google-cloud-security-private_ca-v1beta1 0.1.0

data/proto_docs/google/cloud/security/privateca/v1beta1/resources.rb

@@ -0,0 +1,981 @@
+# frozen_string_literal: true
+
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module Security
+      module PrivateCA
+        module V1beta1
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} represents an individual Certificate Authority.
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} can be used to create {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates}.
+          # @!attribute [r] name
+          #   @return [::String]
+          #     Output only. The resource name for this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} in the
+          #     format `projects/*/locations/*/certificateAuthorities/*`.
+          # @!attribute [rw] type
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::Type]
+          #     Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::Type Type} of this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+          # @!attribute [rw] tier
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::Tier]
+          #     Required. Immutable. The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::Tier Tier} of this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+          # @!attribute [rw] config
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateConfig]
+          #     Required. Immutable. The config used to create a self-signed X.509 certificate or CSR.
+          # @!attribute [rw] lifetime
+          #   @return [::Google::Protobuf::Duration]
+          #     Required. The desired lifetime of the CA certificate. Used to create the
+          #     "not_before_time" and "not_after_time" fields inside an X.509
+          #     certificate.
+          # @!attribute [rw] key_spec
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::KeyVersionSpec]
+          #     Required. Immutable. Used when issuing certificates for this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}. If this
+          #     {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} is a self-signed CertificateAuthority, this key
+          #     is also used to sign the self-signed CA certificate. Otherwise, it
+          #     is used to sign a CSR.
+          # @!attribute [rw] certificate_policy
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy]
+          #     Optional. The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy CertificateAuthorityPolicy} to enforce when issuing
+          #     {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} from this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+          # @!attribute [rw] issuing_options
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::IssuingOptions]
+          #     Optional. The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::IssuingOptions IssuingOptions} to follow when issuing {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates}
+          #     from this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+          # @!attribute [rw] subordinate_config
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::SubordinateConfig]
+          #     Optional. If this is a subordinate {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}, this field will be set
+          #     with the subordinate configuration, which describes its issuers. This may
+          #     be updated, but this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} must continue to validate.
+          # @!attribute [r] state
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::State]
+          #     Output only. The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::State State} for this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+          # @!attribute [r] pem_ca_certificates
+          #   @return [::Array<::String>]
+          #     Output only. This {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}'s certificate chain, including the current
+          #     {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}'s certificate. Ordered such that the root issuer
+          #     is the final element (consistent with RFC 5246). For a self-signed CA, this
+          #     will only list the current {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}'s certificate.
+          # @!attribute [r] ca_certificate_descriptions
+          #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::CertificateDescription>]
+          #     Output only. A structured description of this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}'s CA certificate
+          #     and its issuers. Ordered as self-to-root.
+          # @!attribute [rw] gcs_bucket
+          #   @return [::String]
+          #     Immutable. The name of a Cloud Storage bucket where this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} will
+          #     publish content, such as the CA certificate and CRLs. This must be a bucket
+          #     name, without any prefixes (such as `gs://`) or suffixes (such as
+          #     `.googleapis.com`). For example, to use a bucket named `my-bucket`, you
+          #     would simply specify `my-bucket`. If not specified, a managed bucket will
+          #     be created.
+          # @!attribute [r] access_urls
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::AccessUrls]
+          #     Output only. URLs for accessing content published by this CA, such as the CA certificate
+          #     and CRLs.
+          # @!attribute [r] create_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} was created.
+          # @!attribute [r] update_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} was updated.
+          # @!attribute [r] delete_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} will be deleted, if
+          #     scheduled for deletion.
+          # @!attribute [rw] labels
+          #   @return [::Google::Protobuf::Map{::String => ::String}]
+          #     Optional. Labels with user-defined metadata.
+          class CertificateAuthority
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Options that affect all certificates issued by a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+            # @!attribute [rw] include_ca_cert_url
+            #   @return [::Boolean]
+            #     Required. When true, includes a URL to the issuing CA certificate in the
+            #     "authority information access" X.509 extension.
+            # @!attribute [rw] include_crl_access_url
+            #   @return [::Boolean]
+            #     Required. When true, includes a URL to the CRL corresponding to certificates
+            #     issued from a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+            #     CRLs will expire 7 days from their creation. However, we will rebuild
+            #     daily. CRLs are also rebuilt shortly after a certificate is revoked.
+            class IssuingOptions
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # The issuing policy for a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+            # {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} will not be successfully issued from this
+            # {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} if they violate the policy.
+            # @!attribute [rw] allowed_config_list
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::AllowedConfigList]
+            #     Optional. All {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} issued by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}
+            #     must match at least one listed {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigWrapper ReusableConfigWrapper} in the list.
