Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. HashiCorp Vault Provider
  3. API Docs
  4. pkiSecret
  5. SecretBackendCert
HashiCorp Vault v6.6.0 published on Thursday, Mar 13, 2025 by Pulumi
pulumi/pulumi-vault

vault.pkiSecret.SecretBackendCert

Explore with Pulumi AI

HashiCorp Vault v6.6.0 published on Thursday, Mar 13, 2025 by Pulumi
pulumi/pulumi-vault

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const app = new vault.pkisecret.SecretBackendCert("app", {
    backend: intermediate.path,
    name: test.name,
    commonName: "app.my.domain",
}, {
    dependsOn: [admin],
});
Copy
import pulumi
import pulumi_vault as vault

app = vault.pki_secret.SecretBackendCert("app",
    backend=intermediate["path"],
    name=test["name"],
    common_name="app.my.domain",
    opts = pulumi.ResourceOptions(depends_on=[admin]))
Copy
package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/pkisecret"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := pkisecret.NewSecretBackendCert(ctx, "app", &pkisecret.SecretBackendCertArgs{
			Backend:    pulumi.Any(intermediate.Path),
			Name:       pulumi.Any(test.Name),
			CommonName: pulumi.String("app.my.domain"),
		}, pulumi.DependsOn([]pulumi.Resource{
			admin,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var app = new Vault.PkiSecret.SecretBackendCert("app", new()
    {
        Backend = intermediate.Path,
        Name = test.Name,
        CommonName = "app.my.domain",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            admin,
        },
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.pkiSecret.SecretBackendCert;
import com.pulumi.vault.pkiSecret.SecretBackendCertArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var app = new SecretBackendCert("app", SecretBackendCertArgs.builder()
            .backend(intermediate.path())
            .name(test.name())
            .commonName("app.my.domain")
            .build(), CustomResourceOptions.builder()
                .dependsOn(admin)
                .build());

    }
}
Copy
resources:
  app:
    type: vault:pkiSecret:SecretBackendCert
    properties:
      backend: ${intermediate.path}
      name: ${test.name}
      commonName: app.my.domain
    options:
      dependsOn:
        - ${admin}
Copy

Create SecretBackendCert Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new SecretBackendCert(name: string, args: SecretBackendCertArgs, opts?: CustomResourceOptions);
@overload
def SecretBackendCert(resource_name: str,
                      args: SecretBackendCertArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendCert(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      backend: Optional[str] = None,
                      common_name: Optional[str] = None,
                      name: Optional[str] = None,
                      namespace: Optional[str] = None,
                      auto_renew: Optional[bool] = None,
                      exclude_cn_from_sans: Optional[bool] = None,
                      format: Optional[str] = None,
                      ip_sans: Optional[Sequence[str]] = None,
                      issuer_ref: Optional[str] = None,
                      min_seconds_remaining: Optional[int] = None,
                      alt_names: Optional[Sequence[str]] = None,
                      cert_metadata: Optional[str] = None,
                      not_after: Optional[str] = None,
                      other_sans: Optional[Sequence[str]] = None,
                      private_key_format: Optional[str] = None,
                      revoke: Optional[bool] = None,
                      revoke_with_key: Optional[bool] = None,
                      ttl: Optional[str] = None,
                      uri_sans: Optional[Sequence[str]] = None,
                      user_ids: Optional[Sequence[str]] = None)
func NewSecretBackendCert(ctx *Context, name string, args SecretBackendCertArgs, opts ...ResourceOption) (*SecretBackendCert, error)
public SecretBackendCert(string name, SecretBackendCertArgs args, CustomResourceOptions? opts = null)
public SecretBackendCert(String name, SecretBackendCertArgs args)
public SecretBackendCert(String name, SecretBackendCertArgs args, CustomResourceOptions options)

type: vault:pkiSecret:SecretBackendCert
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. SecretBackendCertArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. SecretBackendCertArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. SecretBackendCertArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. SecretBackendCertArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. SecretBackendCertArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var secretBackendCertResource = new Vault.PkiSecret.SecretBackendCert("secretBackendCertResource", new()
{
    Backend = "string",
    CommonName = "string",
    Name = "string",
    Namespace = "string",
    AutoRenew = false,
    ExcludeCnFromSans = false,
    Format = "string",
    IpSans = new[]
    {
        "string",
    },
    IssuerRef = "string",
    MinSecondsRemaining = 0,
    AltNames = new[]
    {
        "string",
    },
    CertMetadata = "string",
    NotAfter = "string",
    OtherSans = new[]
    {
        "string",
    },
    PrivateKeyFormat = "string",
    Revoke = false,
    RevokeWithKey = false,
    Ttl = "string",
    UriSans = new[]
    {
        "string",
    },
    UserIds = new[]
    {
        "string",
    },
});
Copy
example, err := pkiSecret.NewSecretBackendCert(ctx, "secretBackendCertResource", &pkiSecret.SecretBackendCertArgs{
	Backend:           pulumi.String("string"),
	CommonName:        pulumi.String("string"),
	Name:              pulumi.String("string"),
	Namespace:         pulumi.String("string"),
	AutoRenew:         pulumi.Bool(false),
	ExcludeCnFromSans: pulumi.Bool(false),
	Format:            pulumi.String("string"),
	IpSans: pulumi.StringArray{
		pulumi.String("string"),
	},
	IssuerRef:           pulumi.String("string"),
	MinSecondsRemaining: pulumi.Int(0),
	AltNames: pulumi.StringArray{
		pulumi.String("string"),
	},
	CertMetadata: pulumi.String("string"),
	NotAfter:     pulumi.String("string"),
	OtherSans: pulumi.StringArray{
		pulumi.String("string"),
	},
	PrivateKeyFormat: pulumi.String("string"),
	Revoke:           pulumi.Bool(false),
	RevokeWithKey:    pulumi.Bool(false),
	Ttl:              pulumi.String("string"),
	UriSans: pulumi.StringArray{
		pulumi.String("string"),
	},
	UserIds: pulumi.StringArray{
		pulumi.String("string"),
	},
})
Copy
var secretBackendCertResource = new SecretBackendCert("secretBackendCertResource", SecretBackendCertArgs.builder()
    .backend("string")
    .commonName("string")
    .name("string")
    .namespace("string")
    .autoRenew(false)
    .excludeCnFromSans(false)
    .format("string")
    .ipSans("string")
    .issuerRef("string")
    .minSecondsRemaining(0)
    .altNames("string")
    .certMetadata("string")
    .notAfter("string")
    .otherSans("string")
    .privateKeyFormat("string")
    .revoke(false)
    .revokeWithKey(false)
    .ttl("string")
    .uriSans("string")
    .userIds("string")
    .build());
Copy
secret_backend_cert_resource = vault.pki_secret.SecretBackendCert("secretBackendCertResource",
    backend="string",
    common_name="string",
    name="string",
    namespace="string",
    auto_renew=False,
    exclude_cn_from_sans=False,
    format="string",
    ip_sans=["string"],
    issuer_ref="string",
    min_seconds_remaining=0,
    alt_names=["string"],
    cert_metadata="string",
    not_after="string",
    other_sans=["string"],
    private_key_format="string",
    revoke=False,
    revoke_with_key=False,
    ttl="string",
    uri_sans=["string"],
    user_ids=["string"])
Copy
const secretBackendCertResource = new vault.pkisecret.SecretBackendCert("secretBackendCertResource", {
    backend: "string",
    commonName: "string",
    name: "string",
    namespace: "string",
    autoRenew: false,
    excludeCnFromSans: false,
    format: "string",
    ipSans: ["string"],
    issuerRef: "string",
    minSecondsRemaining: 0,
    altNames: ["string"],
    certMetadata: "string",
    notAfter: "string",
    otherSans: ["string"],
    privateKeyFormat: "string",
    revoke: false,
    revokeWithKey: false,
    ttl: "string",
    uriSans: ["string"],
    userIds: ["string"],
});
Copy
type: vault:pkiSecret:SecretBackendCert
properties:
    altNames:
        - string
    autoRenew: false
    backend: string
    certMetadata: string
    commonName: string
    excludeCnFromSans: false
    format: string
    ipSans:
        - string
    issuerRef: string
    minSecondsRemaining: 0
    name: string
    namespace: string
    notAfter: string
    otherSans:
        - string
    privateKeyFormat: string
    revoke: false
    revokeWithKey: false
    ttl: string
    uriSans:
        - string
    userIds:
        - string
Copy

