Verify Certificate Criteria

Oct 13, 2025 by wbrum.org 148 views

Terraform Core Bug: Inconsistent Behavior with AWS Provider

Terraform is a popular infrastructure-as-code tool used for managing cloud and on-premises resources. However, like any other software, it is not immune to bugs and inconsistencies. In this article, we will explore a bug in Terraform Core version 1.11.0, specifically with the AWS provider version 5.89.0. The bug causes an error when attempting to modify an ELBv2 listener, resulting in an inconsistent behavior.

The bug is related to the modification of an ELBv2 listener using the AWS provider. The error occurs when the certificate associated with the listener does not meet the required criteria, such as having a fully-qualified domain name, a supported signature, and a supported key size. The error message indicates that the certificate 'arn:aws:acm:us-east-2:315400321086:certificate/81e2888a-7e57-4bf9-8887-1d645b81f50c' must have a fully-qualified domain name, a supported signature, and a supported key size.

The Terraform configuration files are provided in the Terraform Configuration Files section. The configuration files include the generation of a certificate via ACM, the creation of a Route 53 record, and the validation of the certificate.

+
+
+# Generate cert via ACM
+resource "aws_acm_certificate" "acm-ssl" {
+  domain_name               = local.domain_name
+  subject_alternative_names = local.san
+  validation_method         = "DNS"
+
+  # https://docs.aws.amazon.com/acm/latest/userguide/acm-public-certificates.html#request-public->
+  key_algorithm = "EC_prime256v1"
+  lifecycle {
+    create_before_destroy = true  # Ensures a smooth transition during updates
+  }
+}
+
+data "aws_route53_zone" "base-domain" {
+  name = local.domain_name
+
+}
+
+resource "aws_route53_record" "acm-ssl-validation" {
+  for_each = {
+    for dvo in aws_acm_certificate.acm-ssl.domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      type   = dvo.resource_record_type
+      record = dvo.resource_record_value
+    }
+    if !startswith(dvo.domain_name, "*.")
+  }
+
+  zone_id = data.aws_route53_zone.base-domain.zone_id
+  name    = each.value.name
+  type    = each.value.type
+  records = [each.value.record]
+  ttl     = 60
+}
+
+resource "aws_acm_certificate_validation" "acm-ssl" {
+  certificate_arn         = aws_acm_certificate.acm-ssl.arn
+  validation_record_fqdns = [for record in aws_route53_record.acm-ssl-validation : record.fqdn]
+}

To reproduce the bug, apply the provided Terraform configuration files to your TF configuration for your cluster. Run terraform plan/apply and observe the error. Then, retry terraform plan/apply and verify that it works fine.

There is no debug output provided in the Debug Output section.

There is no panic output provided in the Panic Output section.

There are no important factoids provided in the Important Factoids section.

There are no references provided in the References section.

In conclusion, the bug in Terraform Core version 1.11.0, specifically with the AWS provider version 5.89.0, causes an error when attempting to modify an ELBv2 listener. The error occurs when the certificate associated with the listener does not meet the required criteria. The bug can be reproduced by applying the provided Terraform configuration files to your TF configuration for your cluster. The error can be resolved by retrying terraform plan/apply.

Based on the analysis of the bug, the following recommendations are made:

Upgrade Terraform Core: Upgrade to the latest version of Terraform Core to ensure that you have the latest bug fixes and features.
Verify Certificate Criteria: Verify that the certificate associated with the ELBv2 listener meets the required criteria, such as having a fully-qualified domain name, a supported signature, and a supported key size.
Retry Terraform Plan/Apply: Retry terraform plan/apply to resolve the error.

By following these recommendations, you can resolve the bug and ensure that your Terraform configuration files are working correctly.
Terraform Core Bug: Inconsistent Behavior with AWS Provider - Q&A

In our previous article, we explored a bug in Terraform Core version 1.11.0, specifically with the AWS provider version 5.89.0. The bug causes an error when attempting to modify an ELBv2 listener, resulting in an inconsistent behavior. In this article, we will provide a Q&A section to help you better understand the bug and its implications.

A: The bug in Terraform Core version 1.11.0 causes an error when attempting to modify an ELBv2 listener using the AWS provider. The error occurs when the certificate associated with the listener does not meet the required criteria, such as having a fully-qualified domain name, a supported signature, and a supported key size.

A: The error message associated with the bug is:

Error: modifying ELBv2 Listener (arn:aws:elasticloadbalancing:us-east-2:315400321086:listener/app/stg-essentials-public/878aa2f5b669ad53/862c774913d6e5f7): operation error Elastic Load Balancing v2: ModifyListener, https response error StatusCode: 400, RequestID: db8af1bf-b3db-4c43-822f-c8f0a182639b, api error UnsupportedCertificate: The certificate 'arn:aws:acm:us-east-2:315400321086:certificate/81e2888a-7e57-4bf9-8887-1d645b81f50c' must have a fully-qualified domain name, a supported signature, and a supported key size.

A: To reproduce the bug, apply the provided Terraform configuration files to your TF configuration for your cluster. Run terraform plan/apply and observe the error. Then, retry terraform plan/apply and verify that it works fine.

A: The bug can cause inconsistent behavior when attempting to modify an ELBv2 listener using the AWS provider. This can lead to errors and failures in your Terraform configuration files.

A: To resolve the bug, you can try the following:

Upgrade Terraform Core: Upgrade to the latest version of Terraform Core to ensure that you have the latest bug fixes and features.
Verify Certificate Criteria: Verify that the certificate associated with the ELBv2 listener meets the required criteria, such as having a fully-qualified domain name, a supported signature, and a supported key size.
Retry Terraform Plan/Apply: Retry terraform plan/apply to resolve the error.

A: To avoid the bug, follow these best practices:

Verify Certificate Criteria: Verify that the certificate associated with the ELBv2 listener meets the required criteria, such as having a fully-qualified domain name, a supported signature, and a supported key size.
Use the Latest Terraform Core Version: Use the latest version of Terraform Core to ensure that you have the latest bug fixes and features.
Test Your Terraform Configuration Files: Test your Terraform configuration files thoroughly to ensure that they are working correctly.

In conclusion, the bug in Terraform Core version 1.11.0, specifically with the AWS provider version 5.89.0, causes an error when attempting to modify an ELBv2 listener. The error occurs when the certificate associated with the listener does not meet the required criteria. By following the best practices and recommendations outlined in this article, you can resolve the bug and ensure that your Terraform configuration files are working correctly.