Certificate types

Choose a configuration based on the TLS endpoint and resource owner. Every supported example includes complete HCL, resulting public JSON, commands, and expected results. Use the named certificate workflow for the primary HTTPS deployment.

Supported configurations

Qualification limits

The provider has 25 certificate nodes across 14 resource types. Sixteen support encrypted configuration lifecycles in the documented environment. Configuration readback, stable plans, and cleanup are separate from served TLS. Use dated qualification records for observed status; verify your own deployment with the installed artifacts.

Certificate node	Schema validation	Live lifecycle	Served TLS	Example and prerequisite or restriction
`xcsh_advertise_policy.tls_parameters.common_params.tls_certificates`	Passed	Passed	Unqualified	HCL Concrete consumer/advertisement required for serving.
`xcsh_bigip_http_proxy.proxy_config.https.tls_parameters.tls_certificates`	Passed	Unqualified	Unqualified	HCL Tenant API returns HTTP 501 Not Implemented
`xcsh_cdn_loadbalancer.https.tls_cert_options.tls_inline_params.tls_certificates`	Passed	Passed	Unqualified	HCL Concrete consumer/advertisement required for serving.
`xcsh_cdn_loadbalancer.origin_pool.use_tls.use_mtls.tls_certificates`	Passed	Passed	Unqualified	HCL Existing origin with client authentication and trusted server chain.
`xcsh_certificate`	Passed	Passed	Passed	HCL Existing namespace and tenant-managed hostname.
`xcsh_cluster.tls_parameters.common_params.tls_certificates`	Passed	Passed	Unqualified	HCL Concrete consumer/advertisement required for serving.
`xcsh_http_loadbalancer.default_pool.use_tls.use_mtls.tls_certificates`	Passed	Passed	Unqualified	HCL Existing origin with client authentication and trusted server chain.
`xcsh_http_loadbalancer.https.tls_parameters.tls_certificates`	Passed	Passed	Passed	HCL Existing namespace and tenant-managed hostname.
`xcsh_network_connector.enable_forward_proxy.tls_intercept.custom_certificate`	Passed	Failed	Unqualified	HCL API accepts system object but drops interception TLS configuration
`xcsh_nfv_service.https_management.advertise_on_sli_vip.tls_certificates`	Passed	Unqualified	Unqualified	HCL Isolated NFV service and managed cloud appliance prerequisites unavailable
`xcsh_nfv_service.https_management.advertise_on_slo_internet_vip.tls_certificates`	Passed	Unqualified	Unqualified	HCL Isolated NFV service and managed cloud appliance prerequisites unavailable
`xcsh_nfv_service.https_management.advertise_on_slo_sli.tls_certificates`	Passed	Unqualified	Unqualified	HCL Isolated NFV service and managed cloud appliance prerequisites unavailable
`xcsh_nfv_service.https_management.advertise_on_slo_vip.tls_certificates`	Passed	Unqualified	Unqualified	HCL Isolated NFV service and managed cloud appliance prerequisites unavailable
`xcsh_origin_pool.use_tls.use_mtls.tls_certificates`	Passed	Passed	Passed	HCL Existing origin with client authentication and trusted server chain.
`xcsh_proxy.dynamic_proxy.https_proxy.tls_params.tls_certificates`	Passed	Passed	Unqualified	HCL Concrete consumer/advertisement required for serving.
`xcsh_proxy.tls_intercept.custom_certificate`	Passed	Passed	Unqualified	HCL Forward proxy route and client CA trust.
`xcsh_secret_management_access.access_info.tls_config.common_params.tls_certificates`	Passed	Passed	Unqualified	HCL Concrete consumer/advertisement required for serving.
`xcsh_tcp_loadbalancer.tls_tcp.tls_parameters.tls_certificates`	Passed	Passed	Unqualified	HCL Concrete consumer/advertisement required for serving.
`xcsh_virtual_host.tls_parameters.common_params.tls_certificates`	Passed	Passed	Unqualified	HCL Concrete consumer/advertisement required for serving.
`xcsh_workload.service.advertise_options.advertise_custom.ports.http_loadbalancer.https.tls_parameters.tls_certificates`	Passed	Passed	Unqualified	HCL Existing CE virtual site and workload capacity.
`xcsh_workload.service.advertise_options.advertise_on_public.multi_ports.ports.http_loadbalancer.https.tls_parameters.tls_certificates`	Passed	Passed	Unqualified	HCL Existing CE virtual site and workload capacity.
`xcsh_workload.service.advertise_options.advertise_on_public.port.http_loadbalancer.https.tls_parameters.tls_certificates`	Passed	Passed	Unqualified	HCL Existing CE virtual site and workload capacity.
`xcsh_workload.stateful_service.advertise_options.advertise_custom.ports.http_loadbalancer.https.tls_parameters.tls_certificates`	Passed	Failed	Unqualified	HCL Current API returns HTTP 500; the HTTP-only control also fails
`xcsh_workload.stateful_service.advertise_options.advertise_on_public.multi_ports.ports.http_loadbalancer.https.tls_parameters.tls_certificates`	Passed	Failed	Unqualified	HCL Current API returns HTTP 500; the HTTP-only control also fails
`xcsh_workload.stateful_service.advertise_options.advertise_on_public.port.http_loadbalancer.https.tls_parameters.tls_certificates`	Passed	Failed	Unqualified	HCL Current API returns HTTP 500; the HTTP-only control also fails

Restricted reference fragments

Files under terraform/reference end in .tf.example. They illustrate schema paths and are excluded from normal terraform apply discovery. Review them against the installed schema; do not deploy them into the retained shared namespace.

BIG-IP HTTP proxy returned HTTP 501 Not Implemented in the tenant.
Stateful workloads’ public single-port, public multi-port, and custom advertisement paths were rejected by the API.
Network function virtualization (NFV) certificates need a separately managed appliance and isolated site. All four nodes remain unqualified live.
Network connectors require the system namespace. Current certificate-specific readback shows that the API accepts the object but drops interception TLS settings, so the current provider fails the write when encrypted readback is missing. The path remains restricted even there.

These limitations and unqualified served paths remain explicit even when schema validation passes. Review provider #2539 for tracked acceptance restrictions before selecting these configurations.