@aws-sdk/client-acm-pca 3.857.0 → 3.859.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -16
- package/dist-types/ACMPCA.d.ts +1 -16
- package/dist-types/ACMPCAClient.d.ts +1 -16
- package/dist-types/commands/CreateCertificateAuthorityAuditReportCommand.d.ts +3 -13
- package/dist-types/commands/CreateCertificateAuthorityCommand.d.ts +4 -27
- package/dist-types/commands/CreatePermissionCommand.d.ts +4 -33
- package/dist-types/commands/DeleteCertificateAuthorityCommand.d.ts +3 -24
- package/dist-types/commands/DeletePermissionCommand.d.ts +3 -33
- package/dist-types/commands/DeletePolicyCommand.d.ts +4 -42
- package/dist-types/commands/DescribeCertificateAuthorityAuditReportCommand.d.ts +3 -8
- package/dist-types/commands/DescribeCertificateAuthorityCommand.d.ts +3 -45
- package/dist-types/commands/GetCertificateAuthorityCertificateCommand.d.ts +3 -8
- package/dist-types/commands/GetCertificateAuthorityCsrCommand.d.ts +3 -9
- package/dist-types/commands/GetCertificateCommand.d.ts +3 -12
- package/dist-types/commands/GetPolicyCommand.d.ts +3 -35
- package/dist-types/commands/ImportCertificateAuthorityCertificateCommand.d.ts +4 -132
- package/dist-types/commands/IssueCertificateCommand.d.ts +4 -14
- package/dist-types/commands/ListCertificateAuthoritiesCommand.d.ts +1 -2
- package/dist-types/commands/ListPermissionsCommand.d.ts +4 -34
- package/dist-types/commands/ListTagsCommand.d.ts +3 -8
- package/dist-types/commands/PutPolicyCommand.d.ts +5 -41
- package/dist-types/commands/RestoreCertificateAuthorityCommand.d.ts +3 -15
- package/dist-types/commands/RevokeCertificateCommand.d.ts +4 -26
- package/dist-types/commands/TagCertificateAuthorityCommand.d.ts +5 -23
- package/dist-types/commands/UntagCertificateAuthorityCommand.d.ts +4 -11
- package/dist-types/commands/UpdateCertificateAuthorityCommand.d.ts +4 -17
- package/dist-types/index.d.ts +1 -16
- package/dist-types/models/models_0.d.ts +151 -848
- package/package.json +5 -5
|
@@ -6,42 +6,33 @@ import { ACMPCAServiceException as __BaseException } from "./ACMPCAServiceExcept
|
|
|
6
6
|
*/
|
|
7
7
|
export interface CustomAttribute {
|
|
8
8
|
/**
|
|
9
|
-
* <p>Specifies the object identifier (OID) of the attribute type of the relative
|
|
10
|
-
* distinguished name (RDN).</p>
|
|
9
|
+
* <p>Specifies the object identifier (OID) of the attribute type of the relative distinguished name (RDN).</p>
|
|
11
10
|
* @public
|
|
12
11
|
*/
|
|
13
12
|
ObjectIdentifier: string | undefined;
|
|
14
13
|
/**
|
|
15
|
-
* <p/>
|
|
16
|
-
* <p>Specifies the attribute value of relative distinguished name (RDN).</p>
|
|
14
|
+
* <p/> <p>Specifies the attribute value of relative distinguished name (RDN).</p>
|
|
17
15
|
* @public
|
|
18
16
|
*/
|
|
19
17
|
Value: string | undefined;
|
|
20
18
|
}
|
|
21
19
|
/**
|
|
22
|
-
* <p>Contains information about the certificate subject. The <code>Subject</code> field in
|
|
23
|
-
* the certificate identifies the entity that owns or controls the public key in the
|
|
24
|
-
* certificate. The entity can be a user, computer, device, or service. The <code>Subject
|
|
25
|
-
* </code>must contain an X.500 distinguished name (DN). A DN is a sequence of relative
|
|
26
|
-
* distinguished names (RDNs). The RDNs are separated by commas in the certificate.</p>
|
|
20
|
+
* <p>Contains information about the certificate subject. The <code>Subject</code> field in the certificate identifies the entity that owns or controls the public key in the certificate. The entity can be a user, computer, device, or service. The <code>Subject </code>must contain an X.500 distinguished name (DN). A DN is a sequence of relative distinguished names (RDNs). The RDNs are separated by commas in the certificate.</p>
|
|
27
21
|
* @public
|
|
28
22
|
*/
|
|
29
23
|
export interface ASN1Subject {
|
|
30
24
|
/**
|
|
31
|
-
* <p>Two-digit code that specifies the country in which the certificate subject
|
|
32
|
-
* located.</p>
|
|
25
|
+
* <p>Two-digit code that specifies the country in which the certificate subject located.</p>
|
|
33
26
|
* @public
|
|
34
27
|
*/
|
|
35
28
|
Country?: string | undefined;
|
|
36
29
|
/**
|
|
37
|
-
* <p>Legal name of the organization with which the certificate subject is affiliated.
|
|
38
|
-
* </p>
|
|
30
|
+
* <p>Legal name of the organization with which the certificate subject is affiliated. </p>
|
|
39
31
|
* @public
|
|
40
32
|
*/
|
|
41
33
|
Organization?: string | undefined;
|
|
42
34
|
/**
|
|
43
|
-
* <p>A subdivision or unit of the organization (such as sales or finance) with which the
|
|
44
|
-
* certificate subject is affiliated.</p>
|
|
35
|
+
* <p>A subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated.</p>
|
|
45
36
|
* @public
|
|
46
37
|
*/
|
|
47
38
|
OrganizationalUnit?: string | undefined;
|
|
@@ -56,10 +47,7 @@ export interface ASN1Subject {
|
|
|
56
47
|
*/
|
|
57
48
|
State?: string | undefined;
|
|
58
49
|
/**
|
|
59
|
-
* <p>For CA and end-entity certificates in a private PKI, the common name (CN) can be any
|
|
60
|
-
* string within the length limit. </p>
|
|
61
|
-
* <p>Note: In publicly trusted certificates, the common name must be a fully qualified
|
|
62
|
-
* domain name (FQDN) associated with the certificate subject.</p>
|
|
50
|
+
* <p>For CA and end-entity certificates in a private PKI, the common name (CN) can be any string within the length limit. </p> <p>Note: In publicly trusted certificates, the common name must be a fully qualified domain name (FQDN) associated with the certificate subject.</p>
|
|
63
51
|
* @public
|
|
64
52
|
*/
|
|
65
53
|
CommonName?: string | undefined;
|
|
@@ -69,20 +57,17 @@ export interface ASN1Subject {
|
|
|
69
57
|
*/
|
|
70
58
|
SerialNumber?: string | undefined;
|
|
71
59
|
/**
|
|
72
|
-
* <p>The locality (such as a city or town) in which the certificate subject is
|
|
73
|
-
* located.</p>
|
|
60
|
+
* <p>The locality (such as a city or town) in which the certificate subject is located.</p>
|
|
74
61
|
* @public
|
|
75
62
|
*/
|
|
76
63
|
Locality?: string | undefined;
|
|
77
64
|
/**
|
|
78
|
-
* <p>A title such as Mr. or Ms., which is pre-pended to the name to refer formally to the
|
|
79
|
-
* certificate subject.</p>
|
|
65
|
+
* <p>A title such as Mr. or Ms., which is pre-pended to the name to refer formally to the certificate subject.</p>
|
|
80
66
|
* @public
|
|
81
67
|
*/
|
|
82
68
|
Title?: string | undefined;
|
|
83
69
|
/**
|
|
84
|
-
* <p>Family name. In the US and the UK, for example, the surname of an individual is
|
|
85
|
-
* ordered last. In Asian cultures the surname is typically ordered first.</p>
|
|
70
|
+
* <p>Family name. In the US and the UK, for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first.</p>
|
|
86
71
|
* @public
|
|
87
72
|
*/
|
|
88
73
|
Surname?: string | undefined;
|
|
@@ -92,40 +77,28 @@ export interface ASN1Subject {
|
|
|
92
77
|
*/
|
|
93
78
|
GivenName?: string | undefined;
|
|
94
79
|
/**
|
|
95
|
-
* <p>Concatenation that typically contains the first letter of the <b>GivenName</b>, the first letter of the middle name if one exists, and the
|
|
96
|
-
* first letter of the <b>Surname</b>.</p>
|
|
80
|
+
* <p>Concatenation that typically contains the first letter of the <b>GivenName</b>, the first letter of the middle name if one exists, and the first letter of the <b>Surname</b>.</p>
|
|
97
81
|
* @public
|
|
98
82
|
*/
|
|
99
83
|
Initials?: string | undefined;
|
|
100
84
|
/**
|
|
101
|
-
* <p>Typically a shortened version of a longer <b>GivenName</b>.
|
|
102
|
-
* For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth,
|
|
103
|
-
* Liz, or Eliza.</p>
|
|
85
|
+
* <p>Typically a shortened version of a longer <b>GivenName</b>. For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza.</p>
|
|
104
86
|
* @public
|
|
105
87
|
*/
|
|
106
88
|
Pseudonym?: string | undefined;
|
|
107
89
|
/**
|
|
108
|
-
* <p>Typically a qualifier appended to the name of an individual. Examples include Jr. for
|
|
109
|
-
* junior, Sr. for senior, and III for third.</p>
|
|
90
|
+
* <p>Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third.</p>
|
|
110
91
|
* @public
|
|
111
92
|
*/
|
|
112
93
|
GenerationQualifier?: string | undefined;
|
|
113
94
|
/**
|
|
114
|
-
* <p/>
|
|
115
|
-
* <p>Contains a sequence of one or more X.500 relative distinguished names (RDNs), each of
|
|
116
|
-
* which consists of an object identifier (OID) and a value. For more information, see
|
|
117
|
-
* NIST’s definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier (OID)</a>.</p>
|
|
118
|
-
* <note>
|
|
119
|
-
* <p>Custom attributes cannot be used in combination with standard attributes.</p>
|
|
120
|
-
* </note>
|
|
95
|
+
* <p/> <p>Contains a sequence of one or more X.500 relative distinguished names (RDNs), each of which consists of an object identifier (OID) and a value. For more information, see NIST’s definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier (OID)</a>.</p> <note> <p>Custom attributes cannot be used in combination with standard attributes.</p> </note>
|
|
121
96
|
* @public
|
|
122
97
|
*/
|
|
123
98
|
CustomAttributes?: CustomAttribute[] | undefined;
|
|
124
99
|
}
|
|
125
100
|
/**
|
|
126
|
-
* <p>Describes an Electronic Data Interchange (EDI) entity as described in as defined in
|
|
127
|
-
* <a href="https://datatracker.ietf.org/doc/html/rfc5280">Subject Alternative
|
|
128
|
-
* Name</a> in RFC 5280.</p>
|
|
101
|
+
* <p>Describes an Electronic Data Interchange (EDI) entity as described in as defined in <a href="https://datatracker.ietf.org/doc/html/rfc5280">Subject Alternative Name</a> in RFC 5280.</p>
|
|
129
102
|
* @public
|
|
130
103
|
*/
|
|
131
104
|
export interface EdiPartyName {
|
|
@@ -141,10 +114,7 @@ export interface EdiPartyName {
|
|
|
141
114
|
NameAssigner?: string | undefined;
|
|
142
115
|
}
|
|
143
116
|
/**
|
|
144
|
-
* <p>Defines a custom ASN.1 X.400 <code>GeneralName</code> using an object identifier (OID)
|
|
145
|
-
* and value. The OID must satisfy the regular expression shown below. For more
|
|
146
|
-
* information, see NIST's definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier
|
|
147
|
-
* (OID)</a>.</p>
|
|
117
|
+
* <p>Defines a custom ASN.1 X.400 <code>GeneralName</code> using an object identifier (OID) and value. The OID must satisfy the regular expression shown below. For more information, see NIST's definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier (OID)</a>.</p>
|
|
148
118
|
* @public
|
|
149
119
|
*/
|
|
150
120
|
export interface OtherName {
|
|
@@ -160,9 +130,7 @@ export interface OtherName {
|
|
|
160
130
|
Value: string | undefined;
|
|
161
131
|
}
|
|
162
132
|
/**
|
|
163
|
-
* <p>Describes an ASN.1 X.400 <code>GeneralName</code> as defined in <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>. Only one of
|
|
164
|
-
* the following naming options should be provided. Providing more than one option results
|
|
165
|
-
* in an <code>InvalidArgsException</code> error.</p>
|
|
133
|
+
* <p>Describes an ASN.1 X.400 <code>GeneralName</code> as defined in <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>. Only one of the following naming options should be provided. Providing more than one option results in an <code>InvalidArgsException</code> error.</p>
|
|
166
134
|
* @public
|
|
167
135
|
*/
|
|
168
136
|
export interface GeneralName {
|
|
@@ -172,8 +140,7 @@ export interface GeneralName {
|
|
|
172
140
|
*/
|
|
173
141
|
OtherName?: OtherName | undefined;
|
|
174
142
|
/**
|
|
175
|
-
* <p>Represents <code>GeneralName</code> as an <a href="https://datatracker.ietf.org/doc/html/rfc822">RFC 822</a> email
|
|
176
|
-
* address.</p>
|
|
143
|
+
* <p>Represents <code>GeneralName</code> as an <a href="https://datatracker.ietf.org/doc/html/rfc822">RFC 822</a> email address.</p>
|
|
177
144
|
* @public
|
|
178
145
|
*/
|
|
179
146
|
Rfc822Name?: string | undefined;
|
|
@@ -183,11 +150,7 @@ export interface GeneralName {
|
|
|
183
150
|
*/
|
|
184
151
|
DnsName?: string | undefined;
|
|
185
152
|
/**
|
|
186
|
-
* <p>Contains information about the certificate subject. The <code>Subject</code> field in
|
|
187
|
-
* the certificate identifies the entity that owns or controls the public key in the
|
|
188
|
-
* certificate. The entity can be a user, computer, device, or service. The <code>Subject
|
|
189
|
-
* </code>must contain an X.500 distinguished name (DN). A DN is a sequence of relative
|
|
190
|
-
* distinguished names (RDNs). The RDNs are separated by commas in the certificate.</p>
|
|
153
|
+
* <p>Contains information about the certificate subject. The <code>Subject</code> field in the certificate identifies the entity that owns or controls the public key in the certificate. The entity can be a user, computer, device, or service. The <code>Subject </code>must contain an X.500 distinguished name (DN). A DN is a sequence of relative distinguished names (RDNs). The RDNs are separated by commas in the certificate.</p>
|
|
191
154
|
* @public
|
|
192
155
|
*/
|
|
193
156
|
DirectoryName?: ASN1Subject | undefined;
|
|
@@ -226,17 +189,12 @@ export declare const AccessMethodType: {
|
|
|
226
189
|
*/
|
|
227
190
|
export type AccessMethodType = (typeof AccessMethodType)[keyof typeof AccessMethodType];
|
|
228
191
|
/**
|
|
229
|
-
* <p>Describes the type and format of extension access. Only one of
|
|
230
|
-
* <code>CustomObjectIdentifier</code> or <code>AccessMethodType</code> may be
|
|
231
|
-
* provided. Providing both results in <code>InvalidArgsException</code>.</p>
|
|
192
|
+
* <p>Describes the type and format of extension access. Only one of <code>CustomObjectIdentifier</code> or <code>AccessMethodType</code> may be provided. Providing both results in <code>InvalidArgsException</code>.</p>
|
|
232
193
|
* @public
|
|
233
194
|
*/
|
|
234
195
|
export interface AccessMethod {
|
|
235
196
|
/**
|
|
236
|
-
* <p>An object identifier (OID) specifying the <code>AccessMethod</code>. The OID must
|
|
237
|
-
* satisfy the regular expression shown below. For more information, see NIST's definition
|
|
238
|
-
* of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier
|
|
239
|
-
* (OID)</a>.</p>
|
|
197
|
+
* <p>An object identifier (OID) specifying the <code>AccessMethod</code>. The OID must satisfy the regular expression shown below. For more information, see NIST's definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier (OID)</a>.</p>
|
|
240
198
|
* @public
|
|
241
199
|
*/
|
|
242
200
|
CustomObjectIdentifier?: string | undefined;
|
|
@@ -247,8 +205,7 @@ export interface AccessMethod {
|
|
|
247
205
|
AccessMethodType?: AccessMethodType | undefined;
|
|
248
206
|
}
|
|
249
207
|
/**
|
|
250
|
-
* <p>Provides access information used by the <code>authorityInfoAccess</code> and
|
|
251
|
-
* <code>subjectInfoAccess</code> extensions described in <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>.</p>
|
|
208
|
+
* <p>Provides access information used by the <code>authorityInfoAccess</code> and <code>subjectInfoAccess</code> extensions described in <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>.</p>
|
|
252
209
|
* @public
|
|
253
210
|
*/
|
|
254
211
|
export interface AccessDescription {
|
|
@@ -264,8 +221,7 @@ export interface AccessDescription {
|
|
|
264
221
|
AccessLocation: GeneralName | undefined;
|
|
265
222
|
}
|
|
266
223
|
/**
|
|
267
|
-
* <p>Defines one or more purposes for which the key contained in the certificate can be
|
|
268
|
-
* used. Default value for each option is false.</p>
|
|
224
|
+
* <p>Defines one or more purposes for which the key contained in the certificate can be used. Default value for each option is false.</p>
|
|
269
225
|
* @public
|
|
270
226
|
*/
|
|
271
227
|
export interface KeyUsage {
|
|
@@ -316,21 +272,17 @@ export interface KeyUsage {
|
|
|
316
272
|
DecipherOnly?: boolean | undefined;
|
|
317
273
|
}
|
|
318
274
|
/**
|
|
319
|
-
* <p>Describes the certificate extensions to be added to the certificate signing request
|
|
320
|
-
* (CSR).</p>
|
|
275
|
+
* <p>Describes the certificate extensions to be added to the certificate signing request (CSR).</p>
|
|
321
276
|
* @public
