azurerm_key_vault_certificate: fixed 'Unknown' issuer not working Issue #5589

[ThomasZeman]

The 'Unknown' issuer certificate workflow does not create a "ready to use" but pending certificate which needs to get signed. Until then it will not have a SID which is the reason why the current code times out waiting for a SID to become available (Refer to https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/azurerm/internal/services/keyvault/key_vault_certificate_resource.go#L445).

In this workflow, the user needs to manually download a certificate signing request (CSR file) from the portal and get it signed by an external CA (upload the CSR there and so on). Because of this the azurerm resource for an unknown issuer is finished with its work as soon as the certificate exists which is the case when the go client receives http status code 200. (Refer to https://github.com/Azure/azure-sdk-for-go/blob/master/services/keyvault/2016-10-01/keyvault/client.go#L1303 )

All possible issuers are:

• self: For self signed certificates (this works and is well tested)
• < CA Alias configured in Azure >: CA configured in Azure with user's CA account name and password. Azure can then automatically request signing and renewing certificates
• Unknown: Users need to take care that certificates get signed externally

[tombuildsstuff]

hey @ThomasZeman

Thanks for this PR - taking a look through this is looking good - if we can fix up the crash point then this otherwise LGTM 👍

Thanks!

[tombuildsstuff]

LGTM - thanks for pushing that change @ThomasZeman

[tombuildsstuff]

Acceptance Tests pass:

[ghost]

This has been released in version 2.12.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.12.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!