From be9bdc9b807f6bd4ef1441540dea8edfb3782fbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ste=CC=81phane=20Este-Gracias?= <sestegra@gmail.com>
Date: Fri, 30 Dec 2022 19:48:36 +0100
Subject: [PATCH 1/7] Add max_path_length attribute on certificates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stéphane Este-Gracias <sestegra@gmail.com>
---
 docs/data-sources/certificate.md              |   3 +-
 docs/resources/locally_signed_cert.md         |   1 +
 docs/resources/self_signed_cert.md            |   1 +
 internal/provider/common_cert.go              |  11 ++
 internal/provider/data_source_certificate.go  |   2 +
 .../provider/data_source_certificate_test.go  |  10 ++
 internal/provider/models.go                   |   3 +
 .../provider/resource_locally_signed_cert.go  |  12 ++
 .../resource_locally_signed_cert_test.go      | 104 ++++++++++++++++++
 .../provider/resource_self_signed_cert.go     |  12 ++
 .../resource_self_signed_cert_test.go         |  63 +++++++++++
 templates/data-sources/certificate.md.tmpl    |   3 +-
 12 files changed, 223 insertions(+), 2 deletions(-)

diff --git a/docs/data-sources/certificate.md b/docs/data-sources/certificate.md
index e66c2f67..093b8d86 100644
--- a/docs/data-sources/certificate.md
+++ b/docs/data-sources/certificate.md
@@ -38,7 +38,7 @@ data "tls_certificate" "example_content" {
 }
 ```
 
-<!-- 
+<!--
     Schema ORIGINALLY generated by tfplugindocs,
     then manually tweaked to circumvent current limitations.
 
@@ -63,6 +63,7 @@ data "tls_certificate" "example_content" {
 Read-Only:
 
 - `is_ca` (Boolean) `true` if the certificate is of a CA (Certificate Authority).
+- `max_path_length` (Number) The maximum number of intermediate certificates that can follow this certificate in a valid certification path. If `is_ca` is `false`, this value is `-1`.
 - `issuer` (String) Who verified and signed the certificate, roughly following [RFC2253](https://tools.ietf.org/html/rfc2253).
 - `not_after` (String) The time until which the certificate is invalid, as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
 - `not_before` (String) The time after which the certificate is valid, as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
diff --git a/docs/resources/locally_signed_cert.md b/docs/resources/locally_signed_cert.md
index e9aa5083..591d1982 100644
--- a/docs/resources/locally_signed_cert.md
+++ b/docs/resources/locally_signed_cert.md
@@ -46,6 +46,7 @@ resource "tls_locally_signed_cert" "example" {
 
 - `early_renewal_hours` (Number) The resource will consider the certificate to have expired the given number of hours before its actual expiry time. This can be useful to deploy an updated certificate in advance of the expiration of the current certificate. However, the old certificate remains valid until its true expiration time, since this resource does not (and cannot) support certificate revocation. Also, this advance update can only be performed should the Terraform configuration be applied during the early renewal period. (default: `0`)
 - `is_ca_certificate` (Boolean) Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
+- `max_path_length` (Number) Maximum number of intermediate certificates that may follow this certificate in a valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)
 - `set_subject_key_id` (Boolean) Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 
 ### Read-Only
diff --git a/docs/resources/self_signed_cert.md b/docs/resources/self_signed_cert.md
index 9ae05ac2..85c4c807 100644
--- a/docs/resources/self_signed_cert.md
+++ b/docs/resources/self_signed_cert.md
@@ -51,6 +51,7 @@ resource "tls_self_signed_cert" "example" {
 - `early_renewal_hours` (Number) The resource will consider the certificate to have expired the given number of hours before its actual expiry time. This can be useful to deploy an updated certificate in advance of the expiration of the current certificate. However, the old certificate remains valid until its true expiration time, since this resource does not (and cannot) support certificate revocation. Also, this advance update can only be performed should the Terraform configuration be applied during the early renewal period. (default: `0`)
 - `ip_addresses` (List of String) List of IP addresses for which a certificate is being requested (i.e. certificate subjects).
 - `is_ca_certificate` (Boolean) Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
+- `max_path_length` (Number) Maximum number of intermediate certificates that may follow this certificate in a valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)
 - `set_authority_key_id` (Boolean) Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 - `set_subject_key_id` (Boolean) Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 - `subject` (Block List) The subject for which a certificate is being requested. The acceptable arguments are all optional and their naming is based upon [Issuer Distinguished Names (RFC5280)](https://tools.ietf.org/html/rfc5280#section-4.1.2.4) section. (see [below for nested schema](#nestedblock--subject))
diff --git a/internal/provider/common_cert.go b/internal/provider/common_cert.go
index 1b16428a..61a7baf3 100644
--- a/internal/provider/common_cert.go
+++ b/internal/provider/common_cert.go
@@ -178,6 +178,17 @@ func createCertificate(ctx context.Context, template, parent *x509.Certificate,
 		}
 	}
 
+	// Set max-path-len on the template
+	maxPathLenPath := path.Root("max_path_length")
+	var maxPathLen types.Int64
+	diags.Append(plan.GetAttribute(ctx, maxPathLenPath, &maxPathLen)...)
+	if diags.HasError() {
+		return nil, diags
+	}
+	if !maxPathLen.IsNull() && !maxPathLen.IsUnknown() && maxPathLen.ValueInt64() >= 0 {
+		template.MaxPathLen = int(maxPathLen.ValueInt64())
+	}
+
 	// Set subject-id on the template
 	setSubjectKeyIDPath := path.Root("set_subject_key_id")
 	var setSubjectKeyID types.Bool
diff --git a/internal/provider/data_source_certificate.go b/internal/provider/data_source_certificate.go
index 1576627b..14f35122 100644
--- a/internal/provider/data_source_certificate.go
+++ b/internal/provider/data_source_certificate.go
@@ -278,6 +278,7 @@ func certificateToStruct(cert *x509.Certificate) CertificateModel {
 		PublicKeyAlgorithm: types.StringValue(cert.PublicKeyAlgorithm.String()),
 		SerialNumber:       types.StringValue(cert.SerialNumber.String()),
 		IsCA:               types.BoolValue(cert.IsCA),
+		MaxPathLen:         types.Int64Value(int64(cert.MaxPathLen)),
 		Version:            types.Int64Value(int64(cert.Version)),
 		Issuer:             types.StringValue(cert.Issuer.String()),
 		Subject:            types.StringValue(cert.Subject.String()),
@@ -294,6 +295,7 @@ func x509CertObjectAttrTypes() map[string]attr.Type {
 		"public_key_algorithm": types.StringType,
 		"serial_number":        types.StringType,
 		"is_ca":                types.BoolType,
+		"max_path_length":      types.Int64Type,
 		"version":              types.Int64Type,
 		"issuer":               types.StringType,
 		"subject":              types.StringType,
diff --git a/internal/provider/data_source_certificate_test.go b/internal/provider/data_source_certificate_test.go
index 36d7af79..475c034d 100644
--- a/internal/provider/data_source_certificate_test.go
+++ b/internal/provider/data_source_certificate_test.go
@@ -34,6 +34,7 @@ func TestDataSourceCertificate_CertificateContent(t *testing.T) {
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.public_key_algorithm", "RSA"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.serial_number", "266244246501122064554217434340898012243"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.is_ca", "false"),
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.max_path_length", "-1"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.version", "3"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.issuer", "CN=Root CA,O=Test Org,L=Here"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.subject", "CN=Child Cert,O=Child Co.,L=Everywhere"),
@@ -71,6 +72,7 @@ func TestAccDataSourceCertificate_UpgradeFromVersion3_4_0(t *testing.T) {
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.public_key_algorithm", "RSA"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.serial_number", "266244246501122064554217434340898012243"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.is_ca", "false"),
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.max_path_length", "-1"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.version", "3"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.issuer", "CN=Root CA,O=Test Org,L=Here"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.subject", "CN=Child Cert,O=Child Co.,L=Everywhere"),
@@ -104,6 +106,7 @@ func TestAccDataSourceCertificate_UpgradeFromVersion3_4_0(t *testing.T) {
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.public_key_algorithm", "RSA"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.serial_number", "266244246501122064554217434340898012243"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.is_ca", "false"),
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.max_path_length", "-1"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.version", "3"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.issuer", "CN=Root CA,O=Test Org,L=Here"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.subject", "CN=Child Cert,O=Child Co.,L=Everywhere"),
@@ -141,7 +144,9 @@ func TestAccDataSourceCertificate_TerraformIO(t *testing.T) {
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.signature_algorithm", "SHA256-RSA"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.public_key_algorithm", "RSA"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.is_ca", "true"),
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.sha1_fingerprint", "a053375bfe84e8b748782c7cee15827a6af5a405"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.sha1_fingerprint", "696db3af0dffc17e65c6a20d925c5a7bd24dec7e"),
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.max_path_length", "0"),
 
 					// www.terraform.io
 					r.TestCheckResourceAttrPair("data.tls_certificate.test", "certificates.1.issuer", "data.tls_certificate.test", "certificates.0.subject"),
@@ -149,7 +154,10 @@ func TestAccDataSourceCertificate_TerraformIO(t *testing.T) {
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.signature_algorithm", "SHA256-RSA"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.public_key_algorithm", "RSA"),
 					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.is_ca", "false"),
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.max_path_length", "0"),
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.sha1_fingerprint", "a053375bfe84e8b748782c7cee15827a6af5a405"),
 
+					r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.max_path_length", "-1"),
 					// NOTE: Not checking the fingerprint, as this certificate is auto-updated frequently:
 					//   all the other data are stable, but the signature changes every time.
