google-cloud-security-private_ca-v1 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (30) hide show
  1. checksums.yaml +7 -0
  2. data/.yardopts +12 -0
  3. data/AUTHENTICATION.md +169 -0
  4. data/LICENSE.md +201 -0
  5. data/README.md +139 -0
  6. data/lib/google-cloud-security-private_ca-v1.rb +21 -0
  7. data/lib/google/cloud/security/private_ca/v1.rb +40 -0
  8. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service.rb +53 -0
  9. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/client.rb +2891 -0
  10. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/credentials.rb +53 -0
  11. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/operations.rb +657 -0
  12. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/paths.rb +155 -0
  13. data/lib/google/cloud/security/private_ca/v1/version.rb +30 -0
  14. data/lib/google/cloud/security/privateca/v1/resources_pb.rb +368 -0
  15. data/lib/google/cloud/security/privateca/v1/service_pb.rb +254 -0
  16. data/lib/google/cloud/security/privateca/v1/service_services_pb.rb +119 -0
  17. data/proto_docs/README.md +4 -0
  18. data/proto_docs/google/api/field_behavior.rb +65 -0
  19. data/proto_docs/google/api/resource.rb +283 -0
  20. data/proto_docs/google/cloud/security/privateca/v1/resources.rb +1188 -0
  21. data/proto_docs/google/cloud/security/privateca/v1/service.rb +934 -0
  22. data/proto_docs/google/longrunning/operations.rb +164 -0
  23. data/proto_docs/google/protobuf/any.rb +141 -0
  24. data/proto_docs/google/protobuf/duration.rb +98 -0
  25. data/proto_docs/google/protobuf/empty.rb +36 -0
  26. data/proto_docs/google/protobuf/field_mask.rb +229 -0
  27. data/proto_docs/google/protobuf/timestamp.rb +129 -0
  28. data/proto_docs/google/rpc/status.rb +46 -0
  29. data/proto_docs/google/type/expr.rb +75 -0
  30. metadata +221 -0
data/proto_docs/google/cloud/security/privateca/v1/resources.rb ADDED
@@ -0,0 +1,1188 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2021 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Cloud
22
+ module Security
23
+ module PrivateCA
24
+ module V1
25
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} represents an individual Certificate Authority.
26
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} can be used to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}.
27
+ # @!attribute [r] name
28
+ # @return [::String]
29
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the
30
+ # format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
31
+ # @!attribute [rw] type
32
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::Type]
33
+ # Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::Type Type} of this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
34
+ # @!attribute [rw] config
35
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig]
36
+ # Required. Immutable. The config used to create a self-signed X.509 certificate or CSR.
37
+ # @!attribute [rw] lifetime
38
+ # @return [::Google::Protobuf::Duration]
39
+ # Required. The desired lifetime of the CA certificate. Used to create the
40
+ # "not_before_time" and "not_after_time" fields inside an X.509
41
+ # certificate.
42
+ # @!attribute [rw] key_spec
43
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::KeyVersionSpec]
44
+ # Required. Immutable. Used when issuing certificates for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. If this
45
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} is a self-signed CertificateAuthority, this key
46
+ # is also used to sign the self-signed CA certificate. Otherwise, it
47
+ # is used to sign a CSR.
48
+ # @!attribute [rw] subordinate_config
49
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubordinateConfig]
50
+ # Optional. If this is a subordinate {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, this field will be set
51
+ # with the subordinate configuration, which describes its issuers. This may
52
+ # be updated, but this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} must continue to validate.
53
+ # @!attribute [r] tier
54
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier]
55
+ # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier CaPool.Tier} of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} that includes this
56
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
57
+ # @!attribute [r] state
58
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State]
59
+ # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State State} for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
60
+ # @!attribute [r] pem_ca_certificates
61
+ # @return [::Array<::String>]
62
+ # Output only. This {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate chain, including the current
63
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate. Ordered such that the root issuer
64
+ # is the final element (consistent with RFC 5246). For a self-signed CA, this
65
+ # will only list the current {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate.
66
+ # @!attribute [r] ca_certificate_descriptions
67
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateDescription>]
68
+ # Output only. A structured description of this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate
69
+ # and its issuers. Ordered as self-to-root.
70
+ # @!attribute [rw] gcs_bucket
71
+ # @return [::String]
72
+ # Immutable. The name of a Cloud Storage bucket where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will
73
+ # publish content, such as the CA certificate and CRLs. This must be a bucket
74
+ # name, without any prefixes (such as `gs://`) or suffixes (such as
75
+ # `.googleapis.com`). For example, to use a bucket named `my-bucket`, you
76
+ # would simply specify `my-bucket`. If not specified, a managed bucket will
77
+ # be created.
78
+ # @!attribute [r] access_urls
79
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::AccessUrls]
80
+ # Output only. URLs for accessing content published by this CA, such as the CA certificate
81
+ # and CRLs.
82
+ # @!attribute [r] create_time
83
+ # @return [::Google::Protobuf::Timestamp]
84
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was created.
85
+ # @!attribute [r] update_time
86
+ # @return [::Google::Protobuf::Timestamp]
87
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was last updated.
88
+ # @!attribute [r] delete_time
89
+ # @return [::Google::Protobuf::Timestamp]
90
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was soft deleted, if
91
+ # it is in the {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State::DELETED DELETED} state.
92
+ # @!attribute [r] expire_time
93
+ # @return [::Google::Protobuf::Timestamp]
94
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will be permanently purged,
95
+ # if it is in the {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State::DELETED DELETED} state.
96
+ # @!attribute [rw] labels
97
+ # @return [::Google::Protobuf::Map{::String => ::String}]
98
+ # Optional. Labels with user-defined metadata.
99
+ class CertificateAuthority
100
+ include ::Google::Protobuf::MessageExts
101
+ extend ::Google::Protobuf::MessageExts::ClassMethods
102
+
103
+ # URLs where a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will publish content.
104
+ # @!attribute [rw] ca_certificate_access_url
105
+ # @return [::String]
106
+ # The URL where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate is
107
+ # published. This will only be set for CAs that have been activated.
108
+ # @!attribute [rw] crl_access_urls
109
+ # @return [::Array<::String>]
110
+ # The URLs where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CRLs are published. This
111
+ # will only be set for CAs that have been activated.
112
+ class AccessUrls
113
+ include ::Google::Protobuf::MessageExts
114
+ extend ::Google::Protobuf::MessageExts::ClassMethods
115
+ end
116
+
117
+ # A Cloud KMS key configuration that a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will use.
118
+ # @!attribute [rw] cloud_kms_key_version
119
+ # @return [::String]
120
+ # The resource name for an existing Cloud KMS CryptoKeyVersion in the
121
+ # format
122
+ # `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
123
+ # This option enables full flexibility in the key's capabilities and
124
+ # properties.
