PLUGIN_CA_CERT_PATH

Configure PLUGIN_CA_CERT_PATH to trust a corporate CA certificate for provisioner binary downloads behind a TLS-intercepting proxy.

Points the IaCM plugin to a corporate CA certificate so it can trust a TLS-intercepting proxy during provisioner binary downloads. A corporate CA certificate is your organization's internal certificate authority certificate. Corporate proxies commonly use this certificate to re-sign intercepted HTTPS traffic, which causes standard certificate validation to fail unless the plugin explicitly trusts it.

Applies to: Terraform, OpenTofu, Terragrunt, and AWS CDK.

When to use it: Use this variable when IaCM runs on customer-managed infrastructure behind an HTTP(S) forward proxy that re-signs TLS certificates with a corporate CA. If provisioner downloads fail or hang while calls to *.harness.io succeed, configure PLUGIN_CA_CERT_PATH.

---

Requirements

• The value must point to a single PEM file containing one or more certificates (a CA bundle), not a directory.

• Mount the certificate file into the runner or plugin container before referencing it.

How it works: When set, the plugin creates a trust bundle that combines your corporate CA certificate with the operating system's default trusted root certificates and configures the provisioner download process to use this bundle automatically. The plugin also sets SSL_CERT_FILE, CURL_CA_BUNDLE, and SSL_CERT_DIR for troubleshooting. You do not need to configure these variables manually.

---

Configure PLUGIN_CA_CERT_PATH

1. Mount your corporate CA certificate into the runner or plugin container. For example:

   /etc/iacm/corporate-ca.pem

2. Add a workspace environment variable with:

   • Key: PLUGIN_CA_CERT_PATH

   • Value: The mounted certificate path.

3. Re-run the pipeline.

Verify: Check the step logs for a message similar to:

[certs] corporate CA trust configured from /etc/iacm/corporate-ca.pem

The Installing provisioner step downloads the provisioner binary successfully through the proxy, and the pipeline continues with the remaining IaCM operations.

---

Next steps

• Go to IaCM plugins for the full list of plugin environment variables.

• Go to Custom images for OpenTofu to add certificates by building a custom plugin image.