SecretBackendCert Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The SecretBackendCert resource accepts the following input properties:

Backend
This property is required.
Changes to this property will trigger replacement.
string
The PKI secret backend the resource belongs to.
CommonName
This property is required.
Changes to this property will trigger replacement.
string
CN of certificate to create
AltNames Changes to this property will trigger replacement. List<string>
List of alternative names
AutoRenew bool
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
CertMetadata string
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
ExcludeCnFromSans Changes to this property will trigger replacement. bool
Flag to exclude CN from SANs
Format Changes to this property will trigger replacement. string
The format of data
IpSans Changes to this property will trigger replacement. List<string>
List of alternative IPs
IssuerRef string
Specifies the default issuer of this request.
MinSecondsRemaining int
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
Name Changes to this property will trigger replacement. string
Name of the role to create the certificate against
Namespace Changes to this property will trigger replacement. string
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
NotAfter string
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
OtherSans Changes to this property will trigger replacement. List<string>
List of other SANs
PrivateKeyFormat Changes to this property will trigger replacement. string
The private key format
Revoke bool
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
RevokeWithKey bool
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
Ttl string
Time to live
UriSans Changes to this property will trigger replacement. List<string>
List of alternative URIs
UserIds Changes to this property will trigger replacement. List<string>
List of Subject User IDs
Backend
This property is required.
Changes to this property will trigger replacement.
string
The PKI secret backend the resource belongs to.
CommonName
This property is required.
Changes to this property will trigger replacement.
string
CN of certificate to create
AltNames Changes to this property will trigger replacement. []string
List of alternative names
AutoRenew bool
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
CertMetadata string
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
ExcludeCnFromSans Changes to this property will trigger replacement. bool
Flag to exclude CN from SANs
Format Changes to this property will trigger replacement. string
The format of data
IpSans Changes to this property will trigger replacement. []string
List of alternative IPs
IssuerRef string
Specifies the default issuer of this request.
MinSecondsRemaining int
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
Name Changes to this property will trigger replacement. string
Name of the role to create the certificate against
Namespace Changes to this property will trigger replacement. string
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
NotAfter string
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
OtherSans Changes to this property will trigger replacement. []string
List of other SANs
PrivateKeyFormat Changes to this property will trigger replacement. string
The private key format
Revoke bool
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
RevokeWithKey bool
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
Ttl string
Time to live
UriSans Changes to this property will trigger replacement. []string
List of alternative URIs
UserIds Changes to this property will trigger replacement. []string
List of Subject User IDs
backend
This property is required.
Changes to this property will trigger replacement.
String
The PKI secret backend the resource belongs to.
commonName
This property is required.
Changes to this property will trigger replacement.
String
CN of certificate to create
altNames Changes to this property will trigger replacement. List<String>
List of alternative names
autoRenew Boolean
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
certMetadata String
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
excludeCnFromSans Changes to this property will trigger replacement. Boolean
Flag to exclude CN from SANs
format Changes to this property will trigger replacement. String
The format of data
ipSans Changes to this property will trigger replacement. List<String>
List of alternative IPs
issuerRef String
Specifies the default issuer of this request.
minSecondsRemaining Integer
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. String
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. String
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
notAfter String
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
otherSans Changes to this property will trigger replacement. List<String>
List of other SANs
privateKeyFormat Changes to this property will trigger replacement. String
The private key format
revoke Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revokeWithKey Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
ttl String
Time to live
