Terraform-provider-vault: ca_chain output is empty

[dzirg44]

Terraform Version

Terraform v0.12.21

• provider.local v1.4.0
• provider.tls v2.1.1
• provider.vault v2.4.4

Affected Resource(s)

• vault_pki_secret_backend_root_sign_intermediate

Terraform Configuration Files

resource "vault_mount"  "root" {
    type = "pki"
    path = "pki-ca-test"
    default_lease_ttl_seconds = 31556952 
    max_lease_ttl_seconds = 157680000 
    description = "Root Certificate Authority"
}

resource "vault_mount" "pki_int" {
    type = "pki"
    path = "pki-int-ca-test"
    default_lease_ttl_seconds = 63072000
    max_lease_ttl_seconds = 63072000 
    description = "Intermediate Authority for test.com"
}

resource "vault_pki_secret_backend_intermediate_cert_request" "intermediate" {
  backend = vault_mount.pki_int.path
  type = "exported"
  common_name = "Test Intermediate Certificate"
  format = "pem"
  private_key_format = "der"
  key_type = "rsa"
  key_bits = "2048"
}
resource "vault_pki_secret_backend_root_sign_intermediate" "intermediate" {
  backend = vault_mount.root.path
  csr = vault_pki_secret_backend_intermediate_cert_request.intermediate.csr
  common_name = "Test Intermediate Certificate"
  exclude_cn_from_sans = true
  ou = "Development"
  organization = "test.com"
  ttl = 31536000
}
output "chain"  {
    value = vault_pki_secret_backend_root_sign_intermediate.intermediate.ca_chain
}

Expected Behavior

Certificates chain

Actual Behavior

empty output

Steps to Reproduce

1. terraform apply
   or maybe i don't understand how it works.

[djfinnoy]

I am experiencing the same issue. My vault_mount.root.path PKI engine contains two certificates, so I would expect vault_pki_secret_backend_root_sign_intermediate.intermediate.ca_chain to contain three certificates, but it is null in my tfstate file.

[djfinnoy]

I found a solution, use data "vault_generic_secret" instead of vault_pki_secret_backend_root_sign_intermediate.*.ca_chain:

# Sign the certificate signing request in the root Vault server / namespace
resource "vault_pki_secret_backend_root_sign_intermediate" "root" {
  provider    = vault.vault-config-root
  backend     = var.vault_root_pki_path
  csr         = vault_pki_secret_backend_intermediate_cert_request.intermediate.csr
  common_name = "Intermediate CA"
}

# Get the full CA chain from the signing Vault PKI engine
data "vault_generic_secret" "root_ca_chain" {
  provider = vault.vault-config-root
  path     = "${var.vault_root_pki_path}/cert/ca_chain"
}

# Add the signed ca chain as the intermediate within the target Vault server / namespace
resource "vault_pki_secret_backend_intermediate_set_signed" "intermediate" {
  provider    = vault.vault-config-target
  backend     = vault_mount.pki.path
  certificate = <<-EOT
    ${vault_pki_secret_backend_root_sign_intermediate.root.certificate}
    ${data.vault_generic_secret.root_ca_chain.data.certificate}
  EOT
}