Docs Packages
  1. Packages
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. certificateauthority
  5. CaPool
Google Cloud Classic v6.58.0 published on Tuesday, Jun 6, 2023 by Pulumi
pulumi/pulumi-gcp

gcp.certificateauthority.CaPool

Explore with Pulumi AI

gcp logo
Google Cloud Classic v6.58.0 published on Tuesday, Jun 6, 2023 by Pulumi
pulumi/pulumi-gcp

    A CaPool represents a group of CertificateAuthorities that form a trust anchor. A CaPool can be used to manage issuance policies for one or more CertificateAuthority resources and to rotate CA certificates in and out of the trust anchor.

    Example Usage

    Privateca Capool Basic

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var @default = new Gcp.CertificateAuthority.CaPool("default", new()
    {
        Labels = 
        {
            { "foo", "bar" },
        },
        Location = "us-central1",
        PublishingOptions = new Gcp.CertificateAuthority.Inputs.CaPoolPublishingOptionsArgs
        {
            PublishCaCert = true,
            PublishCrl = true,
        },
        Tier = "ENTERPRISE",
    });

});

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/certificateauthority"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := certificateauthority.NewCaPool(ctx, "default", &certificateauthority.CaPoolArgs{
			Labels: pulumi.StringMap{
				"foo": pulumi.String("bar"),
			},
			Location: pulumi.String("us-central1"),
			PublishingOptions: &certificateauthority.CaPoolPublishingOptionsArgs{
				PublishCaCert: pulumi.Bool(true),
				PublishCrl:    pulumi.Bool(true),
			},
			Tier: pulumi.String("ENTERPRISE"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.certificateauthority.CaPool;
import com.pulumi.gcp.certificateauthority.CaPoolArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolPublishingOptionsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new CaPool("default", CaPoolArgs.builder()        
            .labels(Map.of("foo", "bar"))
            .location("us-central1")
            .publishingOptions(CaPoolPublishingOptionsArgs.builder()
                .publishCaCert(true)
                .publishCrl(true)
                .build())
            .tier("ENTERPRISE")
            .build());

    }
}

    import pulumi
import pulumi_gcp as gcp

default = gcp.certificateauthority.CaPool("default",
    labels={
        "foo": "bar",
    },
    location="us-central1",
    publishing_options=gcp.certificateauthority.CaPoolPublishingOptionsArgs(
        publish_ca_cert=True,
        publish_crl=True,
    ),
    tier="ENTERPRISE")

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const _default = new gcp.certificateauthority.CaPool("default", {
    labels: {
        foo: "bar",
    },
    location: "us-central1",
    publishingOptions: {
        publishCaCert: true,
        publishCrl: true,
    },
    tier: "ENTERPRISE",
});

    resources:
  default:
    type: gcp:certificateauthority:CaPool
    properties:
      labels:
        foo: bar
      location: us-central1
      publishingOptions:
        publishCaCert: true
        publishCrl: true
      tier: ENTERPRISE

    Privateca Capool All Fields

    Coming soon!

    Coming soon!

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.certificateauthority.CaPool;
import com.pulumi.gcp.certificateauthority.CaPoolArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyAllowedIssuanceModesArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesNameConstraintsArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyIdentityConstraintsArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolPublishingOptionsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new CaPool("default", CaPoolArgs.builder()        
            .issuancePolicy(CaPoolIssuancePolicyArgs.builder()
                .allowedIssuanceModes(CaPoolIssuancePolicyAllowedIssuanceModesArgs.builder()
                    .allowConfigBasedIssuance(true)
                    .allowCsrBasedIssuance(true)
                    .build())
                .allowedKeyTypes(                
                    CaPoolIssuancePolicyAllowedKeyTypeArgs.builder()
                        .ellipticCurve(CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgs.builder()
                            .signatureAlgorithm("ECDSA_P256")
                            .build())
                        .build(),
                    CaPoolIssuancePolicyAllowedKeyTypeArgs.builder()
                        .rsa(CaPoolIssuancePolicyAllowedKeyTypeRsaArgs.builder()
                            .maxModulusSize(10)
                            .minModulusSize(5)
                            .build())
                        .build())
                .baselineValues(CaPoolIssuancePolicyBaselineValuesArgs.builder()
                    .additionalExtensions(CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgs.builder()
                        .critical(true)
                        .objectId(CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgs.builder()
                            .objectIdPath(                            
                                1,
                                7)
                            .build())
                        .value("asdf")
                        .build())
                    .aiaOcspServers("example.com")
                    .caOptions(CaPoolIssuancePolicyBaselineValuesCaOptionsArgs.builder()
                        .isCa(true)
                        .maxIssuerPathLength(10)
                        .build())
                    .keyUsage(CaPoolIssuancePolicyBaselineValuesKeyUsageArgs.builder()
                        .baseKeyUsage(CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs.builder()
                            .certSign(false)
                            .contentCommitment(true)
                            .crlSign(true)
                            .dataEncipherment(true)
                            .decipherOnly(true)
                            .digitalSignature(true)
                            .keyAgreement(true)
                            .keyEncipherment(false)
                            .build())
                        .extendedKeyUsage(CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs.builder()
                            .clientAuth(false)
                            .codeSigning(true)
                            .emailProtection(true)
                            .serverAuth(true)
                            .timeStamping(true)
                            .build())
                        .build())
                    .nameConstraints(CaPoolIssuancePolicyBaselineValuesNameConstraintsArgs.builder()
                        .critical(true)
                        .excludedDnsNames(                        
                            "*.deny.example1.com",
                            "*.deny.example2.com")
                        .excludedEmailAddresses(                        
                            ".deny.example1.com",
                            ".deny.example2.com")
                        .excludedIpRanges(                        
                            "10.1.1.0/24",
                            "11.1.1.0/24")
                        .excludedUris(                        
                            ".deny.example1.com",
                            ".deny.example2.com")
                        .permittedDnsNames(                        
                            "*.example1.com",
                            "*.example2.com")
                        .permittedEmailAddresses(                        
                            ".example1.com",
                            ".example2.com")
                        .permittedIpRanges(                        
                            "10.0.0.0/8",
                            "11.0.0.0/8")
                        .permittedUris(                        
                            ".example1.com",
                            ".example2.com")
                        .build())
                    .policyIds(                    
                        CaPoolIssuancePolicyBaselineValuesPolicyIdArgs.builder()
                            .objectIdPath(                            
                                1,
                                5)
                            .build(),
                        CaPoolIssuancePolicyBaselineValuesPolicyIdArgs.builder()
                            .objectIdPath(                            
                                1,
                                5,
                                7)
                            .build())
                    .build())
                .identityConstraints(CaPoolIssuancePolicyIdentityConstraintsArgs.builder()
                    .allowSubjectAltNamesPassthrough(true)
                    .allowSubjectPassthrough(true)
                    .celExpression(CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgs.builder()
                        .expression("subject_alt_names.all(san, san.type == DNS || san.type == EMAIL )")
                        .title("My title")
                        .build())
                    .build())
                .maximumLifetime("50000s")
                .build())
            .labels(Map.of("foo", "bar"))
            .location("us-central1")
            .publishingOptions(CaPoolPublishingOptionsArgs.builder()
                .encodingFormat("PEM")
                .publishCaCert(false)
                .publishCrl(true)
                .build())
            .tier("ENTERPRISE")
            .build());