|
|
322
277
|
*/
|
|
323
278
|
export interface CsrExtensions {
|
|
324
279
|
/**
|
|
325
|
-
* <p>Indicates the purpose of the certificate and of the key contained in the
|
|
326
|
-
* certificate.</p>
|
|
280
|
+
* <p>Indicates the purpose of the certificate and of the key contained in the certificate.</p>
|
|
327
281
|
* @public
|
|
328
282
|
*/
|
|
329
283
|
KeyUsage?: KeyUsage | undefined;
|
|
330
284
|
/**
|
|
331
|
-
* <p>For CA certificates, provides a path to additional information pertaining to the CA,
|
|
332
|
-
* such as revocation and policy. For more information, see <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.2">Subject
|
|
333
|
-
* Information Access</a> in RFC 5280.</p>
|
|
285
|
+
* <p>For CA certificates, provides a path to additional information pertaining to the CA, such as revocation and policy. For more information, see <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.2">Subject Information Access</a> in RFC 5280.</p>
|
|
334
286
|
* @public
|
|
335
287
|
*/
|
|
336
288
|
SubjectInformationAccess?: AccessDescription[] | undefined;
|
|
@@ -370,37 +322,27 @@ export declare const SigningAlgorithm: {
|
|
|
370
322
|
*/
|
|
371
323
|
export type SigningAlgorithm = (typeof SigningAlgorithm)[keyof typeof SigningAlgorithm];
|
|
372
324
|
/**
|
|
373
|
-
* <p>Contains configuration information for your private certificate authority (CA). This
|
|
374
|
-
* includes information about the class of public key algorithm and the key pair that your
|
|
375
|
-
* private CA creates when it issues a certificate. It also includes the signature
|
|
376
|
-
* algorithm that it uses when issuing certificates, and its X.500 distinguished name. You
|
|
377
|
-
* must specify this information when you call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. </p>
|
|
325
|
+
* <p>Contains configuration information for your private certificate authority (CA). This includes information about the class of public key algorithm and the key pair that your private CA creates when it issues a certificate. It also includes the signature algorithm that it uses when issuing certificates, and its X.500 distinguished name. You must specify this information when you call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. </p>
|
|
378
326
|
* @public
|
|
379
327
|
*/
|
|
380
328
|
export interface CertificateAuthorityConfiguration {
|
|
381
329
|
/**
|
|
382
|
-
* <p>Type of the public key algorithm and size, in bits, of the key pair that your CA
|
|
383
|
-
* creates when it issues a certificate. When you create a subordinate CA, you must use a
|
|
384
|
-
* key algorithm supported by the parent CA.</p>
|
|
330
|
+
* <p>Type of the public key algorithm and size, in bits, of the key pair that your CA creates when it issues a certificate. When you create a subordinate CA, you must use a key algorithm supported by the parent CA.</p>
|
|
385
331
|
* @public
|
|
386
332
|
*/
|
|
387
333
|
KeyAlgorithm: KeyAlgorithm | undefined;
|
|
388
334
|
/**
|
|
389
|
-
* <p>Name of the algorithm your private CA uses to sign certificate requests.</p>
|
|
390
|
-
* <p>This parameter should not be confused with the <code>SigningAlgorithm</code> parameter
|
|
391
|
-
* used to sign certificates when they are issued.</p>
|
|
335
|
+
* <p>Name of the algorithm your private CA uses to sign certificate requests.</p> <p>This parameter should not be confused with the <code>SigningAlgorithm</code> parameter used to sign certificates when they are issued.</p>
|
|
392
336
|
* @public
|
|
393
337
|
*/
|
|
394
338
|
SigningAlgorithm: SigningAlgorithm | undefined;
|
|
395
339
|
/**
|
|
396
|
-
* <p>Structure that contains X.500 distinguished name information for your private
|
|
397
|
-
* CA.</p>
|
|
340
|
+
* <p>Structure that contains X.500 distinguished name information for your private CA.</p>
|
|
398
341
|
* @public
|
|
399
342
|
*/
|
|
400
343
|
Subject: ASN1Subject | undefined;
|
|
401
344
|
/**
|
|
402
|
-
* <p>Specifies information to be added to the extension section of the certificate signing
|
|
403
|
-
* request (CSR).</p>
|
|
345
|
+
* <p>Specifies information to be added to the extension section of the certificate signing request (CSR).</p>
|
|
404
346
|
* @public
|
|
405
347
|
*/
|
|
406
348
|
CsrExtensions?: CsrExtensions | undefined;
|
|
@@ -431,19 +373,12 @@ export declare const KeyStorageSecurityStandard: {
|
|
|
431
373
|
*/
|
|
432
374
|
export type KeyStorageSecurityStandard = (typeof KeyStorageSecurityStandard)[keyof typeof KeyStorageSecurityStandard];
|
|
433
375
|
/**
|
|
434
|
-
* <p>Contains configuration information for the default behavior of the CRL Distribution Point (CDP) extension in certificates issued by your CA. This extension
|
|
435
|
-
* contains a link to download the CRL, so you can check whether a certificate has been revoked. To choose whether you want this extension
|
|
436
|
-
* omitted or not in certificates issued by your CA, you can set the <b>OmitExtension</b> parameter.</p>
|
|
376
|
+
* <p>Contains configuration information for the default behavior of the CRL Distribution Point (CDP) extension in certificates issued by your CA. This extension contains a link to download the CRL, so you can check whether a certificate has been revoked. To choose whether you want this extension omitted or not in certificates issued by your CA, you can set the <b>OmitExtension</b> parameter.</p>
|
|
437
377
|
* @public
|
|
438
378
|
*/
|
|
439
379
|
export interface CrlDistributionPointExtensionConfiguration {
|
|
440
380
|
/**
|
|
441
|
-
* <p>Configures whether the CRL Distribution Point extension should be populated with the default URL to the CRL. If set to <code>true</code>, then the CDP extension will
|
|
442
|
-
* not be present in any certificates issued by that CA unless otherwise specified through CSR or API passthrough.</p>
|
|
443
|
-
* <note>
|
|
444
|
-
* <p>Only set this if you have another way to distribute the CRL Distribution Points ffor certificates issued by your CA, such as the Matter Distributed Compliance Ledger</p>
|
|
445
|
-
* <p>This configuration cannot be enabled with a custom CNAME set.</p>
|
|
446
|
-
* </note>
|
|
381
|
+
* <p>Configures whether the CRL Distribution Point extension should be populated with the default URL to the CRL. If set to <code>true</code>, then the CDP extension will not be present in any certificates issued by that CA unless otherwise specified through CSR or API passthrough.</p> <note> <p>Only set this if you have another way to distribute the CRL Distribution Points ffor certificates issued by your CA, such as the Matter Distributed Compliance Ledger</p> <p>This configuration cannot be enabled with a custom CNAME set.</p> </note>
|
|
447
382
|
* @public
|
|
448
383
|
*/
|
|
449
384
|
OmitExtension: boolean | undefined;
|
|
@@ -473,128 +408,12 @@ export declare const S3ObjectAcl: {
|
|
|
473
408
|
*/
|
|
474
409
|
export type S3ObjectAcl = (typeof S3ObjectAcl)[keyof typeof S3ObjectAcl];
|
|
475
410
|
/**
|
|
476
|
-
* <p>Contains configuration information for a certificate revocation list (CRL). Your
|
|
477
|
-
* private certificate authority (CA) creates base CRLs. Delta CRLs are not supported. You
|
|
478
|
-
* can enable CRLs for your new or an existing private CA by setting the <b>Enabled</b> parameter to <code>true</code>. Your private CA
|
|
479
|
-
* writes CRLs to an S3 bucket that you specify in the <b>S3BucketName</b> parameter. You can hide the name of your bucket by
|
|
480
|
-
* specifying a value for the <b>CustomCname</b> parameter. Your
|
|
481
|
-
* private CA by default copies the CNAME or the S3 bucket name to the <b>CRL
|
|
482
|
-
* Distribution Points</b> extension of each certificate it issues. If you want to configure
|
|
483
|
-
* this default behavior to be something different, you can set the <b>CrlDistributionPointExtensionConfiguration</b>
|
|
484
|
-
* parameter. Your S3
|
|
485
|
-
* bucket policy must give write permission to Amazon Web Services Private CA. </p>
|
|
486
|
-
* <p>Amazon Web Services Private CA assets that are stored in Amazon S3 can be protected with encryption.
|
|
487
|
-
* For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html#crl-encryption">Encrypting Your
|
|
488
|
-
* CRLs</a>.</p>
|
|
489
|
-
* <p>Your private CA uses the value in the <b>ExpirationInDays</b> parameter to calculate the <b>nextUpdate</b> field in the CRL. The CRL is refreshed prior to a
|
|
490
|
-
* certificate's expiration date or when a certificate is revoked. When a certificate is
|
|
491
|
-
* revoked, it appears in the CRL until the certificate expires, and then in one additional
|
|
492
|
-
* CRL after expiration, and it always appears in the audit report.</p>
|
|
493
|
-
* <p>A CRL is typically updated approximately 30 minutes after a certificate
|
|
494
|
-
* is revoked. If for any reason a CRL update fails, Amazon Web Services Private CA makes further attempts
|
|
495
|
-
* every 15 minutes.</p>
|
|
496
|
-
* <p>CRLs contain the following fields:</p>
|
|
497
|
-
* <ul>
|
|
498
|
-
* <li>
|
|
499
|
-
* <p>
|
|
500
|
-
* <b>Version</b>: The current version number defined
|
|
501
|
-
* in RFC 5280 is V2. The integer value is 0x1. </p>
|
|
502
|
-
* </li>
|
|
503
|
-
* <li>
|
|
504
|
-
* <p>
|
|
505
|
-
* <b>Signature Algorithm</b>: The name of the
|
|
506
|
-
* algorithm used to sign the CRL.</p>
|
|
507
|
-
* </li>
|
|
508
|
-
* <li>
|
|
509
|
-
* <p>
|
|
510
|
-
* <b>Issuer</b>: The X.500 distinguished name of your
|
|
511
|
-
* private CA that issued the CRL.</p>
|
|
512
|
-
* </li>
|
|
513
|
-
* <li>
|
|
514
|
-
* <p>
|
|
515
|
-
* <b>Last Update</b>: The issue date and time of this
|
|
516
|
-
* CRL.</p>
|
|
517
|
-
* </li>
|
|
518
|
-
* <li>
|
|
519
|
-
* <p>
|
|
520
|
-
* <b>Next Update</b>: The day and time by which the
|
|
521
|
-
* next CRL will be issued.</p>
|
|
522
|
-
* </li>
|
|
523
|
-
* <li>
|
|
524
|
-
* <p>
|
|
525
|
-
* <b>Revoked Certificates</b>: List of revoked
|
|
526
|
-
* certificates. Each list item contains the following information.</p>
|
|
527
|
-
* <ul>
|
|
528
|
-
* <li>
|
|
529
|
-
* <p>
|
|
530
|
-
* <b>Serial Number</b>: The serial number, in
|
|
531
|
-
* hexadecimal format, of the revoked certificate.</p>
|
|
532
|
-
* </li>
|
|
533
|
-
* <li>
|
|
534
|
-
* <p>
|
|
535
|
-
* <b>Revocation Date</b>: Date and time the
|
|
536
|
-
* certificate was revoked.</p>
|
|
537
|
-
* </li>
|
|
538
|
-
* <li>
|
|
539
|
-
* <p>
|
|
540
|
-
* <b>CRL Entry Extensions</b>: Optional
|
|
541
|
-
* extensions for the CRL entry.</p>
|
|
542
|
-
* <ul>
|
|
543
|
-
* <li>
|
|
544
|
-
* <p>
|
|
545
|
-
* <b>X509v3 CRL Reason Code</b>:
|
|
546
|
-
* Reason the certificate was revoked.</p>
|
|
547
|
-
* </li>
|
|
548
|
-
* </ul>
|
|
549
|
-
* </li>
|
|
550
|
-
* </ul>
|
|
551
|
-
* </li>
|
|
552
|
-
* <li>
|
|
553
|
-
* <p>
|
|
554
|
-
* <b>CRL Extensions</b>: Optional extensions for the
|
|
555
|
-
* CRL.</p>
|
|
556
|
-
* <ul>
|
|
557
|
-
* <li>
|
|
558
|
-
* <p>
|
|
559
|
-
* <b>X509v3 Authority Key Identifier</b>:
|
|
560
|
-
* Identifies the public key associated with the private key used to sign
|
|
561
|
-
* the certificate.</p>
|
|
562
|
-
* </li>
|
|
563
|
-
* <li>
|
|
564
|
-
* <p>
|
|
565
|
-
* <b>X509v3 CRL Number:</b>: Decimal sequence
|
|
566
|
-
* number for the CRL.</p>
|
|
567
|
-
* </li>
|
|
568
|
-
* </ul>
|
|
569
|
-
* </li>
|
|
570
|
-
* <li>
|
|
571
|
-
* <p>
|
|
572
|
-
* <b>Signature Algorithm</b>: Algorithm used by your
|
|
573
|
-
* private CA to sign the CRL.</p>
|
|
574
|
-
* </li>
|
|
575
|
-
* <li>
|
|
576
|
-
* <p>
|
|
577
|
-
* <b>Signature Value</b>: Signature computed over the
|
|
578
|
-
* CRL.</p>
|
|
579
|
-
* </li>
|
|
580
|
-
* </ul>
|
|
581
|
-
* <p>Certificate revocation lists created by Amazon Web Services Private CA are DER-encoded. You can use the
|
|
582
|
-
* following OpenSSL command to list a CRL.</p>
|
|
583
|
-
* <p>
|
|
584
|
-
* <code>openssl crl -inform DER -text -in <i>crl_path</i>
|
|
585
|
-
* -noout</code>
|
|
586
|
-
* </p>
|
|
587
|
-
* <p>For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html">Planning a certificate revocation list
|
|
588
|
-
* (CRL)</a> in the <i>Amazon Web Services Private Certificate Authority User Guide</i>
|
|
589
|
-
* </p>
|
|
411
|
+
* <p>Contains configuration information for a certificate revocation list (CRL). Your private certificate authority (CA) creates base CRLs. Delta CRLs are not supported. You can enable CRLs for your new or an existing private CA by setting the <b>Enabled</b> parameter to <code>true</code>. Your private CA writes CRLs to an S3 bucket that you specify in the <b>S3BucketName</b> parameter. You can hide the name of your bucket by specifying a value for the <b>CustomCname</b> parameter. Your private CA by default copies the CNAME or the S3 bucket name to the <b>CRL Distribution Points</b> extension of each certificate it issues. If you want to configure this default behavior to be something different, you can set the <b>CrlDistributionPointExtensionConfiguration</b> parameter. Your S3 bucket policy must give write permission to Amazon Web Services Private CA. </p> <p>Amazon Web Services Private CA assets that are stored in Amazon S3 can be protected with encryption. For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html#crl-encryption">Encrypting Your CRLs</a>.</p> <p>Your private CA uses the value in the <b>ExpirationInDays</b> parameter to calculate the <b>nextUpdate</b> field in the CRL. The CRL is refreshed prior to a certificate's expiration date or when a certificate is revoked. When a certificate is revoked, it appears in the CRL until the certificate expires, and then in one additional CRL after expiration, and it always appears in the audit report.</p> <p>A CRL is typically updated approximately 30 minutes after a certificate is revoked. If for any reason a CRL update fails, Amazon Web Services Private CA makes further attempts every 15 minutes.</p> <p>CRLs contain the following fields:</p> <ul> <li> <p> <b>Version</b>: The current version number defined in RFC 5280 is V2. The integer value is 0x1. </p> </li> <li> <p> <b>Signature Algorithm</b>: The name of the algorithm used to sign the CRL.</p> </li> <li> <p> <b>Issuer</b>: The X.500 distinguished name of your private CA that issued the CRL.</p> </li> <li> <p> <b>Last Update</b>: The issue date and time of this CRL.</p> </li> <li> <p> <b>Next Update</b>: The day and time by which the next CRL will be issued.</p> </li> <li> <p> <b>Revoked Certificates</b>: List of revoked certificates. Each list item contains the following information.</p> <ul> <li> <p> <b>Serial Number</b>: The serial number, in hexadecimal format, of the revoked certificate.</p> </li> <li> <p> <b>Revocation Date</b>: Date and time the certificate was revoked.</p> </li> <li> <p> <b>CRL Entry Extensions</b>: Optional extensions for the CRL entry.</p> <ul> <li> <p> <b>X509v3 CRL Reason Code</b>: Reason the certificate was revoked.</p> </li> </ul> </li> </ul> </li> <li> <p> <b>CRL Extensions</b>: Optional extensions for the CRL.</p> <ul> <li> <p> <b>X509v3 Authority Key Identifier</b>: Identifies the public key associated with the private key used to sign the certificate.</p> </li> <li> <p> <b>X509v3 CRL Number:</b>: Decimal sequence number for the CRL.</p> </li> </ul> </li> <li> <p> <b>Signature Algorithm</b>: Algorithm used by your private CA to sign the CRL.</p> </li> <li> <p> <b>Signature Value</b>: Signature computed over the CRL.</p> </li> </ul> <p>Certificate revocation lists created by Amazon Web Services Private CA are DER-encoded. You can use the following OpenSSL command to list a CRL.</p> <p> <code>openssl crl -inform DER -text -in <i>crl_path</i> -noout</code> </p> <p>For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html">Planning a certificate revocation list (CRL)</a> in the <i>Amazon Web Services Private Certificate Authority User Guide</i> </p>
|
|
590
412
|
* @public
|
|
591
413
|
*/
|
|
592
414
|
export interface CrlConfiguration {
|
|
593
415
|
/**
|
|
594
|
-
* <p>Boolean value that specifies whether certificate revocation lists (CRLs) are enabled.
