Certificates Object
Relationships
graph LR
Certificates -->|"account"| Accounts
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
The primary domain name (subject CN).
End of validity (NotAfter).
Whether the certificate may be exported with its private key.
Whether the private key has been exported.
Whether any provider resource uses the certificate.
Provider ids (ARNs) of the resources using it. Read on GET only.
provider_issued: a public certificate issued and renewed by the provider. imported: a certificate the customer imported (no managed renewal). private_ca: issued by a private CA the customer runs.
provider_issuedimportedprivate_ca
The key algorithm, verbatim (on AWS: RSA_2048, EC_prime256v1, ...).
The provider service that manages the certificate and its renewal, verbatim (on AWS: CLOUDFRONT). Null when the customer manages it.
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
Start of validity.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
The provider's managed-renewal status, verbatim (on AWS: PENDING_AUTO_RENEWAL, PENDING_VALIDATION, SUCCESS, FAILED). Read on GET only; null when no renewal has run.
The provider's own status, verbatim (on AWS: PENDING_VALIDATION, ISSUED, INACTIVE, EXPIRED, VALIDATION_TIMED_OUT, REVOKED, FAILED).
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
Whether the provider can renew the certificate by itself (on AWS: RenewalEligibility ELIGIBLE). Verbatim in remote_data.
The provider's managed renewal, normalised. pending: renewal is queued (on AWS: PENDING_AUTO_RENEWAL). Read on GET only; null when no renewal has run. provider_renewal_status has the value verbatim.
pendingpending_validationsucceededfailedunknown
The signature algorithm, verbatim (e.g. SHA256WITHRSA). Read on GET only.
Status, normalised. failed also covers a validation that timed out (on AWS: VALIDATION_TIMED_OUT). provider_status has the provider's value verbatim.
pending_validationissuedinactiveexpiredrevokedfailedunknown
Subject alternative names. On the list at most the first 100 - see unreadable_fields.
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.