    }
}

    Coming soon!

    Coming soon!

    resources:
  default:
    type: gcp:certificateauthority:CaPool
    properties:
      issuancePolicy:
        allowedIssuanceModes:
          allowConfigBasedIssuance: true
          allowCsrBasedIssuance: true
        allowedKeyTypes:
          - ellipticCurve:
              signatureAlgorithm: ECDSA_P256
          - rsa:
              maxModulusSize: 10
              minModulusSize: 5
        baselineValues:
          additionalExtensions:
            - critical: true
              objectId:
                objectIdPath:
                  - 1
                  - 7
              value: asdf
          aiaOcspServers:
            - example.com
          caOptions:
            isCa: true
            maxIssuerPathLength: 10
          keyUsage:
            baseKeyUsage:
              certSign: false
              contentCommitment: true
              crlSign: true
              dataEncipherment: true
              decipherOnly: true
              digitalSignature: true
              keyAgreement: true
              keyEncipherment: false
            extendedKeyUsage:
              clientAuth: false
              codeSigning: true
              emailProtection: true
              serverAuth: true
              timeStamping: true
          nameConstraints:
            critical: true
            excludedDnsNames:
              - '*.deny.example1.com'
              - '*.deny.example2.com'
            excludedEmailAddresses:
              - .deny.example1.com
              - .deny.example2.com
            excludedIpRanges:
              - 10.1.1.0/24
              - 11.1.1.0/24
            excludedUris:
              - .deny.example1.com
              - .deny.example2.com
            permittedDnsNames:
              - '*.example1.com'
              - '*.example2.com'
            permittedEmailAddresses:
              - .example1.com
              - .example2.com
            permittedIpRanges:
              - 10.0.0.0/8
              - 11.0.0.0/8
            permittedUris:
              - .example1.com
              - .example2.com
          policyIds:
            - objectIdPath:
                - 1
                - 5
            - objectIdPath:
                - 1
                - 5
                - 7
        identityConstraints:
          allowSubjectAltNamesPassthrough: true
          allowSubjectPassthrough: true
          celExpression:
            expression: subject_alt_names.all(san, san.type == DNS || san.type == EMAIL )
            title: My title
        maximumLifetime: 50000s
      labels:
        foo: bar
      location: us-central1
      publishingOptions:
        encodingFormat: PEM
        publishCaCert: false
        publishCrl: true
      tier: ENTERPRISE

    Create CaPool Resource

    new CaPool(name: string, args: CaPoolArgs, opts?: CustomResourceOptions);
    @overload
def CaPool(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           issuance_policy: Optional[CaPoolIssuancePolicyArgs] = None,
           labels: Optional[Mapping[str, str]] = None,
           location: Optional[str] = None,
           name: Optional[str] = None,
           project: Optional[str] = None,
           publishing_options: Optional[CaPoolPublishingOptionsArgs] = None,
           tier: Optional[str] = None)
@overload
def CaPool(resource_name: str,
           args: CaPoolArgs,
           opts: Optional[ResourceOptions] = None)
    func NewCaPool(ctx *Context, name string, args CaPoolArgs, opts ...ResourceOption) (*CaPool, error)
    public CaPool(string name, CaPoolArgs args, CustomResourceOptions? opts = null)
    public CaPool(String name, CaPoolArgs args)
public CaPool(String name, CaPoolArgs args, CustomResourceOptions options)

    type: gcp:certificateauthority:CaPool
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CaPoolArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CaPoolArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CaPoolArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CaPoolArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CaPoolArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    CaPool Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The CaPool resource accepts the following input properties:

    Location string

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    Tier string

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    IssuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    Labels Dictionary<string, string>

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    Name string

    The name for this CaPool.

    Project string

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    PublishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    Location string

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    Tier string

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    IssuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    Labels map[string]string

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    Name string

    The name for this CaPool.

