Repository: hashicorp/terraform-provider-vault

Issue:
[Bug]: disable = false in vault_pki_secret_backend_crl_config not applied
### Terraform Core Version

1.12.2

### Terraform Vault Provider Version

5.0.0

### Vault Server Version

1.19.7

### Affected Resource(s)

Using the vault_pki_secret_backend_crl_config resource to set disable = false does not enable CRL generation. Despite:

The plan showing the change disable: true -> false

terraform apply running without errors

### Expected Behavior

Terraform should apply disable = false successfully, enabling CRL generation.

### Actual Behavior

It remains disable = true

### Relevant Error/Panic Output Snippet

```shell

```

### Terraform Configuration Files

resource "vault_pki_secret_backend_crl_config" "crl_config" {
  backend = vault_mount.pki.path
  expiry  = "4h"
  disable = false
}

### Steps to Reproduce

terraform init
terraform apply


### Debug Output

_No response_

### Panic Output

_No response_

### Important Factoids

_No response_

### References

_No response_

### Would you like to implement a fix?

No

Discussion:

Solution patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f9a74ab..e6e5b67c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ BUGS:
 
 * Fix pki config resources to allow unsetting of fields (to empty fields) ([#2558](https://github.com/hashicorp/terraform-provider-vault/pull/2558))
 * Fix tune auth mounts to allow unsetting of fields (setting fields to empty values) ([#2605](https://github.com/hashicorp/terraform-provider-vault/pull/2605))
+* Fix `vault_pki_secret_backend_crl_config` resource to allow disabling flags previously set to true ([#2615](https://github.com/hashicorp/terraform-provider-vault/pull/2615))
 
 ## 5.3.0 (Sep 4, 2025)
 
diff --git a/vault/resource_pki_secret_backend_crl_config.go b/vault/resource_pki_secret_backend_crl_config.go
index f8954126..f6807e04 100644
--- a/vault/resource_pki_secret_backend_crl_config.go
+++ b/vault/resource_pki_secret_backend_crl_config.go
@@ -131,7 +131,7 @@ func pkiSecretBackendCrlConfigCreate(ctx context.Context, d *schema.ResourceData
 	path := pkiSecretBackendCrlConfigPath(backend)
 	fields := buildConfigCRLFields(meta)
 
-	data := util.GetAPIRequestDataWithSliceOk(d, fields)
+	data := util.GetAPIRequestDataWithSliceOkExists(d, fields)
 	log.Printf("[DEBUG] Creating CRL config on PKI secret backend %q", backend)
 	_, err := client.Logical().Write(path, data)
 	if err != nil {
@@ -188,7 +188,7 @@ func pkiSecretBackendCrlConfigUpdate(ctx context.Context, d *schema.ResourceData
 	path := d.Id()
 	fields := buildConfigCRLFields(meta)
 
-	data := util.GetAPIRequestDataWithSliceOk(d, fields)
+	data := util.GetAPIRequestDataWithSliceOkExists(d, fields)
 	log.Printf("[DEBUG] Updating CRL config on PKI secret path %q", path)
 	_, err := client.Logical().Write(path, data)
 	if err != nil {



Test patch:
diff --git a/vault/resource_pki_secret_backend_crl_config_test.go b/vault/resource_pki_secret_backend_crl_config_test.go
index 6c1aef63..523d31a9 100644
--- a/vault/resource_pki_secret_backend_crl_config_test.go
+++ b/vault/resource_pki_secret_backend_crl_config_test.go
@@ -142,6 +142,38 @@ func TestPkiSecretBackendCrlConfig(t *testing.T) {
 		},
 		)
 	})
+
+	t.Run("testCrlZeroValues", func(t *testing.T) {
+		rootPath := "pki-root-" + strconv.Itoa(acctest.RandInt())
+		resourceName := "vault_pki_secret_backend_crl_config.test"
+
+		// Force the values within the crl_config to be set to non-zero values,
+		// then switch to the zero value and then back to non-zero values.
+		steps := []resource.TestStep{
+			{
+				Config: testPkiSecretBackendCrlConfigConfig_ZeroValues(rootPath, true),
+				Check:  getCRLConfigZeroChecks(resourceName, true),
+			},
+			{
+				Config: testPkiSecretBackendCrlConfigConfig_ZeroValues(rootPath, false),
+				Check:  getCRLConfigZeroChecks(resourceName, false),
+			},
+			{
+				Config: testPkiSecretBackendCrlConfigConfig_ZeroValues(rootPath, true),
+				Check:  getCRLConfigZeroChecks(resourceName, true),
+			},
+		}
+		resource.Test(t, resource.TestCase{
+			ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+			PreCheck: func() {
+				testutil.TestAccPreCheck(t)
+				testutil.TestEntPreCheck(t)
+				SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion120)
+			},
+			CheckDestroy: testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+			Steps:        steps,
+		})
+	})
 }
 