+            # @!attribute [rw] overwrite_config_values
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigWrapper]
+            #     Optional. All {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} issued by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}
+            #     will use the provided configuration values, overwriting any requested
+            #     configuration values.
+            # @!attribute [rw] allowed_locations_and_organizations
+            #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::Subject>]
+            #     Optional. If any {::Google::Cloud::Security::PrivateCA::V1beta1::Subject Subject} is specified here, then all
+            #     {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} issued by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} must
+            #     match at least one listed {::Google::Cloud::Security::PrivateCA::V1beta1::Subject Subject}. If a {::Google::Cloud::Security::PrivateCA::V1beta1::Subject Subject} has an empty
+            #     field, any value will be allowed for that field.
+            # @!attribute [rw] allowed_common_names
+            #   @return [::Array<::String>]
+            #     Optional. If any value is specified here, then all
+            #     {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} issued by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} must
+            #     match at least one listed value. If no value is specified, all values
+            #     will be allowed for this fied. Glob patterns are also supported.
+            # @!attribute [rw] allowed_sans
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::AllowedSubjectAltNames]
+            #     Optional. If a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::AllowedSubjectAltNames AllowedSubjectAltNames} is specified here, then all
+            #     {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} issued by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} must
+            #     match {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::AllowedSubjectAltNames AllowedSubjectAltNames}. If no value or an empty value
+            #     is specified, any value will be allowed for the {::Google::Cloud::Security::PrivateCA::V1beta1::SubjectAltNames SubjectAltNames}
+            #     field.
+            # @!attribute [rw] maximum_lifetime
+            #   @return [::Google::Protobuf::Duration]
+            #     Optional. The maximum lifetime allowed by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}. Note that
+            #     if the any part if the issuing chain expires before a {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate}'s
+            #     requested maximum_lifetime, the effective lifetime will be explicitly
+            #     truncated.
+            # @!attribute [rw] allowed_issuance_modes
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::IssuanceModes]
+            #     Optional. If specified, then only methods allowed in the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::IssuanceModes IssuanceModes} may be
+            #     used to issue {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates}.
+            class CertificateAuthorityPolicy
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+
+              # @!attribute [rw] allowed_config_values
+              #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigWrapper>]
+              #     Required. All {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} issued by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}
+              #     must match at least one listed {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigWrapper ReusableConfigWrapper}. If a
+              #     {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigWrapper ReusableConfigWrapper} has an empty field, any value will be
+              #     allowed for that field.
+              class AllowedConfigList
+                include ::Google::Protobuf::MessageExts
+                extend ::Google::Protobuf::MessageExts::ClassMethods
+              end
+
+              # {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::AllowedSubjectAltNames AllowedSubjectAltNames} specifies the allowed values for
+              # {::Google::Cloud::Security::PrivateCA::V1beta1::SubjectAltNames SubjectAltNames} by the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} when issuing
+              # {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates}.
+              # @!attribute [rw] allowed_dns_names
+              #   @return [::Array<::String>]
+              #     Optional. Contains valid, fully-qualified host names. Glob patterns are also
+              #     supported. To allow an explicit wildcard certificate, escape with
+              #     backlash (i.e. "\*").
+              #     E.g. for globbed entries: '*bar.com' will allow foo.bar.com, but not
+              #     *.bar.com, unless the {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::AllowedSubjectAltNames#allow_globbing_dns_wildcards allow_globbing_dns_wildcards} field is set.
+              #     E.g. for wildcard entries: '\*.bar.com' will allow '*.bar.com', but not
+              #     'foo.bar.com'.
+              # @!attribute [rw] allowed_uris
+              #   @return [::Array<::String>]
+              #     Optional. Contains valid RFC 3986 URIs. Glob patterns are also supported. To
+              #     match across path seperators (i.e. '/') use the double star glob
+              #     pattern (i.e. '**').
+              # @!attribute [rw] allowed_email_addresses
+              #   @return [::Array<::String>]
+              #     Optional. Contains valid RFC 2822 E-mail addresses. Glob patterns are also
+              #     supported.
+              # @!attribute [rw] allowed_ips
+              #   @return [::Array<::String>]
+              #     Optional. Contains valid 32-bit IPv4 addresses and subnet ranges or RFC 4291 IPv6
+              #     addresses and subnet ranges. Subnet ranges are specified using the
+              #     '/' notation (e.g. 10.0.0.0/8, 2001:700:300:1800::/64). Glob patterns
+              #     are supported only for ip address entries (i.e. not for subnet ranges).
+              # @!attribute [rw] allow_globbing_dns_wildcards
+              #   @return [::Boolean]
+              #     Optional. Specifies if glob patterns used for {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::AllowedSubjectAltNames#allowed_dns_names allowed_dns_names} allows
+              #     wildcard certificates.