    Project string

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    PublishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    location String

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    tier String

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels Map<String,String>

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    name String

    The name for this CaPool.

    project String

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    location string

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    tier string

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels {[key: string]: string}

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    name string

    The name for this CaPool.

    project string

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    location str

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    tier str

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuance_policy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels Mapping[str, str]

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    name str

    The name for this CaPool.

    project str

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishing_options CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    location String

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    tier String

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuancePolicy Property Map

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels Map<String>

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    name String

    The name for this CaPool.

    project String

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishingOptions Property Map

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CaPool resource produces the following output properties:

    Id string

    The provider-assigned unique ID for this managed resource.

    Id string

    The provider-assigned unique ID for this managed resource.

    id String

    The provider-assigned unique ID for this managed resource.

    id string

    The provider-assigned unique ID for this managed resource.

    id str

    The provider-assigned unique ID for this managed resource.

    id String

    The provider-assigned unique ID for this managed resource.

    Look up Existing CaPool Resource

    Get an existing CaPool resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: CaPoolState, opts?: CustomResourceOptions): CaPool
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        issuance_policy: Optional[CaPoolIssuancePolicyArgs] = None,
        labels: Optional[Mapping[str, str]] = None,
        location: Optional[str] = None,
        name: Optional[str] = None,
        project: Optional[str] = None,
        publishing_options: Optional[CaPoolPublishingOptionsArgs] = None,
        tier: Optional[str] = None) -> CaPool
    func GetCaPool(ctx *Context, name string, id IDInput, state *CaPoolState, opts ...ResourceOption) (*CaPool, error)
    public static CaPool Get(string name, Input<string> id, CaPoolState? state, CustomResourceOptions? opts = null)
    public static CaPool get(String name, Output<String> id, CaPoolState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    IssuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    Labels Dictionary<string, string>

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    Location string

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    Name string

    The name for this CaPool.

    Project string

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    PublishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    Tier string

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    IssuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    Labels map[string]string

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    Location string

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    Name string

    The name for this CaPool.

    Project string

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    PublishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    Tier string

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels Map<String,String>

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    location String

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    name String

    The name for this CaPool.

    project String

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    tier String

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuancePolicy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels {[key: string]: string}

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    location string

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    name string

    The name for this CaPool.

    project string

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishingOptions CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    tier string

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuance_policy CaPoolIssuancePolicyArgs

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels Mapping[str, str]

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    location str

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    name str

    The name for this CaPool.

    project str

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishing_options CaPoolPublishingOptionsArgs

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    tier str

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    issuancePolicy Property Map

    The IssuancePolicy to control how Certificates will be issued from this CaPool. Structure is documented below.

    labels Map<String>

    Labels with user-defined metadata. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

    location String

    Location of the CaPool. A full list of valid locations can be found by running gcloud privateca locations list.

    name String

    The name for this CaPool.

    project String

    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    publishingOptions Property Map

    The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. Structure is documented below.

    tier String

    The Tier of this CaPool. Possible values are: ENTERPRISE, DEVOPS.

    Supporting Types

    CaPoolIssuancePolicy

    AllowedIssuanceModes CaPoolIssuancePolicyAllowedIssuanceModes

    IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool. Structure is documented below.

    AllowedKeyTypes List<CaPoolIssuancePolicyAllowedKeyType>

    If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used. Structure is documented below.

    BaselineValues CaPoolIssuancePolicyBaselineValues

    A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate issuance request will fail. Structure is documented below.

    IdentityConstraints CaPoolIssuancePolicyIdentityConstraints

    Describes constraints on identities that may appear in Certificates issued through this CaPool. If this is omitted, then this CaPool will not add restrictions on a certificate's identity. Structure is documented below.

    MaximumLifetime string

    The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.

    AllowedIssuanceModes CaPoolIssuancePolicyAllowedIssuanceModes

    IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool. Structure is documented below.

    AllowedKeyTypes []CaPoolIssuancePolicyAllowedKeyType

    If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used. Structure is documented below.

    BaselineValues CaPoolIssuancePolicyBaselineValues

    A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate issuance request will fail. Structure is documented below.

    IdentityConstraints CaPoolIssuancePolicyIdentityConstraints

    Describes constraints on identities that may appear in Certificates issued through this CaPool. If this is omitted, then this CaPool will not add restrictions on a certificate's identity. Structure is documented below.

    MaximumLifetime string

    The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.

    allowedIssuanceModes CaPoolIssuancePolicyAllowedIssuanceModes

    IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool. Structure is documented below.

    allowedKeyTypes List<CaPoolIssuancePolicyAllowedKeyType>

    If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used. Structure is documented below.

    baselineValues CaPoolIssuancePolicyBaselineValues

    A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate issuance request will fail. Structure is documented below.

    identityConstraints CaPoolIssuancePolicyIdentityConstraints

    Describes constraints on identities that may appear in Certificates issued through this CaPool. If this is omitted, then this CaPool will not add restrictions on a certificate's identity. Structure is documented below.

    maximumLifetime String

    The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.

    allowedIssuanceModes CaPoolIssuancePolicyAllowedIssuanceModes

    IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool. Structure is documented below.

    allowedKeyTypes CaPoolIssuancePolicyAllowedKeyType[]

    If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used. Structure is documented below.

    baselineValues CaPoolIssuancePolicyBaselineValues

    A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate issuance request will fail. Structure is documented below.

    identityConstraints CaPoolIssuancePolicyIdentityConstraints

    Describes constraints on identities that may appear in Certificates issued through this CaPool. If this is omitted, then this CaPool will not add restrictions on a certificate's identity. Structure is documented below.

    maximumLifetime string

    The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.

    allowed_issuance_modes CaPoolIssuancePolicyAllowedIssuanceModes

    IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool. Structure is documented below.

    allowed_key_types Sequence[CaPoolIssuancePolicyAllowedKeyType]

    If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used. Structure is documented below.

    baseline_values CaPoolIssuancePolicyBaselineValues

    A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate issuance request will fail. Structure is documented below.

    identity_constraints CaPoolIssuancePolicyIdentityConstraints

    Describes constraints on identities that may appear in Certificates issued through this CaPool. If this is omitted, then this CaPool will not add restrictions on a certificate's identity. Structure is documented below.

    maximum_lifetime str

    The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.

    allowedIssuanceModes Property Map

    IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool. Structure is documented below.

    allowedKeyTypes List<Property Map>

    If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used. Structure is documented below.

    baselineValues Property Map

    A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate issuance request will fail. Structure is documented below.

    identityConstraints Property Map

    Describes constraints on identities that may appear in Certificates issued through this CaPool. If this is omitted, then this CaPool will not add restrictions on a certificate's identity. Structure is documented below.

    maximumLifetime String

    The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.

    CaPoolIssuancePolicyAllowedIssuanceModes

    AllowConfigBasedIssuance bool

    When true, allows callers to create Certificates by specifying a CertificateConfig.

    AllowCsrBasedIssuance bool

    When true, allows callers to create Certificates by specifying a CSR.

    AllowConfigBasedIssuance bool

    When true, allows callers to create Certificates by specifying a CertificateConfig.

    AllowCsrBasedIssuance bool

    When true, allows callers to create Certificates by specifying a CSR.

    allowConfigBasedIssuance Boolean

    When true, allows callers to create Certificates by specifying a CertificateConfig.

    allowCsrBasedIssuance Boolean

    When true, allows callers to create Certificates by specifying a CSR.

    allowConfigBasedIssuance boolean

    When true, allows callers to create Certificates by specifying a CertificateConfig.

    allowCsrBasedIssuance boolean

    When true, allows callers to create Certificates by specifying a CSR.

    allow_config_based_issuance bool

    When true, allows callers to create Certificates by specifying a CertificateConfig.

    allow_csr_based_issuance bool

    When true, allows callers to create Certificates by specifying a CSR.

    allowConfigBasedIssuance Boolean

    When true, allows callers to create Certificates by specifying a CertificateConfig.

    allowCsrBasedIssuance Boolean

    When true, allows callers to create Certificates by specifying a CSR.

    CaPoolIssuancePolicyAllowedKeyType

    EllipticCurve CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve

    Represents an allowed Elliptic Curve key type. Structure is documented below.

    Rsa CaPoolIssuancePolicyAllowedKeyTypeRsa

    Describes an RSA key that may be used in a Certificate issued from a CaPool. Structure is documented below.

    EllipticCurve CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve

    Represents an allowed Elliptic Curve key type. Structure is documented below.

    Rsa CaPoolIssuancePolicyAllowedKeyTypeRsa

    Describes an RSA key that may be used in a Certificate issued from a CaPool. Structure is documented below.

    ellipticCurve CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve

    Represents an allowed Elliptic Curve key type. Structure is documented below.

    rsa CaPoolIssuancePolicyAllowedKeyTypeRsa

    Describes an RSA key that may be used in a Certificate issued from a CaPool. Structure is documented below.

    ellipticCurve CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve

    Represents an allowed Elliptic Curve key type. Structure is documented below.

    rsa CaPoolIssuancePolicyAllowedKeyTypeRsa

    Describes an RSA key that may be used in a Certificate issued from a CaPool. Structure is documented below.

    elliptic_curve CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve

    Represents an allowed Elliptic Curve key type. Structure is documented below.

    rsa CaPoolIssuancePolicyAllowedKeyTypeRsa

    Describes an RSA key that may be used in a Certificate issued from a CaPool. Structure is documented below.

    ellipticCurve Property Map

    Represents an allowed Elliptic Curve key type. Structure is documented below.

    rsa Property Map

    Describes an RSA key that may be used in a Certificate issued from a CaPool. Structure is documented below.

    CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve

    SignatureAlgorithm string

    The algorithm used. Possible values are: ECDSA_P256, ECDSA_P384, EDDSA_25519.

    SignatureAlgorithm string

    The algorithm used. Possible values are: ECDSA_P256, ECDSA_P384, EDDSA_25519.

    signatureAlgorithm String

    The algorithm used. Possible values are: ECDSA_P256, ECDSA_P384, EDDSA_25519.

    signatureAlgorithm string

    The algorithm used. Possible values are: ECDSA_P256, ECDSA_P384, EDDSA_25519.

    signature_algorithm str

    The algorithm used. Possible values are: ECDSA_P256, ECDSA_P384, EDDSA_25519.

    signatureAlgorithm String

    The algorithm used. Possible values are: ECDSA_P256, ECDSA_P384, EDDSA_25519.

    CaPoolIssuancePolicyAllowedKeyTypeRsa

    MaxModulusSize string

    The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.

    MinModulusSize string

    The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.

    MaxModulusSize string

    The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.

    MinModulusSize string

    The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.

    maxModulusSize String

    The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.

    minModulusSize String

    The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.

    maxModulusSize string

    The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.

    minModulusSize string

    The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.

    max_modulus_size str

    The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.

    min_modulus_size str

    The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.

    maxModulusSize String

    The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.

    minModulusSize String

    The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.

    CaPoolIssuancePolicyBaselineValues

    CaOptions CaPoolIssuancePolicyBaselineValuesCaOptions

    Describes values that are relevant in a CA certificate. Structure is documented below.

    KeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsage

    Indicates the intended use for keys that correspond to a certificate. Structure is documented below.

    AdditionalExtensions List<CaPoolIssuancePolicyBaselineValuesAdditionalExtension>

    Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs. Structure is documented below.

    AiaOcspServers List<string>

    Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

    NameConstraints CaPoolIssuancePolicyBaselineValuesNameConstraints

    Describes the X.509 name constraints extension. Structure is documented below.

    PolicyIds List<CaPoolIssuancePolicyBaselineValuesPolicyId>

    Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. Structure is documented below.

    CaOptions CaPoolIssuancePolicyBaselineValuesCaOptions

    Describes values that are relevant in a CA certificate. Structure is documented below.

    KeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsage

    Indicates the intended use for keys that correspond to a certificate. Structure is documented below.

    AdditionalExtensions []CaPoolIssuancePolicyBaselineValuesAdditionalExtension

    Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs. Structure is documented below.

    AiaOcspServers []string

    Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

    NameConstraints CaPoolIssuancePolicyBaselineValuesNameConstraints

    Describes the X.509 name constraints extension. Structure is documented below.

    PolicyIds []CaPoolIssuancePolicyBaselineValuesPolicyId

    Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. Structure is documented below.

    caOptions CaPoolIssuancePolicyBaselineValuesCaOptions

    Describes values that are relevant in a CA certificate. Structure is documented below.

    keyUsage CaPoolIssuancePolicyBaselineValuesKeyUsage

    Indicates the intended use for keys that correspond to a certificate. Structure is documented below.

    additionalExtensions List<CaPoolIssuancePolicyBaselineValuesAdditionalExtension>

    Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs. Structure is documented below.

    aiaOcspServers List<String>

    Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

    nameConstraints CaPoolIssuancePolicyBaselineValuesNameConstraints

    Describes the X.509 name constraints extension. Structure is documented below.

    policyIds List<CaPoolIssuancePolicyBaselineValuesPolicyId>

    Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. Structure is documented below.

    caOptions CaPoolIssuancePolicyBaselineValuesCaOptions

    Describes values that are relevant in a CA certificate. Structure is documented below.

    keyUsage CaPoolIssuancePolicyBaselineValuesKeyUsage

    Indicates the intended use for keys that correspond to a certificate. Structure is documented below.

    additionalExtensions CaPoolIssuancePolicyBaselineValuesAdditionalExtension[]

    Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs. Structure is documented below.

    aiaOcspServers string[]

    Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

    nameConstraints CaPoolIssuancePolicyBaselineValuesNameConstraints

    Describes the X.509 name constraints extension. Structure is documented below.

    policyIds CaPoolIssuancePolicyBaselineValuesPolicyId[]

    Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. Structure is documented below.

    ca_options CaPoolIssuancePolicyBaselineValuesCaOptions

    Describes values that are relevant in a CA certificate. Structure is documented below.

    key_usage CaPoolIssuancePolicyBaselineValuesKeyUsage

    Indicates the intended use for keys that correspond to a certificate. Structure is documented below.

    additional_extensions Sequence[CaPoolIssuancePolicyBaselineValuesAdditionalExtension]

    Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs. Structure is documented below.

    aia_ocsp_servers Sequence[str]

    Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

    name_constraints CaPoolIssuancePolicyBaselineValuesNameConstraints

    Describes the X.509 name constraints extension. Structure is documented below.

    policy_ids Sequence[CaPoolIssuancePolicyBaselineValuesPolicyId]

    Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. Structure is documented below.

    caOptions Property Map

    Describes values that are relevant in a CA certificate. Structure is documented below.

    keyUsage Property Map

    Indicates the intended use for keys that correspond to a certificate. Structure is documented below.

    additionalExtensions List<Property Map>

    Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs. Structure is documented below.

    aiaOcspServers List<String>

    Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

    nameConstraints Property Map

    Describes the X.509 name constraints extension. Structure is documented below.

    policyIds List<Property Map>

    Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. Structure is documented below.

    CaPoolIssuancePolicyBaselineValuesAdditionalExtension

    Critical bool

    Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

    ObjectId CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId

    Describes values that are relevant in a CA certificate. Structure is documented below.

    Value string

    The value of this X.509 extension. A base64-encoded string.

    Critical bool

    Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

    ObjectId CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId

    Describes values that are relevant in a CA certificate. Structure is documented below.

    Value string

    The value of this X.509 extension. A base64-encoded string.

    critical Boolean

    Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

    objectId CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId

    Describes values that are relevant in a CA certificate. Structure is documented below.

    value String

    The value of this X.509 extension. A base64-encoded string.

    critical boolean

    Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

    objectId CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId

    Describes values that are relevant in a CA certificate. Structure is documented below.

    value string

    The value of this X.509 extension. A base64-encoded string.

    critical bool

    Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

    object_id CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId

    Describes values that are relevant in a CA certificate. Structure is documented below.

    value str

    The value of this X.509 extension. A base64-encoded string.

    critical Boolean

    Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

    objectId Property Map

    Describes values that are relevant in a CA certificate. Structure is documented below.

    value String

    The value of this X.509 extension. A base64-encoded string.

    CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId

    ObjectIdPaths List<int>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    ObjectIdPaths []int

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths List<Integer>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths number[]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    object_id_paths Sequence[int]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths List<Number>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    CaPoolIssuancePolicyBaselineValuesCaOptions

    IsCa bool

    When true, the "CA" in Basic Constraints extension will be set to true.

    MaxIssuerPathLength int

    Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.

    NonCa bool

    When true, the "CA" in Basic Constraints extension will be set to false. If both is_ca and non_ca are unset, the extension will be omitted from the CA certificate.

    ZeroMaxIssuerPathLength bool

    When true, the "path length constraint" in Basic Constraints extension will be set to 0. if both max_issuer_path_length and zero_max_issuer_path_length are unset, the max path length will be omitted from the CA certificate.

    IsCa bool

    When true, the "CA" in Basic Constraints extension will be set to true.

    MaxIssuerPathLength int

    Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.

    NonCa bool

    When true, the "CA" in Basic Constraints extension will be set to false. If both is_ca and non_ca are unset, the extension will be omitted from the CA certificate.

    ZeroMaxIssuerPathLength bool

    When true, the "path length constraint" in Basic Constraints extension will be set to 0. if both max_issuer_path_length and zero_max_issuer_path_length are unset, the max path length will be omitted from the CA certificate.

    isCa Boolean

    When true, the "CA" in Basic Constraints extension will be set to true.

    maxIssuerPathLength Integer

    Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.

    nonCa Boolean

    When true, the "CA" in Basic Constraints extension will be set to false. If both is_ca and non_ca are unset, the extension will be omitted from the CA certificate.

    zeroMaxIssuerPathLength Boolean

    When true, the "path length constraint" in Basic Constraints extension will be set to 0. if both max_issuer_path_length and zero_max_issuer_path_length are unset, the max path length will be omitted from the CA certificate.

    isCa boolean

    When true, the "CA" in Basic Constraints extension will be set to true.

    maxIssuerPathLength number

    Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.

    nonCa boolean

    When true, the "CA" in Basic Constraints extension will be set to false. If both is_ca and non_ca are unset, the extension will be omitted from the CA certificate.

    zeroMaxIssuerPathLength boolean

    When true, the "path length constraint" in Basic Constraints extension will be set to 0. if both max_issuer_path_length and zero_max_issuer_path_length are unset, the max path length will be omitted from the CA certificate.

    is_ca bool

    When true, the "CA" in Basic Constraints extension will be set to true.

    max_issuer_path_length int

    Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.

    non_ca bool

    When true, the "CA" in Basic Constraints extension will be set to false. If both is_ca and non_ca are unset, the extension will be omitted from the CA certificate.

    zero_max_issuer_path_length bool

    When true, the "path length constraint" in Basic Constraints extension will be set to 0. if both max_issuer_path_length and zero_max_issuer_path_length are unset, the max path length will be omitted from the CA certificate.

    isCa Boolean

    When true, the "CA" in Basic Constraints extension will be set to true.

    maxIssuerPathLength Number

    Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.

    nonCa Boolean

    When true, the "CA" in Basic Constraints extension will be set to false. If both is_ca and non_ca are unset, the extension will be omitted from the CA certificate.

    zeroMaxIssuerPathLength Boolean

    When true, the "path length constraint" in Basic Constraints extension will be set to 0. if both max_issuer_path_length and zero_max_issuer_path_length are unset, the max path length will be omitted from the CA certificate.

    CaPoolIssuancePolicyBaselineValuesKeyUsage

    BaseKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    ExtendedKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    UnknownExtendedKeyUsages List<CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. Structure is documented below.

    BaseKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    ExtendedKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    UnknownExtendedKeyUsages []CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. Structure is documented below.

    baseKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    extendedKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    unknownExtendedKeyUsages List<CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. Structure is documented below.

    baseKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    extendedKeyUsage CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    unknownExtendedKeyUsages CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage[]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. Structure is documented below.

    base_key_usage CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    extended_key_usage CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage

    Describes high-level ways in which a key may be used. Structure is documented below.

    unknown_extended_key_usages Sequence[CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. Structure is documented below.

    baseKeyUsage Property Map

    Describes high-level ways in which a key may be used. Structure is documented below.

    extendedKeyUsage Property Map

    Describes high-level ways in which a key may be used. Structure is documented below.

    unknownExtendedKeyUsages List<Property Map>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. Structure is documented below.

    CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage

    CertSign bool

    The key may be used to sign certificates.

    ContentCommitment bool

    The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

    CrlSign bool

    The key may be used sign certificate revocation lists.

    DataEncipherment bool

    The key may be used to encipher data.

    DecipherOnly bool

    The key may be used to decipher only.

    DigitalSignature bool

    The key may be used for digital signatures.

    EncipherOnly bool

    The key may be used to encipher only.

    KeyAgreement bool

    The key may be used in a key agreement protocol.

    KeyEncipherment bool

    The key may be used to encipher other keys.

    CertSign bool

    The key may be used to sign certificates.

    ContentCommitment bool

    The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

    CrlSign bool

    The key may be used sign certificate revocation lists.

    DataEncipherment bool

    The key may be used to encipher data.

    DecipherOnly bool

    The key may be used to decipher only.

    DigitalSignature bool

    The key may be used for digital signatures.

    EncipherOnly bool

    The key may be used to encipher only.

    KeyAgreement bool

    The key may be used in a key agreement protocol.

