Certificate

A Certificate represents an SSL/TLS certificate for a domain, used by LoadBalancer listeners for HTTPS/TLS termination. On AWS this is an ACM certificate, on GCP a Certificate Manager resource. Hetzner does not have a standalone certificate resource — certificates are managed on the Load Balancer directly.

Config

Property	Type	Required	Description
name	string	yes	Unique resource name
id	string	no	Explicit ID (auto-generated UUID if omitted)
provider	string	no	Provider label for multi-provider configs
tags	Record<string, string>	no	Arbitrary key-value metadata
domain	string	yes	Domain name for the certificate

Example

import { Certificate, LoadBalancer, Vpc } from '@kykucloud/types'

const cert = new Certificate({
  name: 'example-cert',
  domain: 'example.com',
})

const myVpc = new Vpc({ name: 'my-vpc', cidr: '10.0.0.0/16', region: 'eu-central' })

const lb = new LoadBalancer({
  name: 'web-lb',
  lbType: 'application',
  vpc: myVpc,
  listeners: [{
    port: 443,
    protocol: 'https',
    certificate: cert.name,  // or the certificate ARN
    targets: [],
  }],
})

Provider Support

Provider	Supported	Backend
AWS	✅	ACM (Certificate Manager)
GCP	✅	Certificate Manager
Hetzner	❌	Handled on the LB resource directly
DigitalOcean	❌	Handled on the LB resource directly

Notes

• AWS ACM certificates are regional resources. Must be in the same region as the load balancer. DNS validation is the recommended validation method. Certificates are free with ACM.
• GCP Certificate Manager supports both Google-managed and self-managed certificates. For HTTPS LBs, use a urlMap with the certificate attached to the targetHttpsProxy.
• Hetzner & DigitalOcean: SSL certificates are configured directly on the Load Balancer resource using provider-specific fields, not as standalone resources.