google-cloud-security-private_ca-v1 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. checksums.yaml +7 -0
  2. data/.yardopts +12 -0
  3. data/AUTHENTICATION.md +169 -0
  4. data/LICENSE.md +201 -0
  5. data/README.md +139 -0
  6. data/lib/google-cloud-security-private_ca-v1.rb +21 -0
  7. data/lib/google/cloud/security/private_ca/v1.rb +40 -0
  8. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service.rb +53 -0
  9. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/client.rb +2891 -0
  10. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/credentials.rb +53 -0
  11. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/operations.rb +657 -0
  12. data/lib/google/cloud/security/private_ca/v1/certificate_authority_service/paths.rb +155 -0
  13. data/lib/google/cloud/security/private_ca/v1/version.rb +30 -0
  14. data/lib/google/cloud/security/privateca/v1/resources_pb.rb +368 -0
  15. data/lib/google/cloud/security/privateca/v1/service_pb.rb +254 -0
  16. data/lib/google/cloud/security/privateca/v1/service_services_pb.rb +119 -0
  17. data/proto_docs/README.md +4 -0
  18. data/proto_docs/google/api/field_behavior.rb +65 -0
  19. data/proto_docs/google/api/resource.rb +283 -0
  20. data/proto_docs/google/cloud/security/privateca/v1/resources.rb +1188 -0
  21. data/proto_docs/google/cloud/security/privateca/v1/service.rb +934 -0
  22. data/proto_docs/google/longrunning/operations.rb +164 -0
  23. data/proto_docs/google/protobuf/any.rb +141 -0
  24. data/proto_docs/google/protobuf/duration.rb +98 -0
  25. data/proto_docs/google/protobuf/empty.rb +36 -0
  26. data/proto_docs/google/protobuf/field_mask.rb +229 -0
  27. data/proto_docs/google/protobuf/timestamp.rb +129 -0
  28. data/proto_docs/google/rpc/status.rb +46 -0
  29. data/proto_docs/google/type/expr.rb +75 -0
  30. metadata +221 -0
data/proto_docs/google/cloud/security/privateca/v1/resources.rb ADDED
@@ -0,0 +1,1188 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2021 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Cloud
22
+ module Security
23
+ module PrivateCA
24
+ module V1
25
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} represents an individual Certificate Authority.
26
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} can be used to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}.
27
+ # @!attribute [r] name
28
+ # @return [::String]
29
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the
30
+ # format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
31
+ # @!attribute [rw] type
32
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::Type]
33
+ # Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::Type Type} of this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
34
+ # @!attribute [rw] config
35
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig]
36
+ # Required. Immutable. The config used to create a self-signed X.509 certificate or CSR.
37
+ # @!attribute [rw] lifetime
38
+ # @return [::Google::Protobuf::Duration]
39
+ # Required. The desired lifetime of the CA certificate. Used to create the
40
+ # "not_before_time" and "not_after_time" fields inside an X.509
41
+ # certificate.
42
+ # @!attribute [rw] key_spec
43
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::KeyVersionSpec]
44
+ # Required. Immutable. Used when issuing certificates for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. If this
45
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} is a self-signed CertificateAuthority, this key
46
+ # is also used to sign the self-signed CA certificate. Otherwise, it
47
+ # is used to sign a CSR.
48
+ # @!attribute [rw] subordinate_config
49
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubordinateConfig]
50
+ # Optional. If this is a subordinate {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, this field will be set
51
+ # with the subordinate configuration, which describes its issuers. This may
52
+ # be updated, but this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} must continue to validate.
53
+ # @!attribute [r] tier
54
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier]
55
+ # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier CaPool.Tier} of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} that includes this
56
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
57
+ # @!attribute [r] state
58
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State]
59
+ # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State State} for this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
60
+ # @!attribute [r] pem_ca_certificates
61
+ # @return [::Array<::String>]
62
+ # Output only. This {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate chain, including the current
63
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate. Ordered such that the root issuer
64
+ # is the final element (consistent with RFC 5246). For a self-signed CA, this
65
+ # will only list the current {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s certificate.
66
+ # @!attribute [r] ca_certificate_descriptions
67
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateDescription>]
68
+ # Output only. A structured description of this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate
69
+ # and its issuers. Ordered as self-to-root.
70
+ # @!attribute [rw] gcs_bucket
71
+ # @return [::String]
72
+ # Immutable. The name of a Cloud Storage bucket where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will
73
+ # publish content, such as the CA certificate and CRLs. This must be a bucket
74
+ # name, without any prefixes (such as `gs://`) or suffixes (such as
75
+ # `.googleapis.com`). For example, to use a bucket named `my-bucket`, you
76
+ # would simply specify `my-bucket`. If not specified, a managed bucket will
77
+ # be created.
78
+ # @!attribute [r] access_urls
79
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::AccessUrls]
80
+ # Output only. URLs for accessing content published by this CA, such as the CA certificate
81
+ # and CRLs.
82
+ # @!attribute [r] create_time
83
+ # @return [::Google::Protobuf::Timestamp]
84
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was created.
85
+ # @!attribute [r] update_time
86
+ # @return [::Google::Protobuf::Timestamp]
87
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was last updated.
88
+ # @!attribute [r] delete_time
89
+ # @return [::Google::Protobuf::Timestamp]
90
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} was soft deleted, if
91
+ # it is in the {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State::DELETED DELETED} state.
92
+ # @!attribute [r] expire_time
93
+ # @return [::Google::Protobuf::Timestamp]
94
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will be permanently purged,
95
+ # if it is in the {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::State::DELETED DELETED} state.
96
+ # @!attribute [rw] labels
97
+ # @return [::Google::Protobuf::Map{::String => ::String}]
98
+ # Optional. Labels with user-defined metadata.
99
+ class CertificateAuthority
100
+ include ::Google::Protobuf::MessageExts
101
+ extend ::Google::Protobuf::MessageExts::ClassMethods
102
+
103
+ # URLs where a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will publish content.
104
+ # @!attribute [rw] ca_certificate_access_url
105
+ # @return [::String]
106
+ # The URL where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate is
107
+ # published. This will only be set for CAs that have been activated.
108
+ # @!attribute [rw] crl_access_urls
109
+ # @return [::Array<::String>]
110
+ # The URLs where this {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CRLs are published. This
111
+ # will only be set for CAs that have been activated.
112
+ class AccessUrls
113
+ include ::Google::Protobuf::MessageExts
114
+ extend ::Google::Protobuf::MessageExts::ClassMethods
115
+ end
116
+
117
+ # A Cloud KMS key configuration that a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} will use.
118
+ # @!attribute [rw] cloud_kms_key_version
119
+ # @return [::String]
120
+ # The resource name for an existing Cloud KMS CryptoKeyVersion in the
121
+ # format
122
+ # `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
123
+ # This option enables full flexibility in the key's capabilities and
124
+ # properties.
125
+ # @!attribute [rw] algorithm
126
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority::SignHashAlgorithm]
127
+ # The algorithm to use for creating a managed Cloud KMS key for a for a
128
+ # simplified experience. All managed keys will be have their
129
+ # [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`.
