How to fix Error: Error parsing certificate in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 31, 2025· 127 views

Terraform's TLS certificate parsing error occurs when the TLS provider encounters malformed, expired, or untrusted certificates. This error typically appears when using data sources like tls_certificate or connecting to remote backends with problematic certificates.

Quick fix

Fixes Error: Error parsing certificate

# Extract the certificate from your endpoint or file
openssl s_client -showcerts -connect example.com:443 </dev/null | openssl x509 -text -noout

# Or check a local PEM file
openssl x509 -text -noout -in /path/to/certificate.pem
  1. Verify the certificate format and validity
  2. Check for negative serial numbers if using Terraform 1.10+
  3. Fix certificate chain issues by including all intermediate certificates
  4. Configure certificate verification in tls_certificate data source
terraform — error
# Extract the certificate from your endpoint or file
openssl s_client -showcerts -connect example.com:443 </dev/null | openssl x509 -text -noout
# Or check a local PEM file
openssl x509 -text -noout -in /path/to/certificate.pem
Error: Error parsing certificate

What this error means

This error occurs when Terraform's TLS provider attempts to parse a certificate but encounters an issue with its format or validity. Common causes include malformed PEM encoding, negative serial numbers (in Terraform 1.10+), invalid certificate chains, missing intermediate certificates, or expired certificates. The error often surfaces when using the tls_certificate data source, connecting to HTTPS endpoints during provider initialization, or when accessing state stored in S3 or other cloud backends secured with TLS.

Typical symptoms

  • Terraform plan or apply fails immediately with TLS parsing error
  • tls_certificate data source returns empty or partial results
  • Cannot connect to remote Terraform backends due to certificate validation
  • Error appears when upgrading Terraform versions (especially 1.9 to 1.10)
  • Terraform fails behind corporate proxies or TLS inspection endpoints

Common causes

  1. Malformed or corrupted PEM-encoded certificate file
  2. Negative serial number in certificate (Go 1.23+ enforces stricter validation than Go 1.22)
  3. Invalid or incomplete certificate chain missing intermediate certificates
  4. Expired or self-signed certificates without proper CA trust configuration
  5. Certificate mismatch between certificate content and domain/hostname

How to fix "Error: Error parsing certificate"

1Verify the certificate format and validity

First, check if the certificate file is valid PEM format and not corrupted.

bash
# Extract the certificate from your endpoint or file
openssl s_client -showcerts -connect example.com:443 </dev/null | openssl x509 -text -noout

# Or check a local PEM file
openssl x509 -text -noout -in /path/to/certificate.pem

Look for:
- Valid date range (notBefore and notAfter)
- Correct certificate subject/CN matches your domain
- Complete certificate chain (no truncated PEM blocks)

If the certificate is expired, you'll need to update it with a valid one.

2Check for negative serial numbers if using Terraform 1.10+

Terraform 1.10 upgraded from Go 1.22 to Go 1.23, which enforces stricter certificate validation. Certificates with negative serial numbers are now rejected.

bash
# Check the serial number of the certificate
openssl x509 -serial -noout -in /path/to/certificate.pem

If the serial starts with a minus sign or is very large, you need to either:

1. Upgrade the certificate to one with a valid positive serial number
2. Downgrade to Terraform 1.9.8 temporarily while planning certificate replacement
3. Set environment variable to relax Go's validation (not recommended for production):

bash
export GODEBUG=x509negativeserial=1
terraform plan
3Fix certificate chain issues by including all intermediate certificates

If using a certificate from a provider like AWS ACM or Azure, ensure the complete chain is included. The certificate file must contain the leaf certificate and all intermediate certificates in the correct order.

bash
# Count certificates in your PEM file
grep -c "BEGIN CERTIFICATE" certificate.pem

# Should typically have: 1 (leaf) + N (intermediates) + optional 1 (root)

If missing intermediates, download and append them:

bash
# Download full chain
openssl s_client -showcerts -connect example.com:443 </dev/null |   sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > full_chain.pem

# Use the complete chain in Terraform
4Configure certificate verification in tls_certificate data source

If using the tls_certificate data source, you can control certificate chain verification with the verify_chain parameter:

hcl
data "tls_certificate" "example" {
  url = "https://example.com"
  # Set to false to skip verification (not recommended for production)
  verify_chain = true  # default
}

For local certificate files, use the content parameter instead:

hcl
data "tls_certificate" "example" {
  content = file("${path.module}/certificate.pem")
}

Note: When using content with multiple PEM certificates, only the first is typically parsed.

5Handle self-signed certificates or corporate proxies

If behind a corporate proxy or using self-signed certificates, add the certificate to your system's CA bundle:

On Linux:

bash
# Copy certificate to system store
sudo cp certificate.pem /usr/local/share/ca-certificates/
sudo update-ca-certificates

# Or append to system CA file
cat certificate.pem >> /etc/ssl/certs/ca-certificates.crt

On macOS:

bash
# Add certificate to system keychain
sudo security add-certificates -k /Library/Keychains/System.keychain certificate.pem

In Terraform, you can also set custom CA paths:

hcl
# Set via environment variable (affects all HTTPS connections)
# export TF_VAR_ca_bundle=/path/to/ca-bundle.pem
6Update Terraform to the latest version

Ensure you're running the latest stable version of Terraform and the hashicorp/tls provider:

bash
# Upgrade Terraform
terraform version
# Follow https://www.terraform.io/downloads to upgrade

# Upgrade TLS provider
terraform init -upgrade

Newer versions include bug fixes for certificate parsing. For example:
- Terraform 1.10.5+ has improved Go 1.23 compatibility
- Terraform Enterprise v202405-1+ fixes S3-compatible storage certificate issues

Advanced notes

For advanced troubleshooting, use openssl to verify the entire certificate chain:

bash
openssl verify -CAfile ca-bundle.pem -untrusted intermediate.pem leaf.pem

If using Terraform Enterprise with S3-compatible storage, ensure the certificate validation happens after the CA bundle is loaded. Upgrading to v202405-1 or later resolves timing issues where certificates were checked before CA configuration.

In containerized environments (Docker, Kubernetes), ensure ca-certificates are properly installed and mounted. Different Linux distributions store CA certificates in different locations (/etc/ssl/certs vs /usr/local/share/ca-certificates), which can affect Terraform's certificate discovery.

Frequently asked questions

What does "Error: Error parsing certificate" mean?
This error occurs when Terraform's TLS provider attempts to parse a certificate but encounters an issue with its format or validity. 10+), invalid certificate chains, missing intermediate certificates, or expired certificates. The error often surfaces when using the tls_certificate data source, connecting to HTTPS endpoints during provider initialization, or when accessing state stored in S3 or other cloud backends secured with TLS.
How do I fix "Error: Error parsing certificate"?
Terraform's TLS certificate parsing error occurs when the TLS provider encounters malformed, expired, or untrusted certificates. This error typically appears when using data sources like tls_certificate or connecting to remote backends with problematic certificates.
What causes "Error: Error parsing certificate"?
Malformed or corrupted PEM-encoded certificate file Negative serial number in certificate (Go 1.23+ enforces stricter validation than Go 1.22) Invalid or incomplete certificate chain missing intermediate certificates
Is the "Error: Error parsing certificate" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading