hashicorp / hashicorp/terraform

Support for own CA Certificate for HTTP backend

Open
#36,937 1 comment 6 reactions 0 assignees View on GitHub
backend/http enhancement new
Dominant language
Go
Stars
49.7k
Forks
10.6k
Avg merge
21h 30m
Merged PRs (30d)
100

Description

### Terraform Version

Currently the only way to use an own http Backend with an own PKI infrastructure is to use the Option.
```shell
skip_cert_verification
```

### Use Cases

http Backend with an own PKI infrastructure (for example in Air Gapped environments)

### Attempted Solutions

Review Code and Documentation:
- https://github.com/hashicorp/terraform/blob/main/internal/backend/remote-state/http/backend.go
- https://www.terraform.io/docs/backends/types/http.html

### Proposal

It would be nicer, if we could add a CA Certificate like:

```
terraform {
backend "http" {
address = "http://myrest.api.com/foo"
lock_address = "http://myrest.api.com/foo"
unlock_address = "http://myrest.api.com/foo"
ca_file = "/path/to/my/ca.pem"
}
}
```

### References

Issue Found for mTLS: https://github.com/hashicorp/terraform/issues/21087 and https://github.com/hashicorp/terraform/pull/31699 but no issues found for just the ca_certificate

Contributor guide

Open the contributing guide

Research direction

Start by reading internal/backend/remote-state/http/backend.go and the HTTP backend documentation linked in the issue. Trace how backend configuration creates the HTTP client, then determine the documented behavior for a ca_file setting. Done means the HTTP backend can use the supplied CA certificate for its own PKI without requiring skip_cert_verification, with the configuration documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.