes the CRL to
a bucket you name and refuses to go without unless accept_no_crl.
A certificate without a renewal rule expires. Every certificate issued
here renews 14 days before expiry on a 60-day interval by default; one that
must not renew needs accept_unrenewed_certificates and is listed in
unrenewed_certificates.
The CA key lives in your vault and must be HSM-protected. The API refuses software keys; this module cannot tell from the OCID.
Lifetimes are capped by rule, not by convention. 90-day leaves by default.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-vault-kms
KMS vault with HSM/software master keys, key rotation and secret lifecycle management for app credentials.
gcp-certificate-authority
The DevOps tier does not persist the certificates it issues: no record, no CRL, no revocation - a year-long certificate from it can only answer a key compromise by the CA being distrusted whole. ENTERPRISE tier with the CRL published, a 90-day ceiling on every certificate, RSA below 2048 refused, and deletion protection on because deleting a CA invalidates everything it signed.
aws-private-ca
A root or subordinate CA with revocation configured, its certificate installed in the same apply, and ACM permitted to issue from it. Documents the two traps: a CA bills through its deletion window, and one without CRL or OCSP can issue certificates it can never revoke.