A Private CA that Can Revoke What It Issues
The DevOps tier does not persist the certificates it issues: no record, no CRL, no revocation - a year-long certificate from it can only answer a key compromise by the CA being distrusted whole. ENTERPRISE tier with the CRL published, a 90-day ceiling on every certificate, RSA below 2048 refused, and deletion protection on because deleting a CA invalidates everything it signed.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "certificate_authority" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-certificate-authority/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/gcp-certificate-authority?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Private CA that Can Revoke What It Issues](https://www.iac-bazaar.com/catalog/gcp-certificate-authority?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "certificate_authority" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-certificate-authority/gcp"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-certificate-authority
A private certificate authority that can revoke what it issues. Works with
Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.
The DevOps tier cannot revoke. A CA pool is ENTERPRISE or DEVOPS, and
DevOps does not persist the certificates it issues: no record, no CRL, no
revocation. It is cheaper and built for certificates that live minutes. A
DevOps pool issuing a year-long server certificate can only answer a key
compromise by being distrusted whole. ENTERPRISE here; DevOps needs
accept_no_revocation, as does turning off the CRL.
The pool's issuance policy is the ceiling on every certificate. A pool with no policy issues whatever it is asked for. This module sets a maximum lifetime (90 days by default), refuses RSA below 2048 bits, and can constrain the names the CA may issue for.
Deleting a CA with active certificates invalidates them. Deletion
protection is on and the grace period kept; turning it off needs
accept_deletable_ca.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-certificate-manager
A Certificate Manager certificate map for external HTTPS load balancers, with an optional Google-managed certificate and DNS authorization provisioned when you supply a domain you control.
gcp-kms
Keyrings and rotation-enabled crypto keys with per-key IAM for CMEK across GCS, BigQuery, Cloud SQL and disks.
gcp-secret-manager
Secrets with versions, replication policy, rotation schedules, expiry and accessor IAM.
huawei-private-ca
A CCM private CA, root or subordinate. CRL publication is off by default, and without it you can press revoke while every client keeps trusting the certificate until it expires - so the module refuses that unless it is accepted. Deleting a CA starts a 7 to 30 day clock rather than deleting, and the product exists in two regions only.
ibm-private-ca
A root CA, an intermediate it signs and certificate templates in IBM Cloud Secrets Manager. IBM's examples let a template issue for any name; here templates name their domains, both CAs carry name constraints, and CRLs are built and published. Lifetimes are checked to nest, and the module says plainly that Terraform cannot revoke a CA.
vault-pki-certificate-authority
Issuing from the root puts every leaf one signature from the root's compromise; a PKI role's defaults issue nothing until somebody reaches for allow_any_name, which issues for every hostname; and without AIA and CRL URLs a leaf is valid and unverifiable. A root that signs one intermediate, roles bound to allowed_domains, 30-day leaves under a 90-day ceiling, URLs on both mounts.