How to fix Error creating SslCertificate: googleapi: Error 409: The resource already exists in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 135 views

When using Terraform with Google Cloud Platform, you may encounter a 409 error stating 'The resource already exists' when trying to create or update SSL certificates. This typically occurs when the certificate wasn't properly deleted after a previous operation, or when using create_before_destroy lifecycle rules with managed certificates.

Quick fix

Fixes 409

gcloud compute ssl-certificates list
  1. Check if the certificate exists in Google Cloud Console
  2. Check what's referencing the certificate (target HTTPS proxy)
  3. Option 1: Import the existing certificate into Terraform state
  4. Option 2: Update the proxy to use a different certificate first
terraform — error
gcloud compute ssl-certificates list
Error creating SslCertificate: googleapi: Error 409: The resource already exists

What this error means

This error occurs when Terraform attempts to create an SSL certificate resource that already exists in Google Cloud Platform. GCP returns a 409 (Conflict) HTTP status code, indicating the resource name is already taken. This commonly happens in three scenarios: (1) After running 'terraform destroy' when the certificate deletion was incomplete, (2) When using lifecycle rules with create_before_destroy = true on certificates in use by load balancers, or (3) When manually creating a certificate in GCP Console and then trying to create it via Terraform with the same name.

Typical symptoms

  • terraform apply fails with 'Error 409: The resource already exists, alreadyExists'
  • The error persists across multiple terraform apply attempts
  • Certificate exists in Google Cloud Console but not in Terraform state
  • Using create_before_destroy lifecycle results in the error after destroy
  • Target HTTPS proxy is still using the old certificate during update attempts

Common causes

  1. Incomplete deletion after terraform destroy - the certificate still exists in GCP even though Terraform state is clean
  2. Using create_before_destroy = true with managed certificates that are in use by load balancers (GCP locks them)
  3. Certificate name already exists in GCP from a previous manual creation or incomplete Terraform run
  4. Target HTTPS proxy still references the old certificate during replacement (cannot delete while in use)
  5. Managed SSL certificates have special constraints that prevent simple deletion and recreation

How to fix "Error creating SslCertificate: googleapi: Error 409: The resource already exists"

1Check if the certificate exists in Google Cloud Console

First, verify the certificate exists in GCP by checking Compute Engine > Security > SSL Certificates:

bash
gcloud compute ssl-certificates list

This confirms whether the resource physically exists in GCP, separate from your Terraform state.

2Check what's referencing the certificate (target HTTPS proxy)

If the certificate is in use by a load balancer, it cannot be deleted or replaced directly. List what's using it:

bash
gcloud compute target-https-proxies list
gcloud compute target-https-proxies describe [PROXY_NAME] --global

Note which proxies reference your certificate. This is the most common blocker.

3Option 1: Import the existing certificate into Terraform state

If the certificate already exists in GCP and you want to manage it with Terraform, import it:

bash
terraform import google_compute_ssl_certificate.my_cert [CERTIFICATE_NAME]

This adds the existing resource to your Terraform state without recreating it. Then update your Terraform code to match the actual resource.

4Option 2: Update the proxy to use a different certificate first

If you need to replace the certificate, first update any target HTTPS proxies to use a temporary/migration certificate:

bash
gcloud compute target-https-proxies update [PROXY_NAME] --ssl-certificates=[TEMP_CERT_NAME] --global

Then the old certificate can be deleted via Terraform, allowing the new one to be created.

5Option 3: Create a new certificate with a unique name

For managed certificates where you can't modify domains, use a unique naming strategy with a suffix:

hcl
resource "random_id" "cert_suffix" {
  byte_length = 4
  keepers = {
    domains = join(",", var.domains)
  }
}

resource "google_compute_managed_ssl_certificate" "my_cert" {
  name = "my-cert-${random_id.cert_suffix.hex}"
  managed {
    domains = var.domains
  }

  lifecycle {
    create_before_destroy = true
  }
}

This generates unique names to avoid conflicts when domains change.

6Option 4: Manually delete via gcloud, then retry terraform apply

As a last resort, manually delete the certificate if nothing references it:

bash
gcloud compute ssl-certificates delete [CERTIFICATE_NAME]

Then run:

bash
terraform apply

WARNING: Only do this if you've confirmed nothing is using the certificate, or you'll break production load balancers.

Advanced notes

GCP managed SSL certificates have a complex lifecycle: they cannot be updated once domains are set—only replaced. This is why Terraform's 'create_before_destroy' lifecycle rule is often needed. However, when a certificate is in use by a target HTTPS proxy or load balancer, GCP locks it and prevents deletion, causing the 409 error. The proxy must be switched to a different certificate first. For self-managed certificates (google_compute_ssl_certificate), similar constraints apply. Consider using Google's newer Certificate Manager (google_certificate_manager_certificate) for more flexible certificate management. Additionally, if using Terraform Cloud or Remote State, ensure state is locked properly during concurrent operations to avoid race conditions.

Frequently asked questions

What does "409" mean?
This error occurs when Terraform attempts to create an SSL certificate resource that already exists in Google Cloud Platform. GCP returns a 409 (Conflict) HTTP status code, indicating the resource name is already taken. This commonly happens in three scenarios: (1) After running 'terraform destroy' when the certificate deletion was incomplete, (2) When using lifecycle rules with create_before_destroy = true on certificates in use by load balancers, or (3) When manually creating a certificate in GCP Console and then trying to create it via Terraform with the same name.
How do I fix "409"?
When using Terraform with Google Cloud Platform, you may encounter a 409 error stating 'The resource already exists' when trying to create or update SSL certificates. This typically occurs when the certificate wasn't properly deleted after a previous operation, or when using create_before_destroy lifecycle rules with managed certificates.
What causes "409"?
Incomplete deletion after terraform destroy - the certificate still exists in GCP even though Terraform state is clean Using create_before_destroy = true with managed certificates that are in use by load balancers (GCP locks them) Certificate name already exists in GCP from a previous manual creation or incomplete Terraform run
Is the "409" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading