# frozen_string_literal: true # Copyright 2021 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # Auto-generated by gapic-generator-ruby. DO NOT EDIT! module Google module Cloud module Security module PrivateCA module V1 # A {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} represents an individual Certificate Authority. # A {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} can be used to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. # @!attribute [r] name # @return [::String] # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the # format `projects/*/locations/*/caPools/*/certificateAuthorities/*`. # @!attribute [rw] type # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::Type] # Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::Type Type} of this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. # @!attribute [rw] config # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig] # Required. Immutable. The config used to create a self-signed X.509 certificate or CSR. # @!attribute [rw] lifetime # @return [::Google::Protobuf::Duration] # Required. Immutable. The desired lifetime of the CA certificate. Used to create the # "not_before_time" and "not_after_time" fields inside an X.509 # certificate. # @!attribute [rw] key_spec # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::KeyVersionSpec] # Required. Immutable. Used when issuing certificates for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. If this # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} is a self-signed CertificateAuthority, this key # is also used to sign the self-signed CA certificate. Otherwise, it # is used to sign a CSR. # @!attribute [rw] subordinate_config # @return [::Google::Cloud::Security::PrivateCA::V1::SubordinateConfig] # Optional. If this is a subordinate {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, this field will be set # with the subordinate configuration, which describes its issuers. This may # be updated, but this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} must continue to validate. # @!attribute [r] tier # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier] # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier CaPool.Tier} of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} that includes this # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. # @!attribute [r] state # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State] # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State State} for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. # @!attribute [r] pem_ca_certificates # @return [::Array<::String>] # Output only. This {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate chain, including the current # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate. Ordered such that the root issuer # is the final element (consistent with RFC 5246). For a self-signed CA, this # will only list the current {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate. # @!attribute [r] ca_certificate_descriptions # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateDescription>] # Output only. A structured description of this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate # and its issuers. Ordered as self-to-root. # @!attribute [rw] gcs_bucket # @return [::String] # Immutable. The name of a Cloud Storage bucket where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will # publish content, such as the CA certificate and CRLs. This must be a bucket # name, without any prefixes (such as `gs://`) or suffixes (such as # `.googleapis.com`). For example, to use a bucket named `my-bucket`, you # would simply specify `my-bucket`. If not specified, a managed bucket will # be created. # @!attribute [r] access_urls # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::AccessUrls] # Output only. URLs for accessing content published by this CA, such as the CA certificate # and CRLs. # @!attribute [r] create_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was created. # @!attribute [r] update_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was last updated. # @!attribute [r] delete_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was soft deleted, if # it is in the {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State::DELETED DELETED} state. # @!attribute [r] expire_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will be permanently purged, # if it is in the {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State::DELETED DELETED} state. # @!attribute [rw] labels # @return [::Google::Protobuf::Map{::String => ::String}] # Optional. Labels with user-defined metadata. class CertificateAuthority include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # URLs where a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will publish content. # @!attribute [rw] ca_certificate_access_url # @return [::String] # The URL where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate is # published. This will only be set for CAs that have been activated. # @!attribute [rw] crl_access_urls # @return [::Array<::String>] # The URLs where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CRLs are published. This # will only be set for CAs that have been activated. class AccessUrls include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A Cloud KMS key configuration that a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will use. # @!attribute [rw] cloud_kms_key_version # @return [::String] # The resource name for an existing Cloud KMS CryptoKeyVersion in the # format # `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`. # This option enables full flexibility in the key's capabilities and # properties. # @!attribute [rw] algorithm # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::SignHashAlgorithm] # The algorithm to use for creating a managed Cloud KMS key for a for a # simplified experience. All managed keys will be have their # [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`. class KeyVersionSpec include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # @!attribute [rw] key # @return [::String] # @!attribute [rw] value # @return [::String] class LabelsEntry include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # The type of a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, indicating its issuing chain. module Type # Not specified. TYPE_UNSPECIFIED = 0 # Self-signed CA. SELF_SIGNED = 1 # Subordinate