How to fix x509 certificate error in Terraform

First, determine which certificate is failing verification. Run Terraform with verbose logging to see the hostname:

TF_LOG=DEBUG terraform init

Look for the server hostname in the error message. Then examine its certificate:

# For a web server
openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -text -noout

# For Terraform Enterprise
openssl s_client -connect tfe.company.com:443 < /dev/null | openssl x509 -text -noout

Note the "Issuer" field in the certificate output. If it says your organization or contains "CN=.*Internal", it's a custom or self-signed certificate.

If the certificate was issued by a custom CA, you need to obtain the root CA certificate. Common ways to do this:

From a server with the certificate:

# Export the certificate chain
openssl s_client -connect example.com:443 -showcerts < /dev/null |   sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ca-bundle.crt

From your organization's certificate store:
Ask your IT department for the root CA certificate or intermediate CA certificate in PEM format.

From Terraform Enterprise admin UI:
If using Terraform Enterprise, you can often export the certificate from the Replicated admin console on port 8800.

Copy the CA certificate to the system's CA directory and update the trust store:

# Copy the certificate
sudo cp ca-bundle.crt /usr/local/share/ca-certificates/custom-ca.crt

# Ensure proper permissions
sudo chmod 644 /usr/local/share/ca-certificates/custom-ca.crt

# Update the trust store
sudo update-ca-certificates

Verify the update succeeded:

ls -la /etc/ssl/certs/ | grep custom-ca

On macOS, use the security command to add the certificate to Keychain:

# Convert PEM to DER if needed (some tools require DER)
openssl x509 -inform PEM -in ca-bundle.crt -outform DER -out ca-bundle.cer

# Add to System Keychain
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca-bundle.crt

# Or for current user only
security add-trusted-cert -d -r trustRoot ca-bundle.crt

Note: If you see "The certificate is not trusted" dialog, click "Always Trust" to add it to the keychain.

On Windows, use the certutil command or Certificate Manager:

Via Command Prompt (admin):

certutil -addstore -f "ROOT" ca-bundle.crt

Via Certificate Manager GUI:
1. Press Win+R and type mmc
2. Click File → Add/Remove Snap-in
3. Select "Certificates" and click Add
4. Choose "Computer Account" (for system-wide) or "My user account" (for current user)
5. Navigate to Certificates → Trusted Root Certification Authorities
6. Right-click and select "All Tasks" → "Import"
7. Browse to your CA certificate file and complete the import wizard

After adding the certificate to the trust store, verify it works:

# Test with OpenSSL
openssl verify -CAfile ca-bundle.crt -untrusted ca-bundle.crt ca-bundle.crt

# Or for a remote server
openssl s_client -connect example.com:443 -CAfile ca-bundle.crt -servername example.com

Then retry your Terraform command:

terraform init
terraform plan