130
+ class KeyVersionSpec
131
+ include ::Google::Protobuf::MessageExts
132
+ extend ::Google::Protobuf::MessageExts::ClassMethods
133
+ end
134
+
135
+ # @!attribute [rw] key
136
+ # @return [::String]
137
+ # @!attribute [rw] value
138
+ # @return [::String]
139
+ class LabelsEntry
140
+ include ::Google::Protobuf::MessageExts
141
+ extend ::Google::Protobuf::MessageExts::ClassMethods
142
+ end
143
+
144
+ # The type of a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, indicating its issuing chain.
145
+ module Type
146
+ # Not specified.
147
+ TYPE_UNSPECIFIED = 0
148
+
149
+ # Self-signed CA.
150
+ SELF_SIGNED = 1
151
+
152
+ # Subordinate CA. Could be issued by a Private CA {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}
153
+ # or an unmanaged CA.
154
+ SUBORDINATE = 2
155
+ end
156
+
157
+ # The state of a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, indicating if it can be used.
158
+ module State
159
+ # Not specified.
160
+ STATE_UNSPECIFIED = 0
161
+
162
+ # Certificates can be issued from this CA. CRLs will be generated for this
163
+ # CA. The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will be
164
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
165
+ ENABLED = 1
166
+
167
+ # Certificates cannot be issued from this CA. CRLs will still be generated.
168
+ # The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, but will not be
169
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
170
+ DISABLED = 2
171
+
172
+ # Certificates can be issued from this CA. CRLs will be generated for this
173
+ # CA. The CA will be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, but will not
174
+ # be used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
175
+ STAGED = 3
176
+
177
+ # Certificates cannot be issued from this CA. CRLs will not be generated.
178
+ # The CA will not be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will not be
179
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
180
+ AWAITING_USER_ACTIVATION = 4
181
+
182
+ # Certificates cannot be issued from this CA. CRLs will not be generated.
183
+ # The CA may still be recovered by calling
184
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthorityService::Client#undelete_certificate_authority CertificateAuthorityService.UndeleteCertificateAuthority} before
185
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority#expire_time expire_time}.
186
+ # The CA will not be part of the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s trust anchor, and will not be
187
+ # used to issue certificates from the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
188
+ DELETED = 5
189
+ end
190
+
191
+ # The algorithm of a Cloud KMS CryptoKeyVersion of a
192
+ # [CryptoKey][google.cloud.kms.v1.CryptoKey] with the
193
+ # [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] value
194
+ # `ASYMMETRIC_SIGN`. These values correspond to the
195
+ # [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
196
+ # values. For RSA signing algorithms, the PSS algorithms should be preferred,
197
+ # use PKCS1 algorithms if required for compatibility. For further
198
+ # recommandations, see
199
+ # https://cloud.google.com/kms/docs/algorithms#algorithm_recommendations.
200
+ module SignHashAlgorithm
201
+ # Not specified.
202
+ SIGN_HASH_ALGORITHM_UNSPECIFIED = 0
203
+
204
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256
205
+ RSA_PSS_2048_SHA256 = 1
206
+
207
+ # maps to CryptoKeyVersionAlgorithm. RSA_SIGN_PSS_3072_SHA256
208
+ RSA_PSS_3072_SHA256 = 2
209
+
210
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_4096_SHA256
211
+ RSA_PSS_4096_SHA256 = 3
212
+
213
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_2048_SHA256
214
+ RSA_PKCS1_2048_SHA256 = 6
215
+
216
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_3072_SHA256
217
+ RSA_PKCS1_3072_SHA256 = 7
218
+
219
+ # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_4096_SHA256
220
+ RSA_PKCS1_4096_SHA256 = 8
221
+
222
+ # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256
223
+ EC_P256_SHA256 = 4
224
+
225
+ # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P384_SHA384
226
+ EC_P384_SHA384 = 5
227
+ end
228
+ end
229
+
230
+ # A {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} represents a group of
231
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthorities} that form a trust anchor. A
232
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} can be used to manage issuance policies for one or more
233
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} resources and to rotate CA certificates in and out
234
+ # of the trust anchor.
235
+ # @!attribute [r] name
236
+ # @return [::String]
237
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} in the
238
+ # format `projects/*/locations/*/caPools/*`.
239
+ # @!attribute [rw] tier
240
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier]
241
+ # Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::Tier Tier} of this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
242
+ # @!attribute [rw] issuance_policy
243
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy]
244
+ # Optional. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy} to control how {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}
245
+ # will be issued from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
246
+ # @!attribute [rw] publishing_options
247
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::PublishingOptions]
248
+ # Optional. The {::Google::Cloud::Security::PrivateCA::V1::CaPool::PublishingOptions PublishingOptions} to follow when issuing
249
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} from any {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in this
250
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
251
+ # @!attribute [rw] labels
252
+ # @return [::Google::Protobuf::Map{::String => ::String}]
253
+ # Optional. Labels with user-defined metadata.
254
+ class CaPool
255
+ include ::Google::Protobuf::MessageExts
256
+ extend ::Google::Protobuf::MessageExts::ClassMethods
257
+
258
+ # Options relating to the publication of each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA
259
+ # certificate and CRLs and their inclusion as extensions in issued
260
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. The options set here apply to certificates
261
+ # issued by any {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
262
+ # @!attribute [rw] publish_ca_cert
263
+ # @return [::Boolean]
264
+ # Required. When true, publishes each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CA certificate and
265
+ # includes its URL in the "Authority Information Access" X.509 extension
266
+ # in all issued {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. If this is false, the CA
267
+ # certificate will not be published and the corresponding X.509 extension
268
+ # will not be written in issued certificates.
269
+ # @!attribute [rw] publish_crl
270
+ # @return [::Boolean]
271
+ # Required. When true, publishes each {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}'s CRL and includes its
272
+ # URL in the "CRL Distribution Points" X.509 extension in all issued
273
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. If this is false, CRLs will not be published
274
+ # and the corresponding X.509 extension will not be written in issued
275
+ # certificates.
276
+ # CRLs will expire 7 days from their creation. However, we will rebuild
277
+ # daily. CRLs are also rebuilt shortly after a certificate is revoked.
278
+ class PublishingOptions
279
+ include ::Google::Protobuf::MessageExts
280
+ extend ::Google::Protobuf::MessageExts::ClassMethods
281
+ end
282
+
283
+ # Defines controls over all certificate issuance within a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
284
+ # @!attribute [rw] allowed_key_types
285
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType>]
286
+ # Optional. If any {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType} is specified, then the certificate request's
287
+ # public key must match one of the key types listed here. Otherwise,
288
+ # any key may be used.
289
+ # @!attribute [rw] maximum_lifetime
290
+ # @return [::Google::Protobuf::Duration]
291
+ # Optional. The maximum lifetime allowed for issued {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}. Note
292
+ # that if the issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} expires before a
293
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s requested maximum_lifetime, the effective lifetime will
294
+ # be explicitly truncated to match it.
