Skip to content
F5 Distributed CloudCertificate Management
Aa

Terraform — Maintain

Maintain steps

Section titled “Maintain steps”

Keep the key algorithm unchanged when renewing a referenced certificate. Retain the old pair privately for rollback. Generate or obtain new matching material, validate it, then replace both configured inputs before making a new saved plan.

Terminal window
export TF_VAR_certificate_file="$XCSH_RENEWED_CERT_FILE"
export TF_VAR_private_key_file="$XCSH_RENEWED_KEY_FILE"
terraform -chdir="$XCSH_WORKDIR/deployment" plan \
  -out="$XCSH_WORKDIR/deployment/renew.plan"
terraform -chdir="$XCSH_WORKDIR/deployment" show \
  "$XCSH_WORKDIR/deployment/renew.plan"
shasum -a 256 "$XCSH_WORKDIR/deployment/renew.plan"

Apply the reviewed plan

Section titled “Apply the reviewed plan”

Confirm the exact owned resources and saved-plan hash before running the apply command.

Terminal window
terraform -chdir="$XCSH_WORKDIR/deployment" apply \
  "$XCSH_WORKDIR/deployment/renew.plan"
terraform -chdir="$XCSH_WORKDIR/deployment" plan -detailed-exitcode

Expect one material update followed by exit 0. Select the renewed certificate and key as <XCSH_CERT_FILE> and <XCSH_KEY_FILE> in Customize examples before repeating the strict verification commands and compare the served fingerprint. If xcsh uses the same inputs, rotate its separately owned certificate once after Terraform verification, preserving its metadata, options, name, and references. Keep its previous saved manifest privately.