[Bug]: skip_tls_verify does not work as expected

[Eusebius1920]

Github handle

Eusebius1920

Please describe the issue you are facing?

Creating a resource with skip_tls_verify = true against an API that has a self-signed certificate returns the following error:

│ Error: Request Failed
│ 
│   with terracurl_request.test,
│   on main.tf line 1, in resource "terracurl_request" "test":
│  1: resource "terracurl_request" "test" {
│ 
│ Post "https://10.11.12.13/api/endpoint": tls: failed to verify certificate: x509: certificate signed by unknown authority

Please detail the steps to reproduce the issue?

step 1: try to create a resource against an API with a self-signed certificate
step 2: see the error message

It works with version 1.2.2 of the provider, but it does not work with version 2.1.0 of the provider

TerraCurl provider version

2.0.0

What version of Terraform are you using?

None

What Operating system architecture are you running?

linux_amd64

Relevant log output

[Eusebius1920]

used terraform version: v1.13.1 (was not selectable in the dropdown menu)

[Vokunne]

@devops-rob hi,
Hope you are doing well.

I faced the same glitch using the provider's version 2.1.0
Terraform version: 1.13.5
Running OS: linux_amd64

[delps-presidio]

This problem arises from the following:

In 2.2.0, skip_tls_verify is evaluated as such:

useTLS := !data.CertFile.IsNull() || !data.KeyFile.IsNull() || !data.CaCertFile.IsNull() || !data.CaCertDirectory.IsNull()

if useTLS {
    // This is the ONLY path where SkipTlsVerify is respected
    tlsConfig := &TlsConfig{ SkipTlsVerify: data.SkipTlsVerify.ValueBool() }
    client, err = createTlsClient(tlsConfig)
} else {
    // Default plain http.Client - NO TLS config applied at all
    client = &http.Client{ Timeout: 30 * time.Second }
}

As you can see, it is only evaluated if values are passed for the cert related options, if you just pass skip_tls_verify it doesn't work.

Since IsNull doesn't evaluate an empty string as null, this is how I am doing it in my usage of this provider:

  skip_tls_verify = true
  ca_cert_file = ""
...
  destroy_skip_tls_verify = true
  destroy_ca_cert_file = ""

This works for me.

[devops-rob]

Thanks for reporting this, @Eusebius1920 — confirmed regression from v1.x.

Root cause: skip_tls_verify only took effect when cert-related attributes were also set. With skip_tls_verify = true alone, the provider used the default HTTP client, which still verified server certificates.

Fix: merged in #161 (release 2.5.4). The TLS client is now used when skip_tls_verify is true, even without cert files — matching v1.2.2 behavior.

After upgrading to v2.5.4, self-signed endpoints should work with only:

skip_tls_verify = true

No need for the ca_cert_file = "" workaround.