+              # @!attribute [rw] allow_custom_sans
+              #   @return [::Boolean]
+              #     Optional. Specifies if to allow custom X509Extension values.
+              class AllowedSubjectAltNames
+                include ::Google::Protobuf::MessageExts
+                extend ::Google::Protobuf::MessageExts::ClassMethods
+              end
+
+              # {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::CertificateAuthorityPolicy::IssuanceModes IssuanceModes} specifies the allowed ways in which
+              # {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} may be requested from this
+              # {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+              # @!attribute [rw] allow_csr_based_issuance
+              #   @return [::Boolean]
+              #     Required. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} by
+              #     specifying a CSR.
+              # @!attribute [rw] allow_config_based_issuance
+              #   @return [::Boolean]
+              #     Required. When true, allows callers to create {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates} by
+              #     specifying a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateConfig CertificateConfig}.
+              class IssuanceModes
+                include ::Google::Protobuf::MessageExts
+                extend ::Google::Protobuf::MessageExts::ClassMethods
+              end
+            end
+
+            # URLs where a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} will publish content.
+            # @!attribute [rw] ca_certificate_access_url
+            #   @return [::String]
+            #     The URL where this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}'s CA certificate is
+            #     published. This will only be set for CAs that have been activated.
+            # @!attribute [rw] crl_access_url
+            #   @return [::String]
+            #     The URL where this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}'s CRLs are published. This
+            #     will only be set for CAs that have been activated.
+            class AccessUrls
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # A Cloud KMS key configuration that a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} will use.
+            # @!attribute [rw] cloud_kms_key_version
+            #   @return [::String]
+            #     Required. The resource name for an existing Cloud KMS CryptoKeyVersion in the
+            #     format
+            #     `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
+            #     This option enables full flexibility in the key's capabilities and
+            #     properties.
+            # @!attribute [rw] algorithm
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority::SignHashAlgorithm]
+            #     Required. The algorithm to use for creating a managed Cloud KMS key for a for a
+            #     simplified experience. All managed keys will be have their
+            #     [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`.
+            class KeyVersionSpec
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # @!attribute [rw] key
+            #   @return [::String]
+            # @!attribute [rw] value
+            #   @return [::String]
+            class LabelsEntry
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # The type of a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}, indicating its issuing chain.
+            module Type
+              # Not specified.
+              TYPE_UNSPECIFIED = 0
+
+              # Self-signed CA.
+              SELF_SIGNED = 1
+
+              # Subordinate CA. Could be issued by a Private CA {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}
+              # or an unmanaged CA.
+              SUBORDINATE = 2
+            end
+
+            # The tier of a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}, indicating its supported
+            # functionality and/or billing SKU.
+            module Tier
+              # Not specified.
+              TIER_UNSPECIFIED = 0
+
+              # Enterprise tier.
+              ENTERPRISE = 1
+
+              # DevOps tier.
+              DEVOPS = 2
+            end
+
+            # The state of a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}, indicating if it can be used.
+            module State
+              # Not specified.
+              STATE_UNSPECIFIED = 0
+
+              # Certificates can be issued from this CA. CRLs will be generated for this
+              # CA.
+              ENABLED = 1
+
+              # Certificates cannot be issued from this CA. CRLs will still be generated.
+              DISABLED = 2
+
+              # Certificates cannot be issued from this CA. CRLs will not be generated.
+              PENDING_ACTIVATION = 3
+
+              # Certificates cannot be issued from this CA. CRLs will not be generated.
+              PENDING_DELETION = 4
+            end
+
+            # The algorithm of a Cloud KMS CryptoKeyVersion of a
+            # [CryptoKey][google.cloud.kms.v1.CryptoKey] with the
+            # [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] value
+            # `ASYMMETRIC_SIGN`. These values correspond to the
+            # [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
+            # values. For RSA signing algorithms, the PSS algorithms should be preferred,
+            # use PKCS1 algorithms if required for compatibility. For further
+            # recommandations, see
+            # https://cloud.google.com/kms/docs/algorithms#algorithm_recommendations.
+            module SignHashAlgorithm
+              # Not specified.
+              SIGN_HASH_ALGORITHM_UNSPECIFIED = 0
+
+              # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256
+              RSA_PSS_2048_SHA256 = 1
+
+              # maps to CryptoKeyVersionAlgorithm. RSA_SIGN_PSS_3072_SHA256
+              RSA_PSS_3072_SHA256 = 2
+
+              # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_4096_SHA256
+              RSA_PSS_4096_SHA256 = 3
+
+              # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_2048_SHA256
+              RSA_PKCS1_2048_SHA256 = 6
+
+              # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_3072_SHA256
+              RSA_PKCS1_3072_SHA256 = 7
+
+              # maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_4096_SHA256
+              RSA_PKCS1_4096_SHA256 = 8
+
+              # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256
+              EC_P256_SHA256 = 4
+
+              # maps to CryptoKeyVersionAlgorithm.EC_SIGN_P384_SHA384
+              EC_P384_SHA384 = 5
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList} corresponds to a signed X.509 certificate
+          # Revocation List (CRL). A CRL contains the serial numbers of certificates that
+          # should no longer be trusted.
+          # @!attribute [r] name
+          #   @return [::String]
+          #     Output only. The resource path for this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList} in
+          #     the format
+          #     `projects/*/locations/*/certificateAuthorities/*/
+          #        certificateRevocationLists/*`.
+          # @!attribute [r] sequence_number
+          #   @return [::Integer]
+          #     Output only. The CRL sequence number that appears in pem_crl.
+          # @!attribute [r] revoked_certificates
+          #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList::RevokedCertificate>]
+          #     Output only. The revoked serial numbers that appear in pem_crl.
+          # @!attribute [r] pem_crl
+          #   @return [::String]
+          #     Output only. The PEM-encoded X.509 CRL.
+          # @!attribute [r] access_url
+          #   @return [::String]
+          #     Output only. The location where 'pem_crl' can be accessed.
+          # @!attribute [r] state
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList::State]
+          #     Output only. The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList::State State} for this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList}.
+          # @!attribute [r] create_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList} was created.
+          # @!attribute [r] update_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList} was updated.
+          # @!attribute [rw] labels
+          #   @return [::Google::Protobuf::Map{::String => ::String}]
+          #     Optional. Labels with user-defined metadata.
+          class CertificateRevocationList
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Describes a revoked {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate}.
+            # @!attribute [rw] certificate
+            #   @return [::String]
+            #     The resource path for the {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} in the format
+            #     `projects/*/locations/*/certificateAuthorities/*/certificates/*`.
+            # @!attribute [rw] hex_serial_number
+            #   @return [::String]
+            #     The serial number of the {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate}.
+            # @!attribute [rw] revocation_reason
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::RevocationReason]
+            #     The reason the {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} was revoked.
+            class RevokedCertificate
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # @!attribute [rw] key
+            #   @return [::String]
+            # @!attribute [rw] value
+            #   @return [::String]
+            class LabelsEntry
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # The state of a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList}, indicating if it is current.
+            module State
+              # Not specified.
+              STATE_UNSPECIFIED = 0
+
+              # The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList} is up to date.
+              ACTIVE = 1
+
+              # The {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateRevocationList CertificateRevocationList} is no longer current.
+              SUPERSEDED = 2
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} corresponds to a signed X.509 certificate issued by a
+          # {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}.
+          # @!attribute [r] name
+          #   @return [::String]
+          #     Output only. The resource path for this {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} in the format
+          #     `projects/*/locations/*/certificateAuthorities/*/certificates/*`.
+          # @!attribute [rw] pem_csr
+          #   @return [::String]
+          #     Immutable. A pem-encoded X.509 certificate signing request (CSR).
+          # @!attribute [rw] config
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateConfig]
+          #     Immutable. A description of the certificate and key that does not require X.509 or
+          #     ASN.1.
+          # @!attribute [rw] lifetime
+          #   @return [::Google::Protobuf::Duration]
+          #     Required. Immutable. The desired lifetime of a certificate. Used to create the
+          #     "not_before_time" and "not_after_time" fields inside an X.509
+          #     certificate. Note that the lifetime may be truncated if it would extend
+          #     past the life of any certificate authority in the issuing chain.
+          # @!attribute [r] revocation_details
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::Certificate::RevocationDetails]
+          #     Output only. Details regarding the revocation of this {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate}. This
+          #     {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} is considered revoked if and only if this field is present.
+          # @!attribute [r] pem_certificate
+          #   @return [::String]
+          #     Output only. The pem-encoded, signed X.509 certificate.
+          # @!attribute [r] certificate_description
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateDescription]
+          #     Output only. A structured description of the issued X.509 certificate.
+          # @!attribute [r] pem_certificate_chain
+          #   @return [::Array<::String>]
+          #     Output only. The chain that may be used to verify the X.509 certificate. Expected to be
+          #     in issuer-to-root order according to RFC 5246.
+          # @!attribute [r] create_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} was created.
+          # @!attribute [r] update_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} was updated.
+          # @!attribute [rw] labels
+          #   @return [::Google::Protobuf::Map{::String => ::String}]
+          #     Optional. Labels with user-defined metadata.
+          class Certificate
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Describes fields that are relavent to the revocation of a {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate}.
+            # @!attribute [rw] revocation_state
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::RevocationReason]
+            #     Indicates why a {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} was revoked.
+            # @!attribute [rw] revocation_time
+            #   @return [::Google::Protobuf::Timestamp]
+            #     The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} was revoked.
+            class RevocationDetails
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # @!attribute [rw] key
+            #   @return [::String]
+            # @!attribute [rw] value
+            #   @return [::String]
+            class LabelsEntry
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfig ReusableConfig} refers to a managed {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues ReusableConfigValues}. Those, in
+          # turn, are used to describe certain fields of an X.509 certificate, such as
+          # the key usage fields, fields specific to CA certificates, certificate policy
+          # extensions and custom extensions.
+          # @!attribute [r] name
+          #   @return [::String]
+          #     Output only. The resource path for this {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfig ReusableConfig} in the format
+          #     `projects/*/locations/*/reusableConfigs/*`.
+          # @!attribute [rw] values
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues]
+          #     Required. The config values.
+          # @!attribute [rw] description
+          #   @return [::String]
+          #     Optional. A human-readable description of scenarios these ReusableConfigValues may be
+          #     compatible with.
+          # @!attribute [r] create_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfig ReusableConfig} was created.
+          # @!attribute [r] update_time
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Output only. The time at which this {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfig ReusableConfig} was updated.
+          # @!attribute [rw] labels
+          #   @return [::Google::Protobuf::Map{::String => ::String}]
+          #     Optional. Labels with user-defined metadata.
+          class ReusableConfig
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # @!attribute [rw] key
+            #   @return [::String]
+            # @!attribute [rw] value
+            #   @return [::String]
+            class LabelsEntry
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues ReusableConfigValues} is used to describe certain fields of an
+          # X.509 certificate, such as the key usage fields, fields specific to CA
+          # certificates, certificate policy extensions and custom extensions.
+          # @!attribute [rw] key_usage
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::KeyUsage]
+          #     Optional. Indicates the intended use for keys that correspond to a certificate.
+          # @!attribute [rw] ca_options
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues::CaOptions]
+          #     Optional. Describes options in this {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues ReusableConfigValues} that are
+          #     relevant in a CA certificate.
+          # @!attribute [rw] policy_ids
+          #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::ObjectId>]
+          #     Optional. Describes the X.509 certificate policy object identifiers, per
+          #     https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
+          # @!attribute [rw] aia_ocsp_servers
+          #   @return [::Array<::String>]
+          #     Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses
+          #     that appear in the "Authority Information Access" extension in the
+          #     certificate.
+          # @!attribute [rw] additional_extensions
+          #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::X509Extension>]
+          #     Optional. Describes custom X.509 extensions.
+          class ReusableConfigValues
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Describes values that are relevant in a CA certificate.
+            # @!attribute [rw] is_ca
+            #   @return [::Google::Protobuf::BoolValue]
+            #     Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this
+            #     value is missing, the extension will be omitted from the CA certificate.
+            # @!attribute [rw] max_issuer_path_length
+            #   @return [::Google::Protobuf::Int32Value]
+            #     Optional. Refers to the path length restriction X.509 extension. For a CA
+            #     certificate, this value describes the depth of subordinate CA
+            #     certificates that are allowed.
+            #     If this value is less than 0, the request will fail.
+            #     If this value is missing, the max path length will be omitted from the
+            #     CA certificate.
+            class CaOptions
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigWrapper ReusableConfigWrapper} describes values that may assist in creating an
+          # X.509 certificate, or a reference to a pre-defined set of values.
+          # @!attribute [rw] reusable_config
+          #   @return [::String]
+          #     Required. A resource path to a {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfig ReusableConfig} in the format
+          #     `projects/*/locations/*/reusableConfigs/*`.
+          # @!attribute [rw] reusable_config_values
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues]
+          #     Required. A user-specified inline {::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues ReusableConfigValues}.
+          class ReusableConfigWrapper
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # Describes a subordinate CA's issuers. This is either a resource path to a
+          # known issuing {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}, or a PEM issuer certificate chain.
+          # @!attribute [rw] certificate_authority
+          #   @return [::String]
+          #     Required. This can refer to a {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} in the same project that
+          #     was used to create a subordinate {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}. This field
+          #     is used for information and usability purposes only. The resource name
+          #     is in the format `projects/*/locations/*/certificateAuthorities/*`.
+          # @!attribute [rw] pem_issuer_chain
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::SubordinateConfig::SubordinateConfigChain]
+          #     Required. Contains the PEM certificate chain for the issuers of this
+          #     {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority}, but not pem certificate for this CA itself.