CA. Could be issued by a Private CA {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} # or an unmanaged CA. SUBORDINATE = 2 end # The state of a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, indicating if it can be used. module State # Not specified. STATE_UNSPECIFIED = 0 # Certificates can be issued from this CA. CRLs will be generated for this # CA. The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will be # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. ENABLED = 1 # Certificates cannot be issued from this CA. CRLs will still be generated. # The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, but will not be # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. DISABLED = 2 # Certificates can be issued from this CA. CRLs will be generated for this # CA. The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, but will not # be used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. STAGED = 3 # Certificates cannot be issued from this CA. CRLs will not be generated. # The CA will not be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will not be # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. AWAITING_USER_ACTIVATION = 4 # Certificates cannot be issued from this CA. CRLs will not be generated. # The CA may still be recovered by calling # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthorityService::Client#undelete_certificate_authority CertificateAuthorityService.UndeleteCertificateAuthority} before # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority#expire_time expire_time}. # The CA will not be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will not be # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. DELETED = 5 end # The algorithm of a Cloud KMS CryptoKeyVersion of a # [CryptoKey][google.cloud.kms.v1.CryptoKey] with the # [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] value # `ASYMMETRIC_SIGN`. These values correspond to the # [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] # values. For RSA signing algorithms, the PSS algorithms should be preferred, # use PKCS1 algorithms if required for compatibility. For further # recommendations, see # https://cloud.google.com/kms/docs/algorithms#algorithm_recommendations. module SignHashAlgorithm # Not specified. SIGN_HASH_ALGORITHM_UNSPECIFIED = 0 # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256 RSA_PSS_2048_SHA256 = 1 # maps to CryptoKeyVersionAlgorithm. RSA_SIGN_PSS_3072_SHA256 RSA_PSS_3072_SHA256 = 2 # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_4096_SHA256 RSA_PSS_4096_SHA256 = 3 # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_2048_SHA256 RSA_PKCS1_2048_SHA256 = 6 # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_3072_SHA256 RSA_PKCS1_3072_SHA256 = 7 # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_4096_SHA256 RSA_PKCS1_4096_SHA256 = 8 # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256 EC_P256_SHA256 = 4 # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P384_SHA384 EC_P384_SHA384 = 5 end end # A {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} represents a group of # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthorities} that form a trust anchor. A # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} can be used to manage issuance policies for one or more # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} resources and to rotate CA certificates in and out # of the trust anchor. # @!attribute [r] name # @return [::String] # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} in the # format `projects/*/locations/*/caPools/*`. # @!attribute [rw] tier # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier] # Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier Tier} of this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] issuance_policy # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy] # Optional. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy} to control how {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} # will be issued from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] publishing_options # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::PublishingOptions] # Optional. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::PublishingOptions PublishingOptions} to follow when issuing # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} from any {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in this # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] labels # @return [::Google::Protobuf::Map{::String => ::String}] # Optional. Labels with user-defined metadata. class CaPool include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Options relating to the publication of each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA # certificate and CRLs and their inclusion as extensions in issued # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. The options set here apply to certificates # issued by any {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] publish_ca_cert # @return [::Boolean] # Optional. When true, publishes each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate and # includes its URL in the "Authority Information Access" X.509 extension # in all issued {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. If this is false, the CA # certificate will not be published and the corresponding X.509 extension # will not be written in issued certificates. # @!attribute [rw] publish_crl # @return [::Boolean] # Optional. When true, publishes each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CRL and includes its # URL in the "CRL Distribution Points" X.509 extension in all issued # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. If this is false, CRLs will not be published # and the corresponding X.509 extension will not be written in issued # certificates. # CRLs will expire 7 days from their creation. However, we will rebuild # daily. CRLs are also rebuilt shortly after a certificate is revoked. class PublishingOptions include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Defines controls over all certificate issuance within a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] allowed_key_types # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType>] # Optional. If any {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType} is specified, then the certificate request's # public key must match one of the key types listed here. Otherwise, # any