    KeyEncipherment bool

    The key may be used to encipher other keys.

    certSign Boolean

    The key may be used to sign certificates.

    contentCommitment Boolean

    The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

    crlSign Boolean

    The key may be used sign certificate revocation lists.

    dataEncipherment Boolean

    The key may be used to encipher data.

    decipherOnly Boolean

    The key may be used to decipher only.

    digitalSignature Boolean

    The key may be used for digital signatures.

    encipherOnly Boolean

    The key may be used to encipher only.

    keyAgreement Boolean

    The key may be used in a key agreement protocol.

    keyEncipherment Boolean

    The key may be used to encipher other keys.

    certSign boolean

    The key may be used to sign certificates.

    contentCommitment boolean

    The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

    crlSign boolean

    The key may be used sign certificate revocation lists.

    dataEncipherment boolean

    The key may be used to encipher data.

    decipherOnly boolean

    The key may be used to decipher only.

    digitalSignature boolean

    The key may be used for digital signatures.

    encipherOnly boolean

    The key may be used to encipher only.

    keyAgreement boolean

    The key may be used in a key agreement protocol.

    keyEncipherment boolean

    The key may be used to encipher other keys.

    cert_sign bool

    The key may be used to sign certificates.

    content_commitment bool

    The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

    crl_sign bool

    The key may be used sign certificate revocation lists.

    data_encipherment bool

    The key may be used to encipher data.

    decipher_only bool

    The key may be used to decipher only.

    digital_signature bool

    The key may be used for digital signatures.

    encipher_only bool

    The key may be used to encipher only.

    key_agreement bool

    The key may be used in a key agreement protocol.

    key_encipherment bool

    The key may be used to encipher other keys.

    certSign Boolean

    The key may be used to sign certificates.

    contentCommitment Boolean

    The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

    crlSign Boolean

    The key may be used sign certificate revocation lists.

    dataEncipherment Boolean

    The key may be used to encipher data.

    decipherOnly Boolean

    The key may be used to decipher only.

    digitalSignature Boolean

    The key may be used for digital signatures.

    encipherOnly Boolean

    The key may be used to encipher only.

    keyAgreement Boolean

    The key may be used in a key agreement protocol.

    keyEncipherment Boolean

    The key may be used to encipher other keys.

    CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage

    ClientAuth bool

    Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

    CodeSigning bool

    Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

    EmailProtection bool

    Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

    OcspSigning bool

    Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

    ServerAuth bool

    Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

    TimeStamping bool

    Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

    ClientAuth bool

    Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

    CodeSigning bool

    Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

    EmailProtection bool

    Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

    OcspSigning bool

    Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

    ServerAuth bool

    Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

    TimeStamping bool

    Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

    clientAuth Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

    codeSigning Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

    emailProtection Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

    ocspSigning Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

    serverAuth Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

    timeStamping Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

    clientAuth boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

    codeSigning boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

    emailProtection boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

    ocspSigning boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

    serverAuth boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

    timeStamping boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

    client_auth bool

    Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

    code_signing bool

    Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

    email_protection bool

    Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

    ocsp_signing bool

    Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

    server_auth bool

    Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

    time_stamping bool

    Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

    clientAuth Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

    codeSigning Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

    emailProtection Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

    ocspSigning Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

    serverAuth Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

    timeStamping Boolean

    Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

    CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage

    ObjectIdPaths List<int>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    ObjectIdPaths []int

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths List<Integer>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths number[]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    object_id_paths Sequence[int]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths List<Number>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    CaPoolIssuancePolicyBaselineValuesNameConstraints

    Critical bool

    Indicates whether or not the name constraints are marked critical.

    ExcludedDnsNames List<string>

    Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    ExcludedEmailAddresses List<string>

    Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    ExcludedIpRanges List<string>

    Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    ExcludedUris List<string>

    Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    PermittedDnsNames List<string>

    Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    PermittedEmailAddresses List<string>

    Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    PermittedIpRanges List<string>

    Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    PermittedUris List<string>

    Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    Critical bool

    Indicates whether or not the name constraints are marked critical.

    ExcludedDnsNames []string

    Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    ExcludedEmailAddresses []string

    Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    ExcludedIpRanges []string

    Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    ExcludedUris []string

    Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    PermittedDnsNames []string

    Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    PermittedEmailAddresses []string

    Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    PermittedIpRanges []string

    Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    PermittedUris []string

    Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    critical Boolean

    Indicates whether or not the name constraints are marked critical.

    excludedDnsNames List<String>

    Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    excludedEmailAddresses List<String>

    Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    excludedIpRanges List<String>

    Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    excludedUris List<String>

    Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    permittedDnsNames List<String>

    Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    permittedEmailAddresses List<String>

    Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    permittedIpRanges List<String>

    Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    permittedUris List<String>

    Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    critical boolean

    Indicates whether or not the name constraints are marked critical.

    excludedDnsNames string[]

    Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    excludedEmailAddresses string[]

    Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    excludedIpRanges string[]

    Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    excludedUris string[]

    Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    permittedDnsNames string[]

    Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    permittedEmailAddresses string[]

    Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    permittedIpRanges string[]

    Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    permittedUris string[]

    Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    critical bool

    Indicates whether or not the name constraints are marked critical.

    excluded_dns_names Sequence[str]

    Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    excluded_email_addresses Sequence[str]

    Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    excluded_ip_ranges Sequence[str]

    Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    excluded_uris Sequence[str]

    Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    permitted_dns_names Sequence[str]

    Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    permitted_email_addresses Sequence[str]

    Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    permitted_ip_ranges Sequence[str]

    Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    permitted_uris Sequence[str]

    Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    critical Boolean

    Indicates whether or not the name constraints are marked critical.

    excludedDnsNames List<String>

    Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    excludedEmailAddresses List<String>

    Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    excludedIpRanges List<String>

    Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    excludedUris List<String>

    Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    permittedDnsNames List<String>

    Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, example.com, www.example.com, www.sub.example.com would satisfy example.com while example1.com does not.

    permittedEmailAddresses List<String>

    Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. .example.com) to indicate all email addresses in that domain.

    permittedIpRanges List<String>

    Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses.

    permittedUris List<String>

    Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like .example.com)

    CaPoolIssuancePolicyBaselineValuesPolicyId

    ObjectIdPaths List<int>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    ObjectIdPaths []int

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths List<Integer>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths number[]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    object_id_paths Sequence[int]

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    objectIdPaths List<Number>

    An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.

