Terraform Provider Signature Certificate Renewal

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 10 mins

TL;DR

• What broke: HashiCorp's GPG signing certificate used to verify provider binaries has expired; terraform init and terraform providers mirror abort with a signature verification error, blocking all provider installs.
• How to fix it: Flush the local plugin cache, import the current HashiCorp GPG public key (Key ID 72D7468F), and ensure your terraform binary is ≥ 1.4.x which ships with the refreshed keyring.
• Fast path: Use our Client-Side Sandbox above to auto-refactor your provider_installation block and .terraformrc without leaking registry tokens or private module paths.

│ Error: Failed to install provider
│
│ Error while installing hashicorp/aws v5.x.x: the current package for
│ registry.terraform.io/hashicorp/aws 5.x.x doesn't match any of the
│ checksums previously recorded in the dependency lock file.
│
│ HashiCorp release signature verification failed:
│ certificate expired: current time 2024-xx-xxTxx:xx:xxZ is after
│ 2024-xx-xxTxx:xx:xxZ

How to Fix It

Step 1 — Purge the stale plugin cache

# Nuke the local provider cache. This forces a clean re-download and re-verification.
rm -rf ~/.terraform.d/plugins
rm -rf .terraform/providers
rm .terraform.lock.hcl

Step 2 — Import the current HashiCorp GPG signing key

# HashiCorp's current release key. Verify the fingerprint out-of-band.
curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --import

# Confirm fingerprint: E8A0 32E0 94D8 EB4E A189 D270 DA41 8C88 A321 9F7B
gpg --fingerprint 72D7468F

Step 3 — Upgrade Terraform CLI

Terraform ≥ 1.4.x ships with the refreshed embedded keyring. If you cannot upgrade immediately, the GPG import above is sufficient for the short term.

# macOS
brew upgrade terraform

# Linux (tfenv)
tfenv install latest
tfenv use latest

# Verify
terraform version

Basic Fix — `.terraformrc` provider_installation block

# ~/.terraformrc

provider_installation {
-  filesystem_mirror {
-    path    = "/opt/terraform/providers"
-    include = ["registry.terraform.io/*/*"]
-  }
-  # WARNING: This was added to unblock CI. REMOVE THIS.
-  direct {
-    exclude = []
-  }
+  filesystem_mirror {
+    path    = "/opt/terraform/providers"
+    include = ["registry.terraform.io/hashicorp/*"]
+  }
+  direct {
+    include = ["registry.terraform.io/hashicorp/*"]
+  }
}

Enterprise Best Practice — Enforce signature verification in Terraform Enterprise / Atlantis

For airgapped TFE or a self-hosted registry mirror (Artifactory, Nexus), you must re-sign mirrored provider zips with your internal CA and register the public key in TFE's GPG key store. Never use skip_signature_verification.

# providers.tf — required_providers block

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
-     version = ">= 4.0"
+     version = "~> 5.50"  # Pin to a tested minor, not a floor. Prevents silent major upgrades.
    }
  }
+
+  # Lock file must be committed to VCS. Never .gitignore .terraform.lock.hcl
}

# For Terraform Enterprise: register the new GPG key via API, not manually.

# BAD: Manual key import on one node only.
- curl --header "Authorization: Bearer $TFE_TOKEN" \
-      --request POST \
-      --data '{"data":{"type":"gpg-keys"}}' \
-      https://tfe.internal/api/registry/private/v2/gpg-keys

# GOOD: Automate key rotation via your secrets pipeline (Vault + Terraform TFE provider)
+ resource "tfe_registry_gpg_key" "hashicorp_current" {
+   organization = var.tfe_org
+   ascii_armor   = file("${path.module}/keys/hashicorp-current.asc")
+ }

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .github/workflows/terraform.yml
- name: Setup Terraform
  uses: hashicorp/setup-terraform@v3
  with:
    terraform_version: "1.8.5"   # Explicit pin. Never use 'latest' in prod pipelines.
    terraform_wrapper: false

# checkov/custom/check_no_skip_sig_verification.py
from checkov.common.models.enums import CheckResult, CheckCategories
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

# Scan .terraformrc files in your repo for the dangerous flag.
# Integrate into pre-commit and CI gate.

# Fail the pipeline if anyone committed the bypass flag.
if grep -r "skip_signature_verification" .; then
  echo "FATAL: skip_signature_verification found in repo. Remove it."
  exit 1
fi

# Add to your weekly platform health cron job.
KEY_EXPIRY=$(gpg --list-keys --with-colons 72D7468F | grep '^pub' | cut -d: -f7)
NOW=$(date +%s)
if [ "$KEY_EXPIRY" -lt "$NOW" ]; then
  echo "ALERT: HashiCorp GPG key expired. Rotate immediately."
  # Page on-call via PagerDuty/Opsgenie webhook here.
fi

# policy/terraform_lock.rego
package terraform.lockfile

deny[msg] {
  # Ensure lock file exists and is not empty — catches teams deleting it to "fix" checksum errors.
  not input.provider
  msg := "DENY: .terraform.lock.hcl is missing or has no provider entries. Do not delete the lock file to bypass checksum errors."
}