125
+ # @!attribute [rw] algorithm
126
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::SignHashAlgorithm]
127
+ # The algorithm to use for creating a managed Cloud KMS key for a for a
128
+ # simplified experience. All managed keys will be have their
129
+ # [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`.
130
+ class KeyVersionSpec
131
+ include ::Google::Protobuf::MessageExts
132
+ extend ::Google::Protobuf::MessageExts::ClassMethods
133
+ end
134
+
135
+ # @!attribute [rw] key
136
+ # @return [::String]
137
+ # @!attribute [rw] value
138
+ # @return [::String]
139
+ class LabelsEntry
140
+ include ::Google::Protobuf::MessageExts
141
+ extend ::Google::Protobuf::MessageExts::ClassMethods
142
+ end
143
+
144
+ # The type of a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, indicating its issuing chain.
145
+ module Type
146
+ # Not specified.
147
+ TYPE_UNSPECIFIED = 0
148
+
149
+ # Self-signed CA.
150
+ SELF_SIGNED = 1
151
+
152
+ # Subordinate CA. Could be issued by a Private CA {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}
153
+ # or an unmanaged CA.
154
+ SUBORDINATE = 2
155
+ end
156
+
157
+ # The state of a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, indicating if it can be used.
158
+ module State
159
+ # Not specified.
160
+ STATE_UNSPECIFIED = 0
161
+
162
+ # Certificates can be issued from this CA. CRLs will be generated for this
163
+ # CA. The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will be
164
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
165
+ ENABLED = 1
166
+
167
+ # Certificates cannot be issued from this CA. CRLs will still be generated.
168
+ # The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, but will not be
169
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
170
+ DISABLED = 2
171
+
172
+ # Certificates can be issued from this CA. CRLs will be generated for this
173
+ # CA. The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, but will not
174
+ # be used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
175
+ STAGED = 3
176
+
177
+ # Certificates cannot be issued from this CA. CRLs will not be generated.
178
+ # The CA will not be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will not be
179
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
180
+ AWAITING_USER_ACTIVATION = 4
181
+
182
+ # Certificates cannot be issued from this CA. CRLs will not be generated.
183
+ # The CA may still be recovered by calling
184
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthorityService::Client#undelete_certificate_authority CertificateAuthorityService.UndeleteCertificateAuthority} before
185
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority#expire_time expire_time}.
186
+ # The CA will not be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will not be
187
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
188
+ DELETED = 5
189
+ end
190
+
191
+ # The algorithm of a Cloud KMS CryptoKeyVersion of a
192
+ # [CryptoKey][google.cloud.kms.v1.CryptoKey] with the
193
+ # [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] value
194
+ # `ASYMMETRIC_SIGN`. These values correspond to the
195
+ # [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
196
+ # values. For RSA signing algorithms, the PSS algorithms should be preferred,
197
+ # use PKCS1 algorithms if required for compatibility. For further
198
+ # recommandations, see
199
+ # https://cloud.google.com/kms/docs/algorithms#algorithm_recommendations.
200
+ module SignHashAlgorithm
201
+ # Not specified.
202
+ SIGN_HASH_ALGORITHM_UNSPECIFIED = 0
203
+
204
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256
205
+ RSA_PSS_2048_SHA256 = 1
206
+
207
+ # maps to CryptoKeyVersionAlgorithm. RSA_SIGN_PSS_3072_SHA256
208
+ RSA_PSS_3072_SHA256 = 2
209
+
210
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_4096_SHA256
211
+ RSA_PSS_4096_SHA256 = 3
212
+
213
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_2048_SHA256
214
+ RSA_PKCS1_2048_SHA256 = 6
215
+
216
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_3072_SHA256
217
+ RSA_PKCS1_3072_SHA256 = 7
218
+
219
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_4096_SHA256
220
+ RSA_PKCS1_4096_SHA256 = 8
221
+
222
+ # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256
223
+ EC_P256_SHA256 = 4
224
+
225
+ # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P384_SHA384
226
+ EC_P384_SHA384 = 5
227
+ end
228
+ end
229
+
230
+ # A {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} represents a group of
231
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthorities} that form a trust anchor. A
232
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} can be used to manage issuance policies for one or more
233
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} resources and to rotate CA certificates in and out
234
+ # of the trust anchor.
235
+ # @!attribute [r] name
236
+ # @return [::String]
237
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} in the
238
+ # format `projects/*/locations/*/caPools/*`.
239
+ # @!attribute [rw] tier
240
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier]
241
+ # Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier Tier} of this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
242
+ # @!attribute [rw] issuance_policy
243
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy]
244
+ # Optional. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy} to control how {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}
245
+ # will be issued from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
246
+ # @!attribute [rw] publishing_options
247
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::PublishingOptions]
248
+ # Optional. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::PublishingOptions PublishingOptions} to follow when issuing
249
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} from any {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in this
250
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
251
+ # @!attribute [rw] labels
252
+ # @return [::Google::Protobuf::Map{::String => ::String}]
253
+ # Optional. Labels with user-defined metadata.
254
+ class CaPool
255
+ include ::Google::Protobuf::MessageExts
256
+ extend ::Google::Protobuf::MessageExts::ClassMethods
257
+
258
+ # Options relating to the publication of each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA
259
+ # certificate and CRLs and their inclusion as extensions in issued
260
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. The options set here apply to certificates
261
+ # issued by any {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
262
+ # @!attribute [rw] publish_ca_cert
263
+ # @return [::Boolean]
264
+ # Required. When true, publishes each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate and
265
+ # includes its URL in the "Authority Information Access" X.509 extension
266
+ # in all issued {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. If this is false, the CA
267
+ # certificate will not be published and the corresponding X.509 extension
268
+ # will not be written in issued certificates.
269
+ # @!attribute [rw] publish_crl
270
+ # @return [::Boolean]
271
+ # Required. When true, publishes each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CRL and includes its
272
+ # URL in the "CRL Distribution Points" X.509 extension in all issued
273
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. If this is false, CRLs will not be published
274
+ # and the corresponding X.509 extension will not be written in issued
275
+ # certificates.
276
+ # CRLs will expire 7 days from their creation. However, we will rebuild
277
+ # daily. CRLs are also rebuilt shortly after a certificate is revoked.
278
+ class PublishingOptions
279
+ include ::Google::Protobuf::MessageExts
280
+ extend ::Google::Protobuf::MessageExts::ClassMethods
281
+ end
282
+
283
+ # Defines controls over all certificate issuance within a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
284
+ # @!attribute [rw] allowed_key_types
285
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType>]
286
+ # Optional. If any {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType} is specified, then the certificate request's
287
+ # public key must match one of the key types listed here. Otherwise,
288
+ # any key may be used.
289
+ # @!attribute [rw] maximum_lifetime
290
+ # @return [::Google::Protobuf::Duration]
291
+ # Optional. The maximum lifetime allowed for issued {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. Note
292
+ # that if the issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} expires before a
293
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s requested maximum_lifetime, the effective lifetime will
294
+ # be explicitly truncated to match it.
295
+ # @!attribute [rw] allowed_issuance_modes
296
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes]
297
+ # Optional. If specified, then only methods allowed in the {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes} may be
298
+ # used to issue {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}.
299
+ # @!attribute [rw] baseline_values
300
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
301
+ # Optional. A set of X.509 values that will be applied to all certificates issued
302
+ # through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. If a certificate request includes conflicting
303
+ # values for the same properties, they will be overwritten by the values
304
+ # defined here. If a certificate request uses a {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}
305
+ # that defines conflicting
306
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values} for the same
307
+ # properties, the certificate issuance request will fail.
308
+ # @!attribute [rw] identity_constraints
309
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateIdentityConstraints]
310
+ # Optional. Describes constraints on identities that may appear in
311
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} issued through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
312
+ # If this is omitted, then this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} will not add restrictions on a
313
+ # certificate's identity.
314
+ # @!attribute [rw] passthrough_extensions
315
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints]
316
+ # Optional. Describes the set of X.509 extensions that may appear in a
317
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. If a certificate request
318
+ # sets extensions that don't appear in the {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#passthrough_extensions passthrough_extensions},
319
+ # those extensions will be dropped. If a certificate request uses a
320
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} with
321
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values} that don't
322
+ # appear here, the certificate issuance request will fail. If this is
323
+ # omitted, then this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} will not add restrictions on a
324
+ # certificate's X.509 extensions. These constraints do not apply to X.509
325
+ # extensions set in this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values}.
326
+ class IssuancePolicy
327
+ include ::Google::Protobuf::MessageExts
328
+ extend ::Google::Protobuf::MessageExts::ClassMethods
329
+
330
+ # Describes a "type" of key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
331
+ # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
332
+ # Note that a single {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType} may refer to either a
333
+ # fully-qualified key algorithm, such as RSA 4096, or a family of key
334
+ # algorithms, such as any RSA key.
335
+ # @!attribute [rw] rsa
336
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
337
+ # Represents an allowed RSA key type.
338
+ # @!attribute [rw] elliptic_curve
339
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
340
+ # Represents an allowed Elliptic Curve key type.
341
+ class AllowedKeyType
342
+ include ::Google::Protobuf::MessageExts
343
+ extend ::Google::Protobuf::MessageExts::ClassMethods
344
+
345
+ # Describes an RSA key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
346
+ # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
347
+ # @!attribute [rw] min_modulus_size
348
+ # @return [::Integer]
349
+ # Optional. The minimum allowed RSA modulus size, in bits. If this is not set,
350
+ # or if set to zero, the service-level min RSA modulus size will
351
+ # continue to apply.
352
+ # @!attribute [rw] max_modulus_size
353
+ # @return [::Integer]
354
+ # Optional. The maximum allowed RSA modulus size, in bits. If this is not set,
355
+ # or if set to zero, the service will not enforce an explicit upper
356
+ # bound on RSA modulus sizes.
357
+ class RsaKeyType
358
+ include ::Google::Protobuf::MessageExts
359
+ extend ::Google::Protobuf::MessageExts::ClassMethods
360
+ end
361
+
362
+ # Describes an Elliptic Curve key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}
363
+ # issued from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
364
+ # @!attribute [rw] signature_algorithm
365
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
366
+ # Optional. A signature algorithm that must be used. If this is omitted, any
367
+ # EC-based signature algorithm will be allowed.
368
+ class EcKeyType
369
+ include ::Google::Protobuf::MessageExts
370
+ extend ::Google::Protobuf::MessageExts::ClassMethods
371
+
372
+ # Describes an elliptic curve-based signature algorithm that may be
373
+ # used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
374
+ module EcSignatureAlgorithm
375
+ # Not specified. Signifies that any signature algorithm may be used.
376
+ EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0
377
+
378
+ # Refers to the Elliptic Curve Digital Signature Algorithm over the
379
+ # NIST P-256 curve.
380
+ ECDSA_P256 = 1
381
+
382
+ # Refers to the Elliptic Curve Digital Signature Algorithm over the
383
+ # NIST P-384 curve.
384
+ ECDSA_P384 = 2
385
+
386
+ # Refers to the Edwards-curve Digital Signature Algorithm over curve
387
+ # 25519, as described in RFC 8410.
388
+ EDDSA_25519 = 3
389
+ end
390
+ end
391
+ end
392
+
393
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes} specifies the allowed ways in which
394
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be requested from this
395
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
396
+ # @!attribute [rw] allow_csr_based_issuance
397
+ # @return [::Boolean]
398
+ # Required. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
399
+ # specifying a CSR.
400
+ # @!attribute [rw] allow_config_based_issuance
401
+ # @return [::Boolean]
402
+ # Required. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
403
+ # specifying a {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
404
+ class IssuanceModes
405
+ include ::Google::Protobuf::MessageExts
406
+ extend ::Google::Protobuf::MessageExts::ClassMethods
407
+ end
408
+ end
409
+
410
+ # @!attribute [rw] key
411
+ # @return [::String]
412
+ # @!attribute [rw] value
413
+ # @return [::String]
414
+ class LabelsEntry
415
+ include ::Google::Protobuf::MessageExts
416
+ extend ::Google::Protobuf::MessageExts::ClassMethods
417
+ end
418
+
419
+ # The tier of a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}, indicating its supported functionality and/or
420
+ # billing SKU.
421
+ module Tier
422
+ # Not specified.
423
+ TIER_UNSPECIFIED = 0
424
+
425
+ # Enterprise tier.
426
+ ENTERPRISE = 1
427
+
428
+ # DevOps tier.
429
+ DEVOPS = 2
430
+ end
431
+ end
432
+
433
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} corresponds to a signed X.509 certificate
434
+ # Revocation List (CRL). A CRL contains the serial numbers of certificates that
435
+ # should no longer be trusted.
436
+ # @!attribute [r] name
437
+ # @return [::String]
438
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} in
439
+ # the format
440
+ # `projects/*/locations/*/caPools/*certificateAuthorities/*/
441
+ # certificateRevocationLists/*`.
442
+ # @!attribute [r] sequence_number
443
+ # @return [::Integer]
444
+ # Output only. The CRL sequence number that appears in pem_crl.
445
+ # @!attribute [r] revoked_certificates
446
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::RevokedCertificate>]
447
+ # Output only. The revoked serial numbers that appear in pem_crl.
448
+ # @!attribute [r] pem_crl
449
+ # @return [::String]
450
+ # Output only. The PEM-encoded X.509 CRL.
451
+ # @!attribute [r] access_url
452
+ # @return [::String]
453
+ # Output only. The location where 'pem_crl' can be accessed.
454
+ # @!attribute [r] state
455
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::State]
456
+ # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::State State} for this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}.
457
+ # @!attribute [r] create_time
458
+ # @return [::Google::Protobuf::Timestamp]
459
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} was created.
460
+ # @!attribute [r] update_time
461
+ # @return [::Google::Protobuf::Timestamp]
462
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} was updated.
463
+ # @!attribute [r] revision_id
464
+ # @return [::String]
465
+ # Output only. The revision ID of this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}. A new revision is
466
+ # committed whenever a new CRL is published. The format is an 8-character
467
+ # hexadecimal string.
468
+ # @!attribute [rw] labels
469
+ # @return [::Google::Protobuf::Map{::String => ::String}]
470
+ # Optional. Labels with user-defined metadata.
471
+ class CertificateRevocationList
472
+ include ::Google::Protobuf::MessageExts
473
+ extend ::Google::Protobuf::MessageExts::ClassMethods
474
+
475
+ # Describes a revoked {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
476
+ # @!attribute [rw] certificate
477
+ # @return [::String]
478
+ # The resource name for the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} in the format
479
+ # `projects/*/locations/*/caPools/*/certificates/*`.
480
+ # @!attribute [rw] hex_serial_number
481
+ # @return [::String]
482
+ # The serial number of the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
483
+ # @!attribute [rw] revocation_reason
484
+ # @return [::Google::Cloud::Security::PrivateCA::V1::RevocationReason]
485
+ # The reason the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked.
486
+ class RevokedCertificate
487
+ include ::Google::Protobuf::MessageExts
488
+ extend ::Google::Protobuf::MessageExts::ClassMethods
489
+ end
490
+
491
+ # @!attribute [rw] key
492
+ # @return [::String]
493
+ # @!attribute [rw] value
494
+ # @return [::String]
495
+ class LabelsEntry
496
+ include ::Google::Protobuf::MessageExts
497
+ extend ::Google::Protobuf::MessageExts::ClassMethods
498
+ end
499
+
500
+ # The state of a {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}, indicating if it is current.
501
+ module State
502
+ # Not specified.
503
+ STATE_UNSPECIFIED = 0
504
+
505
+ # The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} is up to date.
506
+ ACTIVE = 1
507
+
508
+ # The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} is no longer current.
509
+ SUPERSEDED = 2
510
+ end
511
+ end
512
+
513
+ # A {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} corresponds to a signed X.509 certificate issued by a
514
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
515
+ # @!attribute [r] name
516
+ # @return [::String]
517
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} in the format
518
+ # `projects/*/locations/*/caPools/*/certificates/*`.
519
+ # @!attribute [rw] pem_csr
520
+ # @return [::String]
521
+ # Immutable. A pem-encoded X.509 certificate signing request (CSR).
522
+ # @!attribute [rw] config
523
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig]
524
+ # Immutable. A description of the certificate and key that does not require X.509 or
525
+ # ASN.1.
526
+ # @!attribute [r] issuer_certificate_authority
527
+ # @return [::String]
528
+ # Output only. The resource name of the issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the format
529
+ # `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
530
+ # @!attribute [rw] lifetime
531
+ # @return [::Google::Protobuf::Duration]
532
+ # Required. Immutable. The desired lifetime of a certificate. Used to create the
533
+ # "not_before_time" and "not_after_time" fields inside an X.509
534
+ # certificate. Note that the lifetime may be truncated if it would extend
535
+ # past the life of any certificate authority in the issuing chain.
536
+ # @!attribute [rw] certificate_template
537
+ # @return [::String]
538
+ # Immutable. The resource name for a {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} used to issue this
539
+ # certificate, in the format
540
+ # `projects/*/locations/*/certificateTemplates/*`.
541
+ # If this is specified, the caller must have the necessary permission to
542
+ # use this template. If this is omitted, no template will be used.
543
+ # This template must be in the same location as the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
544
+ # @!attribute [rw] subject_mode
545
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectRequestMode]
546
+ # Immutable. Specifies how the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s identity fields are to be decided.
547
+ # If this is omitted, the `DEFAULT` subject mode will be used.
548
+ # @!attribute [r] revocation_details
549
+ # @return [::Google::Cloud::Security::PrivateCA::V1::Certificate::RevocationDetails]
550
+ # Output only. Details regarding the revocation of this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}. This
551
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} is considered revoked if and only if this field is present.
552
+ # @!attribute [r] pem_certificate
553
+ # @return [::String]
554
+ # Output only. The pem-encoded, signed X.509 certificate.
555
+ # @!attribute [r] certificate_description
556
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription]
557
+ # Output only. A structured description of the issued X.509 certificate.
558
+ # @!attribute [r] pem_certificate_chain
559
+ # @return [::Array<::String>]
560
+ # Output only. The chain that may be used to verify the X.509 certificate. Expected to be
561
+ # in issuer-to-root order according to RFC 5246.
562
+ # @!attribute [r] create_time
563
+ # @return [::Google::Protobuf::Timestamp]
564
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was created.
565
+ # @!attribute [r] update_time
566
+ # @return [::Google::Protobuf::Timestamp]
567
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was updated.
568
+ # @!attribute [rw] labels
569
+ # @return [::Google::Protobuf::Map{::String => ::String}]
570
+ # Optional. Labels with user-defined metadata.
571
+ class Certificate
572
+ include ::Google::Protobuf::MessageExts
573
+ extend ::Google::Protobuf::MessageExts::ClassMethods
574
+
575
+ # Describes fields that are relavent to the revocation of a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
576
+ # @!attribute [rw] revocation_state
577
+ # @return [::Google::Cloud::Security::PrivateCA::V1::RevocationReason]
578
+ # Indicates why a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked.
579
+ # @!attribute [rw] revocation_time
580
+ # @return [::Google::Protobuf::Timestamp]
581
+ # The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked.
582
+ class RevocationDetails
583
+ include ::Google::Protobuf::MessageExts
584
+ extend ::Google::Protobuf::MessageExts::ClassMethods
585
+ end
586
+
587
+ # @!attribute [rw] key
588
+ # @return [::String]
589
+ # @!attribute [rw] value
590
+ # @return [::String]
591
+ class LabelsEntry
592
+ include ::Google::Protobuf::MessageExts
593
+ extend ::Google::Protobuf::MessageExts::ClassMethods
594
+ end
595
+ end
596
+
597
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} refers to a managed template for certificate
598
+ # issuance.
599
+ # @!attribute [r] name
600
+ # @return [::String]
601
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} in the format
602
+ # `projects/*/locations/*/certificateTemplates/*`.
603
+ # @!attribute [rw] predefined_values
604
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
605
+ # Optional. A set of X.509 values that will be applied to all issued certificates that
606
+ # use this template. If the certificate request includes conflicting values
607
+ # for the same properties, they will be overwritten by the values defined
608
+ # here. If the issuing {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy}
609
+ # defines conflicting
610
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values} for the same
611
+ # properties, the certificate issuance request will fail.
