{"token_count": 595}

# Reference for the teleport\_cert\_authority\_override Terraform resource

This page lists the supported values of the teleport\_cert\_authority\_override resource of the Teleport Terraform provider.

## Schema

### Optional

- `metadata` (Attributes) Metadata for the resource. The name of the resource is the cluster name. (see [below for nested schema](#nested-schema-for-metadata))
- `spec` (Attributes) Spec for the resource. (see [below for nested schema](#nested-schema-for-spec))
- `sub_kind` (String) Sub kind is the CA type. Eg: "db\_client", "spiffe-tls", "windows".
- `version` (String) Version is "v1".

### Nested Schema for `metadata`

Optional:

- `description` (String) description is object description.
- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
- `labels` (Map of String) labels is a set of labels.
- `name` (String) name is an object name.

### Nested Schema for `spec`

Optional:

- `certificate_overrides` (Attributes List) Certificate overrides. Required. (see [below for nested schema](#nested-schema-for-speccertificate_overrides))

### Nested Schema for `spec.certificate_overrides`

Optional:

- `certificate` (String) Certificate to present, in PEM form. The public key must match an existing CA certificate. It must also match the public\_key field, if present. The certificate Subject must contain the cluster name, either in the "O=" field or in OID "1.3.9999.4.1", as per RFD 0237. <https://github.com/gravitational/teleport/blob/master/rfd/0237-sub-ca-support.md#subject-customization>
- `chain` (List of String) Certificate chain, in PEM form. The chain must be sorted from leaf to root. If present Teleport may supply the chain, along with the certificate, in appropriate situations. The chain is limited to a generous (but sensible) server-defined length.
- `disabled` (Boolean) If true disables the override. A disabled override may exist for recording purposes, to be enabled later, or simply to mark a certain public key as not overridden. In the latter case the certificate may be absent. Disabled overrides allow CRLs to be created asynchronously, using CertAuthorityOverride watchers.
- `public_key` (String) SHA256(SubjectPublicKeyInfo DER) printed as hex string. Informative if certificate is present.