uriSans Changes to this property will trigger replacement. List<String>
List of alternative URIs
userIds Changes to this property will trigger replacement. List<String>
List of Subject User IDs
backend
This property is required.
Changes to this property will trigger replacement.
string
The PKI secret backend the resource belongs to.
commonName
This property is required.
Changes to this property will trigger replacement.
string
CN of certificate to create
altNames Changes to this property will trigger replacement. string[]
List of alternative names
autoRenew boolean
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
certMetadata string
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
excludeCnFromSans Changes to this property will trigger replacement. boolean
Flag to exclude CN from SANs
format Changes to this property will trigger replacement. string
The format of data
ipSans Changes to this property will trigger replacement. string[]
List of alternative IPs
issuerRef string
Specifies the default issuer of this request.
minSecondsRemaining number
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. string
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. string
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
notAfter string
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
otherSans Changes to this property will trigger replacement. string[]
List of other SANs
privateKeyFormat Changes to this property will trigger replacement. string
The private key format
revoke boolean
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revokeWithKey boolean
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
ttl string
Time to live
uriSans Changes to this property will trigger replacement. string[]
List of alternative URIs
userIds Changes to this property will trigger replacement. string[]
List of Subject User IDs
backend
This property is required.
Changes to this property will trigger replacement.
str
The PKI secret backend the resource belongs to.
common_name
This property is required.
Changes to this property will trigger replacement.
str
CN of certificate to create
alt_names Changes to this property will trigger replacement. Sequence[str]
List of alternative names
auto_renew bool
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
cert_metadata str
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
exclude_cn_from_sans Changes to this property will trigger replacement. bool
Flag to exclude CN from SANs
format Changes to this property will trigger replacement. str
The format of data
ip_sans Changes to this property will trigger replacement. Sequence[str]
List of alternative IPs
issuer_ref str
Specifies the default issuer of this request.
min_seconds_remaining int
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. str
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. str
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
not_after str
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
other_sans Changes to this property will trigger replacement. Sequence[str]
List of other SANs
private_key_format Changes to this property will trigger replacement. str
The private key format
revoke bool
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revoke_with_key bool
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
ttl str
Time to live
uri_sans Changes to this property will trigger replacement. Sequence[str]
List of alternative URIs
user_ids Changes to this property will trigger replacement. Sequence[str]
List of Subject User IDs
backend
This property is required.
Changes to this property will trigger replacement.
String
The PKI secret backend the resource belongs to.
commonName
This property is required.
Changes to this property will trigger replacement.
String
CN of certificate to create
altNames Changes to this property will trigger replacement. List<String>
List of alternative names
autoRenew Boolean
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
certMetadata String
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
excludeCnFromSans Changes to this property will trigger replacement. Boolean
Flag to exclude CN from SANs
format Changes to this property will trigger replacement. String
The format of data
ipSans Changes to this property will trigger replacement. List<String>
List of alternative IPs
issuerRef String
Specifies the default issuer of this request.
minSecondsRemaining Number
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. String
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. String
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
notAfter String
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
otherSans Changes to this property will trigger replacement. List<String>
List of other SANs
privateKeyFormat Changes to this property will trigger replacement. String
The private key format
revoke Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revokeWithKey Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
ttl String
Time to live
uriSans Changes to this property will trigger replacement. List<String>
List of alternative URIs
userIds Changes to this property will trigger replacement. List<String>
List of Subject User IDs

Outputs

All input properties are implicitly available as output properties. Additionally, the SecretBackendCert resource produces the following output properties:

CaChain string
The CA chain
Certificate string
The certificate
Expiration int
The expiration date of the certificate in unix epoch format
Id string
The provider-assigned unique ID for this managed resource.
IssuingCa string
The issuing CA
PrivateKey string
The private key
PrivateKeyType string
The private key type
RenewPending bool
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
SerialNumber string
The serial number
CaChain string
The CA chain
Certificate string
The certificate
Expiration int
The expiration date of the certificate in unix epoch format
Id string
The provider-assigned unique ID for this managed resource.
IssuingCa string
The issuing CA
PrivateKey string
The private key
PrivateKeyType string
The private key type
RenewPending bool
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
SerialNumber string
The serial number
caChain String
The CA chain
certificate String
The certificate
expiration Integer
The expiration date of the certificate in unix epoch format
id String
The provider-assigned unique ID for this managed resource.
issuingCa String
The issuing CA
privateKey String
The private key
privateKeyType String
The private key type
renewPending Boolean
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
serialNumber String
The serial number
caChain string
The CA chain
certificate string
The certificate
expiration number
The expiration date of the certificate in unix epoch format
id string
The provider-assigned unique ID for this managed resource.
issuingCa string
The issuing CA
privateKey string
The private key
privateKeyType string
The private key type
renewPending boolean
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
serialNumber string
The serial number
ca_chain str
The CA chain
certificate str
The certificate
expiration int
The expiration date of the certificate in unix epoch format
id str
The provider-assigned unique ID for this managed resource.
issuing_ca str
The issuing CA
private_key str
The private key
private_key_type str
The private key type
renew_pending bool
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
serial_number str
The serial number
caChain String
The CA chain
certificate String
The certificate
expiration Number
The expiration date of the certificate in unix epoch format
id String
The provider-assigned unique ID for this managed resource.
issuingCa String
The issuing CA
privateKey String
The private key
privateKeyType String
The private key type
renewPending Boolean
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
serialNumber String
The serial number

Look up Existing SecretBackendCert Resource

Get an existing SecretBackendCert resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecretBackendCertState, opts?: CustomResourceOptions): SecretBackendCert
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        alt_names: Optional[Sequence[str]] = None,
        auto_renew: Optional[bool] = None,
        backend: Optional[str] = None,
        ca_chain: Optional[str] = None,
        cert_metadata: Optional[str] = None,
        certificate: Optional[str] = None,
        common_name: Optional[str] = None,
        exclude_cn_from_sans: Optional[bool] = None,
        expiration: Optional[int] = None,
        format: Optional[str] = None,
        ip_sans: Optional[Sequence[str]] = None,
        issuer_ref: Optional[str] = None,
        issuing_ca: Optional[str] = None,
        min_seconds_remaining: Optional[int] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        not_after: Optional[str] = None,
        other_sans: Optional[Sequence[str]] = None,
        private_key: Optional[str] = None,
        private_key_format: Optional[str] = None,
        private_key_type: Optional[str] = None,
        renew_pending: Optional[bool] = None,
        revoke: Optional[bool] = None,
        revoke_with_key: Optional[bool] = None,
        serial_number: Optional[str] = None,
        ttl: Optional[str] = None,
        uri_sans: Optional[Sequence[str]] = None,
        user_ids: Optional[Sequence[str]] = None) -> SecretBackendCert
func GetSecretBackendCert(ctx *Context, name string, id IDInput, state *SecretBackendCertState, opts ...ResourceOption) (*SecretBackendCert, error)
public static SecretBackendCert Get(string name, Input<string> id, SecretBackendCertState? state, CustomResourceOptions? opts = null)
public static SecretBackendCert get(String name, Output<String> id, SecretBackendCertState state, CustomResourceOptions options)
resources:  _:    type: vault:pkiSecret:SecretBackendCert    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
AltNames Changes to this property will trigger replacement. List<string>
List of alternative names
AutoRenew bool
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
Backend Changes to this property will trigger replacement. string
The PKI secret backend the resource belongs to.
CaChain string
The CA chain
CertMetadata string
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
Certificate string
The certificate
CommonName Changes to this property will trigger replacement. string
CN of certificate to create
ExcludeCnFromSans Changes to this property will trigger replacement. bool
Flag to exclude CN from SANs
Expiration int
The expiration date of the certificate in unix epoch format
Format Changes to this property will trigger replacement. string
The format of data
IpSans Changes to this property will trigger replacement. List<string>
List of alternative IPs
IssuerRef string
Specifies the default issuer of this request.
IssuingCa string
The issuing CA
MinSecondsRemaining int
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
Name Changes to this property will trigger replacement. string
Name of the role to create the certificate against
Namespace Changes to this property will trigger replacement. string
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
NotAfter string
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
OtherSans Changes to this property will trigger replacement. List<string>
List of other SANs
PrivateKey string
The private key
PrivateKeyFormat Changes to this property will trigger replacement. string
The private key format
PrivateKeyType string
The private key type
RenewPending bool
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
Revoke bool
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
RevokeWithKey bool
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
SerialNumber string
The serial number
Ttl string
Time to live
UriSans Changes to this property will trigger replacement. List<string>
List of alternative URIs
UserIds Changes to this property will trigger replacement. List<string>
List of Subject User IDs
AltNames Changes to this property will trigger replacement. []string
List of alternative names
AutoRenew bool
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
Backend Changes to this property will trigger replacement. string
The PKI secret backend the resource belongs to.
CaChain string
The CA chain
CertMetadata string
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
Certificate string
The certificate
CommonName Changes to this property will trigger replacement. string
CN of certificate to create
ExcludeCnFromSans Changes to this property will trigger replacement. bool
Flag to exclude CN from SANs
Expiration int
The expiration date of the certificate in unix epoch format
Format Changes to this property will trigger replacement. string
The format of data
IpSans Changes to this property will trigger replacement. []string
List of alternative IPs
IssuerRef string
Specifies the default issuer of this request.
IssuingCa string
The issuing CA
MinSecondsRemaining int
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
Name Changes to this property will trigger replacement. string
Name of the role to create the certificate against
Namespace Changes to this property will trigger replacement. string
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
NotAfter string
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
OtherSans Changes to this property will trigger replacement. []string
List of other SANs
PrivateKey string
The private key
PrivateKeyFormat Changes to this property will trigger replacement. string
The private key format
PrivateKeyType string
The private key type
RenewPending bool
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
Revoke bool
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
RevokeWithKey bool
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
SerialNumber string
The serial number
Ttl string
Time to live
UriSans Changes to this property will trigger replacement. []string
List of alternative URIs
UserIds Changes to this property will trigger replacement. []string
List of Subject User IDs
altNames Changes to this property will trigger replacement. List<String>
List of alternative names
autoRenew Boolean
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
backend Changes to this property will trigger replacement. String
The PKI secret backend the resource belongs to.
caChain String
The CA chain
certMetadata String
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
certificate String
The certificate
commonName Changes to this property will trigger replacement. String
CN of certificate to create
excludeCnFromSans Changes to this property will trigger replacement. Boolean
Flag to exclude CN from SANs
expiration Integer
The expiration date of the certificate in unix epoch format
format Changes to this property will trigger replacement. String
The format of data
ipSans Changes to this property will trigger replacement. List<String>
List of alternative IPs
issuerRef String
Specifies the default issuer of this request.
issuingCa String
The issuing CA
minSecondsRemaining Integer
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. String
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. String
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