key may be used. # @!attribute [rw] maximum_lifetime # @return [::Google::Protobuf::Duration] # Optional. The maximum lifetime allowed for issued {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. Note # that if the issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} expires before a # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s requested maximum_lifetime, the effective lifetime will # be explicitly truncated to match it. # @!attribute [rw] allowed_issuance_modes # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes] # Optional. If specified, then only methods allowed in the {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes} may be # used to issue {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. # @!attribute [rw] baseline_values # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters] # Optional. A set of X.509 values that will be applied to all certificates issued # through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. If a certificate request includes conflicting # values for the same properties, they will be overwritten by the values # defined here. If a certificate request uses a {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} # that defines conflicting # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values} for the same # properties, the certificate issuance request will fail. # @!attribute [rw] identity_constraints # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateIdentityConstraints] # Optional. Describes constraints on identities that may appear in # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} issued through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # If this is omitted, then this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} will not add restrictions on a # certificate's identity. # @!attribute [rw] passthrough_extensions # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints] # Optional. Describes the set of X.509 extensions that may appear in a # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. If a certificate request # sets extensions that don't appear in the {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#passthrough_extensions passthrough_extensions}, # those extensions will be dropped. If a certificate request uses a # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} with # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values} that don't # appear here, the certificate issuance request will fail. If this is # omitted, then this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} will not add restrictions on a # certificate's X.509 extensions. These constraints do not apply to X.509 # extensions set in this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values}. class IssuancePolicy include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Describes a "type" of key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # Note that a single {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType} may refer to either a # fully-qualified key algorithm, such as RSA 4096, or a family of key # algorithms, such as any RSA key. # @!attribute [rw] rsa # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType] # Represents an allowed RSA key type. # @!attribute [rw] elliptic_curve # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType] # Represents an allowed Elliptic Curve key type. class AllowedKeyType include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Describes an RSA key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] min_modulus_size # @return [::Integer] # Optional. The minimum allowed RSA modulus size (inclusive), in bits. If this is # not set, or if set to zero, the service-level min RSA modulus size # will continue to apply. # @!attribute [rw] max_modulus_size # @return [::Integer] # Optional. The maximum allowed RSA modulus size (inclusive), in bits. If this is # not set, or if set to zero, the service will not enforce an explicit # upper bound on RSA modulus sizes. class RsaKeyType include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Describes an Elliptic Curve key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} # issued from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] signature_algorithm # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm] # Optional. A signature algorithm that must be used. If this is omitted, any # EC-based signature algorithm will be allowed. class EcKeyType include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Describes an elliptic curve-based signature algorithm that may be # used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. module EcSignatureAlgorithm # Not specified. Signifies that any signature algorithm may be used. EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0 # Refers to the Elliptic Curve Digital Signature Algorithm over the # NIST P-256 curve. ECDSA_P256 = 1 # Refers to the Elliptic Curve Digital Signature Algorithm over the # NIST P-384 curve. ECDSA_P384 = 2 # Refers to the Edwards-curve Digital Signature Algorithm over curve # 25519, as described in RFC 8410. EDDSA_25519 = 3 end end end # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes} specifies the allowed ways in which # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be requested from this # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. # @!attribute [rw] allow_csr_based_issuance # @return [::Boolean] # Optional. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by # specifying a CSR. # @!attribute [rw] allow_config_based_issuance # @return [::Boolean] # Optional. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by # specifying a {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}. class IssuanceModes include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # @!attribute [rw] key # @return [::String] # @!attribute [rw] value # @return [::String] class LabelsEntry include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # The tier of a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}, indicating its supported functionality and/or # billing SKU. module Tier # Not specified. TIER_UNSPECIFIED = 0 # Enterprise tier. ENTERPRISE = 1 # DevOps tier. DEVOPS = 2 end end # A {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} corresponds to a signed X.509 certificate # Revocation List (CRL). A CRL contains the serial numbers of certificates that # should no longer be trusted. # @!attribute [r] name # @return [::String] # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} in # the format # `projects/*/locations/*/caPools/*certificateAuthorities/*/ # certificateRevocationLists/*`. # @!attribute [r] sequence_number # @return [::Integer] # Output only. The CRL sequence number that appears in pem_crl. # @!attribute [r] revoked_certificates # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::RevokedCertificate>] # Output only. The revoked serial numbers that appear in pem_crl. # @!attribute [r] pem_crl # @return [::String] # Output only. The PEM-encoded X.509 CRL. # @!attribute [r] access_url # @return [::String] # Output only. The location where 'pem_crl' can be accessed. # @!attribute [r] state # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::State] # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::State State} for this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}. # @!attribute [r] create_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} was created. # @!attribute [r] update_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} was updated. # @!attribute [r] revision_id # @return [::String] # Output only. The revision ID of this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}. A new revision is # committed whenever a new CRL is published. The format is an 8-character # hexadecimal string. # @!attribute [rw] labels # @return [::Google::Protobuf::Map{::String => ::String}] # Optional. Labels with user-defined metadata. class CertificateRevocationList include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Describes a revoked {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}. # @!attribute [rw] certificate # @return [::String] # The resource name for the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} in the format # `projects/*/locations/*/caPools/*/certificates/*`. # @!attribute [rw] hex_serial_number # @return [::String] # The serial number of the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}. # @!attribute [rw] revocation_reason # @return [::Google::Cloud::Security::PrivateCA::V1::RevocationReason] # The reason the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked. class RevokedCertificate include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # @!attribute [rw] key # @return [::String] # @!attribute [rw] value # @return [::String] class LabelsEntry include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # The state of a {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}, indicating if it is current. module State # Not specified. STATE_UNSPECIFIED = 0 # The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} is up to date. ACTIVE = 1 # The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} is no longer current. SUPERSEDED = 2 end end # A {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} corresponds to a signed X.509 certificate issued by a # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. # @!attribute [r] name # @return [::String] # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} in the format # `projects/*/locations/*/caPools/*/certificates/*`. # @!attribute [rw] pem_csr # @return [::String] # Immutable. A pem-encoded X.509 certificate signing request (CSR). # @!attribute [rw] config # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig] # Immutable. A description of the certificate and key that does not require X.509 or # ASN.1. # @!attribute [r] issuer_certificate_authority # @return [::String] # Output only. The resource name of the issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the format # `projects/*/locations/*/caPools/*/certificateAuthorities/*`. # @!attribute [rw] lifetime # @return [::Google::Protobuf::Duration] # Required. Immutable. The desired lifetime of a certificate. Used to create the # "not_before_time" and "not_after_time" fields inside an X.509 # certificate. Note that the lifetime may be truncated if it would extend # past the life of any certificate authority in the issuing chain. # @!attribute [rw] certificate_template # @return [::String] # Immutable. The resource name for a {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} used to issue this # certificate, in the format # `projects/*/locations/*/certificateTemplates/*`. # If this is specified, the caller must have the necessary permission to # use this template. If this is omitted, no template will be used. # This template must be in the same location as the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}. # @!attribute [rw] subject_mode # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectRequestMode] # Immutable. Specifies how the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s identity fields are to be decided. # If this is omitted, the `DEFAULT` subject mode will be used. # @!attribute [r] revocation_details # @return [::Google::Cloud::Security::PrivateCA::V1::Certificate::RevocationDetails] # Output only. Details regarding the revocation of this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}. This # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} is considered revoked if and only if this field is present. # @!attribute [r] pem_certificate # @return [::String] # Output only. The pem-encoded, signed X.509 certificate. # @!attribute [r] certificate_description # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription] # Output only. A structured description of the issued X.509 certificate. # @!attribute [r] pem_certificate_chain # @return [::Array<::String>] # Output only. The chain that may be used to verify the X.509 certificate. Expected to be # in issuer-to-root order according to RFC 5246. # @!attribute [r] create_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was created. # @!attribute [r] update_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was updated. # @!attribute [rw] labels # @return [::Google::Protobuf::Map{::String => ::String}] # Optional. Labels with user-defined metadata. class Certificate include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Describes fields that are relavent to the revocation of a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}. # @!attribute [rw] revocation_state # @return [::Google::Cloud::Security::PrivateCA::V1::RevocationReason] # Indicates why a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked. # @!attribute [rw] revocation_time # @return [::Google::Protobuf::Timestamp] # The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked. class RevocationDetails include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # @!attribute [rw] key # @return [::String] # @!attribute [rw] value # @return [::String] class LabelsEntry include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # A {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} refers to a managed template for certificate # issuance. # @!attribute [r] name # @return [::String] # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} in the format # `projects/*/locations/*/certificateTemplates/*`. # @!attribute [rw] predefined_values # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters] # Optional. A set of X.509 values that will be applied to all issued certificates that # use this template. If the certificate request includes conflicting values # for the same properties, they will be overwritten by the values defined # here. If the issuing {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy} # defines conflicting # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values} for the same # properties, the certificate issuance request will fail. # @!attribute [rw] identity_constraints # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateIdentityConstraints] # Optional. Describes constraints on identities that may be appear in # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} issued using this template. If this is omitted, # then this template will not add restrictions on a certificate's identity. # @!attribute [rw] passthrough_extensions # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints] # Optional. Describes the set of X.509 extensions that may appear in a # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued using this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}. If a certificate # request sets extensions that don't appear in the # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#passthrough_extensions passthrough_extensions}, those extensions will be dropped. If the # issuing {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy} defines # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values} that don't appear # here, the certificate issuance request will fail. If this is omitted, then # this template will not add restrictions on a certificate's X.509 # extensions. These constraints do not apply to X.509 extensions set in this # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}'s {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values}. # @!attribute [rw] description # @return [::String] # Optional. A human-readable description of scenarios this template is intended for. # @!attribute [r] create_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} was created. # @!attribute [r] update_time # @return [::Google::Protobuf::Timestamp] # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} was updated. # @!attribute [rw] labels # @return [::Google::Protobuf::Map{::String => ::String}] # Optional. Labels with user-defined metadata. class CertificateTemplate include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # @!attribute [rw] key # @return [::String] # @!attribute [rw] value # @return [::String] class LabelsEntry include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # An {::Google::Cloud::Security::PrivateCA::V1::X509Parameters X509Parameters} is used to describe certain fields of an # X.509 certificate, such as the key usage fields, fields specific to CA # certificates, certificate policy extensions and custom extensions. # @!attribute [rw] key_usage # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage] # Optional. Indicates the intended use for keys that correspond to a certificate. # @!attribute [rw] ca_options # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters::CaOptions] # Optional. Describes options in this {::Google::Cloud::Security::PrivateCA::V1::X509Parameters X509Parameters} that are relevant in a CA # certificate. # @!attribute [rw] policy_ids # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>] # Optional. Describes the X.509 certificate policy object identifiers, per # https://tools.ietf.org/html/rfc5280#section-4.2.1.4. # @!attribute [rw] aia_ocsp_servers # @return [::Array<::String>] # Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses # that appear in the "Authority Information Access" extension in the # certificate. # @!attribute [rw] additional_extensions # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::X509Extension>] # Optional. Describes custom X.509 extensions. class X509Parameters include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Describes values that are relevant in a CA certificate. # @!attribute [rw] is_ca # @return [::Boolean] # Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this # value is missing, the extension will be omitted from the CA certificate. # @!attribute [rw] max_issuer_path_length # @return [::Integer] # Optional. Refers to the path length restriction X.509 extension. For a CA # certificate, this value describes the depth of subordinate CA # certificates that are allowed. # If this value is less than 0, the request will fail. # If this value is missing, the max path length will be omitted from the # CA certificate. class CaOptions include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # Describes a subordinate CA's issuers. This is either a resource name to a # known issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, or a PEM issuer certificate chain. # @!attribute [rw] certificate_authority # @return [::String] # Required. This can refer to a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} that was used to create a # subordinate {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. This field is used for information # and usability purposes only. The resource name is in the format # `projects/*/locations/*/caPools/*/certificateAuthorities/*`. # @!attribute [rw] pem_issuer_chain # @return [::Google::Cloud::Security::PrivateCA::V1::SubordinateConfig::SubordinateConfigChain] # Required. Contains the PEM certificate chain for the issuers of this # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, but not pem certificate for this CA itself. class SubordinateConfig include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # This message describes a subordinate CA's issuer certificate chain. This # wrapper exists for compatibility reasons. # @!attribute [rw] pem_certificates # @return [::Array<::String>] # Required. Expected to be in leaf-to-root order according to RFC 5246. class