tls_cert_request not recreated when private_key_pem changes

[pascal-hofmann]

Terraform CLI and Provider Versions

Terraform v1.2.5
on darwin_amd64
+ provider registry.terraform.io/hashicorp/tls v4.0.1

Terraform Configuration

resource "tls_private_key" "this" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "tls_cert_request" "client_csr" {
  private_key_pem = tls_private_key.this.private_key_pem

  subject {
    common_name = "this"
  }
}

Expected Behavior

When the private key changes, the CSR should be recreated.

Actual Behavior

The CSR stays unchanged. Only the private_key_pem attribute in terraform state is changed.

Steps to Reproduce

1. terraform apply
2. terraform state pull | jq -r '.resources[] | select(.type == "tls_cert_request") | .instances[0].attributes.cert_request_pem' | openssl req -noout -modulus | openssl md5
3. terraform state pull | jq -r '.resources[] | select(.type == "tls_private_key").instances[0].attributes.private_key_pem' | openssl rsa -noout -modulus | openssl md5

→ Both md5 hashes match at this point.

4. terraform taint tls_private_key.this
5. terraform apply
6. terraform state pull | jq -r '.resources[] | select(.type == "tls_cert_request") | .instances[0].attributes.cert_request_pem' | openssl req -noout -modulus | openssl md5
7. terraform state pull | jq -r '.resources[] | select(.type == "tls_private_key").instances[0].attributes.private_key_pem' | openssl rsa -noout -modulus | openssl md5

→ CSR is unchanged. md5 hashes do not match

How much impact is this issue causing?

High

Code of Conduct

• I agree to follow this project's Code of Conduct

[pascal-hofmann]

I just checked with hashicorp/tls v3.4.0. There a change of private_key_pem forces a replacement.

So this is a bug that was introduced in version 4.

…
  # tls_cert_request.client_csr must be replaced
-/+ resource "tls_cert_request" "client_csr" {
…
      ~ private_key_pem  = (sensitive value) # forces replacement
…

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.