|
|
595
|
-
* You can use this value to enable certificate revocation for a new CA when you call the
|
|
596
|
-
* <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action or for an existing CA when you call the
|
|
597
|
-
* <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> action. </p>
|
|
416
|
+
* <p>Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. You can use this value to enable certificate revocation for a new CA when you call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action or for an existing CA when you call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> action. </p>
|
|
598
417
|
* @public
|
|
599
418
|
*/
|
|
600
419
|
Enabled: boolean | undefined;
|
|
@@ -604,47 +423,17 @@ export interface CrlConfiguration {
|
|
|
604
423
|
*/
|
|
605
424
|
ExpirationInDays?: number | undefined;
|
|
606
425
|
/**
|
|
607
|
-
* <p>Name inserted into the certificate <b>CRL Distribution
|
|
608
|
-
* Points</b> extension that enables the use of an alias for the CRL
|
|
609
|
-
* distribution point. Use this value if you don't want the name of your S3 bucket to be
|
|
610
|
-
* public.</p>
|
|
611
|
-
* <note>
|
|
612
|
-
* <p>The content of a Canonical Name (CNAME) record must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions on the
|
|
613
|
-
* use of special characters in URIs. Additionally, the value of the CNAME must not
|
|
614
|
-
* include a protocol prefix such as "http://" or "https://".</p>
|
|
615
|
-
* </note>
|
|
426
|
+
* <p>Name inserted into the certificate <b>CRL Distribution Points</b> extension that enables the use of an alias for the CRL distribution point. Use this value if you don't want the name of your S3 bucket to be public.</p> <note> <p>The content of a Canonical Name (CNAME) record must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions on the use of special characters in URIs. Additionally, the value of the CNAME must not include a protocol prefix such as "http://" or "https://".</p> </note>
|
|
616
427
|
* @public
|
|
617
428
|
*/
|
|
618
429
|
CustomCname?: string | undefined;
|
|
619
430
|
/**
|
|
620
|
-
* <p>Name of the S3 bucket that contains the CRL. If you do not provide a value for the
|
|
621
|
-
* <b>CustomCname</b> argument, the name of your S3 bucket
|
|
622
|
-
* is placed into the <b>CRL Distribution Points</b> extension of
|
|
623
|
-
* the issued certificate. You can change the name of your bucket by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> operation. You must specify a <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaCreateCa.html#s3-policies">bucket
|
|
624
|
-
* policy</a> that allows Amazon Web Services Private CA to write the CRL to your bucket.</p>
|
|
625
|
-
* <note>
|
|
626
|
-
* <p>The <code>S3BucketName</code> parameter must conform to the <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">S3
|
|
627
|
-
* bucket naming rules</a>.</p>
|
|
628
|
-
* </note>
|
|
431
|
+
* <p>Name of the S3 bucket that contains the CRL. If you do not provide a value for the <b>CustomCname</b> argument, the name of your S3 bucket is placed into the <b>CRL Distribution Points</b> extension of the issued certificate. You can change the name of your bucket by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> operation. You must specify a <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaCreateCa.html#s3-policies">bucket policy</a> that allows Amazon Web Services Private CA to write the CRL to your bucket.</p> <note> <p>The <code>S3BucketName</code> parameter must conform to the <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">S3 bucket naming rules</a>.</p> </note>
|
|
629
432
|
* @public
|
|
630
433
|
*/
|
|
631
434
|
S3BucketName?: string | undefined;
|
|
632
435
|
/**
|
|
633
|
-
* <p>Determines whether the CRL will be publicly readable or privately held in the CRL
|
|
634
|
-
* Amazon S3 bucket. If you choose PUBLIC_READ, the CRL will be accessible over the public
|
|
635
|
-
* internet. If you choose BUCKET_OWNER_FULL_CONTROL, only the owner of the CRL S3 bucket
|
|
636
|
-
* can access the CRL, and your PKI clients may need an alternative method of access. </p>
|
|
637
|
-
* <p>If no value is specified, the default is <code>PUBLIC_READ</code>.</p>
|
|
638
|
-
* <p>
|
|
639
|
-
* <i>Note:</i> This default can cause CA creation to fail in some
|
|
640
|
-
* circumstances. If you have have enabled the Block Public Access (BPA) feature in your S3
|
|
641
|
-
* account, then you must specify the value of this parameter as
|
|
642
|
-
* <code>BUCKET_OWNER_FULL_CONTROL</code>, and not doing so results in an error. If you
|
|
643
|
-
* have disabled BPA in S3, then you can specify either
|
|
644
|
-
* <code>BUCKET_OWNER_FULL_CONTROL</code> or <code>PUBLIC_READ</code> as the
|
|
645
|
-
* value.</p>
|
|
646
|
-
* <p>For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaCreateCa.html#s3-bpa">Blocking public access to the S3
|
|
647
|
-
* bucket</a>.</p>
|
|
436
|
+
* <p>Determines whether the CRL will be publicly readable or privately held in the CRL Amazon S3 bucket. If you choose PUBLIC_READ, the CRL will be accessible over the public internet. If you choose BUCKET_OWNER_FULL_CONTROL, only the owner of the CRL S3 bucket can access the CRL, and your PKI clients may need an alternative method of access. </p> <p>If no value is specified, the default is <code>PUBLIC_READ</code>.</p> <p> <i>Note:</i> This default can cause CA creation to fail in some circumstances. If you have have enabled the Block Public Access (BPA) feature in your S3 account, then you must specify the value of this parameter as <code>BUCKET_OWNER_FULL_CONTROL</code>, and not doing so results in an error. If you have disabled BPA in S3, then you can specify either <code>BUCKET_OWNER_FULL_CONTROL</code> or <code>PUBLIC_READ</code> as the value.</p> <p>For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaCreateCa.html#s3-bpa">Blocking public access to the S3 bucket</a>.</p>
|
|
648
437
|
* @public
|
|
649
438
|
*/
|
|
650
439
|
S3ObjectAcl?: S3ObjectAcl | undefined;
|
|
@@ -654,102 +443,50 @@ export interface CrlConfiguration {
|
|
|
654
443
|
*/
|
|
655
444
|
CrlDistributionPointExtensionConfiguration?: CrlDistributionPointExtensionConfiguration | undefined;
|
|
656
445
|
/**
|
|
657
|
-
* <p>Specifies whether to create a complete or partitioned CRL. This setting determines the maximum
|
|
658
|
-
* number of certificates that the certificate authority can issue and revoke. For more information, see
|
|
659
|
-
* <a href="privateca/latest/userguide/pca.html#limits_pca">Amazon Web Services Private CA quotas</a>.</p>
|
|
660
|
-
* <ul>
|
|
661
|
-
* <li>
|
|
662
|
-
* <p>
|
|
663
|
-
* <code>COMPLETE</code> - The default setting. Amazon Web Services Private CA maintains a single CRL file for all unexpired
|
|
664
|
-
* certificates issued by a CA that have been revoked for any reason. Each certificate that Amazon Web Services Private CA
|
|
665
|
-
* issues is bound to a specific CRL through its CRL distribution point (CDP) extension, defined in <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9">
|
|
666
|
-
* RFC 5280</a>.</p>
|
|
667
|
-
* </li>
|
|
668
|
-
* <li>
|
|
669
|
-
* <p>
|
|
670
|
-
* <code>PARTITIONED</code> - Compared to complete CRLs, partitioned CRLs
|
|
671
|
-
* dramatically increase the number of certificates your private CA can issue. </p>
|
|
672
|
-
* <important>
|
|
673
|
-
* <p> When using partitioned CRLs, you must validate that the CRL's associated
|
|
674
|
-
* issuing distribution point (IDP) URI matches the certificate's CDP URI to ensure
|
|
675
|
-
* the right CRL has been fetched. Amazon Web Services Private CA marks the IDP extension as critical,
|
|
676
|
-
* which your client must be able to process.
|
|
677
|
-
* </p>
|
|
678
|
-
* </important>
|
|
679
|
-
* </li>
|
|
680
|
-
* </ul>
|
|
446
|
+
* <p>Specifies whether to create a complete or partitioned CRL. This setting determines the maximum number of certificates that the certificate authority can issue and revoke. For more information, see <a href="privateca/latest/userguide/pca.html#limits_pca">Amazon Web Services Private CA quotas</a>.</p> <ul> <li> <p> <code>COMPLETE</code> - The default setting. Amazon Web Services Private CA maintains a single CRL file for all unexpired certificates issued by a CA that have been revoked for any reason. Each certificate that Amazon Web Services Private CA issues is bound to a specific CRL through its CRL distribution point (CDP) extension, defined in <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9"> RFC 5280</a>.</p> </li> <li> <p> <code>PARTITIONED</code> - Compared to complete CRLs, partitioned CRLs dramatically increase the number of certificates your private CA can issue. </p> <important> <p> When using partitioned CRLs, you must validate that the CRL's associated issuing distribution point (IDP) URI matches the certificate's CDP URI to ensure the right CRL has been fetched. Amazon Web Services Private CA marks the IDP extension as critical, which your client must be able to process. </p> </important> </li> </ul>
|
|
681
447
|
* @public
|
|
682
448
|
*/
|
|
683
449
|
CrlType?: CrlType | undefined;
|
|
684
450
|
/**
|
|
685
|
-
* <p>Designates a custom file path in S3 for CRL(s). For example, <code>http://<CustomName>/
|
|
686
|
-
* <CustomPath>/<CrlPartition_GUID>.crl</code>.
|
|
687
|
-
* </p>
|
|
451
|
+
* <p>Designates a custom file path in S3 for CRL(s). For example, <code>http://<CustomName>/ <CustomPath>/<CrlPartition_GUID>.crl</code>. </p>
|
|
688
452
|
* @public
|
|
689
453
|
*/
|
|
690
454
|
CustomPath?: string | undefined;
|
|
691
455
|
}
|
|
692
456
|
/**
|
|
693
|
-
* <p>Contains information to enable and configure Online Certificate Status Protocol (OCSP)
|
|
694
|
-
* for validating certificate revocation status.</p>
|
|
695
|
-
* <p>When you revoke a certificate, OCSP responses may take up to 60 minutes
|
|
696
|
-
* to reflect the new status.</p>
|
|
457
|
+
* <p>Contains information to enable and configure Online Certificate Status Protocol (OCSP) for validating certificate revocation status.</p> <p>When you revoke a certificate, OCSP responses may take up to 60 minutes to reflect the new status.</p>
|
|
697
458
|
* @public
|
|
698
459
|
*/
|
|
699
460
|
export interface OcspConfiguration {
|
|
700
461
|
/**
|
|
701
|
-
* <p>Flag enabling use of the Online Certificate Status Protocol (OCSP) for validating
|
|
702
|
-
* certificate revocation status.</p>
|
|
462
|
+
* <p>Flag enabling use of the Online Certificate Status Protocol (OCSP) for validating certificate revocation status.</p>
|
|
703
463
|
* @public
|
|
704
464
|
*/
|
|
705
465
|
Enabled: boolean | undefined;
|
|
706
466
|
/**
|
|
707
|
-
* <p>By default, Amazon Web Services Private CA injects an Amazon Web Services domain into certificates being validated by
|
|
708
|
-
* the Online Certificate Status Protocol (OCSP). A customer can alternatively use this
|
|
709
|
-
* object to define a CNAME specifying a customized OCSP domain.</p>
|
|
710
|
-
* <note>
|
|
711
|
-
* <p>The content of a Canonical Name (CNAME) record must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions on the
|
|
712
|
-
* use of special characters in URIs. Additionally, the value of the CNAME must not
|
|
713
|
-
* include a protocol prefix such as "http://" or "https://".</p>
|
|
714
|
-
* </note>
|
|
715
|
-
* <p>For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/ocsp-customize.html">Customizing Online Certificate Status Protocol
|
|
716
|
-
* (OCSP) </a> in the <i>Amazon Web Services Private Certificate Authority User Guide</i>.</p>
|
|
467
|
+
* <p>By default, Amazon Web Services Private CA injects an Amazon Web Services domain into certificates being validated by the Online Certificate Status Protocol (OCSP). A customer can alternatively use this object to define a CNAME specifying a customized OCSP domain.</p> <note> <p>The content of a Canonical Name (CNAME) record must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions on the use of special characters in URIs. Additionally, the value of the CNAME must not include a protocol prefix such as "http://" or "https://".</p> </note> <p>For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/ocsp-customize.html">Customizing Online Certificate Status Protocol (OCSP) </a> in the <i>Amazon Web Services Private Certificate Authority User Guide</i>.</p>
|
|
717
468
|
* @public
|
|
718
469
|
*/
|
|
719
470
|
OcspCustomCname?: string | undefined;
|
|
720
471
|
}
|
|
721
472
|
/**
|
|
722
|
-
* <p>Certificate revocation information used by the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> actions. Your private certificate authority (CA)
|
|
723
|
-
* can configure Online Certificate Status Protocol (OCSP) support and/or maintain a
|
|
724
|
-
* certificate revocation list (CRL). OCSP returns validation information about
|
|
725
|
-
* certificates as requested by clients, and a CRL contains an updated list of certificates
|
|
726
|
-
* revoked by your CA. For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html">RevokeCertificate</a> and <a href="https://docs.aws.amazon.com/privateca/latest/userguide/revocation-setup.html">Setting up a
|
|
727
|
-
* certificate revocation method</a> in the <i>Amazon Web Services Private Certificate Authority User
|
|
728
|
-
* Guide</i>.</p>
|
|
473
|
+
* <p>Certificate revocation information used by the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> actions. Your private certificate authority (CA) can configure Online Certificate Status Protocol (OCSP) support and/or maintain a certificate revocation list (CRL). OCSP returns validation information about certificates as requested by clients, and a CRL contains an updated list of certificates revoked by your CA. For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html">RevokeCertificate</a> and <a href="https://docs.aws.amazon.com/privateca/latest/userguide/revocation-setup.html">Setting up a certificate revocation method</a> in the <i>Amazon Web Services Private Certificate Authority User Guide</i>.</p>
|
|
729
474
|
* @public
|
|
730
475
|
*/
|
|
731
476
|
export interface RevocationConfiguration {
|
|
732
477
|
/**
|
|
733
|
-
* <p>Configuration of the certificate revocation list (CRL), if any, maintained by your
|
|
734
|
-
* private CA. A CRL is typically updated approximately 30 minutes after a certificate
|
|
735
|
-
* is revoked. If for any reason a CRL update fails, Amazon Web Services Private CA makes further attempts
|
|
736
|
-
* every 15 minutes.</p>
|
|
478
|
+
* <p>Configuration of the certificate revocation list (CRL), if any, maintained by your private CA. A CRL is typically updated approximately 30 minutes after a certificate is revoked. If for any reason a CRL update fails, Amazon Web Services Private CA makes further attempts every 15 minutes.</p>
|
|
737
479
|
* @public
|
|
738
480
|
*/
|
|
739
481
|
CrlConfiguration?: CrlConfiguration | undefined;
|
|
740
482
|
/**
|
|
741
|
-
* <p>Configuration of Online Certificate Status Protocol (OCSP) support, if any, maintained
|
|
742
|
-
* by your private CA. When you revoke a certificate, OCSP responses may take up to 60 minutes
|
|
743
|
-
* to reflect the new status.</p>
|
|
483
|
+
* <p>Configuration of Online Certificate Status Protocol (OCSP) support, if any, maintained by your private CA. When you revoke a certificate, OCSP responses may take up to 60 minutes to reflect the new status.</p>
|
|
744
484
|
* @public
|
|
745
485
|
*/
|
|
746
486
|
OcspConfiguration?: OcspConfiguration | undefined;
|
|
747
487
|
}
|
|
748
488
|
/**
|
|
749
|
-
* <p>Tags are labels that you can use to identify and organize your private CAs. Each tag
|
|
750
|
-
* consists of a key and an optional value. You can associate up to 50 tags with a private
|
|
751
|
-
* CA. To add one or more tags to a private CA, call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_TagCertificateAuthority.html">TagCertificateAuthority</a>
|
|
752
|
-
* action. To remove a tag, call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UntagCertificateAuthority.html">UntagCertificateAuthority</a> action. </p>
|
|
489
|
+
* <p>Tags are labels that you can use to identify and organize your private CAs. Each tag consists of a key and an optional value. You can associate up to 50 tags with a private CA. To add one or more tags to a private CA, call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_TagCertificateAuthority.html">TagCertificateAuthority</a> action. To remove a tag, call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UntagCertificateAuthority.html">UntagCertificateAuthority</a> action. </p>
|
|
753
490
|
* @public
|
|
754
491
|
*/
|
|
755
492
|
export interface Tag {
|
|
@@ -781,37 +518,12 @@ export type CertificateAuthorityUsageMode = (typeof CertificateAuthorityUsageMod
|
|
|
781
518
|
*/
|
|
782
519
|
export interface CreateCertificateAuthorityRequest {
|
|
783
520
|
/**
|
|
784
|
-
* <p>Name and bit size of the private key algorithm, the name of the signing algorithm, and
|
|
785
|
-
* X.500 certificate subject information.</p>
|
|
521
|
+
* <p>Name and bit size of the private key algorithm, the name of the signing algorithm, and X.500 certificate subject information.</p>
|
|
786
522
|
* @public
|
|
787
523
|
*/
|
|
788
524
|
CertificateAuthorityConfiguration: CertificateAuthorityConfiguration | undefined;
|
|
789
525
|
/**
|
|
790
|
-
* <p>Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. By default, both certificate validation mechanisms are disabled.</p>
|
|
791
|
-
* <p>The following requirements apply to revocation configurations.</p>
|
|
792
|
-
* <ul>
|
|
793
|
-
* <li>
|
|
794
|
-
* <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code>
|
|
795
|
-
* parameter, and will fail if other parameters such as <code>CustomCname</code> or
|
|
796
|
-
* <code>ExpirationInDays</code> are included.</p>
|
|
797
|
-
* </li>
|
|
798
|
-
* <li>
|
|
799
|
-
* <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to
|
|
800
|
-
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">Amazon S3
|
|
801
|
-
* bucket naming rules</a>.</p>
|
|
802
|
-
* </li>
|
|
803
|
-
* <li>
|
|
804
|
-
* <p>A configuration containing a custom Canonical
|
|
805
|
-
* Name (CNAME) parameter for CRLs or OCSP must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions
|
|
806
|
-
* on the use of special characters in a CNAME. </p>
|
|
807
|
-
* </li>
|
|
808
|
-
* <li>
|
|
809
|
-
* <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a
|
|
810
|
-
* protocol prefix such as "http://" or "https://".</p>
|
|
811
|
-
* </li>
|
|
812
|
-
* </ul>
|
|
813
|
-
* <p> For more information, see the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html">OcspConfiguration</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a>
|
|
814
|
-
* types.</p>
|
|
526
|
+
* <p>Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. By default, both certificate validation mechanisms are disabled.</p> <p>The following requirements apply to revocation configurations.</p> <ul> <li> <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code> parameter, and will fail if other parameters such as <code>CustomCname</code> or <code>ExpirationInDays</code> are included.</p> </li> <li> <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">Amazon S3 bucket naming rules</a>.</p> </li> <li> <p>A configuration containing a custom Canonical Name (CNAME) parameter for CRLs or OCSP must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions on the use of special characters in a CNAME. </p> </li> <li> <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a protocol prefix such as "http://" or "https://".</p> </li> </ul> <p> For more information, see the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html">OcspConfiguration</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a> types.</p>
|
|
815
527
|
* @public
|
|
816
528
|
*/
|
|
817
529
|
RevocationConfiguration?: RevocationConfiguration | undefined;
|
|
@@ -821,45 +533,22 @@ export interface CreateCertificateAuthorityRequest {
|
|
|
821
533
|
*/
|
|
822
534
|
CertificateAuthorityType: CertificateAuthorityType | undefined;
|
|
823
535
|
/**
|
|
824
|
-
* <p>Custom string that can be used to distinguish between calls to the <b>CreateCertificateAuthority</b> action. Idempotency tokens for
|
|
825
|
-
* <b>CreateCertificateAuthority</b> time out after five
|
|
826
|
-
* minutes. Therefore, if you call <b>CreateCertificateAuthority</b> multiple times with the same idempotency
|
|
827
|
-
* token within five minutes, Amazon Web Services Private CA recognizes that you are requesting only
|
|
828
|
-
* certificate authority and will issue only one. If you change the idempotency token for
|
|
829
|
-
* each call, Amazon Web Services Private CA recognizes that you are requesting multiple certificate
|
|
830
|
-
* authorities.</p>
|
|
536
|
+
* <p>Custom string that can be used to distinguish between calls to the <b>CreateCertificateAuthority</b> action. Idempotency tokens for <b>CreateCertificateAuthority</b> time out after five minutes. Therefore, if you call <b>CreateCertificateAuthority</b> multiple times with the same idempotency token within five minutes, Amazon Web Services Private CA recognizes that you are requesting only certificate authority and will issue only one. If you change the idempotency token for each call, Amazon Web Services Private CA recognizes that you are requesting multiple certificate authorities.</p>
|
|
831
537
|
* @public
|
|
832
538
|
*/
|
|
833
539
|
IdempotencyToken?: string | undefined;
|
|
834
540
|
/**
|
|
835
|
-
* <p>Specifies a cryptographic key management compliance standard
|
|
836
|
-
* keys.</p>
|
|
837
|
-
* <p>Default: FIPS_140_2_LEVEL_3_OR_HIGHER</p>
|
|
838
|
-
* <note>
|
|
839
|
-
* <p>Some Amazon Web Services Regions do not support the default. When creating a CA in these
|
|
840
|
-
* Regions, you must provide <code>FIPS_140_2_LEVEL_2_OR_HIGHER</code> as the argument
|
|
841
|
-
* for <code>KeyStorageSecurityStandard</code>. Failure to do this results in an
|
|
842
|
-
* <code>InvalidArgsException</code> with the message, "A certificate authority
|
|
843
|
-
* cannot be created in this region with the specified security standard."</p>
|
|
844
|
-
* <p>For information about security standard support in various Regions, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys">Storage
|
|
845
|
-
* and security compliance of Amazon Web Services Private CA private keys</a>.</p>
|
|
846
|
-
* </note>
|
|
541
|
+
* <p>Specifies a cryptographic key management compliance standard for handling and protecting CA keys.</p> <p>Default: FIPS_140_2_LEVEL_3_OR_HIGHER</p> <note> <p>Some Amazon Web Services Regions don't support the default value. When you create a CA in these Regions, you must use <code>CCPC_LEVEL_1_OR_HIGHER</code> for the <code>KeyStorageSecurityStandard</code> parameter. If you don't, the operation returns an <code>InvalidArgsException</code> with this message: "A certificate authority cannot be created in this region with the specified security standard."</p> <p>For information about security standard support in different Amazon Web Services Regions, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys">Storage and security compliance of Amazon Web Services Private CA private keys</a>.</p> </note>
|
|
847
542
|
* @public
|
|
848
543
|
*/
|
|
849
544
|
KeyStorageSecurityStandard?: KeyStorageSecurityStandard | undefined;
|
|
850
545
|
/**
|
|
851
|
-
* <p>Key-value pairs that will be attached to the new private CA. You can associate up to
|
|
852
|
-
* 50 tags with a private CA. For information using tags with IAM to manage permissions,
|
|
853
|
-
* see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html">Controlling Access Using IAM Tags</a>.</p>
|
|
546
|
+
* <p>Key-value pairs that will be attached to the new private CA. You can associate up to 50 tags with a private CA. For information using tags with IAM to manage permissions, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html">Controlling Access Using IAM Tags</a>.</p>
|
|
854
547
|
* @public
|
|
855
548
|
*/
|
|
856
549
|
Tags?: Tag[] | undefined;
|
|
857
550
|
/**
|
|
858
|
-
* <p>Specifies whether the CA issues general-purpose certificates that typically require a
|
|
859
|
-
* revocation mechanism, or short-lived certificates that may optionally omit revocation
|
|
860
|
-
* because they expire quickly. Short-lived certificate validity is limited to seven
|
|
861
|
-
* days.</p>
|
|
862
|
-
* <p>The default value is GENERAL_PURPOSE.</p>
|
|
551
|
+
* <p>Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days.</p> <p>The default value is GENERAL_PURPOSE.</p>
|
|
863
552
|
* @public
|
|
864
553
|
*/
|
|
865
554
|
UsageMode?: CertificateAuthorityUsageMode | undefined;
|
|
@@ -869,12 +558,7 @@ export interface CreateCertificateAuthorityRequest {
|
|
|
869
558
|
*/
|
|
870
559
|
export interface CreateCertificateAuthorityResponse {
|
|
871
560
|
/**
|
|
872
|
-
* <p>If successful, the Amazon Resource Name (ARN) of the certificate authority (CA). This
|
|
873
|
-
* is of the form: </p>
|
|
874
|
-
* <p>
|
|
875
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
876
|
-
* </code>.
