Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiexternalca
  6. getSecretBackendOrderChallenge
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiexternalca.getSecretBackendOrderChallenge

vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Retrieves ACME challenge details for a specific identifier in an order. This data source provides the information needed to fulfill ACME challenges (HTTP-01, DNS-01, or TLS-ALPN-01) for domain validation.

    Note This data source will poll the order status until it reaches the awaiting-challenge-fulfillment or completed state. Use this data source after creating an order with vault.pkiexternalca.SecretBackendOrder.

    Example Usage

    With HTTP-01 Challenge

    import * as pulumi from "@pulumi/pulumi";
import * as local from "@pulumi/local";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const example = new vault.pkiexternalca.SecretBackendAcmeAccount("example", {
    mount: pki_external_ca.path,
    name: "my-acme-account",
    directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
    emailContacts: ["admin@example.com"],
});
const exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole("example", {
    mount: pki_external_ca.path,
    name: "example-role",
    acmeAccountName: example.name,
    allowedDomains: ["example.com"],
    allowedDomainOptions: [
        "bare_domains",
        "subdomains",
    ],
    allowedChallengeTypes: ["http-01"],
});
const exampleSecretBackendOrder = new vault.pkiexternalca.SecretBackendOrder("example", {
    mount: pki_external_ca.path,
    roleName: exampleSecretBackendRole.name,
    identifiers: ["www.example.com"],
});
// Retrieve HTTP-01 challenge details
const http = vault.pkiexternalca.getSecretBackendOrderChallengeOutput({
    mount: pki_external_ca.path,
    roleName: exampleSecretBackendRole.name,
    orderId: exampleSecretBackendOrder.orderId,
    challengeType: "http-01",
    identifier: "www.example.com",
});
// Deploy the challenge file
const acmeChallenge = new local.index.File("acme_challenge", {
    filename: `/var/www/html/.well-known/acme-challenge/${http.token}`,
    content: http.keyAuthorization,
});
export const challengeToken = http.apply(http => http.token);
export const challengeUrl = http.apply(http => `http://www.example.com/.well-known/acme-challenge/${http.token}`);

    import pulumi
import pulumi_local as local
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example = vault.pkiexternalca.SecretBackendAcmeAccount("example",
    mount=pki_external_ca.path,
    name="my-acme-account",
    directory_url="https://acme-v02.api.letsencrypt.org/directory",
    email_contacts=["admin@example.com"])
example_secret_backend_role = vault.pkiexternalca.SecretBackendRole("example",
    mount=pki_external_ca.path,
    name="example-role",
    acme_account_name=example.name,
    allowed_domains=["example.com"],
    allowed_domain_options=[
        "bare_domains",
        "subdomains",
    ],
    allowed_challenge_types=["http-01"])
example_secret_backend_order = vault.pkiexternalca.SecretBackendOrder("example",
    mount=pki_external_ca.path,
    role_name=example_secret_backend_role.name,
    identifiers=["www.example.com"])
# Retrieve HTTP-01 challenge details
http = vault.pkiexternalca.get_secret_backend_order_challenge_output(mount=pki_external_ca.path,
    role_name=example_secret_backend_role.name,
    order_id=example_secret_backend_order.order_id,
    challenge_type="http-01",
    identifier="www.example.com")
# Deploy the challenge file
acme_challenge = local.File("acme_challenge",
    filename=f/var/www/html/.well-known/acme-challenge/{http.token},
    content=http.key_authorization)
pulumi.export("challengeToken", http.token)
pulumi.export("challengeUrl", http.apply(lambda http: f"http://www.example.com/.well-known/acme-challenge/{http.token}"))