+          class SubordinateConfig
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # This message describes a subordinate CA's issuer certificate chain. This
+            # wrapper exists for compatibility reasons.
+            # @!attribute [rw] pem_certificates
+            #   @return [::Array<::String>]
+            #     Required. Expected to be in leaf-to-root order according to RFC 5246.
+            class SubordinateConfigChain
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::PublicKey PublicKey} describes a public key.
+          # @!attribute [rw] type
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::PublicKey::KeyType]
+          #     Required. The type of public key.
+          # @!attribute [rw] key
+          #   @return [::String]
+          #     Required. A public key. Padding and encoding varies by 'KeyType' and is described
+          #     along with the KeyType values.
+          class PublicKey
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Types of public keys that are supported.
+            # At a minimum, we support RSA and ECDSA, for the key sizes or curves listed:
+            # https://cloud.google.com/kms/docs/algorithms#asymmetric_signing_algorithms
+            module KeyType
+              # Default unspecified value.
+              KEY_TYPE_UNSPECIFIED = 0
+
+              # A PEM-encoded PKCS#1/RFC 3447 RSAPrivateKey structure.
+              PEM_RSA_KEY = 1
+
+              # A PEM-encoded compressed NIST P-256/secp256r1/prime256v1 or P-384 key.
+              PEM_EC_KEY = 2
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateConfig CertificateConfig} describes an X.509 certificate or CSR that is to be
+          # created, as an alternative to using ASN.1.
+          # @!attribute [rw] subject_config
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateConfig::SubjectConfig]
+          #     Required. Specifies some of the values in a certificate that are related to the
+          #     subject.
+          # @!attribute [rw] reusable_config
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigWrapper]
+          #     Required. Describes how some of the technical fields in a certificate should be
+          #     populated.
+          # @!attribute [rw] public_key
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::PublicKey]
+          #     Optional. The public key that corresponds to this config. This is, for example, used
+          #     when issuing {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificates}, but not when creating a
+          #     self-signed {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} or {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateAuthority CertificateAuthority} CSR.
+          class CertificateConfig
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # These values are used to create the distinguished name and subject
+            # alternative name fields in an X.509 certificate.
+            # @!attribute [rw] subject
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::Subject]
+            #     Required. Contains distinguished name fields such as the location and organization.
+            # @!attribute [rw] common_name
+            #   @return [::String]
+            #     Optional. The "common name" of the distinguished name.
+            # @!attribute [rw] subject_alt_name
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::SubjectAltNames]
+            #     Optional. The subject alternative name fields.
+            class SubjectConfig
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::CertificateDescription CertificateDescription} describes an X.509 certificate or CSR that has
+          # been issued, as an alternative to using ASN.1 / X.509.
+          # @!attribute [rw] subject_description
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateDescription::SubjectDescription]
+          #     Describes some of the values in a certificate that are related to the
+          #     subject and lifetime.
+          # @!attribute [rw] config_values
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::ReusableConfigValues]
+          #     Describes some of the technical fields in a certificate.
+          # @!attribute [rw] public_key
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::PublicKey]
+          #     The public key that corresponds to an issued certificate.
+          # @!attribute [rw] subject_key_id
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateDescription::KeyId]
+          #     Provides a means of identifiying certificates that contain a particular
+          #     public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
+          # @!attribute [rw] authority_key_id
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateDescription::KeyId]
+          #     Identifies the subject_key_id of the parent certificate, per
+          #     https://tools.ietf.org/html/rfc5280#section-4.2.1.1
+          # @!attribute [rw] crl_distribution_points
+          #   @return [::Array<::String>]
+          #     Describes a list of locations to obtain CRL information, i.e.
+          #     the DistributionPoint.fullName described by
+          #     https://tools.ietf.org/html/rfc5280#section-4.2.1.13
+          # @!attribute [rw] aia_issuing_certificate_urls
+          #   @return [::Array<::String>]
+          #     Describes lists of issuer CA certificate URLs that appear in the
+          #     "Authority Information Access" extension in the certificate.
+          # @!attribute [rw] cert_fingerprint
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::CertificateDescription::CertificateFingerprint]
+          #     The hash of the x.509 certificate.
+          class CertificateDescription
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # These values describe fields in an issued X.509 certificate such as the
+            # distinguished name, subject alternative names, serial number, and lifetime.
+            # @!attribute [rw] subject
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::Subject]
+            #     Contains distinguished name fields such as the location and organization.
+            # @!attribute [rw] common_name
+            #   @return [::String]
+            #     The "common name" of the distinguished name.