 				),
@@ -534,6 +542,7 @@ func localTestCertificateChainCheckFunc() r.TestCheckFunc {
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.public_key_algorithm", "RSA"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.serial_number", "60512478256160404377639062250777657301"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.is_ca", "true"),
+		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.max_path_length", "-1"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.version", "3"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.issuer", "CN=Root CA,O=Test Org,L=Here"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.0.subject", "CN=Root CA,O=Test Org,L=Here"),
@@ -547,6 +556,7 @@ func localTestCertificateChainCheckFunc() r.TestCheckFunc {
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.public_key_algorithm", "RSA"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.serial_number", "266244246501122064554217434340898012243"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.is_ca", "false"),
+		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.max_path_length", "-1"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.version", "3"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.issuer", "CN=Root CA,O=Test Org,L=Here"),
 		r.TestCheckResourceAttr("data.tls_certificate.test", "certificates.1.subject", "CN=Child Cert,O=Child Co.,L=Everywhere"),
diff --git a/internal/provider/models.go b/internal/provider/models.go
index 474f888d..159a6bef 100644
--- a/internal/provider/models.go
+++ b/internal/provider/models.go
@@ -31,6 +31,7 @@ type CertificateModel struct {
 	PublicKeyAlgorithm types.String `tfsdk:"public_key_algorithm"`
 	SerialNumber       types.String `tfsdk:"serial_number"`
 	IsCA               types.Bool   `tfsdk:"is_ca"`
+	MaxPathLen         types.Int64  `tfsdk:"max_path_length"`
 	Version            types.Int64  `tfsdk:"version"`
 	Issuer             types.String `tfsdk:"issuer"`
 	Subject            types.String `tfsdk:"subject"`
@@ -87,6 +88,7 @@ type selfSignedCertResourceModel struct {
 	AllowedUses         types.List   `tfsdk:"allowed_uses"`
 	EarlyRenewalHours   types.Int64  `tfsdk:"early_renewal_hours"`
 	IsCACertificate     types.Bool   `tfsdk:"is_ca_certificate"`
+	MaxPathLen          types.Int64  `tfsdk:"max_path_length"`
 	SetSubjectKeyID     types.Bool   `tfsdk:"set_subject_key_id"`
 	SetAuthorityKeyID   types.Bool   `tfsdk:"set_authority_key_id"`
 	CertPEM             types.String `tfsdk:"cert_pem"`
@@ -105,6 +107,7 @@ type locallySignedCertResourceModel struct {
 	AllowedUses         types.List   `tfsdk:"allowed_uses"`
 	EarlyRenewalHours   types.Int64  `tfsdk:"early_renewal_hours"`
 	IsCACertificate     types.Bool   `tfsdk:"is_ca_certificate"`
+	MaxPathLen          types.Int64  `tfsdk:"max_path_length"`
 	SetSubjectKeyID     types.Bool   `tfsdk:"set_subject_key_id"`
 	CertPEM             types.String `tfsdk:"cert_pem"`
 	ReadyForRenewal     types.Bool   `tfsdk:"ready_for_renewal"`
diff --git a/internal/provider/resource_locally_signed_cert.go b/internal/provider/resource_locally_signed_cert.go
index d6510050..164e2c9b 100644
--- a/internal/provider/resource_locally_signed_cert.go
+++ b/internal/provider/resource_locally_signed_cert.go
@@ -112,6 +112,18 @@ func (r *locallySignedCertResource) Schema(_ context.Context, req resource.Schem
 				},
 				Description: "Is the generated certificate representing a Certificate Authority (CA) (default: `false`).",
 			},
+			"max_path_length": schema.Int64Attribute{
+				Optional: true,
+				Computed: true,
+				PlanModifiers: []planmodifier.Int64{
+					attribute_plan_modifier_int64.DefaultValue(types.Int64Value(-1)),
+				},
+				Validators: []validator.Int64{
+					int64validator.AtLeast(-1),
+				},
+				Description: "Maximum number of intermediate certificates that may follow this certificate in a " +
+					"valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)",
+			},
 			"early_renewal_hours": schema.Int64Attribute{
 				Optional: true,
 				Computed: true,
diff --git a/internal/provider/resource_locally_signed_cert_test.go b/internal/provider/resource_locally_signed_cert_test.go
index e7a85b5f..e3d8f68c 100644
--- a/internal/provider/resource_locally_signed_cert_test.go
+++ b/internal/provider/resource_locally_signed_cert_test.go
@@ -753,3 +753,107 @@ func TestResourceLocallySignedCert_InvalidConfigs(t *testing.T) {
 		},
 	})
 }
+
+func TestResourceLocallySignedCert_WithoutMaxPathLen(t *testing.T) {
+	r.UnitTest(t, r.TestCase{
+		ProtoV5ProviderFactories: protoV5ProviderFactories(),
+		Steps: []r.TestStep{
+			{
+				Config: `
+					resource "tls_private_key" "ca_prv_test" {
+						algorithm = "ED25519"
+					}
+					resource "tls_self_signed_cert" "ca_cert_test" {
+						private_key_pem = tls_private_key.ca_prv_test.private_key_pem
+						subject {
+							organization = "test-organization"
+						}
+						is_ca_certificate     = true
+						validity_period_hours = 8760
+						allowed_uses = [
+							"cert_signing",
+						]
+					}
+					resource "tls_private_key" "test" {
+						algorithm = "ED25519"
+					}
+					resource "tls_cert_request" "test" {
+						private_key_pem = tls_private_key.test.private_key_pem
+						subject {
+							common_name  = "test.com"
+						}
+					}
+					resource "tls_locally_signed_cert" "test" {
+						is_ca_certificate     = true
+						validity_period_hours = 1
+						early_renewal_hours = 0
+						allowed_uses = [
+							"server_auth",
+							"client_auth",
+						]
+						cert_request_pem = tls_cert_request.test.cert_request_pem
+						ca_cert_pem = tls_self_signed_cert.ca_cert_test.cert_pem
+						ca_private_key_pem = tls_private_key.ca_prv_test.private_key_pem
+					}
+				`,
+				Check: r.ComposeAggregateTestCheckFunc(
+					r.TestCheckResourceAttr("tls_locally_signed_cert.test", "max_path_length", "-1"),
+					tu.TestCheckPEMFormat("tls_locally_signed_cert.test", "cert_pem", PreambleCertificate.String()),
+				),
+			},
+		},
+	})
+}
+
+func TestResourceLocallySignedCert_WithMaxPathLen(t *testing.T) {
+	r.UnitTest(t, r.TestCase{
+		ProtoV5ProviderFactories: protoV5ProviderFactories(),
+		Steps: []r.TestStep{
+			{
+				Config: `
+					resource "tls_private_key" "ca_prv_test" {
+						algorithm = "ED25519"
+					}
+					resource "tls_self_signed_cert" "ca_cert_test" {
+						private_key_pem = tls_private_key.ca_prv_test.private_key_pem
+						subject {
+							organization = "test-organization"
+						}
+						is_ca_certificate     = true
+						max_path_length       = 2
+						validity_period_hours = 8760
+						allowed_uses = [
+							"cert_signing",
+						]
+					}
+					resource "tls_private_key" "test" {
+						algorithm = "ED25519"
+					}
+					resource "tls_cert_request" "test" {
+						private_key_pem = tls_private_key.test.private_key_pem
+						subject {
+							common_name  = "test.com"
+						}
+					}
+					resource "tls_locally_signed_cert" "test" {
+						is_ca_certificate     = true
+						max_path_length       = 1
+						validity_period_hours = 1
+						early_renewal_hours = 0
+						allowed_uses = [
+							"server_auth",
+							"client_auth",
+						]
+						cert_request_pem = tls_cert_request.test.cert_request_pem
+						ca_cert_pem = tls_self_signed_cert.ca_cert_test.cert_pem