notAfter String
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
otherSans Changes to this property will trigger replacement. List<String>
List of other SANs
privateKey String
The private key
privateKeyFormat Changes to this property will trigger replacement. String
The private key format
privateKeyType String
The private key type
renewPending Boolean
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
revoke Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revokeWithKey Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
serialNumber String
The serial number
ttl String
Time to live
uriSans Changes to this property will trigger replacement. List<String>
List of alternative URIs
userIds Changes to this property will trigger replacement. List<String>
List of Subject User IDs
altNames Changes to this property will trigger replacement. string[]
List of alternative names
autoRenew boolean
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
backend Changes to this property will trigger replacement. string
The PKI secret backend the resource belongs to.
caChain string
The CA chain
certMetadata string
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
certificate string
The certificate
commonName Changes to this property will trigger replacement. string
CN of certificate to create
excludeCnFromSans Changes to this property will trigger replacement. boolean
Flag to exclude CN from SANs
expiration number
The expiration date of the certificate in unix epoch format
format Changes to this property will trigger replacement. string
The format of data
ipSans Changes to this property will trigger replacement. string[]
List of alternative IPs
issuerRef string
Specifies the default issuer of this request.
issuingCa string
The issuing CA
minSecondsRemaining number
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. string
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. string
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
notAfter string
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
otherSans Changes to this property will trigger replacement. string[]
List of other SANs
privateKey string
The private key
privateKeyFormat Changes to this property will trigger replacement. string
The private key format
privateKeyType string
The private key type
renewPending boolean
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
revoke boolean
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revokeWithKey boolean
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
serialNumber string
The serial number
ttl string
Time to live
uriSans Changes to this property will trigger replacement. string[]
List of alternative URIs
userIds Changes to this property will trigger replacement. string[]
List of Subject User IDs
alt_names Changes to this property will trigger replacement. Sequence[str]
List of alternative names
auto_renew bool
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
backend Changes to this property will trigger replacement. str
The PKI secret backend the resource belongs to.
ca_chain str
The CA chain
cert_metadata str
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
certificate str
The certificate
common_name Changes to this property will trigger replacement. str
CN of certificate to create
exclude_cn_from_sans Changes to this property will trigger replacement. bool
Flag to exclude CN from SANs
expiration int
The expiration date of the certificate in unix epoch format
format Changes to this property will trigger replacement. str
The format of data
ip_sans Changes to this property will trigger replacement. Sequence[str]
List of alternative IPs
issuer_ref str
Specifies the default issuer of this request.
issuing_ca str
The issuing CA
min_seconds_remaining int
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. str
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. str
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
not_after str
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
other_sans Changes to this property will trigger replacement. Sequence[str]
List of other SANs
private_key str
The private key
private_key_format Changes to this property will trigger replacement. str
The private key format
private_key_type str
The private key type
renew_pending bool
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
revoke bool
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revoke_with_key bool
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
serial_number str
The serial number
ttl str
Time to live
uri_sans Changes to this property will trigger replacement. Sequence[str]
List of alternative URIs
user_ids Changes to this property will trigger replacement. Sequence[str]
List of Subject User IDs
altNames Changes to this property will trigger replacement. List<String>
List of alternative names
autoRenew Boolean
If set to true, certs will be renewed if the expiration is within min_seconds_remaining. Default false
backend Changes to this property will trigger replacement. String
The PKI secret backend the resource belongs to.
caChain String
The CA chain
certMetadata String
A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's no_store_metadata must be set to false, otherwise an error is returned when specified.
certificate String
The certificate
commonName Changes to this property will trigger replacement. String
CN of certificate to create
excludeCnFromSans Changes to this property will trigger replacement. Boolean
Flag to exclude CN from SANs
expiration Number
The expiration date of the certificate in unix epoch format
format Changes to this property will trigger replacement. String
The format of data
ipSans Changes to this property will trigger replacement. List<String>
List of alternative IPs
issuerRef String
Specifies the default issuer of this request.
issuingCa String
The issuing CA
minSecondsRemaining Number
Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)
name Changes to this property will trigger replacement. String
Name of the role to create the certificate against
namespace Changes to this property will trigger replacement. String
The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
notAfter String
Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
otherSans Changes to this property will trigger replacement. List<String>
List of other SANs
privateKey String
The private key
privateKeyFormat Changes to this property will trigger replacement. String
The private key format
privateKeyType String
The private key type
renewPending Boolean
true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.
revoke Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke PKI API. Conflicts with revoke_with_key. Default false.
revokeWithKey Boolean
If set to true, the certificate will be revoked on resource destruction using the revoke-with-key PKI API. Conflicts with revoke. Default false
serialNumber String
The serial number
ttl String
Time to live
uriSans Changes to this property will trigger replacement. List<String>
List of alternative URIs
userIds Changes to this property will trigger replacement. List<String>
List of Subject User IDs

Package Details

Repository
Vault pulumi/pulumi-vault
License
Apache-2.0
Notes
This Pulumi package is based on the vault Terraform Provider.
HashiCorp Vault v6.6.0 published on Thursday, Mar 13, 2025 by Pulumi
pulumi/pulumi-vault