Custom Hostname SSL changing from Cloudflare managers cert to custom certificate

[skipspence]

Confirmation

• My issue isn't already found on the issue tracker.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.6.6
on darwin_arm64
+ provider registry.terraform.io/cloudflare/cloudflare v4.20.0

Affected resource(s)

• cloudflare_custom_hostname

Terraform configuration files

resource "cloudflare_custom_hostname" "customHostName" {
  hostname                        = "test.hostname.example.com"
  zone_id                         = "abcdefghijklmnop"
  wait_for_ssl_pending_validation = true
  custom_origin_server            = "test.origin.example.com"
  ssl {
    method                = "http"
    type                  = "dv"
    certificate_authority = "lets_encrypt"
  }
}

# Changing the above resource to a custom certificate:
resource "cloudflare_custom_hostname" "customHostName" {
  hostname                        = "test.hostname.example.com"
  zone_id                         = "abcdefghijklmnop"
  wait_for_ssl_pending_validation = true
  custom_origin_server            = "test.origin.example.com"
  ssl {
    custom_certificate    = "-----BEGIN CERTIFICATE-----\nCERT\n-----END CERTIFICATE-----\n"
    custom_key            = "-----BEGIN PRIVATE KEY-----\nCERT\n-----END PRIVATE KEY-----\n"
  }
}

Link to debug output

https://gist.github.com/skipspence/395e43eeda044bac95f7bd2621a98e28

Panic output

No response

Expected output

A successful apply, disabling cloudflare managed certificate and replaced with the custom certificate.

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Actual output

Apply fails. The certificate_authority attribute is not being changed to null when no longer defined. Causing an error response from the Cloudflare API.

│ Error: failed to update custom hostname certificate: The SSL attribute is invalid. Please refer to the API documentation, check your input and try again. (1434)
│
│   with cloudflare_custom_hostname.customHostName,
│   on main.tf line 17, in resource "cloudflare_custom_hostname" "customHostName":
│   17: resource "cloudflare_custom_hostname" "customHostName" {

Steps to reproduce

1. Create a custom hostname resource and configure to use a Cloudflare manager certificate authority.
2. Apply this resource.
3. Update resource to contain a custom_certificate and custom_key while removing method and certificate_authority from the SSL configuration.
4. Apply changed.

Additional factoids

No response

References

Trying to set

[github-actions]

Terraform debug log detected ✅

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.