+            # @!attribute [rw] subject_alt_name
+            #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::SubjectAltNames]
+            #     The subject alternative name fields.
+            # @!attribute [rw] hex_serial_number
+            #   @return [::String]
+            #     The serial number encoded in lowercase hexadecimal.
+            # @!attribute [rw] lifetime
+            #   @return [::Google::Protobuf::Duration]
+            #     For convenience, the actual lifetime of an issued certificate.
+            #     Corresponds to 'not_after_time' - 'not_before_time'.
+            # @!attribute [rw] not_before_time
+            #   @return [::Google::Protobuf::Timestamp]
+            #     The time at which the certificate becomes valid.
+            # @!attribute [rw] not_after_time
+            #   @return [::Google::Protobuf::Timestamp]
+            #     The time at which the certificate expires.
+            class SubjectDescription
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # A KeyId identifies a specific public key, usually by hashing the public
+            # key.
+            # @!attribute [rw] key_id
+            #   @return [::String]
+            #     Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most
+            #     likely the 160 bit SHA-1 hash of the public key.
+            class KeyId
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # A group of fingerprints for the x509 certificate.
+            # @!attribute [rw] sha256_hash
+            #   @return [::String]
+            #     The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
+            class CertificateFingerprint
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # An {::Google::Cloud::Security::PrivateCA::V1beta1::ObjectId ObjectId} specifies an object identifier (OID). These provide context
+          # and describe types in ASN.1 messages.
+          # @!attribute [rw] object_id_path
+          #   @return [::Array<::Integer>]
+          #     Required. The parts of an OID path. The most significant parts of the path come
+          #     first.
+          class ObjectId
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # An {::Google::Cloud::Security::PrivateCA::V1beta1::X509Extension X509Extension} specifies an X.509 extension, which may be used in
+          # different parts of X.509 objects like certificates, CSRs, and CRLs.
+          # @!attribute [rw] object_id
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::ObjectId]
+          #     Required. The OID for this X.509 extension.
+          # @!attribute [rw] critical
+          #   @return [::Boolean]
+          #     Required. Indicates whether or not this extension is critical (i.e., if the client
+          #     does not know how to handle this extension, the client should consider this
+          #     to be an error).
+          # @!attribute [rw] value
+          #   @return [::String]
+          #     Required. The value of this X.509 extension.
+          class X509Extension
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::KeyUsage KeyUsage} describes key usage values that may appear in an X.509
+          # certificate.
+          # @!attribute [rw] base_key_usage
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::KeyUsage::KeyUsageOptions]
+          #     Describes high-level ways in which a key may be used.
+          # @!attribute [rw] extended_key_usage
+          #   @return [::Google::Cloud::Security::PrivateCA::V1beta1::KeyUsage::ExtendedKeyUsageOptions]
+          #     Detailed scenarios in which a key may be used.
+          # @!attribute [rw] unknown_extended_key_usages
+          #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::ObjectId>]
+          #     Used to describe extended key usages that are not listed in the
+          #     {::Google::Cloud::Security::PrivateCA::V1beta1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} message.
+          class KeyUsage
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # {::Google::Cloud::Security::PrivateCA::V1beta1::KeyUsage::KeyUsageOptions KeyUsage.KeyUsageOptions} corresponds to the key usage values
+            # described in https://tools.ietf.org/html/rfc5280#section-4.2.1.3.
+            # @!attribute [rw] digital_signature
+            #   @return [::Boolean]
+            #     The key may be used for digital signatures.
+            # @!attribute [rw] content_commitment
+            #   @return [::Boolean]
+            #     The key may be used for cryptographic commitments. Note that this may
+            #     also be referred to as "non-repudiation".
+            # @!attribute [rw] key_encipherment
+            #   @return [::Boolean]
+            #     The key may be used to encipher other keys.
+            # @!attribute [rw] data_encipherment
+            #   @return [::Boolean]
+            #     The key may be used to encipher data.
+            # @!attribute [rw] key_agreement
+            #   @return [::Boolean]
+            #     The key may be used in a key agreement protocol.
+            # @!attribute [rw] cert_sign
+            #   @return [::Boolean]
+            #     The key may be used to sign certificates.
+            # @!attribute [rw] crl_sign
+            #   @return [::Boolean]
+            #     The key may be used sign certificate revocation lists.
+            # @!attribute [rw] encipher_only
+            #   @return [::Boolean]
+            #     The key may be used to encipher only.
+            # @!attribute [rw] decipher_only
+            #   @return [::Boolean]
+            #     The key may be used to decipher only.
+            class KeyUsageOptions
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # {::Google::Cloud::Security::PrivateCA::V1beta1::KeyUsage::ExtendedKeyUsageOptions KeyUsage.ExtendedKeyUsageOptions} has fields that correspond to
+            # certain common OIDs that could be specified as an extended key usage value.