SubordinateConfigChain include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # A {::Google::Cloud::Security::PrivateCA::V1::PublicKey PublicKey} describes a public key. # @!attribute [rw] key # @return [::String] # Required. A public key. The padding and encoding # must match with the `KeyFormat` value specified for the `format` field. # @!attribute [rw] format # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey::KeyFormat] # Required. The format of the public key. class PublicKey include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Types of public keys formats that are supported. Currently, only `PEM` # format is supported. module KeyFormat # Default unspecified value. KEY_FORMAT_UNSPECIFIED = 0 # The key is PEM-encoded as defined in [RFC # 7468](https://tools.ietf.org/html/rfc7468). It can be any of the # following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey # structure, an RFC 5280 # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1) # or a PEM-encoded X.509 certificate signing request (CSR). If a # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1) # is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey # or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified, # it will used solely for the purpose of extracting the public key. When # generated by the service, it will always be an RFC 5280 # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1) # structure containing an algorithm identifier and a key. PEM = 1 end end # A {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig} describes an X.509 certificate or CSR that is to be # created, as an alternative to using ASN.1. # @!attribute [rw] subject_config # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig::SubjectConfig] # Required. Specifies some of the values in a certificate that are related to the # subject. # @!attribute [rw] x509_config # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters] # Required. Describes how some of the technical X.509 fields in a certificate should be # populated. # @!attribute [rw] public_key # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey] # Optional. The public key that corresponds to this config. This is, for example, used # when issuing {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}, but not when creating a # self-signed {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} or {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} CSR. class CertificateConfig include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # These values are used to create the distinguished name and subject # alternative name fields in an X.509 certificate. # @!attribute [rw] subject # @return [::Google::Cloud::Security::PrivateCA::V1::Subject] # Required. Contains distinguished name fields such as the common name, location and # organization. # @!attribute [rw] subject_alt_name # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames] # Optional. The subject alternative name fields. class SubjectConfig include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # A {::Google::Cloud::Security::PrivateCA::V1::CertificateDescription CertificateDescription} describes an X.509 certificate or CSR that has # been issued, as an alternative to using ASN.1 / X.509. # @!attribute [rw] subject_description # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::SubjectDescription] # Describes some of the values in a certificate that are related to the # subject and lifetime. # @!attribute [rw] x509_description # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters] # Describes some of the technical X.509 fields in a certificate. # @!attribute [rw] public_key # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey] # The public key that corresponds to an issued certificate. # @!attribute [rw] subject_key_id # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::KeyId] # Provides a means of identifiying certificates that contain a particular # public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2. # @!attribute [rw] authority_key_id # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::KeyId] # Identifies the subject_key_id of the parent certificate, per # https://tools.ietf.org/html/rfc5280#section-4.2.1.1 # @!attribute [rw] crl_distribution_points # @return [::Array<::String>] # Describes a list of locations to obtain CRL information, i.e. # the DistributionPoint.fullName described by # https://tools.ietf.org/html/rfc5280#section-4.2.1.13 # @!attribute [rw] aia_issuing_certificate_urls # @return [::Array<::String>] # Describes lists of issuer CA certificate URLs that appear in the # "Authority Information Access" extension in the certificate. # @!attribute [rw] cert_fingerprint # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::CertificateFingerprint] # The hash of the x.509 certificate. class CertificateDescription include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # These values describe fields in an issued X.509 certificate such as the # distinguished name, subject alternative names, serial number, and lifetime. # @!attribute [rw] subject # @return [::Google::Cloud::Security::PrivateCA::V1::Subject] # Contains distinguished name fields such as the common name, location and # / organization. # @!attribute [rw] subject_alt_name # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames] # The subject alternative name fields. # @!attribute [rw] hex_serial_number # @return [::String] # The serial number encoded in lowercase hexadecimal. # @!attribute [rw] lifetime # @return [::Google::Protobuf::Duration] # For convenience, the actual lifetime of an issued certificate. # @!attribute [rw] not_before_time # @return [::Google::Protobuf::Timestamp] # The time at which the certificate becomes valid. # @!attribute [rw] not_after_time # @return [::Google::Protobuf::Timestamp] # The time after which the certificate is expired. # Per RFC 5280, the validity period for a certificate is the period of time # from not_before_time through not_after_time, inclusive. # Corresponds to 'not_before_time' + 'lifetime' - 1 second. class SubjectDescription include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A KeyId identifies a specific public key, usually by hashing the public # key. # @!attribute [rw] key_id # @return [::String] # Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most # likely the 160 bit SHA-1 hash of the public key. class KeyId include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A group of fingerprints for the x509 certificate. # @!attribute [rw] sha256_hash # @return [::String] # The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate. class CertificateFingerprint include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # An {::Google::Cloud::Security::PrivateCA::V1::ObjectId ObjectId} specifies an object identifier (OID). These provide context # and describe types in ASN.1 messages. # @!attribute [rw] object_id_path # @return [::Array<::Integer>] # Required. The parts of an OID path. The most significant parts of the path come # first. class ObjectId include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # An {::Google::Cloud::Security::PrivateCA::V1::X509Extension X509Extension} specifies an X.509 extension, which may be used in # different parts of X.509 objects like certificates, CSRs, and CRLs. # @!attribute [rw] object_id # @return [::Google::Cloud::Security::PrivateCA::V1::ObjectId] # Required. The OID for this X.509 extension. # @!attribute [rw] critical # @return [::Boolean] # Optional. Indicates whether or not this extension is critical (i.e., if the client # does not know how to handle this extension, the client should consider this # to be an error). # @!attribute [rw] value # @return [::String] # Required. The value of this X.509 extension. class X509Extension include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A {::Google::Cloud::Security::PrivateCA::V1::KeyUsage KeyUsage} describes key usage values that may appear in an X.509 # certificate. # @!attribute [rw] base_key_usage # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage::KeyUsageOptions] # Describes high-level ways in which a key may be used. # @!attribute [rw] extended_key_usage # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions] # Detailed scenarios in which a key may be used. # @!attribute [rw] unknown_extended_key_usages # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>] # Used to describe extended key usages that are not listed in the # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} message. class KeyUsage include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::KeyUsageOptions KeyUsage.KeyUsageOptions} corresponds to the key usage values # described in https://tools.ietf.org/html/rfc5280#section-4.2.1.3. # @!attribute [rw] digital_signature # @return [::Boolean] # The key may be used for digital signatures. # @!attribute [rw] content_commitment # @return [::Boolean] # The key may be used for cryptographic commitments. Note that this may # also be referred to as "non-repudiation". # @!attribute [rw] key_encipherment # @return [::Boolean] # The key may be used to encipher other keys. # @!attribute [rw] data_encipherment # @return [::Boolean] # The key may be used to encipher data. # @!attribute [rw] key_agreement # @return [::Boolean] # The key may be used in a key agreement protocol. # @!attribute [rw] cert_sign # @return [::Boolean] # The key may be used to sign certificates. # @!attribute [rw] crl_sign # @return [::Boolean] # The key may be used sign certificate revocation lists. # @!attribute [rw] encipher_only # @return [::Boolean] # The key may be used to encipher only. # @!attribute [rw] decipher_only # @return [::Boolean] # The key may be used to decipher only. class KeyUsageOptions include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} has fields that correspond to # certain common OIDs that could be specified as an extended key usage value. # @!attribute [rw] server_auth # @return [::Boolean] # Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW # server authentication", though regularly used for non-WWW TLS. # @!attribute [rw] client_auth # @return [::Boolean] # Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW # client authentication", though regularly used for non-WWW TLS. # @!attribute [rw] code_signing # @return [::Boolean] # Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of # downloadable executable code client authentication". # @!attribute [rw] email_protection # @return [::Boolean] # Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email # protection". # @!attribute [rw] time_stamping # @return [::Boolean] # Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding # the hash of an object to a time". # @!attribute [rw] ocsp_signing # @return [::Boolean] # Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing # OCSP responses". class ExtendedKeyUsageOptions include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} describes parts of a distinguished name that, in turn, # describes the subject of the certificate. # @!attribute [rw] common_name # @return [::String] # The "common name" of the subject. # @!attribute [rw] country_code # @return [::String] # The country code of the subject. # @!attribute [rw] organization # @return [::String] # The organization of the subject. # @!attribute [rw] organizational_unit # @return [::String] # The organizational_unit of the subject. # @!attribute [rw] locality # @return [::String] # The locality or city of the subject. # @!attribute [rw] province # @return [::String] # The province, territory, or regional state of the subject. # @!attribute [rw] street_address # @return [::String] # The street address of the subject. # @!attribute [rw] postal_code # @return [::String] # The postal code of the subject. class Subject include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} corresponds to a more modern way of listing what # the asserted identity is in a certificate (i.e., compared to the "common # name" in the distinguished name). # @!attribute [rw] dns_names # @return [::Array<::String>] # Contains only valid, fully-qualified host names. # @!attribute [rw] uris # @return [::Array<::String>] # Contains only valid RFC 3986 URIs. # @!attribute [rw] email_addresses # @return [::Array<::String>] # Contains only valid RFC 2822 E-mail addresses. # @!attribute [rw] ip_addresses # @return [::Array<::String>] # Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses. # @!attribute [rw] custom_sans # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::X509Extension>] # Contains additional subject alternative name values. # For each custom_san, the `value` field must contain an ASN.1 encoded # UTF8String. class SubjectAltNames include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Describes constraints on a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames}. # @!attribute [rw] cel_expression # @return [::Google::Type::Expr] # Optional. A CEL expression that may be used to validate the resolved X.509 Subject # and/or Subject Alternative Name before a certificate is signed. # To see the full allowed syntax and some examples, see # https://cloud.google.com/certificate-authority-service/docs/using-cel # @!attribute [rw] allow_subject_passthrough # @return [::Boolean] # Required. If this is true, the {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} field may be copied from a certificate # request into the signed certificate. Otherwise, the requested {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} # will be discarded. # @!attribute [rw] allow_subject_alt_names_passthrough # @return [::Boolean] # Required. If this is true, the {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} extension may be copied from a # certificate request into the signed certificate. Otherwise, the requested # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} will be discarded. class CertificateIdentityConstraints include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Describes a set of X.509 extensions that may be part of some certificate # issuance controls. # @!attribute [rw] known_extensions # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints::KnownCertificateExtension>] # Optional. A set of named X.509 extensions. Will be combined with # {::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints#additional_extensions additional_extensions} to determine the full set of X.509 extensions. # @!attribute [rw] additional_extensions # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>] # Optional. A set of {::Google::Cloud::Security::PrivateCA::V1::ObjectId ObjectIds} identifying custom X.509 extensions. # Will be combined with {::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints#known_extensions known_extensions} to determine the full set of # X.509 extensions. class CertificateExtensionConstraints include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Describes well-known X.509 extensions that can appear in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}, # not including the {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} extension. module KnownCertificateExtension # Not specified. KNOWN_CERTIFICATE_EXTENSION_UNSPECIFIED = 0 # Refers to a certificate's Key Usage extension, as described in [RFC 5280 # section 4.2.1.3](https://tools.ietf.org/html/rfc5280#section-4.2.1.3). # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::KeyUsage#base_key_usage KeyUsage.base_key_usage} field. BASE_KEY_USAGE = 1 # Refers to a certificate's Extended Key Usage extension, as described in # [RFC 5280 # section 4.2.1.12](https://tools.ietf.org/html/rfc5280#section-4.2.1.12). # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::KeyUsage#extended_key_usage KeyUsage.extended_key_usage} message. EXTENDED_KEY_USAGE = 2 # Refers to a certificate's Basic Constraints extension, as described in # [RFC 5280 # section 4.2.1.9](https://tools.ietf.org/html/rfc5280#section-4.2.1.9). # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#ca_options X509Parameters.ca_options} field. CA_OPTIONS = 3 # Refers to a certificate's Policy object identifiers, as described in # [RFC 5280 # section 4.2.1.4](https://tools.ietf.org/html/rfc5280#section-4.2.1.4). # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#policy_ids X509Parameters.policy_ids} field. POLICY_IDS = 4 # Refers to OCSP servers in a certificate's Authority Information Access # extension, as described in # [RFC 5280 # section 4.2.2.1](https://tools.ietf.org/html/rfc5280#section-4.2.2.1), # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#aia_ocsp_servers X509Parameters.aia_ocsp_servers} field. AIA_OCSP_SERVERS = 5 end end # A {::Google::Cloud::Security::PrivateCA::V1::RevocationReason RevocationReason} indicates whether a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} has been revoked, # and the reason for revocation. These correspond to standard revocation # reasons from RFC 5280. Note that the enum labels and values in this # definition are not the same ASN.1 values defined in RFC 5280. These values # will be translated to the correct ASN.1 values when a CRL is created. module RevocationReason # Default unspecified value. This value does indicate that a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} # has been revoked, but that a reason has not been recorded. REVOCATION_REASON_UNSPECIFIED = 0 # Key material for this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} may have leaked. KEY_COMPROMISE = 1 # The key material for a certificate authority in the issuing path may have # leaked. CERTIFICATE_AUTHORITY_COMPROMISE = 2 # The subject or other attributes in this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} have changed. AFFILIATION_CHANGED = 3 # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} has been superseded. SUPERSEDED = 4 # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} or entities in the issuing path have ceased to # operate. CESSATION_OF_OPERATION = 5 # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} should not be considered valid, it is expected that it # may become valid in the future. CERTIFICATE_HOLD = 6 # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} no longer has permission to assert the listed # attributes. PRIVILEGE_WITHDRAWN = 7 # The authority which determines appropriate attributes for a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} # may have been compromised. ATTRIBUTE_AUTHORITY_COMPROMISE = 8 end # Describes the way in which a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} will be resolved. module SubjectRequestMode # Not specified. SUBJECT_REQUEST_MODE_UNSPECIFIED = 0 # The default mode used in most cases. Indicates that the certificate's # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} are specified in the certificate # request. This mode requires the caller to have the # `privateca.certificates.create` permission. DEFAULT = 1 # A mode reserved for special cases. Indicates that the certificate should # have one or more SPIFFE {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} set by the service based # on the caller's identity. This mode will ignore any explicitly specified # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} in the certificate request. # This mode requires the caller to have the # `privateca.certificates.createForSelf` permission. REFLECTED_SPIFFE = 2 end end end end end end