+						ca_private_key_pem = tls_private_key.ca_prv_test.private_key_pem
+					}
+				`,
+				Check: r.ComposeAggregateTestCheckFunc(
+					r.TestCheckResourceAttr("tls_locally_signed_cert.test", "max_path_length", "1"),
+					tu.TestCheckPEMFormat("tls_locally_signed_cert.test", "cert_pem", PreambleCertificate.String()),
+				),
+			},
+		},
+	})
+}
diff --git a/internal/provider/resource_self_signed_cert.go b/internal/provider/resource_self_signed_cert.go
index 150c736f..010d1ae9 100644
--- a/internal/provider/resource_self_signed_cert.go
+++ b/internal/provider/resource_self_signed_cert.go
@@ -148,6 +148,18 @@ func (r *selfSignedCertResource) Schema(_ context.Context, req resource.SchemaRe
 				},
 				Description: "Is the generated certificate representing a Certificate Authority (CA) (default: `false`).",
 			},
+			"max_path_length": schema.Int64Attribute{
+				Optional: true,
+				Computed: true,
+				PlanModifiers: []planmodifier.Int64{
+					attribute_plan_modifier_int64.DefaultValue(types.Int64Value(-1)),
+				},
+				Validators: []validator.Int64{
+					int64validator.AtLeast(-1),
+				},
+				Description: "Maximum number of intermediate certificates that may follow this certificate in a " +
+					"valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)",
+			},
 			"set_subject_key_id": schema.BoolAttribute{
 				Optional: true,
 				Computed: true,
diff --git a/internal/provider/resource_self_signed_cert_test.go b/internal/provider/resource_self_signed_cert_test.go
index de0b3b82..ece7e467 100644
--- a/internal/provider/resource_self_signed_cert_test.go
+++ b/internal/provider/resource_self_signed_cert_test.go
@@ -856,3 +856,66 @@ func TestResourceSelfSignedCert_NoSubject(t *testing.T) {
 		},
 	})
 }
+
+func TestResourceSelfSignedCert_WithoutMaxPathLen(t *testing.T) {
+	r.UnitTest(t, r.TestCase{
+		ProtoV5ProviderFactories: protoV5ProviderFactories(),
+		Steps: []r.TestStep{
+			{
+				Config: `
+					resource "tls_private_key" "test" {
+						algorithm = "ED25519"
+					}
+					resource "tls_self_signed_cert" "test" {
+						private_key_pem = tls_private_key.test.private_key_pem
+						subject {
+							organization = "test-organization"
+						}
+						is_ca_certificate     = true
+						validity_period_hours = 8760
+						allowed_uses = [
+							"cert_signing",
+							"crl_signing",
+						]
+					}
+				`,
+				Check: r.ComposeAggregateTestCheckFunc(
+					r.TestCheckResourceAttr("tls_self_signed_cert.test", "max_path_length", "-1"),
+					tu.TestCheckPEMFormat("tls_self_signed_cert.test", "cert_pem", PreambleCertificate.String()),
+				),
+			},
+		},
+	})
+}
+
+func TestResourceSelfSignedCert_WithMaxPathLen(t *testing.T) {
+	r.UnitTest(t, r.TestCase{
+		ProtoV5ProviderFactories: protoV5ProviderFactories(),
+		Steps: []r.TestStep{
+			{
+				Config: `
+					resource "tls_private_key" "test" {
+						algorithm = "ED25519"
+					}
+					resource "tls_self_signed_cert" "test" {
+						private_key_pem = tls_private_key.test.private_key_pem
+						subject {
+							organization = "test-organization"
+						}
+						is_ca_certificate     = true
+						max_path_length       = 2
+						validity_period_hours = 8760
+						allowed_uses = [
+							"cert_signing",
+							"crl_signing",
+						]
+					}
+				`,
+				Check: r.ComposeAggregateTestCheckFunc(
+					r.TestCheckResourceAttr("tls_self_signed_cert.test", "max_path_length", "2"),
+					tu.TestCheckPEMFormat("tls_self_signed_cert.test", "cert_pem", PreambleCertificate.String()),
+				),
+			},
+		},
+	})
+}
diff --git a/templates/data-sources/certificate.md.tmpl b/templates/data-sources/certificate.md.tmpl
index 9f53af7c..94a5eb8d 100644
--- a/templates/data-sources/certificate.md.tmpl
+++ b/templates/data-sources/certificate.md.tmpl
@@ -17,7 +17,7 @@ description: |-
 ### Content Usage
 {{ tffile "examples/data-sources/tls_certificate/content-example.tf" }}
 
-<!-- 
+<!--
     Schema ORIGINALLY generated by tfplugindocs,
     then manually tweaked to circumvent current limitations.
 
@@ -42,6 +42,7 @@ description: |-
 Read-Only:
 
 - `is_ca` (Boolean) `true` if the certificate is of a CA (Certificate Authority).
+- `max_path_length` (Number) The maximum number of intermediate certificates that can follow this certificate in a valid certification path. If `is_ca` is `false`, this value is `-1`.
 - `issuer` (String) Who verified and signed the certificate, roughly following [RFC2253](https://tools.ietf.org/html/rfc2253).
 - `not_after` (String) The time until which the certificate is invalid, as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
 - `not_before` (String) The time after which the certificate is valid, as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.

From fd386741b04d4b99fa89b1bf1bbbc0dfdff33d20 Mon Sep 17 00:00:00 2001
From: Taliesin Sisson <taliesin.sisson@iongroup.com>
Date: Thu, 19 Jan 2023 12:29:29 +0000
Subject: [PATCH 2/7] Add meta data for authority key so that we can set it

---
 internal/provider/resource_locally_signed_cert.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/internal/provider/resource_locally_signed_cert.go b/internal/provider/resource_locally_signed_cert.go
index 164e2c9b..60b77be5 100644
--- a/internal/provider/resource_locally_signed_cert.go
+++ b/internal/provider/resource_locally_signed_cert.go
@@ -149,6 +149,18 @@ func (r *locallySignedCertResource) Schema(_ context.Context, req resource.Schem
 				Description: "Should the generated certificate include a " +
 					"[subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).",
 			},
+			"set_authority_key_id": schema.BoolAttribute{
+				Optional: true,
+				Computed: true,
+				PlanModifiers: []planmodifier.Bool{
+					attribute_plan_modifier_bool.DefaultValue(types.BoolValue(false)),
+					boolplanmodifier.RequiresReplace(),
+				},
+				Description: "Should the generated certificate include an " +
+					"[authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): " +
+					"for self-signed certificates this is the same value as the " +
+					"[subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).",
+			},
 
 			// Computed attributes
 			"cert_pem": schema.StringAttribute{

From 19794a44b78c9bee380fd7cf96dc5747c26e7fe7 Mon Sep 17 00:00:00 2001
From: Taliesin Sisson <taliesin.sisson@iongroup.com>
Date: Thu, 19 Jan 2023 13:23:37 +0000
Subject: [PATCH 3/7] Add named constraints for dns domains

---
 internal/provider/common_cert.go              | 36 +++++++++++++++++++
 .../provider/resource_locally_signed_cert.go  | 19 ++++++++++
 .../provider/resource_self_signed_cert.go     | 19 ++++++++++
 3 files changed, 74 insertions(+)

diff --git a/internal/provider/common_cert.go b/internal/provider/common_cert.go
index 61a7baf3..a5e20c62 100644
--- a/internal/provider/common_cert.go
+++ b/internal/provider/common_cert.go
@@ -189,6 +189,42 @@ func createCertificate(ctx context.Context, template, parent *x509.Certificate,
 		template.MaxPathLen = int(maxPathLen.ValueInt64())
 	}
 
+	// Set name constraints in the template
+	permittedDNSDomainsCriticalPath := path.Root("name_constraint_permitted_dns_names_critical")
+	var permittedDNSDomainsCritical types.Bool
+	diags.Append(plan.GetAttribute(ctx, permittedDNSDomainsCriticalPath, &permittedDNSDomainsCritical)...)