+            # @!attribute [rw] server_auth
+            #   @return [::Boolean]
+            #     Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW
+            #     server authentication", though regularly used for non-WWW TLS.
+            # @!attribute [rw] client_auth
+            #   @return [::Boolean]
+            #     Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW
+            #     client authentication", though regularly used for non-WWW TLS.
+            # @!attribute [rw] code_signing
+            #   @return [::Boolean]
+            #     Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of
+            #     downloadable executable code client authentication".
+            # @!attribute [rw] email_protection
+            #   @return [::Boolean]
+            #     Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email
+            #     protection".
+            # @!attribute [rw] time_stamping
+            #   @return [::Boolean]
+            #     Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding
+            #     the hash of an object to a time".
+            # @!attribute [rw] ocsp_signing
+            #   @return [::Boolean]
+            #     Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing
+            #     OCSP responses".
+            class ExtendedKeyUsageOptions
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # {::Google::Cloud::Security::PrivateCA::V1beta1::Subject Subject} describes parts of a distinguished name that, in turn,
+          # describes the subject of the certificate.
+          # @!attribute [rw] country_code
+          #   @return [::String]
+          #     The country code of the subject.
+          # @!attribute [rw] organization
+          #   @return [::String]
+          #     The organization of the subject.
+          # @!attribute [rw] organizational_unit
+          #   @return [::String]
+          #     The organizational_unit of the subject.
+          # @!attribute [rw] locality
+          #   @return [::String]
+          #     The locality or city of the subject.
+          # @!attribute [rw] province
+          #   @return [::String]
+          #     The province, territory, or regional state of the subject.
+          # @!attribute [rw] street_address
+          #   @return [::String]
+          #     The street address of the subject.
+          # @!attribute [rw] postal_code
+          #   @return [::String]
+          #     The postal code of the subject.
+          class Subject
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # {::Google::Cloud::Security::PrivateCA::V1beta1::SubjectAltNames SubjectAltNames} corresponds to a more modern way of listing what
+          # the asserted identity is in a certificate (i.e., compared to the "common
+          # name" in the distinguished name).
+          # @!attribute [rw] dns_names
+          #   @return [::Array<::String>]
+          #     Contains only valid, fully-qualified host names.
+          # @!attribute [rw] uris
+          #   @return [::Array<::String>]
+          #     Contains only valid RFC 3986 URIs.
+          # @!attribute [rw] email_addresses
+          #   @return [::Array<::String>]
+          #     Contains only valid RFC 2822 E-mail addresses.
+          # @!attribute [rw] ip_addresses
+          #   @return [::Array<::String>]
+          #     Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
+          # @!attribute [rw] custom_sans
+          #   @return [::Array<::Google::Cloud::Security::PrivateCA::V1beta1::X509Extension>]
+          #     Contains additional subject alternative name values.
+          class SubjectAltNames
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # A {::Google::Cloud::Security::PrivateCA::V1beta1::RevocationReason RevocationReason} indicates whether a {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} has been revoked,
+          # and the reason for revocation. These correspond to standard revocation
+          # reasons from RFC 5280. Note that the enum labels and values in this
+          # definition are not the same ASN.1 values defined in RFC 5280. These values
+          # will be translated to the correct ASN.1 values when a CRL is created.
+          module RevocationReason
+            # Default unspecified value. This value does indicate that a {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate}
+            # has been revoked, but that a reason has not been recorded.
+            REVOCATION_REASON_UNSPECIFIED = 0
+
+            # Key material for this {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} may have leaked.
+            KEY_COMPROMISE = 1
+
+            # The key material for a certificate authority in the issuing path may have
+            # leaked.
+            CERTIFICATE_AUTHORITY_COMPROMISE = 2
+
+            # The subject or other attributes in this {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} have changed.
+            AFFILIATION_CHANGED = 3
+
+            # This {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} has been superseded.
+            SUPERSEDED = 4
+
+            # This {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} or entities in the issuing path have ceased to
+            # operate.
+            CESSATION_OF_OPERATION = 5
+
+            # This {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} should not be considered valid, it is expected that it
+            # may become valid in the future.
+            CERTIFICATE_HOLD = 6
+
+            # This {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate} no longer has permission to assert the listed
+            # attributes.
+            PRIVILEGE_WITHDRAWN = 7
+
+            # The authority which determines appropriate attributes for a {::Google::Cloud::Security::PrivateCA::V1beta1::Certificate Certificate}
+            # may have been compromised.
+            ATTRIBUTE_AUTHORITY_COMPROMISE = 8
+          end
+        end
+      end
+    end
+  end
+end