 func setupCRLConfigTest(t *testing.T, preCheck func(), ignoreImportFields ...string) {
@@ -232,3 +264,57 @@ resource "vault_pki_secret_backend_crl_config" "test" {
 }
 `, testPkiSecretBackendCrlConfigConfig_base(rootPath), strconv.FormatBool(unifiedCrl), maxCrlEntries)
 }
+
+func testPkiSecretBackendCrlConfigConfig_ZeroValues(rootPath string, isZeroVal bool) string {
+	zeroDur := "0"
+	if !isZeroVal {
+		zeroDur = "23h"
+	}
+	zeroBool := strconv.FormatBool(!isZeroVal)
+	return fmt.Sprintf(`
+%[1]s
+
+resource "vault_pki_secret_backend_crl_config" "test" {
+  backend                   	= vault_pki_secret_backend_root_cert.test-ca.backend
+  expiry                    	= "25h" // expiry needs to be larger than auto_rebuild_grace_period
+  disable                   	= %[2]s
+  ocsp_disable              	= %[2]s
+  ocsp_expiry               	= "%[3]s"
+  auto_rebuild              	= %[2]s
+  auto_rebuild_grace_period 	= "%[3]s"
+  enable_delta              	= %[2]s 
+  delta_rebuild_interval   		= "%[3]s"
+  cross_cluster_revocation  	= %[2]s
+  unified_crl					= %[2]s
+  unified_crl_on_existing_paths = %[2]s
+  max_crl_entries				= "100" // max_crl_entries does not accept 0 as a value
+}
+`, testPkiSecretBackendCrlConfigConfig_base(rootPath), zeroBool, zeroDur)
+}
+
+func getCRLConfigZeroChecks(resourceName string, isZeroVal bool) resource.TestCheckFunc {
+	zeroDur := "0"
+	if !isZeroVal {
+		zeroDur = "23h"
+	}
+	zeroBool := strconv.FormatBool(!isZeroVal)
+
+	checks := []resource.TestCheckFunc{
+		resource.TestCheckResourceAttr(resourceName, "expiry", "25h"), // expiry needs to be larger than auto_rebuild_grace_period
+		resource.TestCheckResourceAttr(resourceName, "disable", zeroBool),
+		resource.TestCheckResourceAttr(resourceName, "ocsp_disable", zeroBool),
+		resource.TestCheckResourceAttr(resourceName, "ocsp_expiry", zeroDur),
+		resource.TestCheckResourceAttr(resourceName, "auto_rebuild", zeroBool),
+		resource.TestCheckResourceAttr(resourceName, "auto_rebuild_grace_period", zeroDur),
+		resource.TestCheckResourceAttr(resourceName, "enable_delta", zeroBool),
+		resource.TestCheckResourceAttr(resourceName, "delta_rebuild_interval", zeroDur),
+		resource.TestCheckResourceAttr(resourceName, "cross_cluster_revocation", zeroBool),
+		resource.TestCheckResourceAttr(resourceName, "unified_crl", zeroBool),
+		resource.TestCheckResourceAttr(resourceName, "unified_crl_on_existing_paths", zeroBool),
+		resource.TestCheckResourceAttr(resourceName, "max_crl_entries", "100"), // max_crl_entries does not accept 0 as a value
+	}
+
+	return func(state *terraform.State) error {
+		return resource.ComposeAggregateTestCheckFunc(checks...)(state)
+	}
+}