---
page_title: "tls_cert_request Resource - terraform-provider-tls"
subcategory: ""
description: |-
  Creates a Certificate Signing Request (CSR) in PEM (RFC 1421) https://datatracker.ietf.org/doc/html/rfc1421 format.
  PEM is the typical format used to request a certificate from a Certificate Authority (CA).
  This resource is intended to be used in conjunction with a Terraform provider for a particular certificate authority in order to provision a new certificate.
---

# tls_cert_request (Resource)

Creates a Certificate Signing Request (CSR) in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.

PEM is the typical format used to request a certificate from a Certificate Authority (CA).

This resource is intended to be used in conjunction with a Terraform provider for a particular certificate authority in order to provision a new certificate.

This is a *logical resource*, so it contributes only to the current Terraform
state and does not create any external managed resources.


## Example Usage

```terraform
resource "tls_cert_request" "example" {
  private_key_pem = file("private_key.pem")

  subject {
    common_name  = "example.com"
    organization = "ACME Examples, Inc"
  }
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `dns_names` (List of String) List of DNS names for which a certificate is being requested (i.e. certificate subjects).
- `ip_addresses` (List of String) List of IP addresses for which a certificate is being requested (i.e. certificate subjects).
- `private_key_pem` (String, Sensitive) Private key in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format, that the certificate will belong to. This can be read from a separate file using the [`file`](https://www.terraform.io/language/functions/file) interpolation function. Exactly one of `private_key_pem` or `private_key_pem_wo` must be set.
- `private_key_pem_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only private key in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format, that the certificate will belong to. Unlike `private_key_pem`, the value provided here is never persisted to Terraform state. Requires `private_key_pem_wo_version` to be set, and exactly one of `private_key_pem` or `private_key_pem_wo` must be set.
- `private_key_pem_wo_version` (Number) The version of the `private_key_pem_wo` write-only private key. Because the write-only key is not stored in state, this version is the only signal the provider has that the key changed: increment it to force the certificate request to be re-issued when rotating the key.
- `subject` (Block List) The subject for which a certificate is being requested. The acceptable arguments are all optional and their naming is based upon [Issuer Distinguished Names (RFC5280)](https://tools.ietf.org/html/rfc5280#section-4.1.2.4) section. (see [below for nested schema](#nestedblock--subject))
- `uris` (List of String) List of URIs for which a certificate is being requested (i.e. certificate subjects).

### Read-Only

- `cert_request_pem` (String) The certificate request data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format. **NOTE**: the [underlying](https://pkg.go.dev/encoding/pem#Encode) [libraries](https://pkg.go.dev/golang.org/x/crypto/ssh#MarshalAuthorizedKey) that generate this value append a `\n` at the end of the PEM. In case this disrupts your use case, we recommend using [`trimspace()`](https://www.terraform.io/language/functions/trimspace).
- `id` (String) Unique identifier for this resource: hexadecimal representation of the SHA1 checksum of the resource.
- `key_algorithm` (String) Name of the algorithm used when generating the private key provided in `private_key_pem`.

<a id="nestedblock--subject"></a>
### Nested Schema for `subject`

Optional:

- `common_name` (String) Distinguished name: `CN`
- `country` (String) Distinguished name: `C`
- `email_address` (String) ASN.1 Object Identifier (OID): `1.2.840.113549.1.9.1`
- `locality` (String) Distinguished name: `L`
- `organization` (String) Distinguished name: `O`
- `organizational_unit` (String) Distinguished name: `OU`
- `postal_code` (String) Distinguished name: `PC`
- `province` (String) Distinguished name: `ST`
- `serial_number` (String) Distinguished name: `SERIALNUMBER`
- `street_address` (List of String) Distinguished name: `STREET`