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-local/sdk/go/local"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		example, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, "example", &pkiexternalca.SecretBackendAcmeAccountArgs{
			Mount:        pki_external_ca.Path,
			Name:         pulumi.String("my-acme-account"),
			DirectoryUrl: pulumi.String("https://acme-v02.api.letsencrypt.org/directory"),
			EmailContacts: pulumi.StringArray{
				pulumi.String("admin@example.com"),
			},
		})
		if err != nil {
			return err
		}
		exampleSecretBackendRole, err := pkiexternalca.NewSecretBackendRole(ctx, "example", &pkiexternalca.SecretBackendRoleArgs{
			Mount:           pki_external_ca.Path,
			Name:            pulumi.String("example-role"),
			AcmeAccountName: example.Name,
			AllowedDomains: pulumi.StringArray{
				pulumi.String("example.com"),
			},
			AllowedDomainOptions: pulumi.StringArray{
				pulumi.String("bare_domains"),
				pulumi.String("subdomains"),
			},
			AllowedChallengeTypes: pulumi.StringArray{
				pulumi.String("http-01"),
			},
		})
		if err != nil {
			return err
		}
		exampleSecretBackendOrder, err := pkiexternalca.NewSecretBackendOrder(ctx, "example", &pkiexternalca.SecretBackendOrderArgs{
			Mount:    pki_external_ca.Path,
			RoleName: exampleSecretBackendRole.Name,
			Identifiers: pulumi.StringArray{
				pulumi.String("www.example.com"),
			},
		})
		if err != nil {
			return err
		}
		// Retrieve HTTP-01 challenge details
		http := pkiexternalca.GetSecretBackendOrderChallengeOutput(ctx, pkiexternalca.GetSecretBackendOrderChallengeOutputArgs{
			Mount:         pki_external_ca.Path,
			RoleName:      exampleSecretBackendRole.Name,
			OrderId:       exampleSecretBackendOrder.OrderId,
			ChallengeType: pulumi.String("http-01"),
			Identifier:    pulumi.String("www.example.com"),
		}, nil)
		// Deploy the challenge file
		_, err = local.NewFile(ctx, "acme_challenge", &local.FileArgs{
			Filename: pulumi.Sprintf("/var/www/html/.well-known/acme-challenge/%v", http.Token),
			Content:  http.KeyAuthorization,
		})
		if err != nil {
			return err
		}
		ctx.Export("challengeToken", http.ApplyT(func(http pkiexternalca.GetSecretBackendOrderChallengeResult) (*string, error) {
			return http.Token, nil
		}).(pulumi.StringPtrOutput))
		ctx.Export("challengeUrl", http.ApplyT(func(http pkiexternalca.GetSecretBackendOrderChallengeResult) (string, error) {
			return fmt.Sprintf("http://www.example.com/.well-known/acme-challenge/%v", http.Token), nil
		}).(pulumi.StringOutput))
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Local = Pulumi.Local;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var example = new Vault.PkiExternalCa.SecretBackendAcmeAccount("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-acme-account",
        DirectoryUrl = "https://acme-v02.api.letsencrypt.org/directory",
        EmailContacts = new[]
        {
            "admin@example.com",
        },
    });

    var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "example-role",
        AcmeAccountName = example.Name,
        AllowedDomains = new[]
        {
            "example.com",
        },
        AllowedDomainOptions = new[]
        {
            "bare_domains",
            "subdomains",
        },
        AllowedChallengeTypes = new[]
        {
            "http-01",
        },
    });

    var exampleSecretBackendOrder = new Vault.PkiExternalCa.SecretBackendOrder("example", new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleSecretBackendRole.Name,
        Identifiers = new[]
        {
            "www.example.com",
        },
    });

    // Retrieve HTTP-01 challenge details
    var http = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleSecretBackendRole.Name,
        OrderId = exampleSecretBackendOrder.OrderId,
        ChallengeType = "http-01",
        Identifier = "www.example.com",
    });

    // Deploy the challenge file
    var acmeChallenge = new Local.File("acme_challenge", new()
    {
        Filename = $"/var/www/html/.well-known/acme-challenge/{http.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.Token)}",
        Content = http.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.KeyAuthorization),
    });

    return new Dictionary<string, object?>
    {
        ["challengeToken"] = http.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.Token),
        ["challengeUrl"] = $"http://www.example.com/.well-known/acme-challenge/{http.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.Token)}",
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendRole;
import com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendOrder;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;
import com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;
import com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;
import com.pulumi.local.File;
import com.pulumi.local.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var example = new SecretBackendAcmeAccount("example", SecretBackendAcmeAccountArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-acme-account")
            .directoryUrl("https://acme-v02.api.letsencrypt.org/directory")
            .emailContacts("admin@example.com")
            .build());

        var exampleSecretBackendRole = new SecretBackendRole("exampleSecretBackendRole", SecretBackendRoleArgs.builder()
            .mount(pki_external_ca.path())
            .name("example-role")
            .acmeAccountName(example.name())
            .allowedDomains("example.com")
            .allowedDomainOptions(            
                "bare_domains",
                "subdomains")
            .allowedChallengeTypes("http-01")
            .build());

        var exampleSecretBackendOrder = new SecretBackendOrder("exampleSecretBackendOrder", SecretBackendOrderArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleSecretBackendRole.name())
            .identifiers("www.example.com")
            .build());

        // Retrieve HTTP-01 challenge details
        final var http = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleSecretBackendRole.name())
            .orderId(exampleSecretBackendOrder.orderId())
            .challengeType("http-01")
            .identifier("www.example.com")
            .build());

        // Deploy the challenge file
        var acmeChallenge = new File("acmeChallenge", FileArgs.builder()
            .filename(String.format("/var/www/html/.well-known/acme-challenge/%s", http.token()))
            .content(http.keyAuthorization())
            .build());

        ctx.export("challengeToken", http.applyValue(_http -> _http.token()));
        ctx.export("challengeUrl", http.applyValue(_http -> String.format("http://www.example.com/.well-known/acme-challenge/%s", _http.token())));
    }
}

    resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  example:
    type: vault:pkiexternalca:SecretBackendAcmeAccount
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-acme-account
      directoryUrl: https://acme-v02.api.letsencrypt.org/directory
      emailContacts:
        - admin@example.com
  exampleSecretBackendRole:
    type: vault:pkiexternalca:SecretBackendRole
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      name: example-role
      acmeAccountName: ${example.name}
      allowedDomains:
        - example.com
      allowedDomainOptions:
        - bare_domains
        - subdomains
      allowedChallengeTypes:
        - http-01
  exampleSecretBackendOrder:
    type: vault:pkiexternalca:SecretBackendOrder
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      roleName: ${exampleSecretBackendRole.name}
      identifiers:
        - www.example.com
  # Deploy the challenge file
  acmeChallenge:
    type: local:File
    name: acme_challenge
    properties:
      filename: /var/www/html/.well-known/acme-challenge/${http.token}
      content: ${http.keyAuthorization}
variables:
  # Retrieve HTTP-01 challenge details
  http:
    fn::invoke:
      function: vault:pkiexternalca:getSecretBackendOrderChallenge
      arguments:
        mount: ${["pki-external-ca"].path}
        roleName: ${exampleSecretBackendRole.name}
        orderId: ${exampleSecretBackendOrder.orderId}
        challengeType: http-01
        identifier: www.example.com
outputs:
  # Output challenge details for manual deployment
  challengeToken: ${http.token}
  challengeUrl: http://www.example.com/.well-known/acme-challenge/${http.token}

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

data "vault_pkiexternalca_getsecretbackendorderchallenge" "http" {
  mount          = vault_mount.pki-external-ca.path
  role_name      = vault_pkiexternalca_secretbackendrole.example.name
  order_id       = vault_pkiexternalca_secretbackendorder.example.order_id
  challenge_type = "http-01"
  identifier     = "www.example.com"
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackendacmeaccount" "example" {
  mount          = vault_mount.pki-external-ca.path
  name           = "my-acme-account"
  directory_url  = "https://acme-v02.api.letsencrypt.org/directory"
  email_contacts = ["admin@example.com"]
}
resource "vault_pkiexternalca_secretbackendrole" "example" {
  mount                   = vault_mount.pki-external-ca.path
  name                    = "example-role"
  acme_account_name       = vault_pkiexternalca_secretbackendacmeaccount.example.name
  allowed_domains         = ["example.com"]
  allowed_domain_options  = ["bare_domains", "subdomains"]
  allowed_challenge_types = ["http-01"]
}
resource "vault_pkiexternalca_secretbackendorder" "example" {
  mount       = vault_mount.pki-external-ca.path
  role_name   = vault_pkiexternalca_secretbackendrole.example.name
  identifiers = ["www.example.com"]
}
# Deploy the challenge file
resource "local_file" "acme_challenge" {
  filename ="/var/www/html/.well-known/acme-challenge/${data.vault_pkiexternalca_getsecretbackendorderchallenge.http.token}"
  content  = data.vault_pkiexternalca_getsecretbackendorderchallenge.http.key_authorization
}
# Retrieve HTTP-01 challenge details
# Output challenge details for manual deployment
output "challengeToken" {
  value = data.vault_pkiexternalca_getsecretbackendorderchallenge.http.token
}
output "challengeUrl" {
  value ="http://www.example.com/.well-known/acme-challenge/${data.vault_pkiexternalca_getsecretbackendorderchallenge.http.token}"
}

    With DNS-01 Challenge

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as vault from "@pulumi/vault";

// Retrieve DNS-01 challenge details
const dns = vault.pkiexternalca.getSecretBackendOrderChallenge({
    mount: pki_external_ca.path,
    roleName: exampleVaultPkiExternalCaSecretBackendRole.name,
    orderId: example.orderId,
    challengeType: "dns-01",
    identifier: "www.example.com",
});
// Create DNS TXT record using AWS Route53
const acmeChallenge = new aws.index.Route53Record("acme_challenge", {
    zoneId: exampleAwsRoute53Zone.zoneId,
    name: "_acme-challenge.www.example.com",
    type: "TXT",
    ttl: 60,
    records: [dns.keyAuthorization],
});
export const dnsRecordName = "_acme-challenge.www.example.com";
export const dnsRecordValue = dns.then(dns => dns.keyAuthorization);

    import pulumi
import pulumi_aws as aws
import pulumi_vault as vault

# Retrieve DNS-01 challenge details
dns = vault.pkiexternalca.get_secret_backend_order_challenge(mount=pki_external_ca["path"],
    role_name=example_vault_pki_external_ca_secret_backend_role["name"],
    order_id=example["orderId"],
    challenge_type="dns-01",
    identifier="www.example.com")
# Create DNS TXT record using AWS Route53
acme_challenge = aws.Route53Record("acme_challenge",
    zone_id=example_aws_route53_zone.zone_id,
    name=_acme-challenge.www.example.com,
    type=TXT,
    ttl=60,
    records=[dns.key_authorization])
pulumi.export("dnsRecordName", "_acme-challenge.www.example.com")
pulumi.export("dnsRecordValue", dns.key_authorization)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Retrieve DNS-01 challenge details
		dns, err := pkiexternalca.GetSecretBackendOrderChallenge(ctx, &pkiexternalca.GetSecretBackendOrderChallengeArgs{
			Mount:         pki_external_ca.Path,
			RoleName:      exampleVaultPkiExternalCaSecretBackendRole.Name,
			OrderId:       example.OrderId,
			ChallengeType: "dns-01",
			Identifier:    "www.example.com",
		}, nil)
		if err != nil {
			return err
		}
		// Create DNS TXT record using AWS Route53
		_, err = aws.NewRoute53Record(ctx, "acme_challenge", &aws.Route53RecordArgs{
			ZoneId: exampleAwsRoute53Zone.ZoneId,
			Name:   "_acme-challenge.www.example.com",
			Type:   "TXT",
			Ttl:    60,
			Records: []*string{
				dns.KeyAuthorization,
			},
		})
		if err != nil {
			return err
		}
		ctx.Export("dnsRecordName", pulumi.String("_acme-challenge.www.example.com"))
		ctx.Export("dnsRecordValue", dns.KeyAuthorization)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    // Retrieve DNS-01 challenge details
    var dns = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,
        OrderId = example.OrderId,
        ChallengeType = "dns-01",
        Identifier = "www.example.com",
    });

    // Create DNS TXT record using AWS Route53
    var acmeChallenge = new Aws.Route53Record("acme_challenge", new()
    {
        ZoneId = exampleAwsRoute53Zone.ZoneId,
        Name = "_acme-challenge.www.example.com",
        Type = "TXT",
        Ttl = 60,
        Records = new[]
        {
            dns.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.KeyAuthorization),
        },
    });

    return new Dictionary<string, object?>
    {
        ["dnsRecordName"] = "_acme-challenge.www.example.com",
        ["dnsRecordValue"] = dns.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.KeyAuthorization),
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;
import com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;
import com.pulumi.aws.Route53Record;
import com.pulumi.aws.Route53RecordArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Retrieve DNS-01 challenge details
        final var dns = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())
            .orderId(example.orderId())
            .challengeType("dns-01")
            .identifier("www.example.com")
            .build());

        // Create DNS TXT record using AWS Route53
        var acmeChallenge = new Route53Record("acmeChallenge", Route53RecordArgs.builder()
            .zoneId(exampleAwsRoute53Zone.zoneId())
            .name("_acme-challenge.www.example.com")
            .type("TXT")
            .ttl(60)
            .records(Arrays.asList(dns.keyAuthorization()))
            .build());

        ctx.export("dnsRecordName", "_acme-challenge.www.example.com");
        ctx.export("dnsRecordValue", dns.keyAuthorization());
    }
}

    resources:
  # Create DNS TXT record using AWS Route53
  acmeChallenge:
    type: aws:Route53Record
    name: acme_challenge
    properties:
      zoneId: ${exampleAwsRoute53Zone.zoneId}
      name: _acme-challenge.www.example.com
      type: TXT
      ttl: 60
      records:
        - ${dns.keyAuthorization}
variables:
  # Retrieve DNS-01 challenge details
  dns:
    fn::invoke:
      function: vault:pkiexternalca:getSecretBackendOrderChallenge
      arguments:
        mount: ${["pki-external-ca"].path}
        roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}
        orderId: ${example.orderId}
        challengeType: dns-01
        identifier: www.example.com
outputs:
  # Output DNS record details
  dnsRecordName: _acme-challenge.www.example.com
  dnsRecordValue: ${dns.keyAuthorization}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

data "vault_pkiexternalca_getsecretbackendorderchallenge" "dns" {
  mount          = pki-external-ca.path
  role_name      = exampleVaultPkiExternalCaSecretBackendRole.name
  order_id       = example.orderId
  challenge_type = "dns-01"
  identifier     = "www.example.com"
}

# Create DNS TXT record using AWS Route53
resource "aws_route53record" "acme_challenge" {
  zone_id = exampleAwsRoute53Zone.zoneId
  name    = "_acme-challenge.www.example.com"
  type    = "TXT"
  ttl     = 60
  records = [data.vault_pkiexternalca_getsecretbackendorderchallenge.dns.key_authorization]
}
# Retrieve DNS-01 challenge details
# Output DNS record details
output "dnsRecordName" {
  value = "_acme-challenge.www.example.com"
}
output "dnsRecordValue" {
  value = data.vault_pkiexternalca_getsecretbackendorderchallenge.dns.key_authorization
}

    With TLS-ALPN-01 Challenge

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

// Retrieve TLS-ALPN-01 challenge details
const tlsAlpn = vault.pkiexternalca.getSecretBackendOrderChallenge({
    mount: pki_external_ca.path,
    roleName: exampleVaultPkiExternalCaSecretBackendRole.name,
    orderId: example.orderId,
    challengeType: "tls-alpn-01",
    identifier: "www.example.com",
});
export const tlsAlpnKeyAuth = tlsAlpn.then(tlsAlpn => tlsAlpn.keyAuthorization);

    import pulumi
import pulumi_vault as vault

# Retrieve TLS-ALPN-01 challenge details
tls_alpn = vault.pkiexternalca.get_secret_backend_order_challenge(mount=pki_external_ca["path"],
    role_name=example_vault_pki_external_ca_secret_backend_role["name"],
    order_id=example["orderId"],
    challenge_type="tls-alpn-01",
    identifier="www.example.com")
pulumi.export("tlsAlpnKeyAuth", tls_alpn.key_authorization)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Retrieve TLS-ALPN-01 challenge details
		tlsAlpn, err := pkiexternalca.GetSecretBackendOrderChallenge(ctx, &pkiexternalca.GetSecretBackendOrderChallengeArgs{
			Mount:         pki_external_ca.Path,
			RoleName:      exampleVaultPkiExternalCaSecretBackendRole.Name,
			OrderId:       example.OrderId,
			ChallengeType: "tls-alpn-01",
			Identifier:    "www.example.com",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("tlsAlpnKeyAuth", tlsAlpn.KeyAuthorization)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    // Retrieve TLS-ALPN-01 challenge details
    var tlsAlpn = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,
        OrderId = example.OrderId,
        ChallengeType = "tls-alpn-01",
        Identifier = "www.example.com",
    });

    return new Dictionary<string, object?>
    {
        ["tlsAlpnKeyAuth"] = tlsAlpn.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.KeyAuthorization),
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;
import com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Retrieve TLS-ALPN-01 challenge details
        final var tlsAlpn = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())
            .orderId(example.orderId())
            .challengeType("tls-alpn-01")
            .identifier("www.example.com")
            .build());

        ctx.export("tlsAlpnKeyAuth", tlsAlpn.keyAuthorization());
    }
}

    variables:
  # Retrieve TLS-ALPN-01 challenge details
  tlsAlpn:
    fn::invoke:
      function: vault:pkiexternalca:getSecretBackendOrderChallenge
      arguments:
        mount: ${["pki-external-ca"].path}
        roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}
        orderId: ${example.orderId}
        challengeType: tls-alpn-01
        identifier: www.example.com
outputs:
  # Output challenge details for TLS configuration
  tlsAlpnKeyAuth: ${tlsAlpn.keyAuthorization}

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

data "vault_pkiexternalca_getsecretbackendorderchallenge" "tlsAlpn" {
  mount          = pki-external-ca.path
  role_name      = exampleVaultPkiExternalCaSecretBackendRole.name
  order_id       = example.orderId
  challenge_type = "tls-alpn-01"
  identifier     = "www.example.com"
}

# Retrieve TLS-ALPN-01 challenge details
# Output challenge details for TLS configuration
output "tlsAlpnKeyAuth" {
  value = data.vault_pkiexternalca_getsecretbackendorderchallenge.tlsAlpn.key_authorization
}

    Challenge Type Details

    HTTP-01 Challenge

    For HTTP-01 challenges, you must serve the keyAuthorization value at:

    http://<identifier>/.well-known/acme-challenge/<token>

    The response must:

    • Return HTTP 200 status
    • Have Content-Type: text/plain or no Content-Type header
    • Contain only the keyAuthorization value

    DNS-01 Challenge

    For DNS-01 challenges, you must create a TXT record at:

    _acme-challenge.<identifier>

    The TXT record value must be the keyAuthorization value. DNS propagation may take time, so ensure the record is resolvable before marking the challenge as fulfilled.

    TLS-ALPN-01 Challenge

    For TLS-ALPN-01 challenges, you must configure your TLS server to:

    • Present a self-signed certificate for the identifier
    • Include the acme-tls/1 ALPN protocol
    • Include a specific extension with the keyAuthorization value

    This challenge type is more complex and typically requires custom TLS server configuration.

    Note This data source polls the order status with a maximum of 5 attempts at 2-second intervals. If the order does not reach the appropriate state within this time, the data source read will fail.

    Using getSecretBackendOrderChallenge

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getSecretBackendOrderChallenge(args: GetSecretBackendOrderChallengeArgs, opts?: InvokeOptions): Promise<GetSecretBackendOrderChallengeResult>
function getSecretBackendOrderChallengeOutput(args: GetSecretBackendOrderChallengeOutputArgs, opts?: InvokeOptions): Output<GetSecretBackendOrderChallengeResult>
    def get_secret_backend_order_challenge(challenge_type: Optional[str] = None,
                                       identifier: Optional[str] = None,
                                       mount: Optional[str] = None,
                                       namespace: Optional[str] = None,
                                       order_id: Optional[str] = None,
                                       role_name: Optional[str] = None,
                                       opts: Optional[InvokeOptions] = None) -> GetSecretBackendOrderChallengeResult
def get_secret_backend_order_challenge_output(challenge_type: pulumi.Input[Optional[str]] = None,
                                       identifier: pulumi.Input[Optional[str]] = None,
                                       mount: pulumi.Input[Optional[str]] = None,
                                       namespace: pulumi.Input[Optional[str]] = None,
                                       order_id: pulumi.Input[Optional[str]] = None,
                                       role_name: pulumi.Input[Optional[str]] = None,
                                       opts: Optional[InvokeOptions] = None) -> Output[GetSecretBackendOrderChallengeResult]
    func GetSecretBackendOrderChallenge(ctx *Context, args *GetSecretBackendOrderChallengeArgs, opts ...InvokeOption) (*GetSecretBackendOrderChallengeResult, error)
func GetSecretBackendOrderChallengeOutput(ctx *Context, args *GetSecretBackendOrderChallengeOutputArgs, opts ...InvokeOption) GetSecretBackendOrderChallengeResultOutput

    > Note: This function is named GetSecretBackendOrderChallenge in the Go SDK.