+	if diags.HasError() {
+		return nil, diags
+	}
+	if !permittedDNSDomainsCritical.IsNull() && !permittedDNSDomainsCritical.IsUnknown() && permittedDNSDomainsCritical.ValueBool() {
+		template.PermittedDNSDomainsCritical = permittedDNSDomainsCritical.ValueBool()
+	}
+
+	permittedDNSDomainsPath := path.Root("name_constraint_permitted_dns_names")
+	var permittedDNSDomains types.List
+	diags.Append(plan.GetAttribute(ctx, permittedDNSDomainsPath, &permittedDNSDomains)...)
+	if diags.HasError() {
+		return nil, diags
+	}
+	if !permittedDNSDomains.IsNull() && !permittedDNSDomains.IsUnknown() && len(permittedDNSDomains.Elements()) > 0 {
+		template.PermittedDNSDomains = []string{}
+
+		for _, permittedDNSDomain := range permittedDNSDomains.Elements() {
+			template.PermittedDNSDomains = append(template.PermittedDNSDomains, permittedDNSDomain.(types.String).ValueString())
+		}
+	}
+
+	/*
+		// TODO: add the other constraints to include
+		template.ExcludedDNSDomains          []string
+		template.PermittedIPRanges           []*net.IPNet
+		template.ExcludedIPRanges            []*net.IPNet
+		template.PermittedEmailAddresses     []string
+		template.ExcludedEmailAddresses      []string
+		template.PermittedURIDomains         []string
+		template.ExcludedURIDomains          []string
+	*/
+
 	// Set subject-id on the template
 	setSubjectKeyIDPath := path.Root("set_subject_key_id")
 	var setSubjectKeyID types.Bool
diff --git a/internal/provider/resource_locally_signed_cert.go b/internal/provider/resource_locally_signed_cert.go
index 60b77be5..d211e3cb 100644
--- a/internal/provider/resource_locally_signed_cert.go
+++ b/internal/provider/resource_locally_signed_cert.go
@@ -102,6 +102,25 @@ func (r *locallySignedCertResource) Schema(_ context.Context, req resource.Schem
 					fmt.Sprintf("Accepted values: `%s`.", strings.Join(supportedKeyUsagesStr(), "`, `")),
 			},
 
+			// Name constraints
+			"name_constraint_permitted_dns_names_critical": schema.BoolAttribute{
+				Optional: true,
+				Computed: true,
+				PlanModifiers: []planmodifier.Bool{
+					attribute_plan_modifier_bool.DefaultValue(types.BoolValue(false)),
+					boolplanmodifier.RequiresReplace(),
+				},
+				Description: "Should name constraints permitted dns domains attribute be marked critical.",
+			},
+			"name_constraint_permitted_dns_names": schema.ListAttribute{
+				ElementType: types.StringType,
+				Optional:    true,
+				PlanModifiers: []planmodifier.List{
+					listplanmodifier.RequiresReplace(),
+				},
+				Description: "List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).",
+			},
+
 			// Optional attributes
 			"is_ca_certificate": schema.BoolAttribute{
 				Optional: true,
diff --git a/internal/provider/resource_self_signed_cert.go b/internal/provider/resource_self_signed_cert.go
index 010d1ae9..ca30962a 100644
--- a/internal/provider/resource_self_signed_cert.go
+++ b/internal/provider/resource_self_signed_cert.go
@@ -89,6 +89,25 @@ func (r *selfSignedCertResource) Schema(_ context.Context, req resource.SchemaRe
 					fmt.Sprintf("Accepted values: `%s`.", strings.Join(supportedKeyUsagesStr(), "`, `")),
 			},
 
+			// Name constraints
+			"name_constraint_permitted_dns_names_critical": schema.BoolAttribute{
+				Optional: true,
+				Computed: true,
+				PlanModifiers: []planmodifier.Bool{
+					attribute_plan_modifier_bool.DefaultValue(types.BoolValue(false)),
+					boolplanmodifier.RequiresReplace(),
+				},
+				Description: "Should name constraints permitted dns domains attribute be marked critical.",
+			},
+			"name_constraint_permitted_dns_names": schema.ListAttribute{
+				ElementType: types.StringType,
+				Optional:    true,
+				PlanModifiers: []planmodifier.List{
+					listplanmodifier.RequiresReplace(),
+				},
+				Description: "List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).",
+			},
+
 			// Optional attributes
 			"dns_names": schema.ListAttribute{
 				ElementType: types.StringType,

From 42959e284a0d74cbbd9d11eccc3d68e195bec0f6 Mon Sep 17 00:00:00 2001
From: Taliesin Sisson <taliesin.sisson@iongroup.com>
Date: Thu, 19 Jan 2023 13:28:04 +0000
Subject: [PATCH 4/7] Generate documentation

---
 docs/resources/locally_signed_cert.md | 3 +++
 docs/resources/self_signed_cert.md    | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/docs/resources/locally_signed_cert.md b/docs/resources/locally_signed_cert.md
index 591d1982..2852593f 100644
--- a/docs/resources/locally_signed_cert.md
+++ b/docs/resources/locally_signed_cert.md
@@ -47,6 +47,9 @@ resource "tls_locally_signed_cert" "example" {
 - `early_renewal_hours` (Number) The resource will consider the certificate to have expired the given number of hours before its actual expiry time. This can be useful to deploy an updated certificate in advance of the expiration of the current certificate. However, the old certificate remains valid until its true expiration time, since this resource does not (and cannot) support certificate revocation. Also, this advance update can only be performed should the Terraform configuration be applied during the early renewal period. (default: `0`)
 - `is_ca_certificate` (Boolean) Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
 - `max_path_length` (Number) Maximum number of intermediate certificates that may follow this certificate in a valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)
+- `name_constraint_permitted_dns_names` (List of String) List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).
+- `name_constraint_permitted_dns_names_critical` (Boolean) Should name constraints permitted dns domains attribute be marked critical.
+- `set_authority_key_id` (Boolean) Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 - `set_subject_key_id` (Boolean) Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 
 ### Read-Only
diff --git a/docs/resources/self_signed_cert.md b/docs/resources/self_signed_cert.md
index 85c4c807..d8e30b4a 100644
--- a/docs/resources/self_signed_cert.md
+++ b/docs/resources/self_signed_cert.md
@@ -52,6 +52,8 @@ resource "tls_self_signed_cert" "example" {
 - `ip_addresses` (List of String) List of IP addresses for which a certificate is being requested (i.e. certificate subjects).
 - `is_ca_certificate` (Boolean) Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
 - `max_path_length` (Number) Maximum number of intermediate certificates that may follow this certificate in a valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)
+- `name_constraint_permitted_dns_names` (List of String) List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).
+- `name_constraint_permitted_dns_names_critical` (Boolean) Should name constraints permitted dns domains attribute be marked critical.
 - `set_authority_key_id` (Boolean) Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 - `set_subject_key_id` (Boolean) Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 - `subject` (Block List) The subject for which a certificate is being requested. The acceptable arguments are all optional and their naming is based upon [Issuer Distinguished Names (RFC5280)](https://tools.ietf.org/html/rfc5280#section-4.1.2.4) section. (see [below for nested schema](#nestedblock--subject))

From 032e7f0484ff31483c0110a2f32dafb842e32a22 Mon Sep 17 00:00:00 2001
From: Taliesin Sisson <taliesin.sisson@iongroup.com>
Date: Thu, 19 Jan 2023 14:59:41 +0000
Subject: [PATCH 5/7] Add properties to model

---
 internal/provider/models.go | 71 ++++++++++++++++++++-----------------
 1 file changed, 38 insertions(+), 33 deletions(-)

diff --git a/internal/provider/models.go b/internal/provider/models.go
index 159a6bef..2d357c4e 100644
--- a/internal/provider/models.go
+++ b/internal/provider/models.go
@@ -79,40 +79,45 @@ type privateKeyResourceModel struct {
 }
 
 type selfSignedCertResourceModel struct {
-	PrivateKeyPEM       types.String `tfsdk:"private_key_pem"`
-	DNSNames            types.List   `tfsdk:"dns_names"`
-	IPAddresses         types.List   `tfsdk:"ip_addresses"`
-	URIs                types.List   `tfsdk:"uris"`
-	Subject             types.List   `tfsdk:"subject"` //< certificateSubjectModel
-	ValidityPeriodHours types.Int64  `tfsdk:"validity_period_hours"`
-	AllowedUses         types.List   `tfsdk:"allowed_uses"`
-	EarlyRenewalHours   types.Int64  `tfsdk:"early_renewal_hours"`
-	IsCACertificate     types.Bool   `tfsdk:"is_ca_certificate"`
-	MaxPathLen          types.Int64  `tfsdk:"max_path_length"`
-	SetSubjectKeyID     types.Bool   `tfsdk:"set_subject_key_id"`
-	SetAuthorityKeyID   types.Bool   `tfsdk:"set_authority_key_id"`
-	CertPEM             types.String `tfsdk:"cert_pem"`
-	ReadyForRenewal     types.Bool   `tfsdk:"ready_for_renewal"`
-	ValidityStartTime   types.String `tfsdk:"validity_start_time"`
-	ValidityEndTime     types.String `tfsdk:"validity_end_time"`
-	KeyAlgorithm        types.String `tfsdk:"key_algorithm"`
-	ID                  types.String `tfsdk:"id"`
+	PrivateKeyPEM                               types.String `tfsdk:"private_key_pem"`
+	DNSNames                                    types.List   `tfsdk:"dns_names"`
+	IPAddresses                                 types.List   `tfsdk:"ip_addresses"`
+	URIs                                        types.List   `tfsdk:"uris"`
+	Subject                                     types.List   `tfsdk:"subject"` //< certificateSubjectModel
+	ValidityPeriodHours                         types.Int64  `tfsdk:"validity_period_hours"`
+	AllowedUses                                 types.List   `tfsdk:"allowed_uses"`
+	EarlyRenewalHours                           types.Int64  `tfsdk:"early_renewal_hours"`
+	IsCACertificate                             types.Bool   `tfsdk:"is_ca_certificate"`
+	NamedKeyConstraintPermittedDnsNamesCritical types.Bool   `tfsdk:"name_constraint_permitted_dns_names_critical"`
+	NamedKeyConstraintPermittedDnsNames         types.List   `tfsdk:"name_constraint_permitted_dns_names"`
+	MaxPathLen                                  types.Int64  `tfsdk:"max_path_length"`
+	SetSubjectKeyID                             types.Bool   `tfsdk:"set_subject_key_id"`
+	SetAuthorityKeyID                           types.Bool   `tfsdk:"set_authority_key_id"`
+	CertPEM                                     types.String `tfsdk:"cert_pem"`
+	ReadyForRenewal                             types.Bool   `tfsdk:"ready_for_renewal"`
+	ValidityStartTime                           types.String `tfsdk:"validity_start_time"`
+	ValidityEndTime                             types.String `tfsdk:"validity_end_time"`
+	KeyAlgorithm                                types.String `tfsdk:"key_algorithm"`
+	ID                                          types.String `tfsdk:"id"`
 }
 
 type locallySignedCertResourceModel struct {
-	CACertPEM           types.String `tfsdk:"ca_cert_pem"`
-	CAPrivateKeyPEM     types.String `tfsdk:"ca_private_key_pem"`
-	CertRequestPEM      types.String `tfsdk:"cert_request_pem"`
-	ValidityPeriodHours types.Int64  `tfsdk:"validity_period_hours"`
-	AllowedUses         types.List   `tfsdk:"allowed_uses"`
-	EarlyRenewalHours   types.Int64  `tfsdk:"early_renewal_hours"`
-	IsCACertificate     types.Bool   `tfsdk:"is_ca_certificate"`
-	MaxPathLen          types.Int64  `tfsdk:"max_path_length"`
-	SetSubjectKeyID     types.Bool   `tfsdk:"set_subject_key_id"`
-	CertPEM             types.String `tfsdk:"cert_pem"`
-	ReadyForRenewal     types.Bool   `tfsdk:"ready_for_renewal"`
-	ValidityStartTime   types.String `tfsdk:"validity_start_time"`
-	ValidityEndTime     types.String `tfsdk:"validity_end_time"`
-	CAKeyAlgorithm      types.String `tfsdk:"ca_key_algorithm"`
-	ID                  types.String `tfsdk:"id"`
+	CACertPEM                                   types.String `tfsdk:"ca_cert_pem"`
+	CAPrivateKeyPEM                             types.String `tfsdk:"ca_private_key_pem"`
+	CertRequestPEM                              types.String `tfsdk:"cert_request_pem"`
+	ValidityPeriodHours                         types.Int64  `tfsdk:"validity_period_hours"`
+	AllowedUses                                 types.List   `tfsdk:"allowed_uses"`
+	EarlyRenewalHours                           types.Int64  `tfsdk:"early_renewal_hours"`
+	IsCACertificate                             types.Bool   `tfsdk:"is_ca_certificate"`
+	NamedKeyConstraintPermittedDnsNamesCritical types.Bool   `tfsdk:"name_constraint_permitted_dns_names_critical"`
+	NamedKeyConstraintPermittedDnsNames         types.List   `tfsdk:"name_constraint_permitted_dns_names"`
+	MaxPathLen                                  types.Int64  `tfsdk:"max_path_length"`
+	SetSubjectKeyID                             types.Bool   `tfsdk:"set_subject_key_id"`
+	SetAuthorityKeyID                           types.Bool   `tfsdk:"set_authority_key_id"`
+	CertPEM                                     types.String `tfsdk:"cert_pem"`
+	ReadyForRenewal                             types.Bool   `tfsdk:"ready_for_renewal"`
+	ValidityStartTime                           types.String `tfsdk:"validity_start_time"`
+	ValidityEndTime                             types.String `tfsdk:"validity_end_time"`
+	CAKeyAlgorithm                              types.String `tfsdk:"ca_key_algorithm"`
+	ID                                          types.String `tfsdk:"id"`
 }

From b01d431135a3092c6e9cf12c5bbbd436b50878e7 Mon Sep 17 00:00:00 2001
From: Taliesin Sisson <taliesin.sisson@iongroup.com>
Date: Thu, 19 Jan 2023 20:41:56 +0000
Subject: [PATCH 6/7] Add excluded dns names

---
 .golangci.yml                                 |  3 +-
 docs/resources/locally_signed_cert.md         |  3 +-
 docs/resources/self_signed_cert.md            |  1 +
 internal/provider/common_cert.go              | 35 +++++++++++++------
 internal/provider/models.go                   |  2 ++
 internal/provider/resource_cert_request.go    |  4 +--
 .../provider/resource_locally_signed_cert.go  | 10 +++++-
 .../provider/resource_self_signed_cert.go     | 12 +++++--
 internal/provider/testutils/local_server.go   |  4 +++
 9 files changed, 56 insertions(+), 18 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 3f0edd16..5168343a 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -23,7 +23,8 @@ linters:
     - unconvert
     - unparam
     - unused
-
+    - forcetypeassert
 run:
   # Prevent false positive timeouts in CI
   timeout: 5m
+  allow-parallel-runners: true
diff --git a/docs/resources/locally_signed_cert.md b/docs/resources/locally_signed_cert.md
index 2852593f..ea428c93 100644
--- a/docs/resources/locally_signed_cert.md
+++ b/docs/resources/locally_signed_cert.md
@@ -47,7 +47,8 @@ resource "tls_locally_signed_cert" "example" {
 - `early_renewal_hours` (Number) The resource will consider the certificate to have expired the given number of hours before its actual expiry time. This can be useful to deploy an updated certificate in advance of the expiration of the current certificate. However, the old certificate remains valid until its true expiration time, since this resource does not (and cannot) support certificate revocation. Also, this advance update can only be performed should the Terraform configuration be applied during the early renewal period. (default: `0`)
 - `is_ca_certificate` (Boolean) Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
 - `max_path_length` (Number) Maximum number of intermediate certificates that may follow this certificate in a valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)
-- `name_constraint_permitted_dns_names` (List of String) List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).
