# dokploy_certificate (Resource)

A TLS certificate that Traefik serves for the domains that reference it. Upload the chain and the key here, then select the certificate on a `dokploy_domain` with `certificate_type = "custom"`.

~> **Dokploy stores and returns `private_key` in cleartext.** The attribute is sensitive, so Terraform does not print it, but anyone with API access to the server can read it. The `private_key_wo` companion keeps it out of the Terraform state.

~> Dokploy does not validate the PEM content on create or update. A malformed certificate applies successfully and fails when Traefik loads it.

## Example Usage

```terraform
# Upload a certificate that Traefik serves for a domain. Keep the private key
# out of the state with the write-only companion.
resource "dokploy_certificate" "wildcard" {
  name             = "wildcard-example-com"
  certificate_data = file("${path.module}/certs/wildcard.example.com.pem")

  # Write-only: Terraform 1.11 or later. Change the version when the key file
  # changes, or Terraform does not send the new key.
  private_key_wo         = file("${path.module}/certs/wildcard.example.com.key")
  private_key_wo_version = 1
}

# Use the certificate on a domain.
resource "dokploy_domain" "app" {
  application_id   = dokploy_application.web.id
  host             = "app.example.com"
  https            = true
  certificate_type = "custom"
}

# A certificate that a specific remote server serves. auto_renew and
# server_id cannot change on a stored certificate; a change replaces it.
resource "dokploy_certificate" "worker" {
  name             = "worker-example-com"
  certificate_data = file("${path.module}/certs/worker.pem")
  private_key      = file("${path.module}/certs/worker.key")
  auto_renew       = false
  server_id        = dokploy_server.worker.id
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `certificate_data` (String) The certificate chain in PEM format. Read it from a file with `file()`, or take it from an ACME provider resource.
- `name` (String) Display name. Dokploy does not enforce a unique name.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `auto_renew` (Boolean) Whether Dokploy renews the certificate. Defaults to `false`. Dokploy cannot change it on a stored certificate, so a change replaces the resource.
- `private_key` (String, Sensitive) The private key in PEM format. Set this attribute or `private_key_wo`.
- `private_key_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only form of `private_key`. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of `private_key` and `private_key_wo`. A new value reaches the server only when `private_key_wo_version` changes.
- `private_key_wo_version` (Number) Version of `private_key_wo`. Change it to send the current `private_key_wo` value to the server. It needs `private_key_wo`.
- `server_id` (String) Id of the `dokploy_server` that serves the certificate. Omit it for the Dokploy host. A change replaces the resource.

### Read-Only

- `certificate_path` (String) Name of the Traefik certificate file that Dokploy generates.
- `id` (String) Certificate id.
- `organization_id` (String) Id of the organization that owns the certificate. The provider fills it from the API key's active organization.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
terraform import dokploy_certificate.wildcard uxdzS4pe4_mMDIzGjwXY8
```