PFX Certificate incompatible with Palo Alto about terraform-provider-acme

[vancluever]

@jdelforno the details you provided above lead me to believe that you PANOS expects the PKCS12 content raw versus base64-encoded (the local_file output you've created is basically doing the decoding for you).

I'm loath to include a raw binary output just mainly on part of Terraform lacks a binary type. Rendering binary string data might not be optimal in either output or the JSON state file. Additionally, it'd just be another - largely redundant - encoding of the certificate data.

So I'd recommend just adding the local_file resource to your configuration so that you can decode that way, or use other base64 conversion functions (like base64decode) to get the data where you need it to be.

Thanks!

[jdelforno]

Confirmed that I can output the pfx via
resource "local_file" "foobar" { filename = "./foobar.pfx" content_base64 = acme_certificate.cert.certificate_p12 }

And then upload the certificate into PANOS. Attempting to add the file directly via panos_certificate_import, fails.

I'm wondering if the issue is related to this: hashicorp/terraform#25777

[jdelforno]

Thanks @vancluever I gave the base64decode a shot when passing the the argument and received the same issue unfortunately.

I'm hoping the PANOS provider will be updated to accept base64 encoded certs soon(tm)

[vancluever]

@jdelforno I did notice that the PANOS provider uses a different argument for actually accepting "stream" data instead of a file. I guess you tried using the certificate parameter instead of certificate_filename?

(Edit: doing it in the PKCS12 block obviously versus the PEM block).

[jdelforno]

I tried both at the time, in the end, I switched over my certificate provider and used the PEM block instead and it worked first time =(

[vancluever]

@jdelforno when you say "certificate provider", what are you referring to? Are you still using the ACME provider?