295
+ # @!attribute [rw] allowed_issuance_modes
296
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes]
297
+ # Optional. If specified, then only methods allowed in the {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes} may be
298
+ # used to issue {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}.
299
+ # @!attribute [rw] baseline_values
300
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
301
+ # Optional. A set of X.509 values that will be applied to all certificates issued
302
+ # through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. If a certificate request includes conflicting
303
+ # values for the same properties, they will be overwritten by the values
304
+ # defined here. If a certificate request uses a {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}
305
+ # that defines conflicting
306
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values} for the same
307
+ # properties, the certificate issuance request will fail.
308
+ # @!attribute [rw] identity_constraints
309
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateIdentityConstraints]
310
+ # Optional. Describes constraints on identities that may appear in
311
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} issued through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
312
+ # If this is omitted, then this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} will not add restrictions on a
313
+ # certificate's identity.
314
+ # @!attribute [rw] passthrough_extensions
315
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints]
316
+ # Optional. Describes the set of X.509 extensions that may appear in a
317
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued through this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. If a certificate request
318
+ # sets extensions that don't appear in the {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#passthrough_extensions passthrough_extensions},
319
+ # those extensions will be dropped. If a certificate request uses a
320
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} with
321
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values} that don't
322
+ # appear here, the certificate issuance request will fail. If this is
323
+ # omitted, then this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool} will not add restrictions on a
324
+ # certificate's X.509 extensions. These constraints do not apply to X.509
325
+ # extensions set in this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values}.
326
+ class IssuancePolicy
327
+ include ::Google::Protobuf::MessageExts
328
+ extend ::Google::Protobuf::MessageExts::ClassMethods
329
+
330
+ # Describes a "type" of key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
331
+ # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
332
+ # Note that a single {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType} may refer to either a
333
+ # fully-qualified key algorithm, such as RSA 4096, or a family of key
334
+ # algorithms, such as any RSA key.
335
+ # @!attribute [rw] rsa
336
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
337
+ # Represents an allowed RSA key type.
338
+ # @!attribute [rw] elliptic_curve
339
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
340
+ # Represents an allowed Elliptic Curve key type.
341
+ class AllowedKeyType
342
+ include ::Google::Protobuf::MessageExts
343
+ extend ::Google::Protobuf::MessageExts::ClassMethods
344
+
345
+ # Describes an RSA key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
346
+ # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
347
+ # @!attribute [rw] min_modulus_size
348
+ # @return [::Integer]
349
+ # Optional. The minimum allowed RSA modulus size, in bits. If this is not set,
350
+ # or if set to zero, the service-level min RSA modulus size will
351
+ # continue to apply.
352
+ # @!attribute [rw] max_modulus_size
353
+ # @return [::Integer]
354
+ # Optional. The maximum allowed RSA modulus size, in bits. If this is not set,
355
+ # or if set to zero, the service will not enforce an explicit upper
356
+ # bound on RSA modulus sizes.
357
+ class RsaKeyType
358
+ include ::Google::Protobuf::MessageExts
359
+ extend ::Google::Protobuf::MessageExts::ClassMethods
360
+ end
361
+
362
+ # Describes an Elliptic Curve key that may be used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}
363
+ # issued from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
364
+ # @!attribute [rw] signature_algorithm
365
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
366
+ # Optional. A signature algorithm that must be used. If this is omitted, any
367
+ # EC-based signature algorithm will be allowed.
368
+ class EcKeyType
369
+ include ::Google::Protobuf::MessageExts
370
+ extend ::Google::Protobuf::MessageExts::ClassMethods
371
+
372
+ # Describes an elliptic curve-based signature algorithm that may be
373
+ # used in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
374
+ module EcSignatureAlgorithm
375
+ # Not specified. Signifies that any signature algorithm may be used.
376
+ EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0
377
+
378
+ # Refers to the Elliptic Curve Digital Signature Algorithm over the
379
+ # NIST P-256 curve.
380
+ ECDSA_P256 = 1
381
+
382
+ # Refers to the Elliptic Curve Digital Signature Algorithm over the
383
+ # NIST P-384 curve.
384
+ ECDSA_P384 = 2
385
+
386
+ # Refers to the Edwards-curve Digital Signature Algorithm over curve
387
+ # 25519, as described in RFC 8410.
388
+ EDDSA_25519 = 3
389
+ end
390
+ end
391
+ end
392
+
393
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes} specifies the allowed ways in which
394
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be requested from this
395
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
396
+ # @!attribute [rw] allow_csr_based_issuance
397
+ # @return [::Boolean]
398
+ # Required. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
399
+ # specifying a CSR.
400
+ # @!attribute [rw] allow_config_based_issuance
401
+ # @return [::Boolean]
402
+ # Required. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
403
+ # specifying a {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
404
+ class IssuanceModes
405
+ include ::Google::Protobuf::MessageExts
406
+ extend ::Google::Protobuf::MessageExts::ClassMethods
407
+ end
408
+ end
409
+
410
+ # @!attribute [rw] key
411
+ # @return [::String]
412
+ # @!attribute [rw] value
413
+ # @return [::String]
414
+ class LabelsEntry
415
+ include ::Google::Protobuf::MessageExts
416
+ extend ::Google::Protobuf::MessageExts::ClassMethods
417
+ end
418
+
419
+ # The tier of a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}, indicating its supported functionality and/or
420
+ # billing SKU.
421
+ module Tier
422
+ # Not specified.
423
+ TIER_UNSPECIFIED = 0
424
+
425
+ # Enterprise tier.
426
+ ENTERPRISE = 1
427
+
428
+ # DevOps tier.
429
+ DEVOPS = 2
430
+ end
431
+ end
432
+
433
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} corresponds to a signed X.509 certificate
434
+ # Revocation List (CRL). A CRL contains the serial numbers of certificates that
435
+ # should no longer be trusted.
436
+ # @!attribute [r] name
437
+ # @return [::String]
438
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} in
439
+ # the format
440
+ # `projects/*/locations/*/caPools/*certificateAuthorities/*/
441
+ # certificateRevocationLists/*`.
442
+ # @!attribute [r] sequence_number
443
+ # @return [::Integer]
444
+ # Output only. The CRL sequence number that appears in pem_crl.
445
+ # @!attribute [r] revoked_certificates
446
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::RevokedCertificate>]
447
+ # Output only. The revoked serial numbers that appear in pem_crl.
448
+ # @!attribute [r] pem_crl
449
+ # @return [::String]
450
+ # Output only. The PEM-encoded X.509 CRL.
451
+ # @!attribute [r] access_url
452
+ # @return [::String]
453
+ # Output only. The location where 'pem_crl' can be accessed.
454
+ # @!attribute [r] state
455
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::State]
456
+ # Output only. The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList::State State} for this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}.
457
+ # @!attribute [r] create_time
458
+ # @return [::Google::Protobuf::Timestamp]
459
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} was created.
460
+ # @!attribute [r] update_time
461
+ # @return [::Google::Protobuf::Timestamp]
462
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} was updated.