|
|
877
|
-
* </p>
|
|
561
|
+
* <p>If successful, the Amazon Resource Name (ARN) of the certificate authority (CA). This is of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
878
562
|
* @public
|
|
879
563
|
*/
|
|
880
564
|
CertificateAuthorityArn?: string | undefined;
|
|
@@ -892,8 +576,7 @@ export declare class InvalidArgsException extends __BaseException {
|
|
|
892
576
|
constructor(opts: __ExceptionOptionType<InvalidArgsException, __BaseException>);
|
|
893
577
|
}
|
|
894
578
|
/**
|
|
895
|
-
* <p>The resource policy is invalid or is missing a required statement. For general
|
|
896
|
-
* information about IAM policy and statement structure, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json">Overview of JSON Policies</a>.</p>
|
|
579
|
+
* <p>The resource policy is invalid or is missing a required statement. For general information about IAM policy and statement structure, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json">Overview of JSON Policies</a>.</p>
|
|
897
580
|
* @public
|
|
898
581
|
*/
|
|
899
582
|
export declare class InvalidPolicyException extends __BaseException {
|
|
@@ -905,8 +588,7 @@ export declare class InvalidPolicyException extends __BaseException {
|
|
|
905
588
|
constructor(opts: __ExceptionOptionType<InvalidPolicyException, __BaseException>);
|
|
906
589
|
}
|
|
907
590
|
/**
|
|
908
|
-
* <p>The tag associated with the CA is not valid. The invalid argument is contained in the
|
|
909
|
-
* message field.</p>
|
|
591
|
+
* <p>The tag associated with the CA is not valid. The invalid argument is contained in the message field.</p>
|
|
910
592
|
* @public
|
|
911
593
|
*/
|
|
912
594
|
export declare class InvalidTagException extends __BaseException {
|
|
@@ -918,8 +600,7 @@ export declare class InvalidTagException extends __BaseException {
|
|
|
918
600
|
constructor(opts: __ExceptionOptionType<InvalidTagException, __BaseException>);
|
|
919
601
|
}
|
|
920
602
|
/**
|
|
921
|
-
* <p>An Amazon Web Services Private CA quota has been exceeded. See the exception message returned to determine
|
|
922
|
-
* the quota that was exceeded.</p>
|
|
603
|
+
* <p>An Amazon Web Services Private CA quota has been exceeded. See the exception message returned to determine the quota that was exceeded.</p>
|
|
923
604
|
* @public
|
|
924
605
|
*/
|
|
925
606
|
export declare class LimitExceededException extends __BaseException {
|
|
@@ -947,10 +628,7 @@ export type AuditReportResponseFormat = (typeof AuditReportResponseFormat)[keyof
|
|
|
947
628
|
*/
|
|
948
629
|
export interface CreateCertificateAuthorityAuditReportRequest {
|
|
949
630
|
/**
|
|
950
|
-
* <p>The Amazon Resource Name (ARN) of the CA to be audited. This is of the form:</p>
|
|
951
|
-
* <p>
|
|
952
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
953
|
-
* </code>.</p>
|
|
631
|
+
* <p>The Amazon Resource Name (ARN) of the CA to be audited. This is of the form:</p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>.</p>
|
|
954
632
|
* @public
|
|
955
633
|
*/
|
|
956
634
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -975,15 +653,13 @@ export interface CreateCertificateAuthorityAuditReportResponse {
|
|
|
975
653
|
*/
|
|
976
654
|
AuditReportId?: string | undefined;
|
|
977
655
|
/**
|
|
978
|
-
* <p>The <b>key</b> that uniquely identifies the report file in
|
|
979
|
-
* your S3 bucket.</p>
|
|
656
|
+
* <p>The <b>key</b> that uniquely identifies the report file in your S3 bucket.</p>
|
|
980
657
|
* @public
|
|
981
658
|
*/
|
|
982
659
|
S3Key?: string | undefined;
|
|
983
660
|
}
|
|
984
661
|
/**
|
|
985
|
-
* <p>The requested Amazon Resource Name (ARN) does not refer to an existing
|
|
986
|
-
* resource.</p>
|
|
662
|
+
* <p>The requested Amazon Resource Name (ARN) does not refer to an existing resource.</p>
|
|
987
663
|
* @public
|
|
988
664
|
*/
|
|
989
665
|
export declare class InvalidArnException extends __BaseException {
|
|
@@ -1031,8 +707,7 @@ export declare class RequestInProgressException extends __BaseException {
|
|
|
1031
707
|
constructor(opts: __ExceptionOptionType<RequestInProgressException, __BaseException>);
|
|
1032
708
|
}
|
|
1033
709
|
/**
|
|
1034
|
-
* <p>A resource such as a private CA, S3 bucket, certificate, audit report, or policy
|
|
1035
|
-
* cannot be found.</p>
|
|
710
|
+
* <p>A resource such as a private CA, S3 bucket, certificate, audit report, or policy cannot be found.</p>
|
|
1036
711
|
* @public
|
|
1037
712
|
*/
|
|
1038
713
|
export declare class ResourceNotFoundException extends __BaseException {
|
|
@@ -1061,18 +736,12 @@ export type ActionType = (typeof ActionType)[keyof typeof ActionType];
|
|
|
1061
736
|
*/
|
|
1062
737
|
export interface CreatePermissionRequest {
|
|
1063
738
|
/**
|
|
1064
|
-
* <p>The Amazon Resource Name (ARN) of the CA that grants the permissions. You can find the
|
|
1065
|
-
* ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must have the following form: </p>
|
|
1066
|
-
* <p>
|
|
1067
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1068
|
-
* </code>.
|
|
1069
|
-
* </p>
|
|
739
|
+
* <p>The Amazon Resource Name (ARN) of the CA that grants the permissions. You can find the ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must have the following form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
1070
740
|
* @public
|
|
1071
741
|
*/
|
|
1072
742
|
CertificateAuthorityArn: string | undefined;
|
|
1073
743
|
/**
|
|
1074
|
-
* <p>The Amazon Web Services service or identity that receives the permission. At this time, the only
|
|
1075
|
-
* valid principal is <code>acm.amazonaws.com</code>.</p>
|
|
744
|
+
* <p>The Amazon Web Services service or identity that receives the permission. At this time, the only valid principal is <code>acm.amazonaws.com</code>.</p>
|
|
1076
745
|
* @public
|
|
1077
746
|
*/
|
|
1078
747
|
Principal: string | undefined;
|
|
@@ -1082,9 +751,7 @@ export interface CreatePermissionRequest {
|
|
|
1082
751
|
*/
|
|
1083
752
|
SourceAccount?: string | undefined;
|
|
1084
753
|
/**
|
|
1085
|
-
* <p>The actions that the specified Amazon Web Services service principal can use. These include
|
|
1086
|
-
* <code>IssueCertificate</code>, <code>GetCertificate</code>, and
|
|
1087
|
-
* <code>ListPermissions</code>.</p>
|
|
754
|
+
* <p>The actions that the specified Amazon Web Services service principal can use. These include <code>IssueCertificate</code>, <code>GetCertificate</code>, and <code>ListPermissions</code>.</p>
|
|
1088
755
|
* @public
|
|
1089
756
|
*/
|
|
1090
757
|
Actions: ActionType[] | undefined;
|
|
@@ -1118,17 +785,12 @@ export declare class ConcurrentModificationException extends __BaseException {
|
|
|
1118
785
|
*/
|
|
1119
786
|
export interface DeleteCertificateAuthorityRequest {
|
|
1120
787
|
/**
|
|
1121
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must have the following form: </p>
|
|
1122
|
-
* <p>
|
|
1123
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1124
|
-
* </code>.
|
|
1125
|
-
* </p>
|
|
788
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must have the following form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
1126
789
|
* @public
|
|
1127
790
|
*/
|
|
1128
791
|
CertificateAuthorityArn: string | undefined;
|
|
1129
792
|
/**
|
|
1130
|
-
* <p>The number of days to make a CA restorable after it has been deleted. This can be
|
|
1131
|
-
* anywhere from 7 to 30 days, with 30 being the default.</p>
|
|
793
|
+
* <p>The number of days to make a CA restorable after it has been deleted. This can be anywhere from 7 to 30 days, with 30 being the default.</p>
|
|
1132
794
|
* @public
|
|
1133
795
|
*/
|
|
1134
796
|
PermanentDeletionTimeInDays?: number | undefined;
|
|
@@ -1138,19 +800,12 @@ export interface DeleteCertificateAuthorityRequest {
|
|
|
1138
800
|
*/
|
|
1139
801
|
export interface DeletePermissionRequest {
|
|
1140
802
|
/**
|
|
1141
|
-
* <p>The Amazon Resource Number (ARN) of the private CA that issued the permissions. You
|
|
1142
|
-
* can find the CA's ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must have the following form: </p>
|
|
1143
|
-
* <p>
|
|
1144
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1145
|
-
* </code>.
|
|
1146
|
-
* </p>
|
|
803
|
+
* <p>The Amazon Resource Number (ARN) of the private CA that issued the permissions. You can find the CA's ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must have the following form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
1147
804
|
* @public
|
|
1148
805
|
*/
|
|
1149
806
|
CertificateAuthorityArn: string | undefined;
|
|
1150
807
|
/**
|
|
1151
|
-
* <p>The Amazon Web Services service or identity that will have its CA permissions revoked. At this time,
|
|
1152
|
-
* the only valid service principal is <code>acm.amazonaws.com</code>
|
|
1153
|
-
* </p>
|
|
808
|
+
* <p>The Amazon Web Services service or identity that will have its CA permissions revoked. At this time, the only valid service principal is <code>acm.amazonaws.com</code> </p>
|
|
1154
809
|
* @public
|
|
1155
810
|
*/
|
|
1156
811
|
Principal: string | undefined;
|
|
@@ -1165,18 +820,13 @@ export interface DeletePermissionRequest {
|
|
|
1165
820
|
*/
|
|
1166
821
|
export interface DeletePolicyRequest {
|
|
1167
822
|
/**
|
|
1168
|
-
* <p>The Amazon Resource Number (ARN) of the private CA that will have its policy deleted.
|
|
1169
|
-
* You can find the CA's ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. The ARN value must have the form
|
|
1170
|
-
* <code>arn:aws:acm-pca:region:account:certificate-authority/01234567-89ab-cdef-0123-0123456789ab</code>.
|
|
1171
|
-
* </p>
|
|
823
|
+
* <p>The Amazon Resource Number (ARN) of the private CA that will have its policy deleted. You can find the CA's ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. The ARN value must have the form <code>arn:aws:acm-pca:region:account:certificate-authority/01234567-89ab-cdef-0123-0123456789ab</code>. </p>
|
|
1172
824
|
* @public
|
|
1173
825
|
*/
|
|
1174
826
|
ResourceArn: string | undefined;
|
|
1175
827
|
}
|
|
1176
828
|
/**
|
|
1177
|
-
* <p>The current action was prevented because it would lock the caller out from performing
|
|
1178
|
-
* subsequent actions. Verify that the specified parameters would not result in the caller
|
|
1179
|
-
* being denied access to the resource. </p>
|
|
829
|
+
* <p>The current action was prevented because it would lock the caller out from performing subsequent actions. Verify that the specified parameters would not result in the caller being denied access to the resource. </p>
|
|
1180
830
|
* @public
|
|
1181
831
|
*/
|
|
1182
832
|
export declare class LockoutPreventedException extends __BaseException {
|
|
@@ -1192,11 +842,7 @@ export declare class LockoutPreventedException extends __BaseException {
|
|
|
1192
842
|
*/
|
|
1193
843
|
export interface DescribeCertificateAuthorityRequest {
|
|
1194
844
|
/**
|
|
1195
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p>
|
|
1196
|
-
* <p>
|
|
1197
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1198
|
-
* </code>.