    CaPoolIssuancePolicyIdentityConstraints

    AllowSubjectAltNamesPassthrough bool

    If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.

    AllowSubjectPassthrough bool

    If this is set, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.

    CelExpression CaPoolIssuancePolicyIdentityConstraintsCelExpression

    A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/cel-guide Structure is documented below.

    AllowSubjectAltNamesPassthrough bool

    If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.

    AllowSubjectPassthrough bool

    If this is set, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.

    CelExpression CaPoolIssuancePolicyIdentityConstraintsCelExpression

    A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/cel-guide Structure is documented below.

    allowSubjectAltNamesPassthrough Boolean

    If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.

    allowSubjectPassthrough Boolean

    If this is set, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.

    celExpression CaPoolIssuancePolicyIdentityConstraintsCelExpression

    A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/cel-guide Structure is documented below.

    allowSubjectAltNamesPassthrough boolean

    If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.

    allowSubjectPassthrough boolean

    If this is set, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.

    celExpression CaPoolIssuancePolicyIdentityConstraintsCelExpression

    A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/cel-guide Structure is documented below.

    allow_subject_alt_names_passthrough bool

    If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.

    allow_subject_passthrough bool

    If this is set, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.

    cel_expression CaPoolIssuancePolicyIdentityConstraintsCelExpression

    A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/cel-guide Structure is documented below.

    allowSubjectAltNamesPassthrough Boolean

    If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.

    allowSubjectPassthrough Boolean

    If this is set, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.

    celExpression Property Map

    A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/cel-guide Structure is documented below.

    CaPoolIssuancePolicyIdentityConstraintsCelExpression

    Expression string

    Textual representation of an expression in Common Expression Language syntax.

    Description string

    Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

    Location string

    String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

    Title string

    Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

    Expression string

    Textual representation of an expression in Common Expression Language syntax.

    Description string

    Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

    Location string

    String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

    Title string

    Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

    expression String

    Textual representation of an expression in Common Expression Language syntax.

    description String

    Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

    location String

    String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

    title String

    Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

    expression string

    Textual representation of an expression in Common Expression Language syntax.

    description string

    Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

    location string

    String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

    title string

    Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

    expression str

    Textual representation of an expression in Common Expression Language syntax.

    description str

    Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

    location str

    String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

    title str

    Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

    expression String

    Textual representation of an expression in Common Expression Language syntax.

    description String

    Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

    location String

    String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

    title String

    Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

    CaPoolPublishingOptions

    PublishCaCert bool

    When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access" X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding X.509 extension will not be written in issued certificates.

    PublishCrl bool

    When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are also rebuilt shortly after a certificate is revoked.

    EncodingFormat string

    Specifies the encoding format of each CertificateAuthority's CA certificate and CRLs. If this is omitted, CA certificates and CRLs will be published in PEM. Possible values are: PEM, DER.

    PublishCaCert bool

    When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access" X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding X.509 extension will not be written in issued certificates.

    PublishCrl bool

    When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are also rebuilt shortly after a certificate is revoked.

    EncodingFormat string

    Specifies the encoding format of each CertificateAuthority's CA certificate and CRLs. If this is omitted, CA certificates and CRLs will be published in PEM. Possible values are: PEM, DER.

    publishCaCert Boolean

    When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access" X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding X.509 extension will not be written in issued certificates.

    publishCrl Boolean

    When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are also rebuilt shortly after a certificate is revoked.

    encodingFormat String

    Specifies the encoding format of each CertificateAuthority's CA certificate and CRLs. If this is omitted, CA certificates and CRLs will be published in PEM. Possible values are: PEM, DER.

    publishCaCert boolean

    When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access" X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding X.509 extension will not be written in issued certificates.

    publishCrl boolean

    When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are also rebuilt shortly after a certificate is revoked.

    encodingFormat string

    Specifies the encoding format of each CertificateAuthority's CA certificate and CRLs. If this is omitted, CA certificates and CRLs will be published in PEM. Possible values are: PEM, DER.

    publish_ca_cert bool

    When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access" X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding X.509 extension will not be written in issued certificates.

    publish_crl bool

    When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are also rebuilt shortly after a certificate is revoked.

    encoding_format str

    Specifies the encoding format of each CertificateAuthority's CA certificate and CRLs. If this is omitted, CA certificates and CRLs will be published in PEM. Possible values are: PEM, DER.

    publishCaCert Boolean

    When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access" X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding X.509 extension will not be written in issued certificates.

    publishCrl Boolean

    When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are also rebuilt shortly after a certificate is revoked.

    encodingFormat String

    Specifies the encoding format of each CertificateAuthority's CA certificate and CRLs. If this is omitted, CA certificates and CRLs will be published in PEM. Possible values are: PEM, DER.

    Import

    CaPool can be imported using any of these accepted formats

     $ pulumi import gcp:certificateauthority/caPool:CaPool default projects/{{project}}/locations/{{location}}/caPools/{{name}}

     $ pulumi import gcp:certificateauthority/caPool:CaPool default {{project}}/{{location}}/{{name}}

     $ pulumi import gcp:certificateauthority/caPool:CaPool default {{location}}/{{name}}

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes

    This Pulumi package is based on the google-beta Terraform Provider.

    gcp logo
    Google Cloud Classic v6.58.0 published on Tuesday, Jun 6, 2023 by Pulumi
    pulumi/pulumi-gcp