463
+ # @!attribute [r] revision_id
464
+ # @return [::String]
465
+ # Output only. The revision ID of this {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}. A new revision is
466
+ # committed whenever a new CRL is published. The format is an 8-character
467
+ # hexadecimal string.
468
+ # @!attribute [rw] labels
469
+ # @return [::Google::Protobuf::Map{::String => ::String}]
470
+ # Optional. Labels with user-defined metadata.
471
+ class CertificateRevocationList
472
+ include ::Google::Protobuf::MessageExts
473
+ extend ::Google::Protobuf::MessageExts::ClassMethods
474
+
475
+ # Describes a revoked {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
476
+ # @!attribute [rw] certificate
477
+ # @return [::String]
478
+ # The resource name for the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} in the format
479
+ # `projects/*/locations/*/caPools/*/certificates/*`.
480
+ # @!attribute [rw] hex_serial_number
481
+ # @return [::String]
482
+ # The serial number of the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
483
+ # @!attribute [rw] revocation_reason
484
+ # @return [::Google::Cloud::Security::PrivateCA::V1::RevocationReason]
485
+ # The reason the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked.
486
+ class RevokedCertificate
487
+ include ::Google::Protobuf::MessageExts
488
+ extend ::Google::Protobuf::MessageExts::ClassMethods
489
+ end
490
+
491
+ # @!attribute [rw] key
492
+ # @return [::String]
493
+ # @!attribute [rw] value
494
+ # @return [::String]
495
+ class LabelsEntry
496
+ include ::Google::Protobuf::MessageExts
497
+ extend ::Google::Protobuf::MessageExts::ClassMethods
498
+ end
499
+
500
+ # The state of a {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList}, indicating if it is current.
501
+ module State
502
+ # Not specified.
503
+ STATE_UNSPECIFIED = 0
504
+
505
+ # The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} is up to date.
506
+ ACTIVE = 1
507
+
508
+ # The {::Google::Cloud::Security::PrivateCA::V1::CertificateRevocationList CertificateRevocationList} is no longer current.
509
+ SUPERSEDED = 2
510
+ end
511
+ end
512
+
513
+ # A {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} corresponds to a signed X.509 certificate issued by a
514
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}.
515
+ # @!attribute [r] name
516
+ # @return [::String]
517
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} in the format
518
+ # `projects/*/locations/*/caPools/*/certificates/*`.
519
+ # @!attribute [rw] pem_csr
520
+ # @return [::String]
521
+ # Immutable. A pem-encoded X.509 certificate signing request (CSR).
522
+ # @!attribute [rw] config
523
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig]
524
+ # Immutable. A description of the certificate and key that does not require X.509 or
525
+ # ASN.1.
526
+ # @!attribute [r] issuer_certificate_authority
527
+ # @return [::String]
528
+ # Output only. The resource name of the issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the format
529
+ # `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
530
+ # @!attribute [rw] lifetime
531
+ # @return [::Google::Protobuf::Duration]
532
+ # Required. Immutable. The desired lifetime of a certificate. Used to create the
533
+ # "not_before_time" and "not_after_time" fields inside an X.509
534
+ # certificate. Note that the lifetime may be truncated if it would extend
535
+ # past the life of any certificate authority in the issuing chain.
536
+ # @!attribute [rw] certificate_template
537
+ # @return [::String]
538
+ # Immutable. The resource name for a {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} used to issue this
539
+ # certificate, in the format
540
+ # `projects/*/locations/*/certificateTemplates/*`.
541
+ # If this is specified, the caller must have the necessary permission to
542
+ # use this template. If this is omitted, no template will be used.
543
+ # This template must be in the same location as the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
544
+ # @!attribute [rw] subject_mode
545
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectRequestMode]
546
+ # Immutable. Specifies how the {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s identity fields are to be decided.
547
+ # If this is omitted, the `DEFAULT` subject mode will be used.
548
+ # @!attribute [r] revocation_details
549
+ # @return [::Google::Cloud::Security::PrivateCA::V1::Certificate::RevocationDetails]
550
+ # Output only. Details regarding the revocation of this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}. This
551
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} is considered revoked if and only if this field is present.
552
+ # @!attribute [r] pem_certificate
553
+ # @return [::String]
554
+ # Output only. The pem-encoded, signed X.509 certificate.
555
+ # @!attribute [r] certificate_description
556
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription]
557
+ # Output only. A structured description of the issued X.509 certificate.
558
+ # @!attribute [r] pem_certificate_chain
559
+ # @return [::Array<::String>]
560
+ # Output only. The chain that may be used to verify the X.509 certificate. Expected to be
561
+ # in issuer-to-root order according to RFC 5246.
562
+ # @!attribute [r] create_time
563
+ # @return [::Google::Protobuf::Timestamp]
564
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was created.
565
+ # @!attribute [r] update_time
566
+ # @return [::Google::Protobuf::Timestamp]
567
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was updated.
568
+ # @!attribute [rw] labels
569
+ # @return [::Google::Protobuf::Map{::String => ::String}]
570
+ # Optional. Labels with user-defined metadata.
571
+ class Certificate
572
+ include ::Google::Protobuf::MessageExts
573
+ extend ::Google::Protobuf::MessageExts::ClassMethods
574
+
575
+ # Describes fields that are relavent to the revocation of a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}.
576
+ # @!attribute [rw] revocation_state
577
+ # @return [::Google::Cloud::Security::PrivateCA::V1::RevocationReason]
578
+ # Indicates why a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked.
579
+ # @!attribute [rw] revocation_time
580
+ # @return [::Google::Protobuf::Timestamp]
581
+ # The time at which this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} was revoked.
582
+ class RevocationDetails
583
+ include ::Google::Protobuf::MessageExts
584
+ extend ::Google::Protobuf::MessageExts::ClassMethods
585
+ end
586
+
587
+ # @!attribute [rw] key
588
+ # @return [::String]
589
+ # @!attribute [rw] value
590
+ # @return [::String]
591
+ class LabelsEntry
592
+ include ::Google::Protobuf::MessageExts
593
+ extend ::Google::Protobuf::MessageExts::ClassMethods
594
+ end
595
+ end
596
+
597
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} refers to a managed template for certificate
598
+ # issuance.
599
+ # @!attribute [r] name
600
+ # @return [::String]
601
+ # Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} in the format
602
+ # `projects/*/locations/*/certificateTemplates/*`.
603
+ # @!attribute [rw] predefined_values
604
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
605
+ # Optional. A set of X.509 values that will be applied to all issued certificates that
606
+ # use this template. If the certificate request includes conflicting values
607
+ # for the same properties, they will be overwritten by the values defined
608
+ # here. If the issuing {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy}
609
+ # defines conflicting
610
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values} for the same
611
+ # properties, the certificate issuance request will fail.
612
+ # @!attribute [rw] identity_constraints
613
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateIdentityConstraints]
614
+ # Optional. Describes constraints on identities that may be appear in
615
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} issued using this template. If this is omitted,
616
+ # then this template will not add restrictions on a certificate's identity.
