Can't import certificate with google_compute_ssl_certificate resource

[pierrefevrier]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

terraform # terraform -v
Terraform v0.12.24
+ provider.google v3.17.0
+ provider.google-beta v3.17.0

Affected Resource(s)

• google_compute_ssl_certificate

Terraform Configuration Files

• variables.tf

variable "ssl_certificate" {
  type = object({
    private_key_path = string
    certificate_path = string
  })
}

• iap.tf

resource "google_compute_ssl_certificate" "my_domain" {
  name_prefix = "my-domain-"
  private_key = file(var.ssl_certificate.private_key_path)
  certificate = file(var.ssl_certificate.certificate_path)

  lifecycle {
    create_before_destroy = true
  }
}

Output

Error: Error creating SslCertificate: googleapi: Error 400: The SSL certificate and key do not match., sslCertificateKeyAndCertMismatch

  on iap.tf line 27, in resource "google_compute_ssl_certificate" "my_domain":
  27: resource "google_compute_ssl_certificate" "my_domain" {

Expected Behavior

The certificate should be imported, because it is valid.

Actual Behavior

The certificate is not imported.

Steps to Reproduce

1. Download the root certificate (.cer) + the intermediate one (.cer) + private key (.key)
2. Concat intermediate certificate and root one (in this order)
3. run terraform

• Run docker image of Terraform

docker run -it --rm --name gcp-terraform \
    --entrypoint "/bin/sh" \
    -v "$(pwd):/terraform" \
    -e GOOGLE_CREDENTIALS=/tmp/credentials.json \
    -e SSL_CERTIFICATE=/tmp/certificate.cer \
    -e SSL_CERTIFICATE_PRIVATE_KEY=/tmp/certificate-private-key.key \
    hashicorp/terraform:light

• Run Terraform inside container

vi /tmp/credentials.json # copy/paste credentials
vi /tmp/certificate.cer # copy/paste intermediate certificate, then root one
vi /tmp/certificate-private-key.key # copy/paste private key
export TF_VAR_ssl_certificate="{ certificate_path = \"$SSL_CERTIFICATE\", private_key_path = \"$SSL_CERTIFICATE_PRIVATE_KEY\" }"
terraform init -backend-config "bucket=my-gcp-project-tfstate"
terraform plan -out /tmp/plan.tfplan
terraform apply /tmp/plan.tfplan

I can successfully import this same certificate using the GCP console.

• #0000

[edwardmedia]

@pierrefevrier Can you post your config for your import? What command did you run?

[pierrefevrier]

Hi @edwardmedia ,

Sorry, output was hidden in my post, I just edited it so you can see what it is telling me and I added more details about the command I launch.
Tell me if these infos are enough for you.

Thanks.

[edwardmedia]

@pierrefevrier when I tested the import for your case, I used below code

resource "google_compute_ssl_certificate" "my_domain" {
}

And used below command. You need to replace {{name}} with real ssl cert name.
terraform import google_compute_ssl_certificate.my_domain {{name}}
Was that similar to what you did?

[pierrefevrier]

Arf, when I talk about import, I mean Terraform to GCP, not GCP to Terraform (I didn't try to import the certificate via terraform import as I want to do the opposite).

[edwardmedia]

@pierrefevrier Oh I see. The error seems to be clear what went wrong.googleapi: Error 400: The SSL certificate and key do not match., sslCertificateKeyAndCertMismatch. To verify if your terraform code works, can you deploy a sample certificate?

[pierrefevrier]

What do you mean by deploy a sample certificate (I don't have other certificates to test :/) ? Deploying the same certificate via GCP console works.

[edwardmedia]

@pierrefevrier I meant a self-signed certificate.

[pierrefevrier]

Yeah, I managed to make it work by passing only the intermediate certificate !
This is confusing because I had to pass the root certificate too, when importing the certificate via GCP console.
Thanks for your tips @edwardmedia !

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!