|
|
1199
|
-
* </p>
|
|
845
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
1200
846
|
* @public
|
|
1201
847
|
*/
|
|
1202
848
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -1232,23 +878,12 @@ export declare const CertificateAuthorityStatus: {
|
|
|
1232
878
|
*/
|
|
1233
879
|
export type CertificateAuthorityStatus = (typeof CertificateAuthorityStatus)[keyof typeof CertificateAuthorityStatus];
|
|
1234
880
|
/**
|
|
1235
|
-
* <p>Contains information about your private certificate authority (CA). Your private CA
|
|
1236
|
-
* can issue and revoke X.509 digital certificates. Digital certificates verify that the
|
|
1237
|
-
* entity named in the certificate <b>Subject</b> field owns or
|
|
1238
|
-
* controls the public key contained in the <b>Subject Public Key
|
|
1239
|
-
* Info</b> field. Call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action to create your private CA. You must then
|
|
1240
|
-
* call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificateAuthorityCertificate.html">GetCertificateAuthorityCertificate</a> action to retrieve a private CA
|
|
1241
|
-
* certificate signing request (CSR). Sign the CSR with your Amazon Web Services Private CA-hosted or
|
|
1242
|
-
* on-premises root or subordinate CA certificate. Call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ImportCertificateAuthorityCertificate.html">ImportCertificateAuthorityCertificate</a> action to import the signed
|
|
1243
|
-
* certificate into Certificate Manager (ACM). </p>
|
|
881
|
+
* <p>Contains information about your private certificate authority (CA). Your private CA can issue and revoke X.509 digital certificates. Digital certificates verify that the entity named in the certificate <b>Subject</b> field owns or controls the public key contained in the <b>Subject Public Key Info</b> field. Call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action to create your private CA. You must then call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificateAuthorityCertificate.html">GetCertificateAuthorityCertificate</a> action to retrieve a private CA certificate signing request (CSR). Sign the CSR with your Amazon Web Services Private CA-hosted or on-premises root or subordinate CA certificate. Call the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ImportCertificateAuthorityCertificate.html">ImportCertificateAuthorityCertificate</a> action to import the signed certificate into Certificate Manager (ACM). </p>
|
|
1244
882
|
* @public
|
|
1245
883
|
*/
|
|
1246
884
|
export interface CertificateAuthority {
|
|
1247
885
|
/**
|
|
1248
|
-
* <p>Amazon Resource Name (ARN) for your private certificate authority (CA). The format is
|
|
1249
|
-
* <code>
|
|
1250
|
-
* <i>12345678-1234-1234-1234-123456789012</i>
|
|
1251
|
-
* </code>.</p>
|
|
886
|
+
* <p>Amazon Resource Name (ARN) for your private certificate authority (CA). The format is <code> <i>12345678-1234-1234-1234-123456789012</i> </code>.</p>
|
|
1252
887
|
* @public
|
|
1253
888
|
*/
|
|
1254
889
|
Arn?: string | undefined;
|
|
@@ -1303,34 +938,22 @@ export interface CertificateAuthority {
|
|
|
1303
938
|
*/
|
|
1304
939
|
CertificateAuthorityConfiguration?: CertificateAuthorityConfiguration | undefined;
|
|
1305
940
|
/**
|
|
1306
|
-
* <p>Information about the Online Certificate Status Protocol (OCSP) configuration or
|
|
1307
|
-
* certificate revocation list (CRL) created and maintained by your private CA. </p>
|
|
941
|
+
* <p>Information about the Online Certificate Status Protocol (OCSP) configuration or certificate revocation list (CRL) created and maintained by your private CA. </p>
|
|
1308
942
|
* @public
|
|
1309
943
|
*/
|
|
1310
944
|
RevocationConfiguration?: RevocationConfiguration | undefined;
|
|
1311
945
|
/**
|
|
1312
|
-
* <p>The period during which a deleted CA can be restored. For more information, see the
|
|
1313
|
-
* <code>PermanentDeletionTimeInDays</code> parameter of the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeleteCertificateAuthorityRequest.html">DeleteCertificateAuthorityRequest</a> action. </p>
|
|
946
|
+
* <p>The period during which a deleted CA can be restored. For more information, see the <code>PermanentDeletionTimeInDays</code> parameter of the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeleteCertificateAuthorityRequest.html">DeleteCertificateAuthorityRequest</a> action. </p>
|
|
1314
947
|
* @public
|
|
1315
948
|
*/
|
|
1316
949
|
RestorableUntil?: Date | undefined;
|
|
1317
950
|
/**
|
|
1318
|
-
* <p>Defines a cryptographic key management compliance standard
|
|
1319
|
-
* <p>Default: FIPS_140_2_LEVEL_3_OR_HIGHER</p>
|
|
1320
|
-
* <p>Note: Amazon Web Services Region ap-northeast-3 supports only FIPS_140_2_LEVEL_2_OR_HIGHER. You must
|
|
1321
|
-
* explicitly specify this parameter and value when creating a CA in that Region.
|
|
1322
|
-
* Specifying a different value (or no value) results in an
|
|
1323
|
-
* <code>InvalidArgsException</code> with the message "A certificate authority cannot
|
|
1324
|
-
* be created in this region with the specified security standard."</p>
|
|
951
|
+
* <p>Defines a cryptographic key management compliance standard for handling and protecting CA keys.</p> <p>Default: FIPS_140_2_LEVEL_3_OR_HIGHER</p> <note> <p>Starting January 26, 2023, Amazon Web Services Private CA protects all CA private keys in non-China regions using hardware security modules (HSMs) that comply with FIPS PUB 140-2 Level 3.</p> <p>For information about security standard support in different Amazon Web Services Regions, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys">Storage and security compliance of Amazon Web Services Private CA private keys</a>.</p> </note>
|
|
1325
952
|
* @public
|
|
1326
953
|
*/
|
|
1327
954
|
KeyStorageSecurityStandard?: KeyStorageSecurityStandard | undefined;
|
|
1328
955
|
/**
|
|
1329
|
-
* <p>Specifies whether the CA issues general-purpose certificates that typically require a
|
|
1330
|
-
* revocation mechanism, or short-lived certificates that may optionally omit revocation
|
|
1331
|
-
* because they expire quickly. Short-lived certificate validity is limited to seven
|
|
1332
|
-
* days.</p>
|
|
1333
|
-
* <p>The default value is GENERAL_PURPOSE.</p>
|
|
956
|
+
* <p>Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days.</p> <p>The default value is GENERAL_PURPOSE.</p>
|
|
1334
957
|
* @public
|
|
1335
958
|
*/
|
|
1336
959
|
UsageMode?: CertificateAuthorityUsageMode | undefined;
|
|
@@ -1340,8 +963,7 @@ export interface CertificateAuthority {
|
|
|
1340
963
|
*/
|
|
1341
964
|
export interface DescribeCertificateAuthorityResponse {
|
|
1342
965
|
/**
|
|
1343
|
-
* <p>A <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthority.html">CertificateAuthority</a> structure that contains information about your private
|
|
1344
|
-
* CA.</p>
|
|
966
|
+
* <p>A <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthority.html">CertificateAuthority</a> structure that contains information about your private CA.</p>
|
|
1345
967
|
* @public
|
|
1346
968
|
*/
|
|
1347
969
|
CertificateAuthority?: CertificateAuthority | undefined;
|
|
@@ -1351,11 +973,7 @@ export interface DescribeCertificateAuthorityResponse {
|
|
|
1351
973
|
*/
|
|
1352
974
|
export interface DescribeCertificateAuthorityAuditReportRequest {
|
|
1353
975
|
/**
|
|
1354
|
-
* <p>The Amazon Resource Name (ARN) of the private CA. This must be of the form:</p>
|
|
1355
|
-
* <p>
|
|
1356
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1357
|
-
* </code>.
|
|
1358
|
-
* </p>
|
|
976
|
+
* <p>The Amazon Resource Name (ARN) of the private CA. This must be of the form:</p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
1359
977
|
* @public
|
|
1360
978
|
*/
|
|
1361
979
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -1393,8 +1011,7 @@ export interface DescribeCertificateAuthorityAuditReportResponse {
|
|
|
1393
1011
|
*/
|
|
1394
1012
|
S3BucketName?: string | undefined;
|
|
1395
1013
|
/**
|
|
1396
|
-
* <p>S3 <b>key</b> that uniquely identifies the report file in
|
|
1397
|
-
* your S3 bucket.</p>
|
|
1014
|
+
* <p>S3 <b>key</b> that uniquely identifies the report file in your S3 bucket.</p>
|
|
1398
1015
|
* @public
|
|
1399
1016
|
*/
|
|
1400
1017
|
S3Key?: string | undefined;
|
|
@@ -1409,21 +1026,12 @@ export interface DescribeCertificateAuthorityAuditReportResponse {
|
|
|
1409
1026
|
*/
|
|
1410
1027
|
export interface GetCertificateRequest {
|
|
1411
1028
|
/**
|
|
1412
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p>
|
|
1413
|
-
* <p>
|
|
1414
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1415
|
-
* </code>.
|
|
1416
|
-
* </p>
|
|
1029
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
1417
1030
|
* @public
|
|
1418
1031
|
*/
|
|
1419
1032
|
CertificateAuthorityArn: string | undefined;
|
|
1420
1033
|
/**
|
|
1421
|
-
* <p>The ARN of the issued certificate. The ARN contains the certificate serial number and
|
|
1422
|
-
* must be in the following form: </p>
|
|
1423
|
-
* <p>
|
|
1424
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>/certificate/<i>286535153982981100925020015808220737245</i>
|
|
1425
|
-
* </code>
|
|
1426
|
-
* </p>
|
|
1034
|
+
* <p>The ARN of the issued certificate. The ARN contains the certificate serial number and must be in the following form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>/certificate/<i>286535153982981100925020015808220737245</i> </code> </p>
|
|
1427
1035
|
* @public
|
|
1428
1036
|
*/
|
|
1429
1037
|
CertificateArn: string | undefined;
|
|
@@ -1433,14 +1041,12 @@ export interface GetCertificateRequest {
|
|
|
1433
1041
|
*/
|
|
1434
1042
|
export interface GetCertificateResponse {
|
|
1435
1043
|
/**
|
|
1436
|
-
* <p>The base64 PEM-encoded certificate specified by the <code>CertificateArn</code>
|
|
1437
|
-
* parameter.</p>
|
|
1044
|
+
* <p>The base64 PEM-encoded certificate specified by the <code>CertificateArn</code> parameter.</p>
|
|
1438
1045
|
* @public
|
|
1439
1046
|
*/
|
|
1440
1047
|
Certificate?: string | undefined;
|
|
1441
1048
|
/**
|
|
1442
|
-
* <p>The base64 PEM-encoded certificate chain that chains up to the root CA certificate
|
|
1443
|
-
* that you used to sign your private CA certificate. </p>
|
|
1049
|
+
* <p>The base64 PEM-encoded certificate chain that chains up to the root CA certificate that you used to sign your private CA certificate. </p>
|
|
1444
1050
|
* @public
|
|
1445
1051
|
*/
|
|
1446
1052
|
CertificateChain?: string | undefined;
|
|
@@ -1450,11 +1056,7 @@ export interface GetCertificateResponse {
|
|
|
1450
1056
|
*/
|
|
1451
1057
|
export interface GetCertificateAuthorityCertificateRequest {
|
|
1452
1058
|
/**
|
|
1453
|
-
* <p>The Amazon Resource Name (ARN) of your private CA. This is of the form:</p>
|
|
1454
|
-
* <p>
|
|
1455
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1456
|
-
* </code>.
|
|
1457
|
-
* </p>
|
|
1059
|
+
* <p>The Amazon Resource Name (ARN) of your private CA. This is of the form:</p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
|
|
1458
1060
|
* @public
|
|
1459
1061
|
*/
|
|
1460
1062
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -1469,10 +1071,7 @@ export interface GetCertificateAuthorityCertificateResponse {
|
|
|
1469
1071
|
*/
|
|
1470
1072
|
Certificate?: string | undefined;
|
|
1471
1073
|
/**
|
|
1472
|
-
* <p>Base64-encoded certificate chain that includes any intermediate certificates and
|
|
1473
|
-
* chains up to root certificate that you used to sign your private CA certificate. The
|
|
1474
|
-
* chain does not include your private CA certificate. If this is a root CA, the value will
|
|
1475
|
-
* be null.</p>
|
|
1074
|
+
* <p>Base64-encoded certificate chain that includes any intermediate certificates and chains up to root certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. If this is a root CA, the value will be null.</p>
|
|
1476
1075
|
* @public
|
|
1477
1076
|
*/
|
|
1478
1077
|
CertificateChain?: string | undefined;
|
|
@@ -1482,11 +1081,7 @@ export interface GetCertificateAuthorityCertificateResponse {
|
|
|
1482
1081
|
*/
|
|
1483
1082
|
export interface GetCertificateAuthorityCsrRequest {
|
|
1484
1083
|
/**
|
|
1485
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. This must be of the form: </p>
|
|
1486
|
-
* <p>
|
|
1487
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1488
|
-
* </code>
|
|
1489
|
-
* </p>
|
|
1084
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
1490
1085
|
* @public
|
|
1491
1086
|
*/
|
|
1492
1087
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -1496,8 +1091,7 @@ export interface GetCertificateAuthorityCsrRequest {
|
|
|
1496
1091
|
*/
|
|
1497
1092
|
export interface GetCertificateAuthorityCsrResponse {
|
|
1498
1093
|
/**
|
|
1499
|
-
* <p>The base64 PEM-encoded certificate signing request (CSR) for your private CA
|
|
1500
|
-
* certificate.</p>
|
|
1094
|
+
* <p>The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate.</p>
|
|
1501
1095
|
* @public
|
|
1502
1096
|
*/
|
|
1503
1097
|
Csr?: string | undefined;
|
|
@@ -1507,10 +1101,7 @@ export interface GetCertificateAuthorityCsrResponse {
|
|
|
1507
1101
|
*/
|
|
1508
1102
|
export interface GetPolicyRequest {
|
|
1509
1103
|
/**
|
|
1510
|
-
* <p>The Amazon Resource Number (ARN) of the private CA that will have its policy
|
|
1511
|
-
* retrieved. You can find the CA's ARN by calling the ListCertificateAuthorities action.
|
|
1512
|
-
*
|
|
1513
|
-
* </p>
|
|
1104
|
+
* <p>The Amazon Resource Number (ARN) of the private CA that will have its policy retrieved. You can find the CA's ARN by calling the ListCertificateAuthorities action. </p>
|
|
1514
1105
|
* @public
|
|
1515
1106
|
*/
|
|
1516
1107
|
ResourceArn: string | undefined;
|
|
@@ -1526,8 +1117,7 @@ export interface GetPolicyResponse {
|
|
|
1526
1117
|
Policy?: string | undefined;
|
|
1527
1118
|
}
|
|
1528
1119
|
/**
|
|
1529
|
-
* <p>The certificate authority certificate you are importing does not comply with
|
|
1530
|
-
* conditions specified in the certificate that signed it.</p>
|
|
1120
|
+
* <p>The certificate authority certificate you are importing does not comply with conditions specified in the certificate that signed it.</p>
|
|
1531
1121
|
* @public
|
|
1532
1122
|
*/
|
|
1533
1123
|
export declare class CertificateMismatchException extends __BaseException {
|
|
@@ -1543,27 +1133,17 @@ export declare class CertificateMismatchException extends __BaseException {
|
|
|
1543
1133
|
*/
|
|
1544
1134
|
export interface ImportCertificateAuthorityCertificateRequest {
|
|
1545
1135
|
/**
|
|
1546
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p>
|
|
1547
|
-
* <p>
|
|
1548
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1549
|
-
* </code>
|
|
1550
|
-
* </p>
|
|
1136
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
1551
1137
|
* @public
|
|
1552
1138
|
*/
|
|
1553
1139
|
CertificateAuthorityArn: string | undefined;
|
|
1554
1140
|
/**
|
|
1555
|
-
* <p>The PEM-encoded certificate for a private CA. This may be a self-signed certificate in
|
|
1556
|
-
* the case of a root CA, or it may be signed by another CA that you control.</p>
|
|
1141
|
+
* <p>The PEM-encoded certificate for a private CA. This may be a self-signed certificate in the case of a root CA, or it may be signed by another CA that you control.</p>
|
|
1557
1142
|
* @public
|
|
1558
1143
|
*/
|
|
1559
1144
|
Certificate: Uint8Array | undefined;
|
|
1560
1145
|
/**
|
|
1561
|
-
* <p>A PEM-encoded file that contains all of your certificates, other than the certificate
|
|
1562
|
-
* you're importing, chaining up to your root CA. Your Amazon Web Services Private CA-hosted or on-premises
|
|
1563
|
-
* root certificate is the last in the chain, and each certificate in the chain signs the
|
|
1564
|
-
* one preceding. </p>
|
|
1565
|
-
* <p>This parameter must be supplied when you import a subordinate CA. When you import a
|
|
1566
|
-
* root CA, there is no chain.</p>
|
|
1146
|
+
* <p>A PEM-encoded file that contains all of your certificates, other than the certificate you're importing, chaining up to your root CA. Your Amazon Web Services Private CA-hosted or on-premises root certificate is the last in the chain, and each certificate in the chain signs the one preceding. </p> <p>This parameter must be supplied when you import a subordinate CA. When you import a root CA, there is no chain.</p>
|
|
1567
1147
|
* @public
|
|
1568
1148
|
*/
|
|
1569
1149
|
CertificateChain?: Uint8Array | undefined;
|
|
@@ -1604,22 +1184,18 @@ export declare const PolicyQualifierId: {
|
|
|
1604
1184
|
*/
|
|
1605
1185
|
export type PolicyQualifierId = (typeof PolicyQualifierId)[keyof typeof PolicyQualifierId];
|
|
1606
1186
|
/**
|
|
1607
|
-
* <p>Defines a <code>PolicyInformation</code> qualifier. Amazon Web Services Private CA supports the <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.4">certification
|
|
1608
|
-
* practice statement (CPS) qualifier</a> defined in RFC 5280. </p>
|
|
1187
|
+
* <p>Defines a <code>PolicyInformation</code> qualifier. Amazon Web Services Private CA supports the <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.4">certification practice statement (CPS) qualifier</a> defined in RFC 5280. </p>
|
|
1609
1188
|
* @public
|
|
1610
1189
|
*/
|
|
1611
1190
|
export interface Qualifier {
|
|
1612
1191
|
/**
|
|
1613
|
-
* <p>Contains a pointer to a certification practice statement (CPS) published by the
|
|
1614
|
-
* CA.</p>
|
|
1192
|
+
* <p>Contains a pointer to a certification practice statement (CPS) published by the CA.</p>
|
|
1615
1193
|
* @public
|
|
1616
1194
|
*/
|
|
1617
1195
|
CpsUri: string | undefined;
|
|
1618
1196
|
}
|
|
1619
1197
|
/**
|
|
1620
|
-
* <p>Modifies the <code>CertPolicyId</code> of a <code>PolicyInformation</code> object with
|
|
1621
|
-
* a qualifier. Amazon Web Services Private CA supports the certification practice statement (CPS)
|
|
1622
|
-
* qualifier.</p>
|
|
1198
|
+
* <p>Modifies the <code>CertPolicyId</code> of a <code>PolicyInformation</code> object with a qualifier. Amazon Web Services Private CA supports the certification practice statement (CPS) qualifier.</p>
|
|
1623
1199
|
* @public
|
|
1624
1200
|
*/
|
|
1625
1201
|
export interface PolicyQualifierInfo {
|
|
@@ -1629,8 +1205,7 @@ export interface PolicyQualifierInfo {
|
|
|
1629
1205
|
*/
|
|
1630
1206
|
PolicyQualifierId: PolicyQualifierId | undefined;
|
|
1631
1207
|
/**
|
|
1632
|
-
* <p>Defines the qualifier type. Amazon Web Services Private CA supports the use of a URI for a CPS qualifier
|
|
1633
|
-
* in this field.</p>
|
|
1208
|
+
* <p>Defines the qualifier type. Amazon Web Services Private CA supports the use of a URI for a CPS qualifier in this field.</p>
|
|
1634
1209
|
* @public
|
|
1635
1210
|
*/
|
|
1636
1211
|
Qualifier: Qualifier | undefined;
|
|
@@ -1641,46 +1216,33 @@ export interface PolicyQualifierInfo {
|
|
|
1641
1216
|
*/
|
|
1642
1217
|
export interface PolicyInformation {
|
|
1643
1218
|
/**
|
|
1644
|
-
* <p>Specifies the object identifier (OID) of the certificate policy under which the
|
|
1645
|
-
* certificate was issued. For more information, see NIST's definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier
|
|
1646
|
-
* (OID)</a>.</p>
|
|
1219
|
+
* <p>Specifies the object identifier (OID) of the certificate policy under which the certificate was issued. For more information, see NIST's definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier (OID)</a>.</p>
|
|
1647
1220
|
* @public
|
|
1648
1221
|
*/
|
|
1649
1222
|
CertPolicyId: string | undefined;
|
|
1650
1223
|
/**
|
|
1651
|
-
* <p>Modifies the given <code>CertPolicyId</code> with a qualifier. Amazon Web Services Private CA supports the
|
|
1652
|
-
* certification practice statement (CPS) qualifier.</p>
|
|
1224
|
+
* <p>Modifies the given <code>CertPolicyId</code> with a qualifier. Amazon Web Services Private CA supports the certification practice statement (CPS) qualifier.</p>
|
|
1653
1225
|
* @public
|
|
1654
1226
|
*/
|
|
1655
1227
|
PolicyQualifiers?: PolicyQualifierInfo[] | undefined;
|
|
1656
1228
|
}
|
|
1657
1229
|
/**
|
|
1658
|
-
* <p/>
|
|
1659
|
-
* <p>Specifies the X.509 extension information for a certificate.</p>
|
|
1660
|
-
* <p>Extensions present in <code>CustomExtensions</code> follow the
|
|
1661
|
-
* <code>ApiPassthrough</code>
|
|
1662
|
-
* <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations">template
|
|
1663
|
-
* rules</a>. </p>
|
|
1230
|
+
* <p/> <p>Specifies the X.509 extension information for a certificate.</p> <p>Extensions present in <code>CustomExtensions</code> follow the <code>ApiPassthrough</code> <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations">template rules</a>. </p>
|
|
1664
1231
|
* @public
|
|
1665
1232
|
*/
|
|
1666
1233
|
export interface CustomExtension {
|
|
1667
1234
|
/**
|
|
1668
|
-
* <p/>
|
|
1669
|
-
* <p>Specifies the object identifier (OID) of the X.509 extension. For more information,
|
|
1670
|
-
* see the <a href="https://oidref.com/2.5.29">Global OID reference database.</a>
|
|
1671
|
-
* </p>
|
|
1235
|
+
* <p/> <p>Specifies the object identifier (OID) of the X.509 extension. For more information, see the <a href="https://oidref.com/2.5.29">Global OID reference database.</a> </p>
|
|
1672
1236
|
* @public
|
|
1673
1237
|
*/
|
|
1674
1238
|
ObjectIdentifier: string | undefined;
|
|
1675
1239
|
/**
|
|
1676
|
-
* <p/>
|
|
1677
|
-
* <p>Specifies the base64-encoded value of the X.509 extension.</p>
|
|
1240
|
+
* <p/> <p>Specifies the base64-encoded value of the X.509 extension.</p>
|
|
1678
1241
|
* @public
|
|
1679
1242
|
*/
|
|
1680
1243
|
Value: string | undefined;
|
|
1681
1244
|
/**
|
|
1682
|
-
* <p/>
|
|
1683
|
-
* <p>Specifies the critical flag of the X.509 extension.</p>
|
|
1245
|
+
* <p/> <p>Specifies the critical flag of the X.509 extension.</p>
|
|
1684
1246
|
* @public
|
|
1685
1247
|
*/
|
|
1686
1248
|
Critical?: boolean | undefined;
|
|
@@ -1705,20 +1267,17 @@ export declare const ExtendedKeyUsageType: {
|
|
|
1705
1267
|
*/
|
|
1706
1268
|
export type ExtendedKeyUsageType = (typeof ExtendedKeyUsageType)[keyof typeof ExtendedKeyUsageType];
|
|
1707
1269
|
/**
|
|
1708
|
-
* <p>Specifies additional purposes for which the certified public key may be used other
|
|
1709
|
-
* than basic purposes indicated in the <code>KeyUsage</code> extension.</p>
|
|
1270
|
+
* <p>Specifies additional purposes for which the certified public key may be used other than basic purposes indicated in the <code>KeyUsage</code> extension.</p>
|
|
1710
1271
|
* @public
|
|
1711
1272
|
*/
|
|
1712
1273
|
export interface ExtendedKeyUsage {
|
|
1713
1274
|
/**
|
|
1714
|
-
* <p>Specifies a standard <code>ExtendedKeyUsage</code> as defined as in <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12">RFC
|
|
1715
|
-
* 5280</a>.</p>
|
|
1275
|
+
* <p>Specifies a standard <code>ExtendedKeyUsage</code> as defined as in <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12">RFC 5280</a>.</p>
|
|
1716
1276
|
* @public
|
|
1717
1277
|
*/
|
|
1718
1278
|
ExtendedKeyUsageType?: ExtendedKeyUsageType | undefined;
|
|
1719
1279
|
/**
|
|
1720
|
-
* <p>Specifies a custom <code>ExtendedKeyUsage</code> with an object identifier
|
|
1721
|
-
* (OID).</p>
|
|
1280
|
+
* <p>Specifies a custom <code>ExtendedKeyUsage</code> with an object identifier (OID).</p>
|
|
1722
1281
|
* @public
|
|
1723
1282
|
*/
|
|
1724
1283
|
ExtendedKeyUsageObjectIdentifier?: string | undefined;
|
|
@@ -1729,54 +1288,33 @@ export interface ExtendedKeyUsage {
|
|
|
1729
1288
|
*/
|
|
1730
1289
|
export interface Extensions {
|
|
1731
1290
|
/**
|
|
1732
|
-
* <p>Contains a sequence of one or more policy information terms, each of which consists of
|
|
1733
|
-
* an object identifier (OID) and optional qualifiers. For more information, see NIST's
|
|
1734
|
-
* definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object
|
|
1735
|
-
* Identifier (OID)</a>.</p>
|
|
1736
|
-
* <p>In an end-entity certificate, these terms indicate the policy under which the
|
|
1737
|
-
* certificate was issued and the purposes for which it may be used. In a CA certificate,
|
|
1738
|
-
* these terms limit the set of policies for certification paths that include this
|
|
1739
|
-
* certificate.</p>
|
|
1291
|
+
* <p>Contains a sequence of one or more policy information terms, each of which consists of an object identifier (OID) and optional qualifiers. For more information, see NIST's definition of <a href="https://csrc.nist.gov/glossary/term/Object_Identifier">Object Identifier (OID)</a>.</p> <p>In an end-entity certificate, these terms indicate the policy under which the certificate was issued and the purposes for which it may be used. In a CA certificate, these terms limit the set of policies for certification paths that include this certificate.</p>
|
|
1740
1292
|
* @public
|
|
1741
1293
|
*/
|
|
1742
1294
|
CertificatePolicies?: PolicyInformation[] | undefined;
|
|
1743
1295
|
/**
|
|
1744
|
-
* <p>Specifies additional purposes for which the certified public key may be used other
|
|
1745
|
-
* than basic purposes indicated in the <code>KeyUsage</code> extension.</p>
|
|
1296
|
+
* <p>Specifies additional purposes for which the certified public key may be used other than basic purposes indicated in the <code>KeyUsage</code> extension.</p>
|
|
1746
1297
|
* @public
|
|
1747
1298
|
*/
|
|
1748
1299
|
ExtendedKeyUsage?: ExtendedKeyUsage[] | undefined;
|
|
1749
1300
|
/**
|
|
1750
|
-
* <p>Defines one or more purposes for which the key contained in the certificate can be
|
|
1751
|
-
* used. Default value for each option is false.</p>
|
|
1301
|
+
* <p>Defines one or more purposes for which the key contained in the certificate can be used. Default value for each option is false.</p>
|
|
1752
1302
|
* @public
|
|
1753
1303
|
*/
|
|
1754
1304
|
KeyUsage?: KeyUsage | undefined;
|
|
1755
1305
|
/**
|
|
1756
|
-
* <p>The subject alternative name extension allows identities to be bound to the subject of
|
|
1757
|
-
* the certificate. These identities may be included in addition to or in place of the
|
|
1758
|
-
* identity in the subject field of the certificate.</p>
|
|
1306
|
+
* <p>The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate.</p>
|
|
1759
1307
|
* @public
|
|
1760
1308
|
*/
|
|
1761
1309
|
SubjectAlternativeNames?: GeneralName[] | undefined;
|
|
1762
1310
|
/**
|
|
1763
|
-
* <p/>
|
|
1764
|
-
* <p>Contains a sequence of one or more X.509 extensions, each of which consists of an
|
|
1765
|
-
* object identifier (OID), a base64-encoded value, and the critical flag. For more
|
|
1766
|
-
* information, see the <a href="https://oidref.com/2.5.29">Global OID reference
|
|
1767
|
-
* database.</a>
|
|
1768
|
-
* </p>
|
|
1311
|
+
* <p/> <p>Contains a sequence of one or more X.509 extensions, each of which consists of an object identifier (OID), a base64-encoded value, and the critical flag. For more information, see the <a href="https://oidref.com/2.5.29">Global OID reference database.</a> </p>
|
|
1769
1312
|
* @public
|
|
1770
1313
|
*/
|
|
1771
1314
|
CustomExtensions?: CustomExtension[] | undefined;
|
|
1772
1315
|
}
|
|
1773
1316
|
/**
|
|
1774
|
-
* <p>Contains X.509 certificate information to be placed in an issued certificate. An
|
|
1775
|
-
* <code>APIPassthrough</code> or <code>APICSRPassthrough</code> template variant must
|
|
1776
|
-
* be selected, or else this parameter is ignored. </p>
|
|
1777
|
-
* <p>If conflicting or duplicate certificate information is supplied from other sources,
|
|
1778
|
-
* Amazon Web Services Private CA applies <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations">order of
|
|
1779
|
-
* operation rules</a> to determine what information is used.</p>
|
|
1317
|
+
* <p>Contains X.509 certificate information to be placed in an issued certificate. An <code>APIPassthrough</code> or <code>APICSRPassthrough</code> template variant must be selected, or else this parameter is ignored. </p> <p>If conflicting or duplicate certificate information is supplied from other sources, Amazon Web Services Private CA applies <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations">order of operation rules</a> to determine what information is used.</p>
|
|
1780
1318
|
* @public
|
|
1781
1319
|
*/
|
|
1782
1320
|
export interface ApiPassthrough {
|
|
@@ -1786,11 +1324,7 @@ export interface ApiPassthrough {
|
|
|
1786
1324
|
*/
|
|
1787
1325
|
Extensions?: Extensions | undefined;
|
|
1788
1326
|
/**
|
|
1789
|
-
* <p>Contains information about the certificate subject. The <code>Subject</code> field in
|
|
1790
|
-
* the certificate identifies the entity that owns or controls the public key in the
|
|
1791
|
-
* certificate. The entity can be a user, computer, device, or service. The <code>Subject
|
|
1792
|
-
* </code>must contain an X.500 distinguished name (DN). A DN is a sequence of relative
|
|
1793
|
-
* distinguished names (RDNs). The RDNs are separated by commas in the certificate.</p>
|
|
1327
|
+
* <p>Contains information about the certificate subject. The <code>Subject</code> field in the certificate identifies the entity that owns or controls the public key in the certificate. The entity can be a user, computer, device, or service. The <code>Subject </code>must contain an X.500 distinguished name (DN). A DN is a sequence of relative distinguished names (RDNs). The RDNs are separated by commas in the certificate.</p>
|
|
1794
1328
|
* @public
|
|
1795
1329
|
*/
|
|
1796
1330
|
Subject?: ASN1Subject | undefined;
|
|
@@ -1811,16 +1345,7 @@ export declare const ValidityPeriodType: {
|
|
|
1811
1345
|
*/
|
|
1812
1346
|
export type ValidityPeriodType = (typeof ValidityPeriodType)[keyof typeof ValidityPeriodType];
|
|
1813
1347
|
/**
|
|
1814
|
-
* <p>Validity specifies the period of time during which a certificate is valid. Validity
|
|
1815
|
-
* can be expressed as an explicit date and time when the validity of a certificate starts
|
|
1816
|
-
* or expires, or as a span of time after issuance, stated in days, months, or years. For
|
|
1817
|
-
* more information, see <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.5">Validity</a> in RFC 5280.</p>
|
|
1818
|
-
* <p>Amazon Web Services Private CA API consumes the <code>Validity</code> data type differently in two
|
|
1819
|
-
* distinct parameters of the <code>IssueCertificate</code> action. The required parameter
|
|
1820
|
-
* <code>IssueCertificate</code>:<code>Validity</code> specifies the end of a
|
|
1821
|
-
* certificate's validity period. The optional parameter
|
|
1822
|
-
* <code>IssueCertificate</code>:<code>ValidityNotBefore</code> specifies a customized
|
|
1823
|
-
* starting time for the validity period.</p>
|
|
1348
|
+
* <p>Validity specifies the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the validity of a certificate starts or expires, or as a span of time after issuance, stated in days, months, or years. For more information, see <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.5">Validity</a> in RFC 5280.</p> <p>Amazon Web Services Private CA API consumes the <code>Validity</code> data type differently in two distinct parameters of the <code>IssueCertificate</code> action. The required parameter <code>IssueCertificate</code>:<code>Validity</code> specifies the end of a certificate's validity period. The optional parameter <code>IssueCertificate</code>:<code>ValidityNotBefore</code> specifies a customized starting time for the validity period.</p>
|
|
1824
1349
|
* @public
|
|
1825
1350
|
*/
|
|
1826
1351
|
export interface Validity {
|
|
@@ -1830,50 +1355,7 @@ export interface Validity {
|
|
|
1830
1355
|
*/
|
|
1831
1356
|
Value: number | undefined;
|
|
1832
1357
|
/**
|
|
1833
|
-
* <p>Determines how <i>Amazon Web Services Private CA</i> interprets the <code>Value</code>
|
|
1834
|
-
* parameter, an integer. Supported validity types include those listed below. Type
|
|
1835
|
-
* definitions with values include a sample input value and the resulting output. </p>
|
|
1836
|
-
* <p>
|
|
1837
|
-
* <code>END_DATE</code>: The specific date and time when the certificate will expire,
|
|
1838
|
-
* expressed using UTCTime (YYMMDDHHMMSS) or GeneralizedTime (YYYYMMDDHHMMSS) format. When
|
|
1839
|
-
* UTCTime is used, if the year field (YY) is greater than or equal to 50, the year is
|
|
1840
|
-
* interpreted as 19YY. If the year field is less than 50, the year is interpreted as
|
|
1841
|
-
* 20YY.</p>
|
|
1842
|
-
* <ul>
|
|
1843
|
-
* <li>
|
|
1844
|
-
* <p>Sample input value: 491231235959 (UTCTime format)</p>
|
|
1845
|
-
* </li>
|
|
1846
|
-
* <li>
|
|
1847
|
-
* <p>Output expiration date/time: 12/31/2049 23:59:59</p>
|
|
1848
|
-
* </li>
|
|
1849
|
-
* </ul>
|
|
1850
|
-
* <p>
|
|
1851
|
-
* <code>ABSOLUTE</code>: The specific date and time when the validity of a certificate
|
|
1852
|
-
* will start or expire, expressed in seconds since the Unix Epoch. </p>
|
|
1853
|
-
* <ul>
|
|
1854
|
-
* <li>
|
|
1855
|
-
* <p>Sample input value: 2524608000</p>
|
|
1856
|
-
* </li>
|
|
1857
|
-
* <li>
|
|
1858
|
-
* <p>Output expiration date/time: 01/01/2050 00:00:00</p>
|
|
1859
|
-
* </li>
|
|
1860
|
-
* </ul>
|
|
1861
|
-
* <p>
|
|
1862
|
-
* <code>DAYS</code>, <code>MONTHS</code>, <code>YEARS</code>: The relative time from the
|
|
1863
|
-
* moment of issuance until the certificate will expire, expressed in days, months, or
|
|
1864
|
-
* years. </p>
|
|
1865
|
-
* <p>Example if <code>DAYS</code>, issued on 10/12/2020 at 12:34:54 UTC:</p>
|
|
1866
|
-
* <ul>
|
|
1867
|
-
* <li>
|
|
1868
|
-
* <p>Sample input value: 90</p>
|
|
1869
|
-
* </li>
|
|
1870
|
-
* <li>
|
|
1871
|
-
* <p>Output expiration date: 01/10/2020 12:34:54 UTC</p>
|
|
1872
|
-
* </li>
|
|
1873
|
-
* </ul>
|
|
1874
|
-
* <p>The minimum validity duration for a certificate using relative time
|
|
1875
|
-
* (<code>DAYS</code>) is one day. The minimum validity for a certificate using absolute
|
|
1876
|
-
* time (<code>ABSOLUTE</code> or <code>END_DATE</code>) is one second.</p>
|
|
1358
|
+
* <p>Determines how <i>Amazon Web Services Private CA</i> interprets the <code>Value</code> parameter, an integer. Supported validity types include those listed below. Type definitions with values include a sample input value and the resulting output. </p> <p> <code>END_DATE</code>: The specific date and time when the certificate will expire, expressed using UTCTime (YYMMDDHHMMSS) or GeneralizedTime (YYYYMMDDHHMMSS) format. When UTCTime is used, if the year field (YY) is greater than or equal to 50, the year is interpreted as 19YY. If the year field is less than 50, the year is interpreted as 20YY.</p> <ul> <li> <p>Sample input value: 491231235959 (UTCTime format)</p> </li> <li> <p>Output expiration date/time: 12/31/2049 23:59:59</p> </li> </ul> <p> <code>ABSOLUTE</code>: The specific date and time when the validity of a certificate will start or expire, expressed in seconds since the Unix Epoch. </p> <ul> <li> <p>Sample input value: 2524608000</p> </li> <li> <p>Output expiration date/time: 01/01/2050 00:00:00</p> </li> </ul> <p> <code>DAYS</code>, <code>MONTHS</code>, <code>YEARS</code>: The relative time from the moment of issuance until the certificate will expire, expressed in days, months, or years. </p> <p>Example if <code>DAYS</code>, issued on 10/12/2020 at 12:34:54 UTC:</p> <ul> <li> <p>Sample input value: 90</p> </li> <li> <p>Output expiration date: 01/10/2020 12:34:54 UTC</p> </li> </ul> <p>The minimum validity duration for a certificate using relative time (<code>DAYS</code>) is one day. The minimum validity for a certificate using absolute time (<code>ABSOLUTE</code> or <code>END_DATE</code>) is one second.</p>
|
|
1877
1359
|
* @public
|
|
1878
1360
|
*/
|
|
1879
1361
|
Type: ValidityPeriodType | undefined;
|
|
@@ -1883,113 +1365,42 @@ export interface Validity {
|
|
|
1883
1365
|
*/
|
|
1884
1366
|
export interface IssueCertificateRequest {
|
|
1885
1367
|
/**
|
|
1886
|
-
* <p>Specifies X.509 certificate information to be included in the issued certificate. An
|
|
1887
|
-
* <code>APIPassthrough</code> or <code>APICSRPassthrough</code> template variant must
|
|
1888
|
-
* be selected, or else this parameter is ignored. For more information about using these
|
|
1889
|
-
* templates, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html">Understanding Certificate Templates</a>.</p>
|
|
1890
|
-
* <p>If conflicting or duplicate certificate information is supplied during certificate
|
|
1891
|
-
* issuance, Amazon Web Services Private CA applies <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations">order of
|
|
1892
|
-
* operation rules</a> to determine what information is used.</p>
|
|
1368
|
+
* <p>Specifies X.509 certificate information to be included in the issued certificate. An <code>APIPassthrough</code> or <code>APICSRPassthrough</code> template variant must be selected, or else this parameter is ignored. For more information about using these templates, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html">Understanding Certificate Templates</a>.</p> <p>If conflicting or duplicate certificate information is supplied during certificate issuance, Amazon Web Services Private CA applies <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-order-of-operations">order of operation rules</a> to determine what information is used.</p>
|
|
1893
1369
|
* @public
|
|
1894
1370
|
*/
|
|
1895
1371
|
ApiPassthrough?: ApiPassthrough | undefined;
|
|
1896
1372
|
/**
|
|
1897
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form:</p>
|
|
1898
|
-
* <p>
|
|
1899
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
1900
|
-
* </code>
|
|
1901
|
-
* </p>
|
|
1373
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form:</p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
1902
1374
|
* @public
|
|
1903
1375
|
*/
|
|
1904
1376
|
CertificateAuthorityArn: string | undefined;
|
|
1905
1377
|
/**
|
|
1906
|
-
* <p>The certificate signing request (CSR) for the certificate you want to issue. As an
|
|
1907
|
-
* example, you can use the following OpenSSL command to create the CSR and a 2048 bit RSA
|
|
1908
|
-
* private key. </p>
|
|
1909
|
-
* <p>
|
|
1910
|
-
* <code>openssl req -new -newkey rsa:2048 -days 365 -keyout private/test_cert_priv_key.pem
|
|
1911
|
-
* -out csr/test_cert_.csr</code>
|
|
1912
|
-
* </p>
|
|
1913
|
-
* <p>If you have a configuration file, you can then use the following OpenSSL command. The
|
|
1914
|
-
* <code>usr_cert</code> block in the configuration file contains your X509 version 3
|
|
1915
|
-
* extensions. </p>
|
|
1916
|
-
* <p>
|
|
1917
|
-
* <code>openssl req -new -config openssl_rsa.cnf -extensions usr_cert -newkey rsa:2048
|
|
1918
|
-
* -days 365 -keyout private/test_cert_priv_key.pem -out
|
|
1919
|
-
* csr/test_cert_.csr</code>
|
|
1920
|
-
* </p>
|
|
1921
|
-
* <p>Note: A CSR must provide either a <i>subject name</i> or a
|
|
1922
|
-
* <i>subject alternative name</i> or the request will be rejected.