+- `name_constraint_excluded_dns_names` (List of String) List of excluded DNS names for which a certificate name constraints is being requested (i.e. excluded DNS domains).
+- `name_constraint_permitted_dns_names` (List of String) List of permitted DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).
 - `name_constraint_permitted_dns_names_critical` (Boolean) Should name constraints permitted dns domains attribute be marked critical.
 - `set_authority_key_id` (Boolean) Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
 - `set_subject_key_id` (Boolean) Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
diff --git a/docs/resources/self_signed_cert.md b/docs/resources/self_signed_cert.md
index d8e30b4a..a564bead 100644
--- a/docs/resources/self_signed_cert.md
+++ b/docs/resources/self_signed_cert.md
@@ -52,6 +52,7 @@ resource "tls_self_signed_cert" "example" {
 - `ip_addresses` (List of String) List of IP addresses for which a certificate is being requested (i.e. certificate subjects).
 - `is_ca_certificate` (Boolean) Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
 - `max_path_length` (Number) Maximum number of intermediate certificates that may follow this certificate in a valid certification path. If `is_ca_certificate` is `false`, this value is ignored. (default: `-1`)
+- `name_constraint_excluded_dns_names` (List of String) List of excluded DNS names for which a certificate name constraints is being requested (i.e. excluded DNS domains).
 - `name_constraint_permitted_dns_names` (List of String) List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).
 - `name_constraint_permitted_dns_names_critical` (Boolean) Should name constraints permitted dns domains attribute be marked critical.
 - `set_authority_key_id` (Boolean) Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
diff --git a/internal/provider/common_cert.go b/internal/provider/common_cert.go
index a5e20c62..5734a24f 100644
--- a/internal/provider/common_cert.go
+++ b/internal/provider/common_cert.go
@@ -210,20 +210,33 @@ func createCertificate(ctx context.Context, template, parent *x509.Certificate,
 		template.PermittedDNSDomains = []string{}
 
 		for _, permittedDNSDomain := range permittedDNSDomains.Elements() {
-			template.PermittedDNSDomains = append(template.PermittedDNSDomains, permittedDNSDomain.(types.String).ValueString())
+			permittedDNSDomainString, ok := permittedDNSDomain.(types.String)
+			if !ok {
+				diags.AddError("Failed to convert permittedDNSDomain to string", "expected permittedDNSDomain to be of type types.String")
+				return nil, diags
+			}
+			template.PermittedDNSDomains = append(template.PermittedDNSDomains, permittedDNSDomainString.ValueString())
 		}
 	}
 
-	/*
-		// TODO: add the other constraints to include
-		template.ExcludedDNSDomains          []string
-		template.PermittedIPRanges           []*net.IPNet
-		template.ExcludedIPRanges            []*net.IPNet
-		template.PermittedEmailAddresses     []string
-		template.ExcludedEmailAddresses      []string
-		template.PermittedURIDomains         []string
-		template.ExcludedURIDomains          []string
-	*/
+	excludedDNSDomainsPath := path.Root("name_constraint_excluded_dns_names")
+	var excludedDNSDomains types.List
+	diags.Append(plan.GetAttribute(ctx, excludedDNSDomainsPath, &excludedDNSDomains)...)
+	if diags.HasError() {
+		return nil, diags
+	}
+	if !excludedDNSDomains.IsNull() && !excludedDNSDomains.IsUnknown() && len(excludedDNSDomains.Elements()) > 0 {
+		template.ExcludedDNSDomains = []string{}
+
+		for _, excludedDNSDomain := range excludedDNSDomains.Elements() {
+			excludedDNSDomainString, ok := excludedDNSDomain.(types.String)
+			if !ok {
+				diags.AddError("Failed to convert excludedDNSDomain to string", "expected excludedDNSDomain to be of type types.String")
+				return nil, diags
+			}
+			template.ExcludedDNSDomains = append(template.ExcludedDNSDomains, excludedDNSDomainString.ValueString())
+		}
+	}
 
 	// Set subject-id on the template
 	setSubjectKeyIDPath := path.Root("set_subject_key_id")
diff --git a/internal/provider/models.go b/internal/provider/models.go
index 2d357c4e..797d5ac5 100644
--- a/internal/provider/models.go
+++ b/internal/provider/models.go
@@ -90,6 +90,7 @@ type selfSignedCertResourceModel struct {
 	IsCACertificate                             types.Bool   `tfsdk:"is_ca_certificate"`
 	NamedKeyConstraintPermittedDnsNamesCritical types.Bool   `tfsdk:"name_constraint_permitted_dns_names_critical"`
 	NamedKeyConstraintPermittedDnsNames         types.List   `tfsdk:"name_constraint_permitted_dns_names"`
+	NamedKeyConstraintExcludedDnsNames          types.List   `tfsdk:"name_constraint_excluded_dns_names"`
 	MaxPathLen                                  types.Int64  `tfsdk:"max_path_length"`
 	SetSubjectKeyID                             types.Bool   `tfsdk:"set_subject_key_id"`
 	SetAuthorityKeyID                           types.Bool   `tfsdk:"set_authority_key_id"`
@@ -111,6 +112,7 @@ type locallySignedCertResourceModel struct {
 	IsCACertificate                             types.Bool   `tfsdk:"is_ca_certificate"`
 	NamedKeyConstraintPermittedDnsNamesCritical types.Bool   `tfsdk:"name_constraint_permitted_dns_names_critical"`
 	NamedKeyConstraintPermittedDnsNames         types.List   `tfsdk:"name_constraint_permitted_dns_names"`
+	NamedKeyConstraintExcludedDnsNames          types.List   `tfsdk:"name_constraint_excluded_dns_names"`
 	MaxPathLen                                  types.Int64  `tfsdk:"max_path_length"`
 	SetSubjectKeyID                             types.Bool   `tfsdk:"set_subject_key_id"`
 	SetAuthorityKeyID                           types.Bool   `tfsdk:"set_authority_key_id"`
diff --git a/internal/provider/resource_cert_request.go b/internal/provider/resource_cert_request.go
index 8754665a..ad051c53 100644
--- a/internal/provider/resource_cert_request.go
+++ b/internal/provider/resource_cert_request.go
@@ -276,7 +276,7 @@ func (r *certRequestResource) Create(ctx context.Context, req resource.CreateReq
 		for _, ipStr := range ipAddresses {
 			ip := net.ParseIP(ipStr)
 			if ip == nil {
-				res.Diagnostics.AddError("Invalid IP address", fmt.Sprintf("Failed to parse %#v", ipStr))
+				res.Diagnostics.AddError("Invalid IP address", fmt.Sprintf("Failed to parse %#v", ipString.ValueString()))
 				return
 			}
 			certReq.IPAddresses = append(certReq.IPAddresses, ip)
@@ -298,7 +298,7 @@ func (r *certRequestResource) Create(ctx context.Context, req resource.CreateReq
 		for _, uriStr := range uris {
 			uri, err := url.Parse(uriStr)
 			if err != nil {
-				res.Diagnostics.AddError("Invalid URI", fmt.Sprintf("Failed to parse %#v: %v", uriStr, err.Error()))
+				res.Diagnostics.AddError("Invalid URI", fmt.Sprintf("Failed to parse %#v: %v", uriString.ValueString(), err.Error()))
 				return
 			}
 			certReq.URIs = append(certReq.URIs, uri)
diff --git a/internal/provider/resource_locally_signed_cert.go b/internal/provider/resource_locally_signed_cert.go
index d211e3cb..447ae633 100644
--- a/internal/provider/resource_locally_signed_cert.go
+++ b/internal/provider/resource_locally_signed_cert.go
@@ -118,7 +118,15 @@ func (r *locallySignedCertResource) Schema(_ context.Context, req resource.Schem
 				PlanModifiers: []planmodifier.List{
 					listplanmodifier.RequiresReplace(),
 				},
-				Description: "List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).",
+				Description: "List of permitted DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).",
+			},
+			"name_constraint_excluded_dns_names": schema.ListAttribute{
+				ElementType: types.StringType,
+				Optional:    true,
+				PlanModifiers: []planmodifier.List{
+					listplanmodifier.RequiresReplace(),
+				},
+				Description: "List of excluded DNS names for which a certificate name constraints is being requested (i.e. excluded DNS domains).",
 			},
 
 			// Optional attributes
diff --git a/internal/provider/resource_self_signed_cert.go b/internal/provider/resource_self_signed_cert.go
index ca30962a..5b37a426 100644
--- a/internal/provider/resource_self_signed_cert.go
+++ b/internal/provider/resource_self_signed_cert.go
@@ -107,6 +107,14 @@ func (r *selfSignedCertResource) Schema(_ context.Context, req resource.SchemaRe
 				},
 				Description: "List of DNS names for which a certificate name constraints is being requested (i.e. permitted DNS domains).",
 			},
+			"name_constraint_excluded_dns_names": schema.ListAttribute{
+				ElementType: types.StringType,
+				Optional:    true,
+				PlanModifiers: []planmodifier.List{
+					listplanmodifier.RequiresReplace(),
+				},
+				Description: "List of excluded DNS names for which a certificate name constraints is being requested (i.e. excluded DNS domains).",
+			},
 
 			// Optional attributes
 			"dns_names": schema.ListAttribute{
@@ -412,7 +420,7 @@ func (r *selfSignedCertResource) Create(ctx context.Context, req resource.Create
 			if ip == nil {
 				res.Diagnostics.AddError(
 					"Invalid IP address",
-					fmt.Sprintf("Failed to parse %#v", ipStr),
+					fmt.Sprintf("Failed to parse %#v", ipString.ValueString()),
 				)
 				return
 			}
@@ -437,7 +445,7 @@ func (r *selfSignedCertResource) Create(ctx context.Context, req resource.Create
 			if err != nil {
 				res.Diagnostics.AddError(
 					"Invalid URI",
-					fmt.Sprintf("Failed to parse %#v: %v", uriStr, err.Error()),
+					fmt.Sprintf("Failed to parse %#v: %v", uriString.ValueString(), err.Error()),
 				)
 				return
 			}
diff --git a/internal/provider/testutils/local_server.go b/internal/provider/testutils/local_server.go
index ec660f2d..928eaba1 100644
--- a/internal/provider/testutils/local_server.go
+++ b/internal/provider/testutils/local_server.go
@@ -70,6 +70,10 @@ func NewHTTPProxyServerWithBasicAuth(expectedUsername, expectedPassword string)
 	if err != nil {
 		return nil, err
 	}
+	proxyHttpServer, ok := proxy.server.Handler.(*goproxy.ProxyHttpServer)
+	if !ok {
+		return nil, fmt.Errorf("expected proxy.server.Handler to be of type *goproxy.ProxyHttpServer")
+	}
 
 	proxyHttpServer, ok := proxy.server.Handler.(*goproxy.ProxyHttpServer)
 	if !ok {

From 98aff1836390324cd7553eed9d75d499d013687b Mon Sep 17 00:00:00 2001
From: Taliesin Sisson <taliesin.sisson@iongroup.com>
Date: Wed, 10 Apr 2024 15:03:06 +0100
Subject: [PATCH 7/7] go mod tidy fix build failures

---
 .golangci.yml                                 |  1 -
 go.mod                                        |  6 ++--
 go.sum                                        | 35 +++++++++++++++++++
 internal/provider/resource_cert_request.go    |  4 +--
 .../provider/resource_locally_signed_cert.go  |  8 ++---
 .../provider/resource_self_signed_cert.go     | 10 +++---
 internal/provider/testutils/local_server.go   |  4 ---
 7 files changed, 47 insertions(+), 21 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 5168343a..2f5a3c05 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -27,4 +27,3 @@ linters:
 run:
   # Prevent false positive timeouts in CI
   timeout: 5m
-  allow-parallel-runners: true
diff --git a/go.mod b/go.mod
index b3fbbb68..281db9bc 100644
--- a/go.mod
+++ b/go.mod
@@ -3,8 +3,8 @@ module github.com/hashicorp/terraform-provider-tls
 go 1.22.7
 
 require (
-	github.com/elazarl/goproxy v0.0.0-20220529153421-8ea89ba92021
-	github.com/elazarl/goproxy/ext v0.0.0-20220529153421-8ea89ba92021
+	github.com/elazarl/goproxy v0.0.0-20231117061959-7cc037d33fb5
+	github.com/elazarl/goproxy/ext v0.0.0-20231117061959-7cc037d33fb5
 	github.com/google/go-cmp v0.6.0
 	github.com/hashicorp/terraform-plugin-framework v1.11.0
 	github.com/hashicorp/terraform-plugin-framework-validators v0.13.0
@@ -46,7 +46,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
-	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/oklog/run v1.1.0 // indirect
diff --git a/go.sum b/go.sum
index 7d084552..0532fc7e 100644
--- a/go.sum
+++ b/go.sum
@@ -4,8 +4,12 @@ github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migc
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/ProtonMail/go-crypto v1.1.0-alpha.2 h1:bkyFVUP+ROOARdgCiJzNQo2V2kiB97LyUpzH9P6Hrlg=
 github.com/ProtonMail/go-crypto v1.1.0-alpha.2/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.1.0-alpha.2-proton h1:HKz85FwoXx86kVtTvFke7rgHvq/HoloSUvW5semjFWs=
+github.com/ProtonMail/go-crypto v1.1.0-alpha.2-proton/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
 github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
+github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
+github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
@@ -21,9 +25,13 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/elazarl/goproxy v0.0.0-20220529153421-8ea89ba92021 h1:EbF0UihnxWRcIMOwoVtqnAylsqcjzqpSvMdjF2Ud4rA=
 github.com/elazarl/goproxy v0.0.0-20220529153421-8ea89ba92021/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
+github.com/elazarl/goproxy v0.0.0-20231117061959-7cc037d33fb5 h1:m62nsMU279qRD9PQSWD1l66kmkXzuYcnVJqL4XLeV2M=
+github.com/elazarl/goproxy v0.0.0-20231117061959-7cc037d33fb5/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
 github.com/elazarl/goproxy/ext v0.0.0-20190711103511-473e67f1d7d2/go.mod h1:gNh8nYJoAm43RfaxurUnxr+N1PwuFV3ZMl/efxlIlY8=
 github.com/elazarl/goproxy/ext v0.0.0-20220529153421-8ea89ba92021 h1:XO62HGrPPZne8dYsNMZJGCCBOHkhcGUWNxyQdggKE3o=
 github.com/elazarl/goproxy/ext v0.0.0-20220529153421-8ea89ba92021/go.mod h1:gNh8nYJoAm43RfaxurUnxr+N1PwuFV3ZMl/efxlIlY8=
+github.com/elazarl/goproxy/ext v0.0.0-20231117061959-7cc037d33fb5 h1:iGoePcl8bIDJxxRAL2Q4E4Rt35z5m917RJb8lAvdrQw=
+github.com/elazarl/goproxy/ext v0.0.0-20231117061959-7cc037d33fb5/go.mod h1:gNh8nYJoAm43RfaxurUnxr+N1PwuFV3ZMl/efxlIlY8=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
@@ -35,6 +43,7 @@ github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+
 github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
 github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
 github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
+github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
 github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
@@ -44,6 +53,8 @@ github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaS
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
@@ -60,6 +71,8 @@ github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 h1:1/D3zfFHttUK
 github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDmTk8A=
@@ -75,6 +88,8 @@ github.com/hashicorp/hc-install v0.8.0 h1:LdpZeXkZYMQhoKPCecJHlKvUkQFixN/nvyR1Cd
 github.com/hashicorp/hc-install v0.8.0/go.mod h1:+MwJYjDfCruSD/udvBmRB22Nlkwwkwf5sAB6uTIhSaU=
 github.com/hashicorp/hcl/v2 v2.21.0 h1:lve4q/o/2rqwYOgUg3y3V2YPyD1/zkCLGjIV74Jit14=
 github.com/hashicorp/hcl/v2 v2.21.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
+github.com/hashicorp/hcl/v2 v2.20.1 h1:M6hgdyz7HYt1UN9e61j+qKJBqR3orTWbI1HKBJEdxtc=