    public static class GetSecretBackendOrderChallenge 
{
    public static Task<GetSecretBackendOrderChallengeResult> InvokeAsync(GetSecretBackendOrderChallengeArgs args, InvokeOptions? opts = null)
    public static Output<GetSecretBackendOrderChallengeResult> Invoke(GetSecretBackendOrderChallengeInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetSecretBackendOrderChallengeResult> getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs args, InvokeOptions options)
public static Output<GetSecretBackendOrderChallengeResult> getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs args, InvokeOptions options)

    fn::invoke:
  function: vault:pkiexternalca/getSecretBackendOrderChallenge:getSecretBackendOrderChallenge
  arguments:
    # arguments dictionary
    data "vault_pkiexternalca_get_secret_backend_order_challenge" "name" {
    # arguments
}

    The following arguments are supported:

    ChallengeType string
    The type of ACME challenge to retrieve. Valid values are:

    • http-01 - HTTP challenge (requires placing a file at a specific URL)
    • dns-01 - DNS challenge (requires creating a TXT record)
    • tls-alpn-01 - TLS-ALPN challenge (requires configuring TLS with specific ALPN extension)
    Identifier string
    The identifier (domain name) for which to retrieve the challenge.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    OrderId string
    The unique identifier for the ACME order.
    RoleName string
    Name of the role associated with the order.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ChallengeType string
    The type of ACME challenge to retrieve. Valid values are:

    • http-01 - HTTP challenge (requires placing a file at a specific URL)
    • dns-01 - DNS challenge (requires creating a TXT record)
    • tls-alpn-01 - TLS-ALPN challenge (requires configuring TLS with specific ALPN extension)
    Identifier string
    The identifier (domain name) for which to retrieve the challenge.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    OrderId string
    The unique identifier for the ACME order.
    RoleName string
    Name of the role associated with the order.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    challenge_type string
    The type of ACME challenge to retrieve. Valid values are:

    • http-01 - HTTP challenge (requires placing a file at a specific URL)
    • dns-01 - DNS challenge (requires creating a TXT record)
    • tls-alpn-01 - TLS-ALPN challenge (requires configuring TLS with specific ALPN extension)
    identifier string
    The identifier (domain name) for which to retrieve the challenge.
    mount string
    The path where the PKI External CA secret backend is mounted.
    order_id string
    The unique identifier for the ACME order.
    role_name string
    Name of the role associated with the order.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    challengeType String
    The type of ACME challenge to retrieve. Valid values are:

    • http-01 - HTTP challenge (requires placing a file at a specific URL)
    • dns-01 - DNS challenge (requires creating a TXT record)
    • tls-alpn-01 - TLS-ALPN challenge (requires configuring TLS with specific ALPN extension)
    identifier String
    The identifier (domain name) for which to retrieve the challenge.
    mount String
    The path where the PKI External CA secret backend is mounted.
    orderId String
    The unique identifier for the ACME order.
    roleName String
    Name of the role associated with the order.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    challengeType string
    The type of ACME challenge to retrieve. Valid values are:

    • http-01 - HTTP challenge (requires placing a file at a specific URL)
    • dns-01 - DNS challenge (requires creating a TXT record)
    • tls-alpn-01 - TLS-ALPN challenge (requires configuring TLS with specific ALPN extension)
    identifier string
    The identifier (domain name) for which to retrieve the challenge.
    mount string
    The path where the PKI External CA secret backend is mounted.
    orderId string
    The unique identifier for the ACME order.
    roleName string
    Name of the role associated with the order.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    challenge_type str
    The type of ACME challenge to retrieve. Valid values are:

    • http-01 - HTTP challenge (requires placing a file at a specific URL)
    • dns-01 - DNS challenge (requires creating a TXT record)
    • tls-alpn-01 - TLS-ALPN challenge (requires configuring TLS with specific ALPN extension)
    identifier str
    The identifier (domain name) for which to retrieve the challenge.
    mount str
    The path where the PKI External CA secret backend is mounted.
    order_id str
    The unique identifier for the ACME order.
    role_name str
    Name of the role associated with the order.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    challengeType String
    The type of ACME challenge to retrieve. Valid values are:

    • http-01 - HTTP challenge (requires placing a file at a specific URL)
    • dns-01 - DNS challenge (requires creating a TXT record)
    • tls-alpn-01 - TLS-ALPN challenge (requires configuring TLS with specific ALPN extension)
    identifier String
    The identifier (domain name) for which to retrieve the challenge.
    mount String
    The path where the PKI External CA secret backend is mounted.
    orderId String
    The unique identifier for the ACME order.
    roleName String
    Name of the role associated with the order.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    getSecretBackendOrderChallenge Result

    The following output properties are available:

    ChallengeType string
    Expires string
    Expiry time for the challenge in RFC3339 format.
    Id string
    Unique identifier for this data source read.
    Identifier string
    KeyAuthorization string
    The key authorization string for the challenge. This is the value that must be:

    • Served at the challenge URL for HTTP-01
    • Set as the TXT record value for DNS-01
    • Used in the TLS certificate for TLS-ALPN-01
    Mount string
    OrderId string
    RoleName string
    Status string
    The current status of the challenge (e.g., pending, valid, invalid).
    Token string
    The challenge token provided by the ACME server. For HTTP-01 challenges, this is used in the URL path.
    Namespace string
    ChallengeType string
    Expires string
    Expiry time for the challenge in RFC3339 format.
    Id string
    Unique identifier for this data source read.
    Identifier string
    KeyAuthorization string
    The key authorization string for the challenge. This is the value that must be:

    • Served at the challenge URL for HTTP-01
    • Set as the TXT record value for DNS-01
    • Used in the TLS certificate for TLS-ALPN-01
    Mount string
    OrderId string
    RoleName string
    Status string
    The current status of the challenge (e.g., pending, valid, invalid).
    Token string
    The challenge token provided by the ACME server. For HTTP-01 challenges, this is used in the URL path.
    Namespace string
    challenge_type string
    expires string
    Expiry time for the challenge in RFC3339 format.
    id string
    Unique identifier for this data source read.
    identifier string
    key_authorization string
    The key authorization string for the challenge. This is the value that must be:

    • Served at the challenge URL for HTTP-01
    • Set as the TXT record value for DNS-01
    • Used in the TLS certificate for TLS-ALPN-01
    mount string
    order_id string
    role_name string
    status string
    The current status of the challenge (e.g., pending, valid, invalid).
    token string
    The challenge token provided by the ACME server. For HTTP-01 challenges, this is used in the URL path.
    namespace string
    challengeType String
    expires String
    Expiry time for the challenge in RFC3339 format.
    id String
    Unique identifier for this data source read.
    identifier String
    keyAuthorization String
    The key authorization string for the challenge. This is the value that must be:

    • Served at the challenge URL for HTTP-01
    • Set as the TXT record value for DNS-01
    • Used in the TLS certificate for TLS-ALPN-01
    mount String
    orderId String
    roleName String
    status String
    The current status of the challenge (e.g., pending, valid, invalid).
    token String
    The challenge token provided by the ACME server. For HTTP-01 challenges, this is used in the URL path.
    namespace String
    challengeType string
    expires string
    Expiry time for the challenge in RFC3339 format.
    id string
    Unique identifier for this data source read.
    identifier string
    keyAuthorization string
    The key authorization string for the challenge. This is the value that must be:

    • Served at the challenge URL for HTTP-01
    • Set as the TXT record value for DNS-01
    • Used in the TLS certificate for TLS-ALPN-01
    mount string
    orderId string
    roleName string
    status string
    The current status of the challenge (e.g., pending, valid, invalid).
    token string
    The challenge token provided by the ACME server. For HTTP-01 challenges, this is used in the URL path.
    namespace string
    challenge_type str
    expires str
    Expiry time for the challenge in RFC3339 format.
    id str
    Unique identifier for this data source read.
    identifier str
    key_authorization str
    The key authorization string for the challenge. This is the value that must be:

    • Served at the challenge URL for HTTP-01
    • Set as the TXT record value for DNS-01
    • Used in the TLS certificate for TLS-ALPN-01
    mount str
    order_id str
    role_name str
    status str
    The current status of the challenge (e.g., pending, valid, invalid).
    token str
    The challenge token provided by the ACME server. For HTTP-01 challenges, this is used in the URL path.
    namespace str
    challengeType String
    expires String
    Expiry time for the challenge in RFC3339 format.
    id String
    Unique identifier for this data source read.
    identifier String
    keyAuthorization String
    The key authorization string for the challenge. This is the value that must be:

    • Served at the challenge URL for HTTP-01
    • Set as the TXT record value for DNS-01
    • Used in the TLS certificate for TLS-ALPN-01
    mount String
    orderId String
    roleName String
    status String
    The current status of the challenge (e.g., pending, valid, invalid).
    token String
    The challenge token provided by the ACME server. For HTTP-01 challenges, this is used in the URL path.
    namespace String

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial