Managing Certificates Using AppViewX Terraform Provider

What is Terraform?

Terraform is an infrastructure-as-code tool that lets you build, change, and version cloud and on-prem resources safely and efficiently.

HashiCorp Terraform is an infrastructure-as-code tool that allows you to define both cloud and on-prem resources using human-readable configuration files. These files can be versioned, reused, and shared. Terraform enables you to apply a consistent workflow to provision and manage your infrastructure throughout its entire lifecycle. It can handle low-level components such as compute, storage, and networking resources, as well as higher-level components like DNS entries and SaaS features.

How does Terraform work?

Terraform creates and manages resources on cloud platforms and other services through their application programming interfaces (APIs). Providers enable Terraform to work with virtually any platform or service with an accessible API.

HashiCorp and the Terraform community have already written thousands of providers to manage many different types of resources and services. You can find all publicly available providers on the Terraform Registry, AppViewX Terraform is one of the providers.

The core Terraform workflow consists of three stages:

• Write: You define resources that span multiple cloud providers and services. For example, you can create a configuration to deploy an application on virtual machines within a Virtual Private Cloud (VPC) network, complete with security groups and a load balancer.
• Plan: Terraform creates an execution plan that outlines the infrastructure it will create, update, or destroy based on the existing infrastructure and your configuration.
• Apply: Once approved, Terraform executes the proposed operations in the correct sequence, aking resource dependencies into account. For example, if you update the properties of a VPC and change the number of virtual machines within it, Terraform will re-create the VPC before scaling the virtual machines.

What AppViewX Terraform Provider does?

• Creates Certificate with the provided CSR Parameters.
• Downloads the certificate in different formats along with the trust store certificates, if needed
• Downloads the private key from AppViewX in password protected manner and in plain .pem format

Where is AppViewX Terraform Provider Hosted?

• The latest version of AppViewX Terraform Provider is 1.0.1 which is hosted in Hashicorp Terraform Registry.
• Opensource git hub repository which will be synced with this Terraform Registry.

Supported Authentication Models

• AppViewX user name and password credentials
• AppViewX service account credentials

Supported APIs and Details

Following are the APIs used internally in AppViewX Terraform Provider to create certificates and download them:

• Log onto AppViewX using your user name and password
  • Using the session id for further API calls
• Log onto AppViewX using service account credentials
  • Using the access token for further API calls
• Create Certificate with the provided CSR parameters in the .tf file.
  • Create Certificate uses Visual Workflow process, so disabling the approval level in policy will be helpful.
• Download end certificate in formats such as .pem, .crt, .cer, .der, .p12, .pfx, .jks.
  • Download trusted certificates along with .p12, .pfx and .jks formats.
• Download the private key created in AppViewX in the password protected manner or in plain .pem format
• OpenSSL command to get the plain private key from the password protected key:

  openssl pkey -in <Password protected private key file> -out <Plain Private key file path> -passin pass:<Password of the private key>

How to use AppViewX Terraform Provider?

• Install and configure Terraform on your local machine where you intend to use it.
• Copy the provider from the AppViewX Terraform provider link and add it to your local version.tf file
• Create a .tf configuration file to enroll the certificate.
• Remove the .tfstate configuration:

  rm -rf ./terraform.tfstate

• Validate the terraform configuration:

  terraform validate

• Review the execution plan:

  terraform plan

• Apply the Terraform configurations:

  terraform apply

  Post this step, the certificate creation process will be triggered.

 ….
 ….
}
resource "time_sleep" "wait" {
           depends_on = [appviewx_create_certificate.createcert]
           create_duration = "10s" 
}
resource "appviewx_download_certificate" "downloadcert"{
	depends_on = [time_sleep.wait]
	resource_id=appviewx_create_certificate.createcert.resource_id
            …..
} 

Sample Provider and Resources .tf files

terraform {
  required_providers {
    appviewx = {
      source = "AppViewX/appviewx"
      version = "1.0.1"
    }
  }
}

Troubleshooting

1. Ensure that the provider version is correct.
2. Verify that the fields in the .tf files have the exact field names and types.
3. Review the console logs after running the terraform apply command.
4. Change the logging level using the command: export TF_LOG=DEBUG or export TF_LOG=TRACE.
5. For authentication-related errors: Check the AppViewX user account's role and permissions in the AppViewX GUI to ensure the user has access to create and download certificates.
6. For internal server errors: Verify the provided input parameters and check the AppViewX server logs for any failures or issues on the AppViewX side.

Enhancements Implemented

1. The group name must be provided in the payload when creating the certificate.
2. Ability to enroll certificates from Sectigo CA.
3. Option to download the certificate and private key separately.
4. Support for using service account credentials alongside username and password.
5. Capability to pull updates directly from the AppViewX Terraform registry.
6. Enhanced logging in Terraform to display error messages from AppViewX for improved clarity.
7. Support for specifying certificate validity in days, months, and years.

Use Cases supported in AppViewX Terraform Registry v1.0.1

1. Custom attributes are functional, allowing users to view Terraform-issued certificates with the field custom_fields={"fieldname":"value"}.
2. After creating certificates with Terraform, the CA connector displays all relevant information, such as certificate type, CSR parameters, and template names.
3. Ability to issue certificates for MSCA, AppViewX CA, and CCM CA, all of which were tested in an internal lab.
4. Ability to create and download certificates in both async and sync modes.
5. AbleAbility to download the private key in both plain and password-protected formats.
6. When validity_unit="days" and validity_unit_value=1, the validity period is automatically calculated in days, months, and years are all supported for validity calculations.

Future Roadmap Items

• Support renewal before provided number of days.
• Improve logging for better handling of 407 Proxy Authentication Required errors.
• Ability to support multiple versions of AppViewX providers.

Points to Remember

• Users can authenticate using either username/password or client ID/client secret.
• Downloading the private key is optional but access to private key download in AppViewX is required to retrieve the key.
• Fields related to certificate download are mandatory when is_syncis true and within the appviewx_download_certificateresource.
• The Certificate Password field is only required for formats such as PFX, P12, and JKS.
• The isChainRequired field is applicable only for formats such as CRT, CER, CERT, PEM, and DER.
• Users on older versions of the provider should update their resource names to appviewx_create_certificate and appviewx_download_certificate. All other fields remain unchanged, allowing seamless usage.