Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Tls Provider
TLS v5.1.1 published on Saturday, Mar 15, 2025 by Pulumi
pulumi/pulumi-tls

Tls Provider

TLS v5.1.1 published on Saturday, Mar 15, 2025 by Pulumi
pulumi/pulumi-tls

Installation

The Tls provider is available as a package in all Pulumi languages:

Overview

The TLS provider provides utilities for working with Transport Layer Security keys and certificates. It provides resources that allow private keys, certificates and certificate requests to be created as part of a Pulumi deployment.

Another name for Transport Layer Security is Secure Sockets Layer, or SSL. TLS and SSL are equivalent when considering the resources managed by this provider.

This provider is not particularly useful on its own, but it can be used to create certificates and credentials that can then be used with other providers when creating resources that expose TLS services or that themselves provision TLS certificates.

Use the navigation to the left to read about the available resources.

Example Usage

Example currently unavailable in this language
Copy
Example currently unavailable in this language
Copy
Example currently unavailable in this language
Copy
Example currently unavailable in this language
Copy
resources:
  # This example creates a self-signed certificate,
  # and uses it to create an AWS IAM Server certificate.
  #
  # THIS IS NOT RECOMMENDED FOR PRODUCTION SERVICES.
  # See the detailed documentation of each resource for further
  # security considerations and other practical tradeoffs.
  example:
    type: tls:PrivateKey
    properties:
      algorithm: ECDSA
  exampleSelfSignedCert:
    type: tls:SelfSignedCert
    name: example
    properties:
      keyAlgorithm: ${example.algorithm}
      privateKeyPem: ${example.privateKeyPem}
      validityPeriodHours: 12 # Generate a new certificate if Pulumi is run within three
      #   # hours of the certificate's expiration time.
      earlyRenewalHours: 3 # Reasonable set of uses for a server SSL certificate.
      allowedUses:
        - key_encipherment
        - digital_signature
        - server_auth
      dnsNames:
        - example.com
        - example.net
      subject:
        commonName: example.com
        organization: ACME Examples, Inc
  # For example, this can be used to populate an AWS IAM server certificate.
  exampleServerCertificate:
    type: aws:iam:ServerCertificate
    name: example
    properties:
      name: example_self_signed_cert
      certificateBody: ${exampleSelfSignedCert.certPem}
      privateKey: ${example.privateKeyPem}
Copy
Example currently unavailable in this language
Copy

Configuring Proxy

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: nodejs
Copy
import * as pulumi from "@pulumi/pulumi";
import * as tls from "@pulumi/tls";

const test = tls.getCertificate({
    url: "https://example.com",
});
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: python
Copy
import pulumi
import pulumi_tls as tls

test = tls.get_certificate(url="https://example.com")
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: dotnet
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Tls = Pulumi.Tls;

return await Deployment.RunAsync(() =>
{
    var test = Tls.GetCertificate.Invoke(new()
    {
        Url = "https://example.com",
    });

});
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: go
Copy
package main

import (
	"github.com/pulumi/pulumi-tls/sdk/v5/go/tls"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := tls.GetCertificate(ctx, &tls.GetCertificateArgs{
			Url: pulumi.StringRef("https://example.com"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: yaml
Copy
variables:
  test:
    fn::invoke:
      Function: tls:getCertificate
      Arguments:
        url: https://example.com
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: java
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.tls.TlsFunctions;
import com.pulumi.tls.inputs.GetCertificateArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var test = TlsFunctions.getCertificate(GetCertificateArgs.builder()
            .url("https://example.com")
            .build());

    }
}
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: nodejs
Copy
import * as pulumi from "@pulumi/pulumi";
import * as tls from "@pulumi/tls";

const test = tls.getCertificate({
    url: "https://example.com",
});
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: python
Copy
import pulumi
import pulumi_tls as tls

test = tls.get_certificate(url="https://example.com")
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: dotnet
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Tls = Pulumi.Tls;

return await Deployment.RunAsync(() =>
{
    var test = Tls.GetCertificate.Invoke(new()
    {
        Url = "https://example.com",
    });

});
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: go
Copy
package main

import (
	"github.com/pulumi/pulumi-tls/sdk/v5/go/tls"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := tls.GetCertificate(ctx, &tls.GetCertificateArgs{
			Url: pulumi.StringRef("https://example.com"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: yaml
Copy
variables:
  test:
    fn::invoke:
      Function: tls:getCertificate
      Arguments:
        url: https://example.com
Copy
# Pulumi.yaml provider configuration file
name: configuration-example
runtime: java
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.tls.TlsFunctions;
import com.pulumi.tls.inputs.GetCertificateArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var test = TlsFunctions.getCertificate(GetCertificateArgs.builder()
            .url("https://example.com")
            .build());

    }
}
Copy

Configuration Reference

  • proxy (Block List) Proxy used by resources and functions that connect to external endpoints. (see below for nested schema)

Nested Schema for proxy

Optional:

  • fromEnv (Boolean) When true the provider will discover the proxy configuration from environment variables. This is based upon http.ProxyFromEnvironment and it supports the same environment variables (default: true).
  • password (String, Sensitive) Password used for Basic authentication against the Proxy.
  • url (String) URL used to connect to the Proxy. Accepted schemes are: http, https, socks5.
  • username (String) Username (or Token) used for Basic authentication against the Proxy.

Limitations

ECDSA with P224 elliptic curve

When using ECDSA with P224, all the (computed) attributes that have to do with OpenSSH will have a value of "" (empty string). This applies to different resources and functions offered by this provider, like the tls.PrivateKey resource or the tls.getPublicKey function.

The attributes affected are:

  • .public_key_openssh
  • .private_key_openssh
  • .public_key_fingerprint_md5
  • .public_key_fingerprint_sha256

This is because the SSH ECC Algorithm Integration (RFC 5656) restricts support for elliptic curves to “nistp256”, “nistp384” and “nistp521”.

TLS v5.1.1 published on Saturday, Mar 15, 2025 by Pulumi
pulumi/pulumi-tls