|
|
1923
|
-
* </p>
|
|
1378
|
+
* <p>The certificate signing request (CSR) for the certificate you want to issue. As an example, you can use the following OpenSSL command to create the CSR and a 2048 bit RSA private key. </p> <p> <code>openssl req -new -newkey rsa:2048 -days 365 -keyout private/test_cert_priv_key.pem -out csr/test_cert_.csr</code> </p> <p>If you have a configuration file, you can then use the following OpenSSL command. The <code>usr_cert</code> block in the configuration file contains your X509 version 3 extensions. </p> <p> <code>openssl req -new -config openssl_rsa.cnf -extensions usr_cert -newkey rsa:2048 -days 365 -keyout private/test_cert_priv_key.pem -out csr/test_cert_.csr</code> </p> <p>Note: A CSR must provide either a <i>subject name</i> or a <i>subject alternative name</i> or the request will be rejected. </p>
|
|
1924
1379
|
* @public
|
|
1925
1380
|
*/
|
|
1926
1381
|
Csr: Uint8Array | undefined;
|
|
1927
1382
|
/**
|
|
1928
|
-
* <p>The name of the algorithm that will be used to sign the certificate to be issued. </p>
|
|
1929
|
-
* <p>This parameter should not be confused with the <code>SigningAlgorithm</code> parameter
|
|
1930
|
-
* used to sign a CSR in the <code>CreateCertificateAuthority</code> action.</p>
|
|
1931
|
-
* <note>
|
|
1932
|
-
* <p>The specified signing algorithm family (RSA or ECDSA) must match the algorithm
|
|
1933
|
-
* family of the CA's secret key.</p>
|
|
1934
|
-
* </note>
|
|
1383
|
+
* <p>The name of the algorithm that will be used to sign the certificate to be issued. </p> <p>This parameter should not be confused with the <code>SigningAlgorithm</code> parameter used to sign a CSR in the <code>CreateCertificateAuthority</code> action.</p> <note> <p>The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key.</p> </note>
|
|
1935
1384
|
* @public
|
|
1936
1385
|
*/
|
|
1937
1386
|
SigningAlgorithm: SigningAlgorithm | undefined;
|
|
1938
1387
|
/**
|
|
1939
|
-
* <p>Specifies a custom configuration template to use when issuing a certificate. If this
|
|
1940
|
-
* parameter is not provided, Amazon Web Services Private CA defaults to the
|
|
1941
|
-
* <code>EndEntityCertificate/V1</code> template. For CA certificates, you should
|
|
1942
|
-
* choose the shortest path length that meets your needs. The path length is indicated by
|
|
1943
|
-
* the PathLen<i>N</i> portion of the ARN, where <i>N</i> is
|
|
1944
|
-
* the <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaTerms.html#terms-cadepth">CA
|
|
1945
|
-
* depth</a>.</p>
|
|
1946
|
-
* <p>Note: The CA depth configured on a subordinate CA certificate must not exceed the
|
|
1947
|
-
* limit set by its parents in the CA hierarchy.</p>
|
|
1948
|
-
* <p>For a list of <code>TemplateArn</code> values supported by Amazon Web Services Private CA, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html">Understanding Certificate
|
|
1949
|
-
* Templates</a>.</p>
|
|
1388
|
+
* <p>Specifies a custom configuration template to use when issuing a certificate. If this parameter is not provided, Amazon Web Services Private CA defaults to the <code>EndEntityCertificate/V1</code> template. For CA certificates, you should choose the shortest path length that meets your needs. The path length is indicated by the PathLen<i>N</i> portion of the ARN, where <i>N</i> is the <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaTerms.html#terms-cadepth">CA depth</a>.</p> <p>Note: The CA depth configured on a subordinate CA certificate must not exceed the limit set by its parents in the CA hierarchy.</p> <p>For a list of <code>TemplateArn</code> values supported by Amazon Web Services Private CA, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html">Understanding Certificate Templates</a>.</p>
|
|
1950
1389
|
* @public
|
|
1951
1390
|
*/
|
|
1952
1391
|
TemplateArn?: string | undefined;
|
|
1953
1392
|
/**
|
|
1954
|
-
* <p>Information describing the end of the validity period of the certificate. This
|
|
1955
|
-
* parameter sets the “Not After” date for the certificate.</p>
|
|
1956
|
-
* <p>Certificate validity is the period of time during which a certificate is valid.
|
|
1957
|
-
* Validity can be expressed as an explicit date and time when the certificate expires, or
|
|
1958
|
-
* as a span of time after issuance, stated in days, months, or years. For more
|
|
1959
|
-
* information, see <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5">Validity</a>
|
|
1960
|
-
* in RFC 5280. </p>
|
|
1961
|
-
* <p>This value is unaffected when <code>ValidityNotBefore</code> is also specified. For
|
|
1962
|
-
* example, if <code>Validity</code> is set to 20 days in the future, the certificate will
|
|
1963
|
-
* expire 20 days from issuance time regardless of the <code>ValidityNotBefore</code>
|
|
1964
|
-
* value.</p>
|
|
1965
|
-
* <p>The end of the validity period configured on a certificate must not exceed the limit
|
|
1966
|
-
* set on its parents in the CA hierarchy.</p>
|
|
1393
|
+
* <p>Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate.</p> <p>Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5">Validity</a> in RFC 5280. </p> <p>This value is unaffected when <code>ValidityNotBefore</code> is also specified. For example, if <code>Validity</code> is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the <code>ValidityNotBefore</code> value.</p> <p>The end of the validity period configured on a certificate must not exceed the limit set on its parents in the CA hierarchy.</p>
|
|
1967
1394
|
* @public
|
|
1968
1395
|
*/
|
|
1969
1396
|
Validity: Validity | undefined;
|
|
1970
1397
|
/**
|
|
1971
|
-
* <p>Information describing the start of the validity period of the certificate. This
|
|
1972
|
-
* parameter sets the “Not Before" date for the certificate.</p>
|
|
1973
|
-
* <p>By default, when issuing a certificate, Amazon Web Services Private CA sets the "Not Before" date to the
|
|
1974
|
-
* issuance time minus 60 minutes. This compensates for clock inconsistencies across
|
|
1975
|
-
* computer systems. The <code>ValidityNotBefore</code> parameter can be used to customize
|
|
1976
|
-
* the “Not Before” value. </p>
|
|
1977
|
-
* <p>Unlike the <code>Validity</code> parameter, the <code>ValidityNotBefore</code>
|
|
1978
|
-
* parameter is optional.</p>
|
|
1979
|
-
* <p>The <code>ValidityNotBefore</code> value is expressed as an explicit date and time,
|
|
1980
|
-
* using the <code>Validity</code> type value <code>ABSOLUTE</code>. For more information,
|
|
1981
|
-
* see <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_Validity.html">Validity</a> in
|
|
1982
|
-
* this API reference and <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5">Validity</a>
|
|
1983
|
-
* in RFC 5280.</p>
|
|
1398
|
+
* <p>Information describing the start of the validity period of the certificate. This parameter sets the “Not Before" date for the certificate.</p> <p>By default, when issuing a certificate, Amazon Web Services Private CA sets the "Not Before" date to the issuance time minus 60 minutes. This compensates for clock inconsistencies across computer systems. The <code>ValidityNotBefore</code> parameter can be used to customize the “Not Before” value. </p> <p>Unlike the <code>Validity</code> parameter, the <code>ValidityNotBefore</code> parameter is optional.</p> <p>The <code>ValidityNotBefore</code> value is expressed as an explicit date and time, using the <code>Validity</code> type value <code>ABSOLUTE</code>. For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_Validity.html">Validity</a> in this API reference and <a href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5">Validity</a> in RFC 5280.</p>
|
|
1984
1399
|
* @public
|
|
1985
1400
|
*/
|
|
1986
1401
|
ValidityNotBefore?: Validity | undefined;
|
|
1987
1402
|
/**
|
|
1988
|
-
* <p>Alphanumeric string that can be used to distinguish between calls to the <b>IssueCertificate</b> action. Idempotency tokens for <b>IssueCertificate</b> time out after five
|
|
1989
|
-
* you call <b>IssueCertificate</b> multiple times with the same
|
|
1990
|
-
* idempotency token within five minutes, Amazon Web Services Private CA recognizes that you are requesting
|
|
1991
|
-
* only one certificate and will issue only one. If you change the idempotency token for
|
|
1992
|
-
* each call, Amazon Web Services Private CA recognizes that you are requesting multiple certificates.</p>
|
|
1403
|
+
* <p>Alphanumeric string that can be used to distinguish between calls to the <b>IssueCertificate</b> action. Idempotency tokens for <b>IssueCertificate</b> time out after five minutes. Therefore, if you call <b>IssueCertificate</b> multiple times with the same idempotency token within five minutes, Amazon Web Services Private CA recognizes that you are requesting only one certificate and will issue only one. If you change the idempotency token for each call, Amazon Web Services Private CA recognizes that you are requesting multiple certificates.</p>
|
|
1993
1404
|
* @public
|
|
1994
1405
|
*/
|
|
1995
1406
|
IdempotencyToken?: string | undefined;
|
|
@@ -1999,12 +1410,7 @@ export interface IssueCertificateRequest {
|
|
|
1999
1410
|
*/
|
|
2000
1411
|
export interface IssueCertificateResponse {
|
|
2001
1412
|
/**
|
|
2002
|
-
* <p>The Amazon Resource Name (ARN) of the issued certificate and the certificate serial
|
|
2003
|
-
* number. This is of the form:</p>
|
|
2004
|
-
* <p>
|
|
2005
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>/certificate/<i>286535153982981100925020015808220737245</i>
|
|
2006
|
-
* </code>
|
|
2007
|
-
* </p>
|
|
1413
|
+
* <p>The Amazon Resource Name (ARN) of the issued certificate and the certificate serial number. This is of the form:</p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>/certificate/<i>286535153982981100925020015808220737245</i> </code> </p>
|
|
2008
1414
|
* @public
|
|
2009
1415
|
*/
|
|
2010
1416
|
CertificateArn?: string | undefined;
|
|
@@ -2022,8 +1428,7 @@ export declare class MalformedCSRException extends __BaseException {
|
|
|
2022
1428
|
constructor(opts: __ExceptionOptionType<MalformedCSRException, __BaseException>);
|
|
2023
1429
|
}
|
|
2024
1430
|
/**
|
|
2025
|
-
* <p>The token specified in the <code>NextToken</code> argument is not valid. Use the token
|
|
2026
|
-
* returned from your previous call to <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a>.</p>
|
|
1431
|
+
* <p>The token specified in the <code>NextToken</code> argument is not valid. Use the token returned from your previous call to <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a>.</p>
|
|
2027
1432
|
* @public
|
|
2028
1433
|
*/
|
|
2029
1434
|
export declare class InvalidNextTokenException extends __BaseException {
|
|
@@ -2051,25 +1456,17 @@ export type ResourceOwner = (typeof ResourceOwner)[keyof typeof ResourceOwner];
|
|
|
2051
1456
|
*/
|
|
2052
1457
|
export interface ListCertificateAuthoritiesRequest {
|
|
2053
1458
|
/**
|
|
2054
|
-
* <p>Use this parameter when paginating results to specify the maximum number of items to
|
|
2055
|
-
* return in the response on each page. If additional items exist beyond the number you
|
|
2056
|
-
* specify, the <code>NextToken</code> element is sent in the response. Use this
|
|
2057
|
-
* <code>NextToken</code> value in a subsequent request to retrieve additional
|
|
2058
|
-
* items.</p>
|
|
2059
|
-
* <p>Although the maximum value is 1000, the action only returns a maximum of 100 items.</p>
|
|
1459
|
+
* <p>Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the <code>NextToken</code> element is sent in the response. Use this <code>NextToken</code> value in a subsequent request to retrieve additional items.</p> <p>Although the maximum value is 1000, the action only returns a maximum of 100 items.</p>
|
|
2060
1460
|
* @public
|
|
2061
1461
|
*/
|
|
2062
1462
|
MaxResults?: number | undefined;
|
|
2063
1463
|
/**
|
|
2064
|
-
* <p>Use this parameter when paginating results in a subsequent request after you receive a
|
|
2065
|
-
* response with truncated results. Set it to the value of the <code>NextToken</code>
|
|
2066
|
-
* parameter from the response you just received.</p>
|
|
1464
|
+
* <p>Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the <code>NextToken</code> parameter from the response you just received.</p>
|
|
2067
1465
|
* @public
|
|
2068
1466
|
*/
|
|
2069
1467
|
NextToken?: string | undefined;
|
|
2070
1468
|
/**
|
|
2071
|
-
* <p>Use this parameter to filter the returned set of certificate authorities based on
|
|
2072
|
-
* their owner. The default is SELF.</p>
|
|
1469
|
+
* <p>Use this parameter to filter the returned set of certificate authorities based on their owner. The default is SELF.</p>
|
|
2073
1470
|
* @public
|
|
2074
1471
|
*/
|
|
2075
1472
|
ResourceOwner?: ResourceOwner | undefined;
|
|
@@ -2079,8 +1476,7 @@ export interface ListCertificateAuthoritiesRequest {
|
|
|
2079
1476
|
*/
|
|
2080
1477
|
export interface ListCertificateAuthoritiesResponse {
|
|
2081
1478
|
/**
|
|
2082
|
-
* <p>When the list is truncated, this value is present and should be used for the
|
|
2083
|
-
* <code>NextToken</code> parameter in a subsequent pagination request.</p>
|
|
1479
|
+
* <p>When the list is truncated, this value is present and should be used for the <code>NextToken</code> parameter in a subsequent pagination request.</p>
|
|
2084
1480
|
* @public
|
|
2085
1481
|
*/
|
|
2086
1482
|
NextToken?: string | undefined;
|
|
@@ -2095,43 +1491,28 @@ export interface ListCertificateAuthoritiesResponse {
|
|
|
2095
1491
|
*/
|
|
2096
1492
|
export interface ListPermissionsRequest {
|
|
2097
1493
|
/**
|
|
2098
|
-
* <p>When paginating results, use this parameter to specify the maximum number of items to
|
|
2099
|
-
* return in the response. If additional items exist beyond the number you specify, the
|
|
2100
|
-
* <b>NextToken</b> element is sent in the response. Use this
|
|
2101
|
-
* <b>NextToken</b> value in a subsequent request to retrieve
|
|
2102
|
-
* additional items.</p>
|
|
1494
|
+
* <p>When paginating results, use this parameter to specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the <b>NextToken</b> element is sent in the response. Use this <b>NextToken</b> value in a subsequent request to retrieve additional items.</p>
|
|
2103
1495
|
* @public
|
|
2104
1496
|
*/
|
|
2105
1497
|
MaxResults?: number | undefined;
|
|
2106
1498
|
/**
|
|
2107
|
-
* <p>When paginating results, use this parameter in a subsequent request after you receive
|
|
2108
|
-
* a response with truncated results. Set it to the value of <b>NextToken</b> from the response you just received.</p>
|
|
1499
|
+
* <p>When paginating results, use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <b>NextToken</b> from the response you just received.</p>
|
|
2109
1500
|
* @public
|
|
2110
1501
|
*/
|
|
2111
1502
|
NextToken?: string | undefined;
|
|
2112
1503
|
/**
|
|
2113
|
-
* <p>The Amazon Resource Number (ARN) of the private CA to inspect. You can find the ARN by
|
|
2114
|
-
* calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must be of the form:
|
|
2115
|
-
* <code>arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012</code>
|
|
2116
|
-
* You can get a private CA's ARN by running the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action.</p>
|
|
1504
|
+
* <p>The Amazon Resource Number (ARN) of the private CA to inspect. You can find the ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must be of the form: <code>arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012</code> You can get a private CA's ARN by running the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action.</p>
|
|
2117
1505
|
* @public
|
|
2118
1506
|
*/
|
|
2119
1507
|
CertificateAuthorityArn: string | undefined;
|
|
2120
1508
|
}
|
|
2121
1509
|
/**
|
|
2122
|
-
* <p>Permissions designate which private CA actions can be performed by an Amazon Web Services service or
|
|
2123
|
-
* entity. In order for ACM to automatically renew private certificates, you must give
|
|
2124
|
-
* the ACM service principal all available permissions (<code>IssueCertificate</code>,
|
|
2125
|
-
* <code>GetCertificate</code>, and <code>ListPermissions</code>). Permissions can be
|
|
2126
|
-
* assigned with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreatePermission.html">CreatePermission</a> action,
|
|
2127
|
-
* removed with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePermission.html">DeletePermission</a> action, and
|
|
2128
|
-
* listed with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListPermissions.html">ListPermissions</a> action.</p>
|
|
1510
|
+
* <p>Permissions designate which private CA actions can be performed by an Amazon Web Services service or entity. In order for ACM to automatically renew private certificates, you must give the ACM service principal all available permissions (<code>IssueCertificate</code>, <code>GetCertificate</code>, and <code>ListPermissions</code>). Permissions can be assigned with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreatePermission.html">CreatePermission</a> action, removed with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePermission.html">DeletePermission</a> action, and listed with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListPermissions.html">ListPermissions</a> action.</p>
|
|
2129
1511
|
* @public
|
|
2130
1512
|
*/
|
|
2131
1513
|
export interface Permission {
|
|
2132
1514
|
/**
|
|
2133
|
-
* <p>The Amazon Resource Number (ARN) of the private CA from which the permission was
|
|
2134
|
-
* issued.</p>
|
|
1515
|
+
* <p>The Amazon Resource Number (ARN) of the private CA from which the permission was issued.</p>
|
|
2135
1516
|
* @public
|
|
2136
1517
|
*/
|
|
2137
1518
|
CertificateAuthorityArn?: string | undefined;
|
|
@@ -2141,8 +1522,7 @@ export interface Permission {
|
|
|
2141
1522
|
*/
|
|
2142
1523
|
CreatedAt?: Date | undefined;
|
|
2143
1524
|
/**
|
|
2144
|
-
* <p>The Amazon Web Services service or entity that holds the permission. At this time, the only valid
|
|
2145
|
-
* principal is <code>acm.amazonaws.com</code>.</p>
|
|
1525
|
+
* <p>The Amazon Web Services service or entity that holds the permission. At this time, the only valid principal is <code>acm.amazonaws.com</code>.</p>
|
|
2146
1526
|
* @public
|
|
2147
1527
|
*/
|
|
2148
1528
|
Principal?: string | undefined;
|
|
@@ -2167,14 +1547,12 @@ export interface Permission {
|
|
|
2167
1547
|
*/
|
|
2168
1548
|
export interface ListPermissionsResponse {
|
|
2169
1549
|
/**
|
|
2170
|
-
* <p>When the list is truncated, this value is present and should be used for the <b>NextToken</b> parameter in a subsequent pagination request.
|
|
2171
|
-
* </p>
|
|
1550
|
+
* <p>When the list is truncated, this value is present and should be used for the <b>NextToken</b> parameter in a subsequent pagination request. </p>
|
|
2172
1551
|
* @public
|
|
2173
1552
|
*/
|
|
2174
1553
|
NextToken?: string | undefined;
|
|
2175
1554
|
/**
|
|
2176
|
-
* <p>Summary information about each permission assigned by the specified private CA,
|
|
2177
|
-
* including the action enabled, the policy provided, and the time of creation.</p>
|
|
1555
|
+
* <p>Summary information about each permission assigned by the specified private CA, including the action enabled, the policy provided, and the time of creation.</p>
|
|
2178
1556
|
* @public
|
|
2179
1557
|
*/
|
|
2180
1558
|
Permissions?: Permission[] | undefined;
|
|
@@ -2184,26 +1562,17 @@ export interface ListPermissionsResponse {
|
|
|
2184
1562
|
*/
|
|
2185
1563
|
export interface ListTagsRequest {
|
|
2186
1564
|
/**
|
|
2187
|
-
* <p>Use this parameter when paginating results to specify the maximum number of items to
|
|
2188
|
-
* return in the response. If additional items exist beyond the number you specify, the
|
|
2189
|
-
* <b>NextToken</b> element is sent in the response. Use this
|
|
2190
|
-
* <b>NextToken</b> value in a subsequent request to retrieve
|
|
2191
|
-
* additional items.</p>
|
|
1565
|
+
* <p>Use this parameter when paginating results to specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the <b>NextToken</b> element is sent in the response. Use this <b>NextToken</b> value in a subsequent request to retrieve additional items.</p>
|
|
2192
1566
|
* @public
|
|
2193
1567
|
*/
|
|
2194
1568
|
MaxResults?: number | undefined;
|
|
2195
1569
|
/**
|
|
2196
|
-
* <p>Use this parameter when paginating results in a subsequent request after you receive a
|
|
2197
|
-
* response with truncated results. Set it to the value of <b>NextToken</b> from the response you just received.</p>
|
|
1570
|
+
* <p>Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of <b>NextToken</b> from the response you just received.</p>
|
|
2198
1571
|
* @public
|
|
2199
1572
|
*/
|
|
2200
1573
|
NextToken?: string | undefined;
|
|
2201
1574
|
/**
|
|
2202
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. This must be of the form: </p>
|
|
2203
|
-
* <p>
|
|
2204
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
2205
|
-
* </code>
|
|
2206
|
-
* </p>
|
|
1575
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
2207
1576
|
* @public
|
|
2208
1577
|
*/
|
|
2209
1578
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -2213,8 +1582,7 @@ export interface ListTagsRequest {
|
|
|
2213
1582
|
*/
|
|
2214
1583
|
export interface ListTagsResponse {
|
|
2215
1584
|
/**
|
|
2216
|
-
* <p>When the list is truncated, this value is present and should be used for the <b>NextToken</b> parameter in a subsequent pagination request.
|
|
2217
|
-
* </p>
|
|
1585
|
+
* <p>When the list is truncated, this value is present and should be used for the <b>NextToken</b> parameter in a subsequent pagination request. </p>
|
|
2218
1586
|
* @public
|
|
2219
1587
|
*/
|
|
2220
1588
|
NextToken?: string | undefined;
|
|
@@ -2229,18 +1597,12 @@ export interface ListTagsResponse {
|
|
|
2229
1597
|
*/
|
|
2230
1598
|
export interface PutPolicyRequest {
|
|
2231
1599
|
/**
|
|
2232
|
-
* <p>The Amazon Resource Number (ARN) of the private CA to associate with the policy. The
|
|
2233
|
-
* ARN of the CA can be found by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action.</p>
|
|
2234
|
-
* <p/>
|
|
1600
|
+
* <p>The Amazon Resource Number (ARN) of the private CA to associate with the policy. The ARN of the CA can be found by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action.</p> <p/>
|
|
2235
1601
|
* @public
|
|
2236
1602
|
*/
|
|
2237
1603
|
ResourceArn: string | undefined;
|
|
2238
1604
|
/**
|
|
2239
|
-
* <p>The path and file name of a JSON-formatted IAM policy to attach to the specified
|
|
2240
|
-
* private CA resource. If this policy does not contain all required statements or if it
|
|
2241
|
-
* includes any statement that is not allowed, the <code>PutPolicy</code> action returns an
|
|
2242
|
-
* <code>InvalidPolicyException</code>. For information about IAM policy and
|
|
2243
|
-
* statement structure, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json">Overview of JSON Policies</a>.</p>
|
|
1605
|
+
* <p>The path and file name of a JSON-formatted IAM policy to attach to the specified private CA resource. If this policy does not contain all required statements or if it includes any statement that is not allowed, the <code>PutPolicy</code> action returns an <code>InvalidPolicyException</code>. For information about IAM policy and statement structure, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json">Overview of JSON Policies</a>.</p>
|
|
2244
1606
|
* @public
|
|
2245
1607
|
*/
|
|
2246
1608
|
Policy: string | undefined;
|
|
@@ -2250,11 +1612,7 @@ export interface PutPolicyRequest {
|
|
|
2250
1612
|
*/
|
|
2251
1613
|
export interface RestoreCertificateAuthorityRequest {
|
|
2252
1614
|
/**
|
|
2253
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. This must be of the form: </p>
|
|
2254
|
-
* <p>
|
|
2255
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
2256
|
-
* </code>
|
|
2257
|
-
* </p>
|
|
1615
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a> action. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
2258
1616
|
* @public
|
|
2259
1617
|
*/
|
|
2260
1618
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -2294,27 +1652,12 @@ export type RevocationReason = (typeof RevocationReason)[keyof typeof Revocation
|
|
|
2294
1652
|
*/
|
|
2295
1653
|
export interface RevokeCertificateRequest {
|
|
2296
1654
|
/**
|
|
2297
|
-
* <p>Amazon Resource Name (ARN) of the private CA that issued the certificate to be
|
|
2298
|
-
* revoked. This must be of the form:</p>
|
|
2299
|
-
* <p>
|
|
2300
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
2301
|
-
* </code>
|
|
2302
|
-
* </p>
|
|
1655
|
+
* <p>Amazon Resource Name (ARN) of the private CA that issued the certificate to be revoked. This must be of the form:</p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
2303
1656
|
* @public
|
|
2304
1657
|
*/
|
|
2305
1658
|
CertificateAuthorityArn: string | undefined;
|
|
2306
1659
|
/**
|
|
2307
|
-
* <p>Serial number of the certificate to be revoked. This must be in hexadecimal format.
|
|
2308
|
-
* You can retrieve the serial number by calling <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificate.html">GetCertificate</a> with the Amazon
|
|
2309
|
-
* Resource Name (ARN) of the certificate you want and the ARN of your private CA. The
|
|
2310
|
-
* <b>GetCertificate</b> action retrieves the certificate in
|
|
2311
|
-
* the PEM format. You can use the following OpenSSL command to list the certificate in
|
|
2312
|
-
* text format and copy the hexadecimal serial number. </p>
|
|
2313
|
-
* <p>
|
|
2314
|
-
* <code>openssl x509 -in <i>file_path</i> -text -noout</code>
|
|
2315
|
-
* </p>
|
|
2316
|
-
* <p>You can also copy the serial number from the console or use the <a href="https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html">DescribeCertificate</a> action in the <i>Certificate Manager API
|
|
2317
|
-
* Reference</i>. </p>
|
|
1660
|
+
* <p>Serial number of the certificate to be revoked. This must be in hexadecimal format. You can retrieve the serial number by calling <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificate.html">GetCertificate</a> with the Amazon Resource Name (ARN) of the certificate you want and the ARN of your private CA. The <b>GetCertificate</b> action retrieves the certificate in the PEM format. You can use the following OpenSSL command to list the certificate in text format and copy the hexadecimal serial number. </p> <p> <code>openssl x509 -in <i>file_path</i> -text -noout</code> </p> <p>You can also copy the serial number from the console or use the <a href="https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html">DescribeCertificate</a> action in the <i>Certificate Manager API Reference</i>. </p>
|
|
2318
1661
|
* @public
|
|
2319
1662
|
*/
|
|
2320
1663
|
CertificateSerial: string | undefined;
|
|
@@ -2329,11 +1672,7 @@ export interface RevokeCertificateRequest {
|
|
|
2329
1672
|
*/
|
|
2330
1673
|
export interface TagCertificateAuthorityRequest {
|
|
2331
1674
|
/**
|
|
2332
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p>
|
|
2333
|
-
* <p>
|
|
2334
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
2335
|
-
* </code>
|
|
2336
|
-
* </p>
|
|
1675
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
2337
1676
|
* @public
|
|
2338
1677
|
*/
|
|
2339
1678
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -2344,8 +1683,7 @@ export interface TagCertificateAuthorityRequest {
|
|
|
2344
1683
|
Tags: Tag[] | undefined;
|
|
2345
1684
|
}
|
|
2346
1685
|
/**
|
|
2347
|
-
* <p>You can associate up to 50 tags with a private CA. Exception information is contained
|
|
2348
|
-
* in the exception message field.</p>
|
|
1686
|
+
* <p>You can associate up to 50 tags with a private CA. Exception information is contained in the exception message field.</p>
|
|
2349
1687
|
* @public
|
|
2350
1688
|
*/
|
|
2351
1689
|
export declare class TooManyTagsException extends __BaseException {
|
|
@@ -2361,11 +1699,7 @@ export declare class TooManyTagsException extends __BaseException {
|
|
|
2361
1699
|
*/
|
|
2362
1700
|
export interface UntagCertificateAuthorityRequest {
|
|
2363
1701
|
/**
|
|
2364
|
-
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p>
|
|
2365
|
-
* <p>
|
|
2366
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
2367
|
-
* </code>
|
|
2368
|
-
* </p>
|
|
1702
|
+
* <p>The Amazon Resource Name (ARN) that was returned when you called <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html">CreateCertificateAuthority</a>. This must be of the form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
2369
1703
|
* @public
|
|
2370
1704
|
*/
|
|
2371
1705
|
CertificateAuthorityArn: string | undefined;
|
|
@@ -2380,43 +1714,12 @@ export interface UntagCertificateAuthorityRequest {
|
|
|
2380
1714
|
*/
|
|
2381
1715
|
export interface UpdateCertificateAuthorityRequest {
|
|
2382
1716
|
/**
|
|
2383
|
-
* <p>Amazon Resource Name (ARN) of the private CA that issued the certificate to be
|
|
2384
|
-
* revoked. This must be of the form:</p>
|
|
2385
|
-
* <p>
|
|
2386
|
-
* <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i>
|
|
2387
|
-
* </code>
|
|
2388
|
-
* </p>
|
|
1717
|
+
* <p>Amazon Resource Name (ARN) of the private CA that issued the certificate to be revoked. This must be of the form:</p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code> </p>
|
|
2389
1718
|
* @public
|
|
2390
1719
|
*/
|
|
2391
1720
|
CertificateAuthorityArn: string | undefined;
|
|
2392
1721
|
/**
|
|
2393
|
-
* <p>Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. If you don't supply this parameter, existing capibilites remain unchanged. For more
|
|
2394
|
-
* information, see the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html">OcspConfiguration</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a> types.</p>
|
|
2395
|
-
* <p>The following requirements apply to revocation configurations.</p>
|
|
2396
|
-
* <ul>
|
|
2397
|
-
* <li>
|
|
2398
|
-
* <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code>
|
|
2399
|
-
* parameter, and will fail if other parameters such as <code>CustomCname</code> or
|
|
2400
|
-
* <code>ExpirationInDays</code> are included.</p>
|
|
2401
|
-
* </li>
|
|
2402
|
-
* <li>
|
|
2403
|
-
* <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to
|
|
2404
|
-
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">Amazon S3
|
|
2405
|
-
* bucket naming rules</a>.</p>
|
|
2406
|
-
* </li>
|
|
2407
|
-
* <li>
|
|
2408
|
-
* <p>A configuration containing a custom Canonical
|
|
2409
|
-
* Name (CNAME) parameter for CRLs or OCSP must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions
|
|
2410
|
-
* on the use of special characters in a CNAME. </p>
|
|
2411
|
-
* </li>
|
|
2412
|
-
* <li>
|
|
2413
|
-
* <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a
|
|
2414
|
-
* protocol prefix such as "http://" or "https://".</p>
|
|
2415
|
-
* </li>
|
|
2416
|
-
* </ul>
|
|
2417
|
-
* <important>
|
|
2418
|
-
* <p> If you update the <code>S3BucketName</code> of <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a>, you can break revocation for existing certificates. In other words, if you call <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> to update the CRL configuration's S3 bucket name, Amazon Web Services Private CA only writes CRLs to the new S3 bucket. Certificates issued prior to this point will have the old S3 bucket name in your CRL Distribution Point (CDP) extension, essentially breaking revocation. If you must update the S3 bucket, you'll need to reissue old certificates to keep the revocation working. Alternatively, you can use a <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html#privateca-Type-CrlConfiguration-CustomCname">CustomCname</a> in your CRL configuration if you might need to change the S3 bucket name in the future.</p>
|
|
2419
|
-
* </important>
|
|
1722
|
+
* <p>Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. If you don't supply this parameter, existing capibilites remain unchanged. For more information, see the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_OcspConfiguration.html">OcspConfiguration</a> and <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a> types.</p> <p>The following requirements apply to revocation configurations.</p> <ul> <li> <p>A configuration disabling CRLs or OCSP must contain only the <code>Enabled=False</code> parameter, and will fail if other parameters such as <code>CustomCname</code> or <code>ExpirationInDays</code> are included.</p> </li> <li> <p>In a CRL configuration, the <code>S3BucketName</code> parameter must conform to <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">Amazon S3 bucket naming rules</a>.</p> </li> <li> <p>A configuration containing a custom Canonical Name (CNAME) parameter for CRLs or OCSP must conform to <a href="https://www.ietf.org/rfc/rfc2396.txt">RFC2396</a> restrictions on the use of special characters in a CNAME. </p> </li> <li> <p>In a CRL or OCSP configuration, the value of a CNAME parameter must not include a protocol prefix such as "http://" or "https://".</p> </li> </ul> <important> <p> If you update the <code>S3BucketName</code> of <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html">CrlConfiguration</a>, you can break revocation for existing certificates. In other words, if you call <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html">UpdateCertificateAuthority</a> to update the CRL configuration's S3 bucket name, Amazon Web Services Private CA only writes CRLs to the new S3 bucket. Certificates issued prior to this point will have the old S3 bucket name in your CRL Distribution Point (CDP) extension, essentially breaking revocation. If you must update the S3 bucket, you'll need to reissue old certificates to keep the revocation working. Alternatively, you can use a <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CrlConfiguration.html#privateca-Type-CrlConfiguration-CustomCname">CustomCname</a> in your CRL configuration if you might need to change the S3 bucket name in the future.</p> </important>
|
|
2420
1723
|
* @public
|
|
2421
1724
|
*/
|
|
2422
1725
|
RevocationConfiguration?: RevocationConfiguration | undefined;
|