Declaring multiple ssl certificates in Application Gateway

[eosman-tibco]

I'm a little confused on how to declare multiple SSL Certificates within the application gateway as I have to declare the certificates name within the https listener like so:

  http_listener {
        name                                  = "https-listener-1"
        frontend_ip_configuration_name        = "feip"
        frontend_port_name                    = "https-port"
        protocol                              = "Https"
        ssl_certificate_name                  = "ssl-certificate-1"
    }

  ssl_certificate {
      name                                    = "ssl-certificate-1"
      data                                    = "${var.certificate_content}"
      password                                = "${var.certificate_passphrase}"
    }

Do I need to declare multiple https_listener and ssl_certificate and give each a unique name? An example would be helpful as the resource documentation doesn't indicate how to achieve this.

[eosman-tibco]

I've tried using a list of maps like so:

  http_listener = ["${var.https_listener_list}"]

  ssl_certificate = ["${var.ssl_certificate_list}"]

  request_routing_rule = ["${var.request_routing_rule_list}"]

And declaring the inputs as lists in this manner:

variable "https_listener_list" {
  type  = "list"
  default = [
    {
      name = "https-listener-1"
      frontend_ip_configuration_name = "feip"
      frontend_port_name = "http-port"
      protocol = "Https"
      ssl_certificate_name = "ssl-certificate-1"
    }
  ]
}

variable "ssl_certificate_list" {
  type = "list"
  default = [
    {
      name  = "ssl-certificate-1"
      data  = "foo"
      password = ""

    }
  ]
}

variable "request_routing_rule_list" {
  type = "list"
  default = [
    {
      name                       = "j-rqrt-https"
      rule_type                  = "Basic"
      http_listener_name         = "https-listener-1"
      backend_address_pool_name  = "beap"
      backend_http_settings_name = "backendhttp"
    }
  ]
}

However when I'm trying to pass calculated values into the input it doesn't work:

module "certificate" {
  source = "../terraform-modules/azure/azure_ssl_certificate"
  secret_name = "ahmed"
  key_vault_name = "testvault"
}

module "application_gateway" {
  source = "../terraform-modules/azure/azure_application_gateway"
  resource_group_name = "${module.rg.resource_group_name}"
  subnet_name = "${module.vnet.gateway_subnets[0]}"
  backend_address_list = [
    "192.168.1.10"
  ]

  https_listener_list = [
    {
      name = "https-listener-1"
      frontend_ip_configuration_name = "feip"
      frontend_port_name = "http-port"
      protocol = "Https"
      ssl_certificate_name = "ssl-certificate-1"
    }
  ]

  ssl_certificate_list = [
    {
      name  = "ssl-certificate-1"
      data  = "${module.certificate.secret_value}"
      password = "${module.certificate.secret_passphrase}"
    }
  ]

  request_routing_rule_list = [
    {
      name                       = "j-rqrt-https"
      rule_type                  = "Basic"
      http_listener_name         = "https-listener-1"
      backend_address_pool_name  = "beap"
      backend_http_settings_name = "backendhttp"
    }
  ]


}

The expected result is a successful plan however I get the following error instead:

Error: module.application_gateway.azurerm_application_gateway.this: "ssl_certificate.0.data": required field is not set



Error: module.application_gateway.azurerm_application_gateway.this: "ssl_certificate.0.name": required field is not set



Error: module.application_gateway.azurerm_application_gateway.this: "ssl_certificate.0.password": required field is not set

If I change data and password to static values the plan succeeds.

Edit: My proposed method is hitting a limitation in terraform which is going to be solved in v0.12 (hashicorp/terraform#7034).

It would be great to understand if there's another way to accomplish this.

[OffColour]

I've not tried anything with lists. I just do the following:

locals {
wildcard_cert1_domain_cert_name = "cert1"
wildcard_cert1_domain_cert_key  = "pfxkey"
wildcard_cert1_domain_cert_data = "${base64encode(file("..\\Certificates\\mypfx1.pfx"))}"
  
wildcard_cert2_domain_cert_name = "cert2"
wildcard_cert2_domain_cert_key  = "pfxkey"
wildcard_cert2_domain_cert_data = "${base64encode(file("..\\Certificates\\mypfx2.pfx"))}"
}

#In App Gateway resource

 # cert1
  ssl_certificate {
    name     = "${local.wildcard_cert1_domain_cert_name}"
    password = "${local.wildcard_cert1_domain_cert_key}"
    data     = "${local.wildcard_cert1_domain_cert_data}"
  }
  # cert2
  ssl_certificate {
    name     = "${local.wildcard_cert2_domain_cert_name}"
    password = "${local.wildcard_cert2_domain_cert_key}"
    data     = "${local.wildcard_cert2_domain_cert_data}"
  }

http_listener {
    name                           = "apply"
    frontend_ip_configuration_name = "feip"
    frontend_port_name             = "feport"
    protocol                       = "Https"
    ssl_certificate_name           = "${local.wildcard_cert1_domain_cert_name}"
    host_name                      = "apply.mydomain1.com"
    require_sni                    = true
  }
  
  http_listener {
    name                           = "apply"
    frontend_ip_configuration_name = "feip"
    frontend_port_name             = "feport"
    protocol                       = "Https"
    ssl_certificate_name           = "${local.wildcard_cert2_domain_cert_name}"
    host_name                      = "apply.mydomain2.com"
    require_sni                    = true
  }

[eosman-tibco]

That works as you're declaring each one directly. I ended up having to just declare the application_gateway resource directly in the deployment and will have to revisit this when 0.12 is released.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!