DXE-1925 what value we can use for certificate_chain_type

[janezhen08]

Hello Team,

I am using akamai provider to create dv certificate and i would like to use "R3 + ISRG Root X1 (signed by DST Root CA X3)" as certificate_chain_type, but when running terraform apply, it reports error:

cps/v2/error-types/invalid-certificate-chain-type
statusCode: 400

Please advise what value should be set in certificate_chain_type? what's the difference between default and R3 + ISRG Root X1 (signed by DST Root CA X3)?

Thanks

[kaush-]

Hi @janezhen08,

Thank you for reaching out to us. We checked with our functional team and got the below response for your query:

For DV certificates, the csr object can have an attribute called preferredTrustChain with possible values dst-root-ca-x3 and isrg-root-x1. They are most likely looking for dst-root-ca-x3, which I think is still the default.

There is an API to see the available trust chains by CA. The only one with values is Let's Encrypt. /trust-chains/le is the endpoint. Response looks like this:

{
"trustChains": [
{
"key": "dst-root-ca-x3",
"name": "R3 + ISRG Root X1 (signed by DST Root CA X3)",
"description": "Leaf <– R3 <– ISRG Root X1 <– DST Root CA X3",
"successor": null
},
{
"key": "isrg-root-x1",
"name": "R3 (signed by ISRG Root X1)",
"description": "Leaf <– R3/R4 <– ISRG Root X1 (self signed)",
"successor": null
}
]
}

I hope this answers your query. Let me know in case you have any other questions.

Regards,
Piyush

[janezhen08]

Hi Piyush,

Thanks for working on this, i have tested using value: dst-root-ca-x3, in terraform code, i use certificate_chain_type = "dst-root-ca-x3"

but get below error:

│ Error: create enrollment: API error:
│ {
│ "type": "https://xxx.luna.akamaiapis.net/cps/v2/error-types/invalid-certificate-chain-type",
│ "title": "Invalid value for certificateChainType.",
│ "detail": "Invalid value for certificateChainType: [dst-root-ca-x3].",
│ "instance": "https://xxx.luna.akamaiapis.net/cps/v2/error-types/invalid-certificate-chain-type?id=dc0e3a6eb8104c98b9e036c5c83811f8",
│ "statusCode": 400
│ }
│

Could you advise?

thanks

Jane

[kaush-]

Hi @janezhen08,

The attribute is actually "preferredTrustChain" not "certificateChainType". Can you try by passing the value to it?

Regards,
Piyush

[janezhen08]

Hi Piyush,

I tried this param: preferred_trust_chain = "dst-root-ca-x3", it is unexpected.

╷
│ Error: Unsupported argument
│
│ on ../modules/akamaicertificate/main.tf line 58, in resource "akamai_cps_dv_enrollment" "dws":
│ 58: preferred_trust_chain = "dst-root-ca-x3"
│
│ An argument named "preferred_trust_chain" is not expected here.

I checked in this repo, and found the expected argument is certificate_chain_type.

thanks

Jane

[kaush-]

Hi @janezhen08,

My apologies for the delayed response, unfortunately this parameter was not added to our terraform provider (and Edgrgrid-golang). You can check the utilization of it here https://techdocs.akamai.com/cps/reference/post-enrollment.

For now, I will create an internal feature request for this field and have it added. As a workaround for now, I am afraid we don't have a solution in terraform, but you may use the API call or Akamai-CLI in your automations as a short term fix.

We will keep this issue tracked and updated while working on it. If you have any other questions, please feel free to discuss.

Regards,
Piyush

[kaush-]

Also you can check for the possible acceptable values for different fields on the same API link just in case

[hypnotisttom]

Hi,

So, what are the allowed values for the certificate_chain_type Terraform Argument?

The example shows it being set to "default" though I can't find allowed values anywhere.

The CPS API docs don't even mention a certificate chain type, only a certificate type, which is set by the Resource.

I am working on providing a description for this field and field validation in our automation and thus need to know what its value is used for and what the allowed values are.

Thanks,

Tom

[kaush-]

Hi @hypnotisttom,

Actually there was a bug in document due to which some fields went missing. We have fixed it and you can check the acceptable values there.

I will be closing this issue now as it was related with adding a new field to terraform (preferred_trust_chain) which is now fixed with the latest release. In case you have any other doubts or questions, please feel free to open a new request with us.

Regards,
Piyush

[janezhen08]

Hi team,

I have tried the latest release akamai v3.3.0, and use the value preferred_trust_chain = "dst-root-ca-x3" instead of certificate_chain_type = "default" in terraform code, but get below error:

Seems the issue still not resolved.

Please have a look.

thanks

Jane

[wzagrajcz]

Hello @janezhen08
Based on Your screenshot I suspect that the preferred_trust_chain is in incorrect place: the screenshot suggests that it's on the same level as certificate_chain_type while as documentation states it should be inside the csr block. Hope that will help.

Best regards,
Wojciech

[janezhen08]

Thanks, have verified, it is working now.

[hypnotisttom]

Actually there was a bug in document due to which some fields went missing. We have fixed it and you can check the acceptable values there.

Which doc, @kaush- ?

The https://registry.terraform.io/providers/akamai/akamai/latest/docs/resources/cps_dv_enrollment is still only showing this:

Tom

[kaush-]

It's in the tech doc for the APIs @hypnotisttom. You can find them here https://techdocs.akamai.com/cps/reference/post-enrollment