612
+ # @!attribute [rw] identity_constraints
613
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateIdentityConstraints]
614
+ # Optional. Describes constraints on identities that may be appear in
615
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} issued using this template. If this is omitted,
616
+ # then this template will not add restrictions on a certificate's identity.
617
+ # @!attribute [rw] passthrough_extensions
618
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints]
619
+ # Optional. Describes the set of X.509 extensions that may appear in a
620
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued using this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}. If a certificate
621
+ # request sets extensions that don't appear in the
622
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#passthrough_extensions passthrough_extensions}, those extensions will be dropped. If the
623
+ # issuing {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy} defines
624
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values} that don't appear
625
+ # here, the certificate issuance request will fail. If this is omitted, then
626
+ # this template will not add restrictions on a certificate's X.509
627
+ # extensions. These constraints do not apply to X.509 extensions set in this
628
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}'s {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values}.
629
+ # @!attribute [rw] description
630
+ # @return [::String]
631
+ # Optional. A human-readable description of scenarios this template is intended for.
632
+ # @!attribute [r] create_time
633
+ # @return [::Google::Protobuf::Timestamp]
634
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} was created.
635
+ # @!attribute [r] update_time
636
+ # @return [::Google::Protobuf::Timestamp]
637
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} was updated.
638
+ # @!attribute [rw] labels
639
+ # @return [::Google::Protobuf::Map{::String => ::String}]
640
+ # Optional. Labels with user-defined metadata.
641
+ class CertificateTemplate
642
+ include ::Google::Protobuf::MessageExts
643
+ extend ::Google::Protobuf::MessageExts::ClassMethods
644
+
645
+ # @!attribute [rw] key
646
+ # @return [::String]
647
+ # @!attribute [rw] value
648
+ # @return [::String]
649
+ class LabelsEntry
650
+ include ::Google::Protobuf::MessageExts
651
+ extend ::Google::Protobuf::MessageExts::ClassMethods
652
+ end
653
+ end
654
+
655
+ # An {::Google::Cloud::Security::PrivateCA::V1::X509Parameters X509Parameters} is used to describe certain fields of an
656
+ # X.509 certificate, such as the key usage fields, fields specific to CA
657
+ # certificates, certificate policy extensions and custom extensions.
658
+ # @!attribute [rw] key_usage
659
+ # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage]
660
+ # Optional. Indicates the intended use for keys that correspond to a certificate.
661
+ # @!attribute [rw] ca_options
662
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters::CaOptions]
663
+ # Optional. Describes options in this {::Google::Cloud::Security::PrivateCA::V1::X509Parameters X509Parameters} that are relevant in a CA
664
+ # certificate.
665
+ # @!attribute [rw] policy_ids
666
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>]
667
+ # Optional. Describes the X.509 certificate policy object identifiers, per
668
+ # https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
669
+ # @!attribute [rw] aia_ocsp_servers
670
+ # @return [::Array<::String>]
671
+ # Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses
672
+ # that appear in the "Authority Information Access" extension in the
673
+ # certificate.
674
+ # @!attribute [rw] additional_extensions
675
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::X509Extension>]
676
+ # Optional. Describes custom X.509 extensions.
677
+ class X509Parameters
678
+ include ::Google::Protobuf::MessageExts
679
+ extend ::Google::Protobuf::MessageExts::ClassMethods
680
+
681
+ # Describes values that are relevant in a CA certificate.
682
+ # @!attribute [rw] is_ca
683
+ # @return [::Boolean]
684
+ # Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this
685
+ # value is missing, the extension will be omitted from the CA certificate.
686
+ # @!attribute [rw] max_issuer_path_length
687
+ # @return [::Integer]
688
+ # Optional. Refers to the path length restriction X.509 extension. For a CA
689
+ # certificate, this value describes the depth of subordinate CA
690
+ # certificates that are allowed.
691
+ # If this value is less than 0, the request will fail.
692
+ # If this value is missing, the max path length will be omitted from the
693
+ # CA certificate.
694
+ class CaOptions
695
+ include ::Google::Protobuf::MessageExts
696
+ extend ::Google::Protobuf::MessageExts::ClassMethods
697
+ end
698
+ end
699
+
700
+ # Describes a subordinate CA's issuers. This is either a resource name to a
701
+ # known issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, or a PEM issuer certificate chain.
702
+ # @!attribute [rw] certificate_authority
703
+ # @return [::String]
704
+ # Required. This can refer to a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the same project that
705
+ # was used to create a subordinate {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. This field
706
+ # is used for information and usability purposes only. The resource name
707
+ # is in the format
708
+ # `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
709
+ # @!attribute [rw] pem_issuer_chain
710
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubordinateConfig::SubordinateConfigChain]
711
+ # Required. Contains the PEM certificate chain for the issuers of this
712
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, but not pem certificate for this CA itself.
713
+ class SubordinateConfig
714
+ include ::Google::Protobuf::MessageExts
715
+ extend ::Google::Protobuf::MessageExts::ClassMethods
716
+
717
+ # This message describes a subordinate CA's issuer certificate chain. This
718
+ # wrapper exists for compatibility reasons.
719
+ # @!attribute [rw] pem_certificates
720
+ # @return [::Array<::String>]
721
+ # Required. Expected to be in leaf-to-root order according to RFC 5246.
722
+ class SubordinateConfigChain
723
+ include ::Google::Protobuf::MessageExts
724
+ extend ::Google::Protobuf::MessageExts::ClassMethods
725
+ end
726
+ end
727
+
728
+ # A {::Google::Cloud::Security::PrivateCA::V1::PublicKey PublicKey} describes a public key.
729
+ # @!attribute [rw] key
730
+ # @return [::String]
731
+ # Required. A public key. The padding and encoding
732
+ # must match with the `KeyFormat` value specified for the `format` field.
733
+ # @!attribute [rw] format
734
+ # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey::KeyFormat]
735
+ # Required. The format of the public key.
736
+ class PublicKey
737
+ include ::Google::Protobuf::MessageExts
738
+ extend ::Google::Protobuf::MessageExts::ClassMethods
739
+
740
+ # Types of public keys formats that are supported. Currently, only `PEM`
741
+ # format is supported.
742
+ module KeyFormat
743
+ # Default unspecified value.
744
+ KEY_FORMAT_UNSPECIFIED = 0
745
+
746
+ # The key is PEM-encoded as defined in [RFC
747
+ # 7468](https://tools.ietf.org/html/rfc7468). It can be any of the
748
+ # following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey
749
+ # structure, an RFC 5280
750
+ # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1)
751
+ # or a PEM-encoded X.509 certificate signing request (CSR). If a
752
+ # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1)
753
+ # is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey
754
+ # or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified,
755
+ # it will used solely for the purpose of extracting the public key. When
756
+ # generated by the service, it will always be an RFC 5280
757
+ # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1)
758
+ # structure containing an algorithm identifier and a key.
759
+ PEM = 1
760
+ end
761
+ end
762
+
763
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig} describes an X.509 certificate or CSR that is to be
764
+ # created, as an alternative to using ASN.1.
765
+ # @!attribute [rw] subject_config
766
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig::SubjectConfig]
767
+ # Required. Specifies some of the values in a certificate that are related to the
768
+ # subject.
769
+ # @!attribute [rw] x509_config
770
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
771
+ # Required. Describes how some of the technical X.509 fields in a certificate should be
772
+ # populated.
773
+ # @!attribute [rw] public_key
774
+ # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey]
775
+ # Optional. The public key that corresponds to this config. This is, for example, used
776
+ # when issuing {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}, but not when creating a
777
+ # self-signed {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} or {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} CSR.
778
+ class CertificateConfig
779
+ include ::Google::Protobuf::MessageExts
780
+ extend ::Google::Protobuf::MessageExts::ClassMethods
781
+
782
+ # These values are used to create the distinguished name and subject
783
+ # alternative name fields in an X.509 certificate.
784
+ # @!attribute [rw] subject
785
+ # @return [::Google::Cloud::Security::PrivateCA::V1::Subject]
786
+ # Required. Contains distinguished name fields such as the common name, location and
787
+ # organization.
788
+ # @!attribute [rw] subject_alt_name
789
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames]
790
+ # Optional. The subject alternative name fields.
791
+ class SubjectConfig
792
+ include ::Google::Protobuf::MessageExts
793
+ extend ::Google::Protobuf::MessageExts::ClassMethods
794
+ end
795
+ end
796
+
797
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateDescription CertificateDescription} describes an X.509 certificate or CSR that has
798
+ # been issued, as an alternative to using ASN.1 / X.509.
799
+ # @!attribute [rw] subject_description
800
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::SubjectDescription]
801
+ # Describes some of the values in a certificate that are related to the
802
+ # subject and lifetime.
803
+ # @!attribute [rw] x509_description
804
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
805
+ # Describes some of the technical X.509 fields in a certificate.
806
+ # @!attribute [rw] public_key
807
+ # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey]
808
+ # The public key that corresponds to an issued certificate.
809
+ # @!attribute [rw] subject_key_id
810
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::KeyId]
811
+ # Provides a means of identifiying certificates that contain a particular
812
+ # public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
813
+ # @!attribute [rw] authority_key_id
814
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::KeyId]
815
+ # Identifies the subject_key_id of the parent certificate, per
816
+ # https://tools.ietf.org/html/rfc5280#section-4.2.1.1
817
+ # @!attribute [rw] crl_distribution_points
818
+ # @return [::Array<::String>]
819
+ # Describes a list of locations to obtain CRL information, i.e.
820
+ # the DistributionPoint.fullName described by
821
+ # https://tools.ietf.org/html/rfc5280#section-4.2.1.13
822
+ # @!attribute [rw] aia_issuing_certificate_urls
823
+ # @return [::Array<::String>]
824
+ # Describes lists of issuer CA certificate URLs that appear in the
825
+ # "Authority Information Access" extension in the certificate.
826
+ # @!attribute [rw] cert_fingerprint
827
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::CertificateFingerprint]
828
+ # The hash of the x.509 certificate.
829
+ class CertificateDescription
830
+ include ::Google::Protobuf::MessageExts
831
+ extend ::Google::Protobuf::MessageExts::ClassMethods
832
+
833
+ # These values describe fields in an issued X.509 certificate such as the
834
+ # distinguished name, subject alternative names, serial number, and lifetime.
835
+ # @!attribute [rw] subject
836
+ # @return [::Google::Cloud::Security::PrivateCA::V1::Subject]
837
+ # Contains distinguished name fields such as the common name, location and
838
+ # / organization.
839
+ # @!attribute [rw] subject_alt_name
840
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames]
841
+ # The subject alternative name fields.
842
+ # @!attribute [rw] hex_serial_number
843
+ # @return [::String]
844
+ # The serial number encoded in lowercase hexadecimal.
845
+ # @!attribute [rw] lifetime
846
+ # @return [::Google::Protobuf::Duration]
847
+ # For convenience, the actual lifetime of an issued certificate.
848
+ # Corresponds to 'not_after_time' - 'not_before_time'.
849
+ # @!attribute [rw] not_before_time
850
+ # @return [::Google::Protobuf::Timestamp]
851
+ # The time at which the certificate becomes valid.
852
+ # @!attribute [rw] not_after_time
853
+ # @return [::Google::Protobuf::Timestamp]
854
+ # The time at which the certificate expires.
855
+ class SubjectDescription
856
+ include ::Google::Protobuf::MessageExts
857
+ extend ::Google::Protobuf::MessageExts::ClassMethods
858
+ end
859
+
860
+ # A KeyId identifies a specific public key, usually by hashing the public
861
+ # key.
862
+ # @!attribute [rw] key_id
863
+ # @return [::String]
864
+ # Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most
865
+ # likely the 160 bit SHA-1 hash of the public key.
866
+ class KeyId
867
+ include ::Google::Protobuf::MessageExts
868
+ extend ::Google::Protobuf::MessageExts::ClassMethods
869
+ end
870
+
871
+ # A group of fingerprints for the x509 certificate.
872
+ # @!attribute [rw] sha256_hash
873
+ # @return [::String]
874
+ # The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
875
+ class CertificateFingerprint
876
+ include ::Google::Protobuf::MessageExts
877
+ extend ::Google::Protobuf::MessageExts::ClassMethods
878
+ end
879
+ end
880
+
881
+ # An {::Google::Cloud::Security::PrivateCA::V1::ObjectId ObjectId} specifies an object identifier (OID). These provide context
882
+ # and describe types in ASN.1 messages.
883
+ # @!attribute [rw] object_id_path
884
+ # @return [::Array<::Integer>]
885
+ # Required. The parts of an OID path. The most significant parts of the path come
886
+ # first.
887
+ class ObjectId
888
+ include ::Google::Protobuf::MessageExts
889
+ extend ::Google::Protobuf::MessageExts::ClassMethods
890
+ end
891
+
892
+ # An {::Google::Cloud::Security::PrivateCA::V1::X509Extension X509Extension} specifies an X.509 extension, which may be used in
893
+ # different parts of X.509 objects like certificates, CSRs, and CRLs.
894
+ # @!attribute [rw] object_id
895
+ # @return [::Google::Cloud::Security::PrivateCA::V1::ObjectId]
896
+ # Required. The OID for this X.509 extension.
897
+ # @!attribute [rw] critical
898
+ # @return [::Boolean]
899
+ # Required. Indicates whether or not this extension is critical (i.e., if the client
900
+ # does not know how to handle this extension, the client should consider this
901
+ # to be an error).
902
+ # @!attribute [rw] value
903
+ # @return [::String]
904
+ # Required. The value of this X.509 extension.
905
+ class X509Extension
906
+ include ::Google::Protobuf::MessageExts
907
+ extend ::Google::Protobuf::MessageExts::ClassMethods
908
+ end
909
+
910
+ # A {::Google::Cloud::Security::PrivateCA::V1::KeyUsage KeyUsage} describes key usage values that may appear in an X.509
911
+ # certificate.
912
+ # @!attribute [rw] base_key_usage
913
+ # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage::KeyUsageOptions]
914
+ # Describes high-level ways in which a key may be used.
915
+ # @!attribute [rw] extended_key_usage
916
+ # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions]
917
+ # Detailed scenarios in which a key may be used.
918
+ # @!attribute [rw] unknown_extended_key_usages
919
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>]
920
+ # Used to describe extended key usages that are not listed in the
921
+ # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} message.
922
+ class KeyUsage
923
+ include ::Google::Protobuf::MessageExts
924
+ extend ::Google::Protobuf::MessageExts::ClassMethods
925
+
926
+ # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::KeyUsageOptions KeyUsage.KeyUsageOptions} corresponds to the key usage values
927
+ # described in https://tools.ietf.org/html/rfc5280#section-4.2.1.3.
928
+ # @!attribute [rw] digital_signature
929
+ # @return [::Boolean]
930
+ # The key may be used for digital signatures.
931
+ # @!attribute [rw] content_commitment
932
+ # @return [::Boolean]
933
+ # The key may be used for cryptographic commitments. Note that this may
934
+ # also be referred to as "non-repudiation".
935
+ # @!attribute [rw] key_encipherment
936
+ # @return [::Boolean]
937
+ # The key may be used to encipher other keys.
938
+ # @!attribute [rw] data_encipherment
939
+ # @return [::Boolean]
940
+ # The key may be used to encipher data.
941
+ # @!attribute [rw] key_agreement
942
+ # @return [::Boolean]
943
+ # The key may be used in a key agreement protocol.
944
+ # @!attribute [rw] cert_sign
945
+ # @return [::Boolean]
946
+ # The key may be used to sign certificates.
947
+ # @!attribute [rw] crl_sign
948
+ # @return [::Boolean]
949
+ # The key may be used sign certificate revocation lists.
950
+ # @!attribute [rw] encipher_only
951
+ # @return [::Boolean]
952
+ # The key may be used to encipher only.
953
+ # @!attribute [rw] decipher_only
954
+ # @return [::Boolean]
955
+ # The key may be used to decipher only.
956
+ class KeyUsageOptions
957
+ include ::Google::Protobuf::MessageExts
958
+ extend ::Google::Protobuf::MessageExts::ClassMethods
959
+ end
960
+
961
+ # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} has fields that correspond to
962
+ # certain common OIDs that could be specified as an extended key usage value.
963
+ # @!attribute [rw] server_auth
964
+ # @return [::Boolean]
965
+ # Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW
966
+ # server authentication", though regularly used for non-WWW TLS.
967
+ # @!attribute [rw] client_auth
968
+ # @return [::Boolean]
969
+ # Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW
970
+ # client authentication", though regularly used for non-WWW TLS.
971
+ # @!attribute [rw] code_signing
972
+ # @return [::Boolean]
973
+ # Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of
974
+ # downloadable executable code client authentication".
975
+ # @!attribute [rw] email_protection
976
+ # @return [::Boolean]
977
+ # Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email
978
+ # protection".
979
+ # @!attribute [rw] time_stamping
980
+ # @return [::Boolean]
981
+ # Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding
982
+ # the hash of an object to a time".
983
+ # @!attribute [rw] ocsp_signing
984
+ # @return [::Boolean]
985
+ # Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing
986
+ # OCSP responses".
987
+ class ExtendedKeyUsageOptions
988
+ include ::Google::Protobuf::MessageExts
989
+ extend ::Google::Protobuf::MessageExts::ClassMethods
990
+ end
991
+ end
992
+
993
+ # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} describes parts of a distinguished name that, in turn,
994
+ # describes the subject of the certificate.
995
+ # @!attribute [rw] common_name
996
+ # @return [::String]
997
+ # The "common name" of the subject.
998
+ # @!attribute [rw] country_code
999
+ # @return [::String]
1000
+ # The country code of the subject.
1001
+ # @!attribute [rw] organization
1002
+ # @return [::String]
1003
+ # The organization of the subject.
1004
+ # @!attribute [rw] organizational_unit
1005
+ # @return [::String]
1006
+ # The organizational_unit of the subject.
1007
+ # @!attribute [rw] locality
1008
+ # @return [::String]
1009
+ # The locality or city of the subject.
1010
+ # @!attribute [rw] province
1011
+ # @return [::String]
1012
+ # The province, territory, or regional state of the subject.
1013
+ # @!attribute [rw] street_address
1014
+ # @return [::String]
1015
+ # The street address of the subject.
1016
+ # @!attribute [rw] postal_code
1017
+ # @return [::String]
1018
+ # The postal code of the subject.
1019
+ class Subject
1020
+ include ::Google::Protobuf::MessageExts
1021
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1022
+ end
1023
+
1024
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} corresponds to a more modern way of listing what
1025
+ # the asserted identity is in a certificate (i.e., compared to the "common
1026
+ # name" in the distinguished name).
1027
+ # @!attribute [rw] dns_names
1028
+ # @return [::Array<::String>]
1029
+ # Contains only valid, fully-qualified host names.
1030
+ # @!attribute [rw] uris
1031
+ # @return [::Array<::String>]
1032
+ # Contains only valid RFC 3986 URIs.
1033
+ # @!attribute [rw] email_addresses
1034
+ # @return [::Array<::String>]
1035
+ # Contains only valid RFC 2822 E-mail addresses.
1036
+ # @!attribute [rw] ip_addresses
1037
+ # @return [::Array<::String>]
1038
+ # Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
1039
+ # @!attribute [rw] custom_sans
1040
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::X509Extension>]
1041
+ # Contains additional subject alternative name values.
1042
+ class SubjectAltNames
1043
+ include ::Google::Protobuf::MessageExts
1044
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1045
+ end
1046
+
1047
+ # Describes constraints on a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and
1048
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames}.
1049
+ # @!attribute [rw] cel_expression
1050
+ # @return [::Google::Type::Expr]
1051
+ # Optional. A CEL expression that may be used to validate the resolved X.509 Subject
1052
+ # and/or Subject Alternative Name before a certificate is signed.
1053
+ # To see the full allowed syntax and some examples, see
1054
+ # https://cloud.google.com/certificate-authority-service/docs/cel-guide
1055
+ # @!attribute [rw] allow_subject_passthrough
1056
+ # @return [::Boolean]
1057
+ # Required. If this is true, the {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} field may be copied from a certificate
1058
+ # request into the signed certificate. Otherwise, the requested {::Google::Cloud::Security::PrivateCA::V1::Subject Subject}
1059
+ # will be discarded. The bool is optional to indicate an unset field, which suggests a forgotten value that needs to be set by the caller.
1060
+ # @!attribute [rw] allow_subject_alt_names_passthrough
1061
+ # @return [::Boolean]
1062
+ # Required. If this is true, the {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} extension may be copied from a
1063
+ # certificate request into the signed certificate. Otherwise, the requested
1064
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} will be discarded.
1065
+ # The bool is optional to indicate an unset field, which suggests a forgotten value that needs to be set by the caller.
1066
+ class CertificateIdentityConstraints
1067
+ include ::Google::Protobuf::MessageExts
1068
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1069
+ end
1070
+
1071
+ # Describes a set of X.509 extensions that may be part of some certificate
1072
+ # issuance controls.
1073
+ # @!attribute [rw] known_extensions
1074
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints::KnownCertificateExtension>]
1075
+ # Optional. A set of named X.509 extensions. Will be combined with
1076
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints#additional_extensions additional_extensions} to determine the full set of X.509 extensions.
1077
+ # @!attribute [rw] additional_extensions
1078
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>]
1079
+ # Optional. A set of {::Google::Cloud::Security::PrivateCA::V1::ObjectId ObjectIds} identifying custom X.509 extensions.
1080
+ # Will be combined with {::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints#known_extensions known_extensions} to determine the full set of
1081
+ # X.509 extensions.
1082
+ class CertificateExtensionConstraints
1083
+ include ::Google::Protobuf::MessageExts
1084
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1085
+
1086
+ # Describes well-known X.509 extensions that can appear in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate},
1087
+ # not including the {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} extension.
1088
+ module KnownCertificateExtension
1089
+ # Not specified.
1090
+ KNOWN_CERTIFICATE_EXTENSION_UNSPECIFIED = 0
1091
+
1092
+ # Refers to a certificate's Key Usage extension, as described in [RFC 5280
1093
+ # section 4.2.1.3](https://tools.ietf.org/html/rfc5280#section-4.2.1.3).
1094
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::KeyUsage#base_key_usage KeyUsage.base_key_usage} field.
1095
+ BASE_KEY_USAGE = 1
1096
+
1097
+ # Refers to a certificate's Extended Key Usage extension, as described in
1098
+ # [RFC 5280
1099
+ # section 4.2.1.12](https://tools.ietf.org/html/rfc5280#section-4.2.1.12).
1100
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::KeyUsage#extended_key_usage KeyUsage.extended_key_usage} message.
1101
+ EXTENDED_KEY_USAGE = 2
1102
+
1103
+ # Refers to a certificate's Basic Constraints extension, as described in
1104
+ # [RFC 5280
1105
+ # section 4.2.1.9](https://tools.ietf.org/html/rfc5280#section-4.2.1.9).
1106
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#ca_options X509Parameters.ca_options} field.
1107
+ CA_OPTIONS = 3
1108
+
1109
+ # Refers to a certificate's Policy object identifiers, as described in
1110
+ # [RFC 5280
1111
+ # section 4.2.1.4](https://tools.ietf.org/html/rfc5280#section-4.2.1.4).
1112
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#policy_ids X509Parameters.policy_ids} field.
1113
+ POLICY_IDS = 4
1114
+
1115
+ # Refers to OCSP servers in a certificate's Authority Information Access
1116
+ # extension, as described in
1117
+ # [RFC 5280
1118
+ # section 4.2.2.1](https://tools.ietf.org/html/rfc5280#section-4.2.2.1),
1119
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#aia_ocsp_servers X509Parameters.aia_ocsp_servers} field.
1120
+ AIA_OCSP_SERVERS = 5
1121
+ end
1122
+ end
1123
+
1124
+ # A {::Google::Cloud::Security::PrivateCA::V1::RevocationReason RevocationReason} indicates whether a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} has been revoked,
1125
+ # and the reason for revocation. These correspond to standard revocation
1126
+ # reasons from RFC 5280. Note that the enum labels and values in this
1127
+ # definition are not the same ASN.1 values defined in RFC 5280. These values
1128
+ # will be translated to the correct ASN.1 values when a CRL is created.
1129
+ module RevocationReason
1130
+ # Default unspecified value. This value does indicate that a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}
1131
+ # has been revoked, but that a reason has not been recorded.
1132
+ REVOCATION_REASON_UNSPECIFIED = 0
1133
+
1134
+ # Key material for this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} may have leaked.
1135
+ KEY_COMPROMISE = 1
1136
+
1137
+ # The key material for a certificate authority in the issuing path may have
1138
+ # leaked.
1139
+ CERTIFICATE_AUTHORITY_COMPROMISE = 2
1140
+
1141
+ # The subject or other attributes in this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} have changed.
1142
+ AFFILIATION_CHANGED = 3
1143
+
1144
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} has been superseded.
1145
+ SUPERSEDED = 4
1146
+
1147
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} or entities in the issuing path have ceased to
1148
+ # operate.
1149
+ CESSATION_OF_OPERATION = 5
1150
+
1151
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} should not be considered valid, it is expected that it
1152
+ # may become valid in the future.
1153
+ CERTIFICATE_HOLD = 6
1154
+
1155
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} no longer has permission to assert the listed
1156
+ # attributes.
1157
+ PRIVILEGE_WITHDRAWN = 7
1158
+
1159
+ # The authority which determines appropriate attributes for a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}
1160
+ # may have been compromised.
1161
+ ATTRIBUTE_AUTHORITY_COMPROMISE = 8
1162
+ end
1163
+
1164
+ # Describes the way in which a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or
1165
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} will be resolved.
1166
+ module SubjectRequestMode
1167
+ # Not specified.
1168
+ SUBJECT_REQUEST_MODE_UNSPECIFIED = 0
1169
+
1170
+ # The default mode used in most cases. Indicates that the certificate's
1171
+ # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} are specified in the certificate
1172
+ # request. This mode requires the caller to have the
1173
+ # `privateca.certificates.create` permission.
1174
+ DEFAULT = 1
1175
+
1176
+ # A mode reserved for special cases. Indicates that the certificate should
1177
+ # have one or more SPIFFE {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} set by the service based
1178
+ # on the caller's identity. This mode will ignore any explicitly specified
1179
+ # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} in the certificate request.
1180
+ # This mode requires the caller to have the
1181
+ # `privateca.certificates.createForSelf` permission.
1182
+ REFLECTED_SPIFFE = 2
1183
+ end
1184
+ end
1185
+ end
1186
+ end
1187
+ end
1188
+ end