617
+ # @!attribute [rw] passthrough_extensions
618
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints]
619
+ # Optional. Describes the set of X.509 extensions that may appear in a
620
+ # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued using this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}. If a certificate
621
+ # request sets extensions that don't appear in the
622
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#passthrough_extensions passthrough_extensions}, those extensions will be dropped. If the
623
+ # issuing {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}'s {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy IssuancePolicy} defines
624
+ # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy#baseline_values baseline_values} that don't appear
625
+ # here, the certificate issuance request will fail. If this is omitted, then
626
+ # this template will not add restrictions on a certificate's X.509
627
+ # extensions. These constraints do not apply to X.509 extensions set in this
628
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate}'s {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate#predefined_values predefined_values}.
629
+ # @!attribute [rw] description
630
+ # @return [::String]
631
+ # Optional. A human-readable description of scenarios this template is intended for.
632
+ # @!attribute [r] create_time
633
+ # @return [::Google::Protobuf::Timestamp]
634
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} was created.
635
+ # @!attribute [r] update_time
636
+ # @return [::Google::Protobuf::Timestamp]
637
+ # Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1::CertificateTemplate CertificateTemplate} was updated.
638
+ # @!attribute [rw] labels
639
+ # @return [::Google::Protobuf::Map{::String => ::String}]
640
+ # Optional. Labels with user-defined metadata.
641
+ class CertificateTemplate
642
+ include ::Google::Protobuf::MessageExts
643
+ extend ::Google::Protobuf::MessageExts::ClassMethods
644
+
645
+ # @!attribute [rw] key
646
+ # @return [::String]
647
+ # @!attribute [rw] value
648
+ # @return [::String]
649
+ class LabelsEntry
650
+ include ::Google::Protobuf::MessageExts
651
+ extend ::Google::Protobuf::MessageExts::ClassMethods
652
+ end
653
+ end
654
+
655
+ # An {::Google::Cloud::Security::PrivateCA::V1::X509Parameters X509Parameters} is used to describe certain fields of an
656
+ # X.509 certificate, such as the key usage fields, fields specific to CA
657
+ # certificates, certificate policy extensions and custom extensions.
658
+ # @!attribute [rw] key_usage
659
+ # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage]
660
+ # Optional. Indicates the intended use for keys that correspond to a certificate.
661
+ # @!attribute [rw] ca_options
662
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters::CaOptions]
663
+ # Optional. Describes options in this {::Google::Cloud::Security::PrivateCA::V1::X509Parameters X509Parameters} that are relevant in a CA
664
+ # certificate.
665
+ # @!attribute [rw] policy_ids
666
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>]
667
+ # Optional. Describes the X.509 certificate policy object identifiers, per
668
+ # https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
669
+ # @!attribute [rw] aia_ocsp_servers
670
+ # @return [::Array<::String>]
671
+ # Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses
672
+ # that appear in the "Authority Information Access" extension in the
673
+ # certificate.
674
+ # @!attribute [rw] additional_extensions
675
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::X509Extension>]
676
+ # Optional. Describes custom X.509 extensions.
677
+ class X509Parameters
678
+ include ::Google::Protobuf::MessageExts
679
+ extend ::Google::Protobuf::MessageExts::ClassMethods
680
+
681
+ # Describes values that are relevant in a CA certificate.
682
+ # @!attribute [rw] is_ca
683
+ # @return [::Boolean]
684
+ # Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this
685
+ # value is missing, the extension will be omitted from the CA certificate.
686
+ # @!attribute [rw] max_issuer_path_length
687
+ # @return [::Integer]
688
+ # Optional. Refers to the path length restriction X.509 extension. For a CA
689
+ # certificate, this value describes the depth of subordinate CA
690
+ # certificates that are allowed.
691
+ # If this value is less than 0, the request will fail.
692
+ # If this value is missing, the max path length will be omitted from the
693
+ # CA certificate.
694
+ class CaOptions
695
+ include ::Google::Protobuf::MessageExts
696
+ extend ::Google::Protobuf::MessageExts::ClassMethods
697
+ end
698
+ end
699
+
700
+ # Describes a subordinate CA's issuers. This is either a resource name to a
701
+ # known issuing {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, or a PEM issuer certificate chain.
702
+ # @!attribute [rw] certificate_authority
703
+ # @return [::String]
704
+ # Required. This can refer to a {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} in the same project that
705
+ # was used to create a subordinate {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}. This field
706
+ # is used for information and usability purposes only. The resource name
707
+ # is in the format
708
+ # `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
709
+ # @!attribute [rw] pem_issuer_chain
710
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubordinateConfig::SubordinateConfigChain]
711
+ # Required. Contains the PEM certificate chain for the issuers of this
712
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority}, but not pem certificate for this CA itself.
713
+ class SubordinateConfig
714
+ include ::Google::Protobuf::MessageExts
715
+ extend ::Google::Protobuf::MessageExts::ClassMethods
716
+
717
+ # This message describes a subordinate CA's issuer certificate chain. This
718
+ # wrapper exists for compatibility reasons.
719
+ # @!attribute [rw] pem_certificates
720
+ # @return [::Array<::String>]
721
+ # Required. Expected to be in leaf-to-root order according to RFC 5246.
722
+ class SubordinateConfigChain
723
+ include ::Google::Protobuf::MessageExts
724
+ extend ::Google::Protobuf::MessageExts::ClassMethods
725
+ end
726
+ end
727
+
728
+ # A {::Google::Cloud::Security::PrivateCA::V1::PublicKey PublicKey} describes a public key.
729
+ # @!attribute [rw] key
730
+ # @return [::String]
731
+ # Required. A public key. The padding and encoding
732
+ # must match with the `KeyFormat` value specified for the `format` field.
733
+ # @!attribute [rw] format
734
+ # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey::KeyFormat]
735
+ # Required. The format of the public key.
736
+ class PublicKey
737
+ include ::Google::Protobuf::MessageExts
738
+ extend ::Google::Protobuf::MessageExts::ClassMethods
739
+
740
+ # Types of public keys formats that are supported. Currently, only `PEM`
741
+ # format is supported.
742
+ module KeyFormat
743
+ # Default unspecified value.
744
+ KEY_FORMAT_UNSPECIFIED = 0
745
+
746
+ # The key is PEM-encoded as defined in [RFC
747
+ # 7468](https://tools.ietf.org/html/rfc7468). It can be any of the
748
+ # following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey
749
+ # structure, an RFC 5280
750
+ # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1)
751
+ # or a PEM-encoded X.509 certificate signing request (CSR). If a
752
+ # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1)
753
+ # is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey
754
+ # or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified,
755
+ # it will used solely for the purpose of extracting the public key. When
756
+ # generated by the service, it will always be an RFC 5280
757
+ # [SubjectPublicKeyInfo](https://tools.ietf.org/html/rfc5280#section-4.1)
758
+ # structure containing an algorithm identifier and a key.
759
+ PEM = 1
760
+ end
761
+ end
762
+
763
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig} describes an X.509 certificate or CSR that is to be
764
+ # created, as an alternative to using ASN.1.
765
+ # @!attribute [rw] subject_config
766
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateConfig::SubjectConfig]
767
+ # Required. Specifies some of the values in a certificate that are related to the
768
+ # subject.
769
+ # @!attribute [rw] x509_config
770
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
771
+ # Required. Describes how some of the technical X.509 fields in a certificate should be
772
+ # populated.
773
+ # @!attribute [rw] public_key
774
+ # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey]
775
+ # Optional. The public key that corresponds to this config. This is, for example, used
776
+ # when issuing {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates}, but not when creating a
777
+ # self-signed {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} or {::Google::Cloud::Security::PrivateCA::V1::CertificateAuthority CertificateAuthority} CSR.
778
+ class CertificateConfig
779
+ include ::Google::Protobuf::MessageExts
780
+ extend ::Google::Protobuf::MessageExts::ClassMethods
781
+
782
+ # These values are used to create the distinguished name and subject
783
+ # alternative name fields in an X.509 certificate.
784
+ # @!attribute [rw] subject
785
+ # @return [::Google::Cloud::Security::PrivateCA::V1::Subject]
786
+ # Required. Contains distinguished name fields such as the common name, location and
787
+ # organization.
788
+ # @!attribute [rw] subject_alt_name
789
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames]
790
+ # Optional. The subject alternative name fields.
791
+ class SubjectConfig
792
+ include ::Google::Protobuf::MessageExts
793
+ extend ::Google::Protobuf::MessageExts::ClassMethods
794
+ end
795
+ end
796
+
797
+ # A {::Google::Cloud::Security::PrivateCA::V1::CertificateDescription CertificateDescription} describes an X.509 certificate or CSR that has
798
+ # been issued, as an alternative to using ASN.1 / X.509.
799
+ # @!attribute [rw] subject_description
800
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::SubjectDescription]
801
+ # Describes some of the values in a certificate that are related to the
802
+ # subject and lifetime.
803
+ # @!attribute [rw] x509_description
804
+ # @return [::Google::Cloud::Security::PrivateCA::V1::X509Parameters]
805
+ # Describes some of the technical X.509 fields in a certificate.
806
+ # @!attribute [rw] public_key
807
+ # @return [::Google::Cloud::Security::PrivateCA::V1::PublicKey]
808
+ # The public key that corresponds to an issued certificate.
809
+ # @!attribute [rw] subject_key_id
810
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::KeyId]
811
+ # Provides a means of identifiying certificates that contain a particular
812
+ # public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
813
+ # @!attribute [rw] authority_key_id
814
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::KeyId]
815
+ # Identifies the subject_key_id of the parent certificate, per
816
+ # https://tools.ietf.org/html/rfc5280#section-4.2.1.1
817
+ # @!attribute [rw] crl_distribution_points
818
+ # @return [::Array<::String>]
819
+ # Describes a list of locations to obtain CRL information, i.e.
820
+ # the DistributionPoint.fullName described by
821
+ # https://tools.ietf.org/html/rfc5280#section-4.2.1.13
822
+ # @!attribute [rw] aia_issuing_certificate_urls
823
+ # @return [::Array<::String>]
824
+ # Describes lists of issuer CA certificate URLs that appear in the
825
+ # "Authority Information Access" extension in the certificate.
826
+ # @!attribute [rw] cert_fingerprint
827
+ # @return [::Google::Cloud::Security::PrivateCA::V1::CertificateDescription::CertificateFingerprint]
828
+ # The hash of the x.509 certificate.
829
+ class CertificateDescription
830
+ include ::Google::Protobuf::MessageExts
831
+ extend ::Google::Protobuf::MessageExts::ClassMethods
832
+
833
+ # These values describe fields in an issued X.509 certificate such as the
834
+ # distinguished name, subject alternative names, serial number, and lifetime.
835
+ # @!attribute [rw] subject
836
+ # @return [::Google::Cloud::Security::PrivateCA::V1::Subject]
837
+ # Contains distinguished name fields such as the common name, location and
838
+ # / organization.
839
+ # @!attribute [rw] subject_alt_name
840
+ # @return [::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames]
841
+ # The subject alternative name fields.
842
+ # @!attribute [rw] hex_serial_number
843
+ # @return [::String]
844
+ # The serial number encoded in lowercase hexadecimal.
845
+ # @!attribute [rw] lifetime
846
+ # @return [::Google::Protobuf::Duration]
847
+ # For convenience, the actual lifetime of an issued certificate.
848
+ # Corresponds to 'not_after_time' - 'not_before_time'.
849
+ # @!attribute [rw] not_before_time
850
+ # @return [::Google::Protobuf::Timestamp]
851
+ # The time at which the certificate becomes valid.
852
+ # @!attribute [rw] not_after_time
853
+ # @return [::Google::Protobuf::Timestamp]
854
+ # The time at which the certificate expires.
855
+ class SubjectDescription
856
+ include ::Google::Protobuf::MessageExts
857
+ extend ::Google::Protobuf::MessageExts::ClassMethods
858
+ end
859
+
860
+ # A KeyId identifies a specific public key, usually by hashing the public
861
+ # key.
862
+ # @!attribute [rw] key_id
863
+ # @return [::String]
864
+ # Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most
865
+ # likely the 160 bit SHA-1 hash of the public key.
866
+ class KeyId
867
+ include ::Google::Protobuf::MessageExts
868
+ extend ::Google::Protobuf::MessageExts::ClassMethods
869
+ end
870
+
871
+ # A group of fingerprints for the x509 certificate.
872
+ # @!attribute [rw] sha256_hash
873
+ # @return [::String]
874
+ # The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
875
+ class CertificateFingerprint
876
+ include ::Google::Protobuf::MessageExts
877
+ extend ::Google::Protobuf::MessageExts::ClassMethods
878
+ end
879
+ end
880
+
881
+ # An {::Google::Cloud::Security::PrivateCA::V1::ObjectId ObjectId} specifies an object identifier (OID). These provide context
882
+ # and describe types in ASN.1 messages.
883
+ # @!attribute [rw] object_id_path
884
+ # @return [::Array<::Integer>]
885
+ # Required. The parts of an OID path. The most significant parts of the path come
886
+ # first.
887
+ class ObjectId
888
+ include ::Google::Protobuf::MessageExts
889
+ extend ::Google::Protobuf::MessageExts::ClassMethods
890
+ end
891
+
892
+ # An {::Google::Cloud::Security::PrivateCA::V1::X509Extension X509Extension} specifies an X.509 extension, which may be used in
893
+ # different parts of X.509 objects like certificates, CSRs, and CRLs.
894
+ # @!attribute [rw] object_id
895
+ # @return [::Google::Cloud::Security::PrivateCA::V1::ObjectId]
896
+ # Required. The OID for this X.509 extension.
897
+ # @!attribute [rw] critical
898
+ # @return [::Boolean]
899
+ # Required. Indicates whether or not this extension is critical (i.e., if the client
900
+ # does not know how to handle this extension, the client should consider this
901
+ # to be an error).
902
+ # @!attribute [rw] value
903
+ # @return [::String]
904
+ # Required. The value of this X.509 extension.
905
+ class X509Extension
906
+ include ::Google::Protobuf::MessageExts
907
+ extend ::Google::Protobuf::MessageExts::ClassMethods
908
+ end
909
+
910
+ # A {::Google::Cloud::Security::PrivateCA::V1::KeyUsage KeyUsage} describes key usage values that may appear in an X.509
911
+ # certificate.
912
+ # @!attribute [rw] base_key_usage
913
+ # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage::KeyUsageOptions]
914
+ # Describes high-level ways in which a key may be used.
915
+ # @!attribute [rw] extended_key_usage
916
+ # @return [::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions]
917
+ # Detailed scenarios in which a key may be used.
918
+ # @!attribute [rw] unknown_extended_key_usages
919
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>]
920
+ # Used to describe extended key usages that are not listed in the
921
+ # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} message.
922
+ class KeyUsage
923
+ include ::Google::Protobuf::MessageExts
924
+ extend ::Google::Protobuf::MessageExts::ClassMethods
925
+
926
+ # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::KeyUsageOptions KeyUsage.KeyUsageOptions} corresponds to the key usage values
927
+ # described in https://tools.ietf.org/html/rfc5280#section-4.2.1.3.
928
+ # @!attribute [rw] digital_signature
929
+ # @return [::Boolean]
930
+ # The key may be used for digital signatures.
931
+ # @!attribute [rw] content_commitment
932
+ # @return [::Boolean]
933
+ # The key may be used for cryptographic commitments. Note that this may
934
+ # also be referred to as "non-repudiation".
935
+ # @!attribute [rw] key_encipherment
936
+ # @return [::Boolean]
937
+ # The key may be used to encipher other keys.
938
+ # @!attribute [rw] data_encipherment
939
+ # @return [::Boolean]
940
+ # The key may be used to encipher data.
941
+ # @!attribute [rw] key_agreement
942
+ # @return [::Boolean]
943
+ # The key may be used in a key agreement protocol.
944
+ # @!attribute [rw] cert_sign
945
+ # @return [::Boolean]
946
+ # The key may be used to sign certificates.
947
+ # @!attribute [rw] crl_sign
948
+ # @return [::Boolean]
949
+ # The key may be used sign certificate revocation lists.
950
+ # @!attribute [rw] encipher_only
951
+ # @return [::Boolean]
952
+ # The key may be used to encipher only.
953
+ # @!attribute [rw] decipher_only
954
+ # @return [::Boolean]
955
+ # The key may be used to decipher only.
956
+ class KeyUsageOptions
957
+ include ::Google::Protobuf::MessageExts
958
+ extend ::Google::Protobuf::MessageExts::ClassMethods
959
+ end
960
+
961
+ # {::Google::Cloud::Security::PrivateCA::V1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} has fields that correspond to
962
+ # certain common OIDs that could be specified as an extended key usage value.
963
+ # @!attribute [rw] server_auth
964
+ # @return [::Boolean]
965
+ # Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW
966
+ # server authentication", though regularly used for non-WWW TLS.
967
+ # @!attribute [rw] client_auth
968
+ # @return [::Boolean]
969
+ # Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW
970
+ # client authentication", though regularly used for non-WWW TLS.
971
+ # @!attribute [rw] code_signing
972
+ # @return [::Boolean]
973
+ # Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of
974
+ # downloadable executable code client authentication".
975
+ # @!attribute [rw] email_protection
976
+ # @return [::Boolean]
977
+ # Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email
978
+ # protection".
979
+ # @!attribute [rw] time_stamping
980
+ # @return [::Boolean]
981
+ # Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding
982
+ # the hash of an object to a time".
983
+ # @!attribute [rw] ocsp_signing
984
+ # @return [::Boolean]
985
+ # Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing
986
+ # OCSP responses".
987
+ class ExtendedKeyUsageOptions
988
+ include ::Google::Protobuf::MessageExts
989
+ extend ::Google::Protobuf::MessageExts::ClassMethods
990
+ end
991
+ end
992
+
993
+ # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} describes parts of a distinguished name that, in turn,
994
+ # describes the subject of the certificate.
995
+ # @!attribute [rw] common_name
996
+ # @return [::String]
997
+ # The "common name" of the subject.
998
+ # @!attribute [rw] country_code
999
+ # @return [::String]
1000
+ # The country code of the subject.
1001
+ # @!attribute [rw] organization
1002
+ # @return [::String]
1003
+ # The organization of the subject.
1004
+ # @!attribute [rw] organizational_unit
1005
+ # @return [::String]
1006
+ # The organizational_unit of the subject.
1007
+ # @!attribute [rw] locality
1008
+ # @return [::String]
1009
+ # The locality or city of the subject.
1010
+ # @!attribute [rw] province
1011
+ # @return [::String]
1012
+ # The province, territory, or regional state of the subject.
1013
+ # @!attribute [rw] street_address
1014
+ # @return [::String]
1015
+ # The street address of the subject.
1016
+ # @!attribute [rw] postal_code
1017
+ # @return [::String]
1018
+ # The postal code of the subject.
1019
+ class Subject
1020
+ include ::Google::Protobuf::MessageExts
1021
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1022
+ end
1023
+
1024
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} corresponds to a more modern way of listing what
1025
+ # the asserted identity is in a certificate (i.e., compared to the "common
1026
+ # name" in the distinguished name).
1027
+ # @!attribute [rw] dns_names
1028
+ # @return [::Array<::String>]
1029
+ # Contains only valid, fully-qualified host names.
1030
+ # @!attribute [rw] uris
1031
+ # @return [::Array<::String>]
1032
+ # Contains only valid RFC 3986 URIs.
1033
+ # @!attribute [rw] email_addresses
1034
+ # @return [::Array<::String>]
1035
+ # Contains only valid RFC 2822 E-mail addresses.
1036
+ # @!attribute [rw] ip_addresses
1037
+ # @return [::Array<::String>]
1038
+ # Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
1039
+ # @!attribute [rw] custom_sans
1040
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::X509Extension>]
1041
+ # Contains additional subject alternative name values.
1042
+ class SubjectAltNames
1043
+ include ::Google::Protobuf::MessageExts
1044
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1045
+ end
1046
+
1047
+ # Describes constraints on a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and
1048
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames}.
1049
+ # @!attribute [rw] cel_expression
1050
+ # @return [::Google::Type::Expr]
1051
+ # Optional. A CEL expression that may be used to validate the resolved X.509 Subject
1052
+ # and/or Subject Alternative Name before a certificate is signed.
1053
+ # To see the full allowed syntax and some examples, see
1054
+ # https://cloud.google.com/certificate-authority-service/docs/cel-guide
1055
+ # @!attribute [rw] allow_subject_passthrough
1056
+ # @return [::Boolean]
1057
+ # Required. If this is true, the {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} field may be copied from a certificate
1058
+ # request into the signed certificate. Otherwise, the requested {::Google::Cloud::Security::PrivateCA::V1::Subject Subject}
1059
+ # will be discarded. The bool is optional to indicate an unset field, which suggests a forgotten value that needs to be set by the caller.
