Deploy X.509 Certificates with Terraform

Manage X.509 certificates on Bahriya with Terraform: store a single PEM certificate, attach it to projects and mount it as a file on containers.

Updated 18 Sept 20262 min read

An X.509 certificate stores a single PEM-encoded certificate -- no private key, no CA. X.509 certificates are scoped to your organisation, versioned with rotation history, and can be attached to projects and containers.

Required fields

Field	Type	Description
`handle`	string	A unique identifier (DNS-1123 compliant: lowercase, alphanumeric, hyphens).
`name`	string	A display name.
`cert`	string	PEM-encoded certificate.

Read-only fields

Field	Type	Description
`fingerprint`	string	SHA256 fingerprint of the certificate.
`subject`	string	Certificate subject (e.g. `CN=signing.example.com`).
`issuer`	string	Certificate issuer.
`algorithm`	string	Key algorithm (RSA, EC, etc.).
`key_bits`	integer	Key size in bits.
`notbefore`	string	Certificate validity start (UTC).
`notafter`	string	Certificate expiry (UTC).

Example

resource "bahriya_x509_cert" "signing_cert" {
  handle = "signing-cert"
  name   = "Signing Certificate"
  cert   = file("${path.module}/signing.crt")
}

Attach it to a project so it deploys to the project's regions:

resource "bahriya_project" "production" {
  handle  = "production"
  name    = "Production"
  regions = ["helsinki-1", "falkenstein-1"]
}
 
resource "bahriya_project_x509_cert_attachment" "signing_cert" {
  project_id = bahriya_project.production.id
  handle     = bahriya_x509_cert.signing_cert.handle
}

Then mount it on a container — the cert lands as a file in mountpath:

resource "bahriya_container" "verifier" {
  # ... other fields ...
 
  x509_certs = [
    {
      handle    = bahriya_x509_cert.signing_cert.handle
      mountpath = "/etc/bahriya/x509"
    },
  ]
}

Rotation

To rotate certificate material, update the cert field in your Terraform config and run terraform apply. The Bahriya API creates a new version and marks it current. Previous versions are retained for rollback (default: last 5).

After rotation, file-mounted containers pick up the new certificate automatically within about 60 seconds. No manual redeploy is needed for file-mounted certificates.

Importing an existing certificate

terraform import bahriya_x509_cert.signing_cert <uuid>

Pricing

X.509 certificates are billed at $0.02 per month while they exist in your organisation, plus $0.02 per region per month when attached to a project.