+github.com/hashicorp/hcl/v2 v2.20.1/go.mod h1:TZDqQ4kNKCbh1iJp99FdPiUaVDDUPivbqxZulxDYqL4=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/terraform-exec v0.21.0 h1:uNkLAe95ey5Uux6KJdua6+cv8asgILFVWkd/RG0D2XQ=
@@ -127,6 +142,8 @@ github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJ
 github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
 github.com/mitchellh/go-wordwrap v1.0.0 h1:6GlHJ/LTGMrIJbwgdqdl2eEH8o+Exx/0m8ir9Gns0u4=
 github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -144,6 +161,7 @@ github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
 github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
@@ -161,24 +179,34 @@ github.com/zclconf/go-cty v1.15.0 h1:tTCRWxsexYUmtt/wVxgDClUe+uQusuI443uL6e+5sXQ
 github.com/zclconf/go-cty v1.15.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
+github.com/zclconf/go-cty v1.14.4 h1:uXXczd9QDGsgu0i/QFR/hzI5NYCHLf6NQw/atrbnhq8=
+github.com/zclconf/go-cty v1.14.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
 golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
 golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
 golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
+golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
+golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
 golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -193,10 +221,13 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
 golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
 golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
+golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -209,6 +240,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.20.0 h1:hz/CVckiOxybQvFw6h7b/q80NTr9IUQb4s1IIzW7KNY=
+golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -218,6 +251,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:H4O17MA/PE9BsGx3w+a+W2VOLLD1Qf7oJneAoU6WktY=
 google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
 google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
+google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.34.0 h1:Qo/qEd2RZPCf2nKuorzksSknv0d3ERwp1vFG38gSmH4=
diff --git a/internal/provider/resource_cert_request.go b/internal/provider/resource_cert_request.go
index ad051c53..8754665a 100644
--- a/internal/provider/resource_cert_request.go
+++ b/internal/provider/resource_cert_request.go
@@ -276,7 +276,7 @@ func (r *certRequestResource) Create(ctx context.Context, req resource.CreateReq
 		for _, ipStr := range ipAddresses {
 			ip := net.ParseIP(ipStr)
 			if ip == nil {
-				res.Diagnostics.AddError("Invalid IP address", fmt.Sprintf("Failed to parse %#v", ipString.ValueString()))
+				res.Diagnostics.AddError("Invalid IP address", fmt.Sprintf("Failed to parse %#v", ipStr))
 				return
 			}
 			certReq.IPAddresses = append(certReq.IPAddresses, ip)
@@ -298,7 +298,7 @@ func (r *certRequestResource) Create(ctx context.Context, req resource.CreateReq
 		for _, uriStr := range uris {
 			uri, err := url.Parse(uriStr)
 			if err != nil {
-				res.Diagnostics.AddError("Invalid URI", fmt.Sprintf("Failed to parse %#v: %v", uriString.ValueString(), err.Error()))
+				res.Diagnostics.AddError("Invalid URI", fmt.Sprintf("Failed to parse %#v: %v", uriStr, err.Error()))
 				return
 			}
 			certReq.URIs = append(certReq.URIs, uri)
diff --git a/internal/provider/resource_locally_signed_cert.go b/internal/provider/resource_locally_signed_cert.go
index 447ae633..fb899ec6 100644
--- a/internal/provider/resource_locally_signed_cert.go
+++ b/internal/provider/resource_locally_signed_cert.go
@@ -106,8 +106,8 @@ func (r *locallySignedCertResource) Schema(_ context.Context, req resource.Schem
 			"name_constraint_permitted_dns_names_critical": schema.BoolAttribute{
 				Optional: true,
 				Computed: true,
+				Default:  booldefault.StaticBool(false),
 				PlanModifiers: []planmodifier.Bool{
-					attribute_plan_modifier_bool.DefaultValue(types.BoolValue(false)),
 					boolplanmodifier.RequiresReplace(),
 				},
 				Description: "Should name constraints permitted dns domains attribute be marked critical.",
@@ -142,9 +142,7 @@ func (r *locallySignedCertResource) Schema(_ context.Context, req resource.Schem
 			"max_path_length": schema.Int64Attribute{
 				Optional: true,
 				Computed: true,
-				PlanModifiers: []planmodifier.Int64{
-					attribute_plan_modifier_int64.DefaultValue(types.Int64Value(-1)),
-				},
+				Default:  int64default.StaticInt64(-1),
 				Validators: []validator.Int64{
 					int64validator.AtLeast(-1),
 				},
@@ -179,8 +177,8 @@ func (r *locallySignedCertResource) Schema(_ context.Context, req resource.Schem
 			"set_authority_key_id": schema.BoolAttribute{
 				Optional: true,
 				Computed: true,
+				Default:  booldefault.StaticBool(false),
 				PlanModifiers: []planmodifier.Bool{
-					attribute_plan_modifier_bool.DefaultValue(types.BoolValue(false)),
 					boolplanmodifier.RequiresReplace(),
 				},
 				Description: "Should the generated certificate include an " +
diff --git a/internal/provider/resource_self_signed_cert.go b/internal/provider/resource_self_signed_cert.go
index 5b37a426..b5872d9c 100644
--- a/internal/provider/resource_self_signed_cert.go
+++ b/internal/provider/resource_self_signed_cert.go
@@ -93,8 +93,8 @@ func (r *selfSignedCertResource) Schema(_ context.Context, req resource.SchemaRe
 			"name_constraint_permitted_dns_names_critical": schema.BoolAttribute{
 				Optional: true,
 				Computed: true,
+				Default:  booldefault.StaticBool(false),
 				PlanModifiers: []planmodifier.Bool{
-					attribute_plan_modifier_bool.DefaultValue(types.BoolValue(false)),
 					boolplanmodifier.RequiresReplace(),
 				},
 				Description: "Should name constraints permitted dns domains attribute be marked critical.",
@@ -178,9 +178,7 @@ func (r *selfSignedCertResource) Schema(_ context.Context, req resource.SchemaRe
 			"max_path_length": schema.Int64Attribute{
 				Optional: true,
 				Computed: true,
-				PlanModifiers: []planmodifier.Int64{
-					attribute_plan_modifier_int64.DefaultValue(types.Int64Value(-1)),
-				},
+				Default:  int64default.StaticInt64(-1),
 				Validators: []validator.Int64{
 					int64validator.AtLeast(-1),
 				},
@@ -420,7 +418,7 @@ func (r *selfSignedCertResource) Create(ctx context.Context, req resource.Create
 			if ip == nil {
 				res.Diagnostics.AddError(
 					"Invalid IP address",
-					fmt.Sprintf("Failed to parse %#v", ipString.ValueString()),
+					fmt.Sprintf("Failed to parse %#v", ipStr),
 				)
 				return
 			}
@@ -445,7 +443,7 @@ func (r *selfSignedCertResource) Create(ctx context.Context, req resource.Create
 			if err != nil {
 				res.Diagnostics.AddError(
 					"Invalid URI",
-					fmt.Sprintf("Failed to parse %#v: %v", uriString.ValueString(), err.Error()),
+					fmt.Sprintf("Failed to parse %#v: %v", uriStr, err.Error()),
 				)
 				return
 			}
diff --git a/internal/provider/testutils/local_server.go b/internal/provider/testutils/local_server.go
index 928eaba1..ec660f2d 100644
--- a/internal/provider/testutils/local_server.go
+++ b/internal/provider/testutils/local_server.go
@@ -70,10 +70,6 @@ func NewHTTPProxyServerWithBasicAuth(expectedUsername, expectedPassword string)
 	if err != nil {
 		return nil, err
 	}
-	proxyHttpServer, ok := proxy.server.Handler.(*goproxy.ProxyHttpServer)
-	if !ok {
-		return nil, fmt.Errorf("expected proxy.server.Handler to be of type *goproxy.ProxyHttpServer")
-	}
 
 	proxyHttpServer, ok := proxy.server.Handler.(*goproxy.ProxyHttpServer)
 	if !ok {