1060
+ # @!attribute [rw] allow_subject_alt_names_passthrough
1061
+ # @return [::Boolean]
1062
+ # Required. If this is true, the {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} extension may be copied from a
1063
+ # certificate request into the signed certificate. Otherwise, the requested
1064
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} will be discarded.
1065
+ # The bool is optional to indicate an unset field, which suggests a forgotten value that needs to be set by the caller.
1066
+ class CertificateIdentityConstraints
1067
+ include ::Google::Protobuf::MessageExts
1068
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1069
+ end
1070
+
1071
+ # Describes a set of X.509 extensions that may be part of some certificate
1072
+ # issuance controls.
1073
+ # @!attribute [rw] known_extensions
1074
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints::KnownCertificateExtension>]
1075
+ # Optional. A set of named X.509 extensions. Will be combined with
1076
+ # {::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints#additional_extensions additional_extensions} to determine the full set of X.509 extensions.
1077
+ # @!attribute [rw] additional_extensions
1078
+ # @return [::Array<::Google::Cloud::Security::PrivateCA::V1::ObjectId>]
1079
+ # Optional. A set of {::Google::Cloud::Security::PrivateCA::V1::ObjectId ObjectIds} identifying custom X.509 extensions.
1080
+ # Will be combined with {::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints#known_extensions known_extensions} to determine the full set of
1081
+ # X.509 extensions.
1082
+ class CertificateExtensionConstraints
1083
+ include ::Google::Protobuf::MessageExts
1084
+ extend ::Google::Protobuf::MessageExts::ClassMethods
1085
+
1086
+ # Describes well-known X.509 extensions that can appear in a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate},
1087
+ # not including the {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} extension.
1088
+ module KnownCertificateExtension
1089
+ # Not specified.
1090
+ KNOWN_CERTIFICATE_EXTENSION_UNSPECIFIED = 0
1091
+
1092
+ # Refers to a certificate's Key Usage extension, as described in [RFC 5280
1093
+ # section 4.2.1.3](https://tools.ietf.org/html/rfc5280#section-4.2.1.3).
1094
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::KeyUsage#base_key_usage KeyUsage.base_key_usage} field.
1095
+ BASE_KEY_USAGE = 1
1096
+
1097
+ # Refers to a certificate's Extended Key Usage extension, as described in
1098
+ # [RFC 5280
1099
+ # section 4.2.1.12](https://tools.ietf.org/html/rfc5280#section-4.2.1.12).
1100
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::KeyUsage#extended_key_usage KeyUsage.extended_key_usage} message.
1101
+ EXTENDED_KEY_USAGE = 2
1102
+
1103
+ # Refers to a certificate's Basic Constraints extension, as described in
1104
+ # [RFC 5280
1105
+ # section 4.2.1.9](https://tools.ietf.org/html/rfc5280#section-4.2.1.9).
1106
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#ca_options X509Parameters.ca_options} field.
1107
+ CA_OPTIONS = 3
1108
+
1109
+ # Refers to a certificate's Policy object identifiers, as described in
1110
+ # [RFC 5280
1111
+ # section 4.2.1.4](https://tools.ietf.org/html/rfc5280#section-4.2.1.4).
1112
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#policy_ids X509Parameters.policy_ids} field.
1113
+ POLICY_IDS = 4
1114
+
1115
+ # Refers to OCSP servers in a certificate's Authority Information Access
1116
+ # extension, as described in
1117
+ # [RFC 5280
1118
+ # section 4.2.2.1](https://tools.ietf.org/html/rfc5280#section-4.2.2.1),
1119
+ # This corresponds to the {::Google::Cloud::Security::PrivateCA::V1::X509Parameters#aia_ocsp_servers X509Parameters.aia_ocsp_servers} field.
1120
+ AIA_OCSP_SERVERS = 5
1121
+ end
1122
+ end
1123
+
1124
+ # A {::Google::Cloud::Security::PrivateCA::V1::RevocationReason RevocationReason} indicates whether a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} has been revoked,
1125
+ # and the reason for revocation. These correspond to standard revocation
1126
+ # reasons from RFC 5280. Note that the enum labels and values in this
1127
+ # definition are not the same ASN.1 values defined in RFC 5280. These values
1128
+ # will be translated to the correct ASN.1 values when a CRL is created.
1129
+ module RevocationReason
1130
+ # Default unspecified value. This value does indicate that a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}
1131
+ # has been revoked, but that a reason has not been recorded.
1132
+ REVOCATION_REASON_UNSPECIFIED = 0
1133
+
1134
+ # Key material for this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} may have leaked.
1135
+ KEY_COMPROMISE = 1
1136
+
1137
+ # The key material for a certificate authority in the issuing path may have
1138
+ # leaked.
1139
+ CERTIFICATE_AUTHORITY_COMPROMISE = 2
1140
+
1141
+ # The subject or other attributes in this {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} have changed.
1142
+ AFFILIATION_CHANGED = 3
1143
+
1144
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} has been superseded.
1145
+ SUPERSEDED = 4
1146
+
1147
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} or entities in the issuing path have ceased to
1148
+ # operate.
1149
+ CESSATION_OF_OPERATION = 5
1150
+
1151
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} should not be considered valid, it is expected that it
1152
+ # may become valid in the future.
1153
+ CERTIFICATE_HOLD = 6
1154
+
1155
+ # This {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} no longer has permission to assert the listed
1156
+ # attributes.
1157
+ PRIVILEGE_WITHDRAWN = 7
1158
+
1159
+ # The authority which determines appropriate attributes for a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}
1160
+ # may have been compromised.
1161
+ ATTRIBUTE_AUTHORITY_COMPROMISE = 8
1162
+ end
1163
+
1164
+ # Describes the way in which a {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate}'s {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or
1165
+ # {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} will be resolved.
1166
+ module SubjectRequestMode
1167
+ # Not specified.
1168
+ SUBJECT_REQUEST_MODE_UNSPECIFIED = 0
1169
+
1170
+ # The default mode used in most cases. Indicates that the certificate's
1171
+ # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} are specified in the certificate
1172
+ # request. This mode requires the caller to have the
1173
+ # `privateca.certificates.create` permission.
1174
+ DEFAULT = 1
1175
+
1176
+ # A mode reserved for special cases. Indicates that the certificate should
1177
+ # have one or more SPIFFE {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} set by the service based
1178
+ # on the caller's identity. This mode will ignore any explicitly specified
1179
+ # {::Google::Cloud::Security::PrivateCA::V1::Subject Subject} and/or {::Google::Cloud::Security::PrivateCA::V1::SubjectAltNames SubjectAltNames} in the certificate request.
1180
+ # This mode requires the caller to have the
1181
+ # `privateca.certificates.createForSelf` permission.
1182
+ REFLECTED_SPIFFE = 2
1183
+ end
1184
+ end
1185
+ end
1186
+ end
1187
+ end
1188
+ end