hashicorp / hashicorp/terraform
Support for own CA Certificate for HTTP backend
- Dominant language
- Go
- Stars
- 49.7k
- Forks
- 10.6k
- Avg merge
- 21h 30m
- Merged PRs (30d)
- 100
Description
### Terraform Version
Currently the only way to use an own http Backend with an own PKI infrastructure is to use the Option.
```shell
skip_cert_verification
```
### Use Cases
http Backend with an own PKI infrastructure (for example in Air Gapped environments)
### Attempted Solutions
Review Code and Documentation:
- https://github.com/hashicorp/terraform/blob/main/internal/backend/remote-state/http/backend.go
- https://www.terraform.io/docs/backends/types/http.html
### Proposal
It would be nicer, if we could add a CA Certificate like:
```
terraform {
backend "http" {
address = "http://myrest.api.com/foo"
lock_address = "http://myrest.api.com/foo"
unlock_address = "http://myrest.api.com/foo"
ca_file = "/path/to/my/ca.pem"
}
}
```
### References
Issue Found for mTLS: https://github.com/hashicorp/terraform/issues/21087 and https://github.com/hashicorp/terraform/pull/31699 but no issues found for just the ca_certificate
Contributor guide
Research direction
Start by reading internal/backend/remote-state/http/backend.go and the HTTP backend documentation linked in the issue. Trace how backend configuration creates the HTTP client, then determine the documented behavior for a ca_file setting. Done means the HTTP backend can use the supplied CA certificate for its own PKI without requiring skip_cert_verification, with the configuration documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100