google-native.privateca/v1.Certificate
Create a new Certificate in a given Project, Location from a particular CaPool. Auto-naming is currently not supported for this resource. Note - this resource’s API doesn’t support deletion. When deleted, the resource will persist on Google Cloud even though it will be deleted from Pulumi state.
Create Certificate Resource
new Certificate(name: string, args: CertificateArgs, opts?: CustomResourceOptions);
@overload
def Certificate(resource_name: str,
opts: Optional[ResourceOptions] = None,
ca_pool_id: Optional[str] = None,
certificate_id: Optional[str] = None,
certificate_template: Optional[str] = None,
config: Optional[CertificateConfigArgs] = None,
issuing_certificate_authority_id: Optional[str] = None,
labels: Optional[Mapping[str, str]] = None,
lifetime: Optional[str] = None,
location: Optional[str] = None,
pem_csr: Optional[str] = None,
project: Optional[str] = None,
request_id: Optional[str] = None,
subject_mode: Optional[CertificateSubjectMode] = None,
validate_only: Optional[bool] = None)
@overload
def Certificate(resource_name: str,
args: CertificateArgs,
opts: Optional[ResourceOptions] = None)
func NewCertificate(ctx *Context, name string, args CertificateArgs, opts ...ResourceOption) (*Certificate, error)
public Certificate(string name, CertificateArgs args, CustomResourceOptions? opts = null)
public Certificate(String name, CertificateArgs args)
public Certificate(String name, CertificateArgs args, CustomResourceOptions options)
type: google-native:privateca/v1:Certificate
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Certificate Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The Certificate resource accepts the following input properties:
- Ca
Pool stringId - Lifetime string
Immutable. The desired lifetime of a certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate. Note that the lifetime may be truncated if it would extend past the life of any certificate authority in the issuing chain.
- Certificate
Id string Optional. It must be unique within a location and match the regular expression
[a-zA-Z0-9_-]{1,63}
. This field is required when using a CertificateAuthority in the Enterprise CertificateAuthority.Tier, but is optional and its value is ignored otherwise.- Certificate
Template string Immutable. The resource name for a CertificateTemplate used to issue this certificate, in the format
projects/*/locations/*/certificateTemplates/*
. If this is specified, the caller must have the necessary permission to use this template. If this is omitted, no template will be used. This template must be in the same location as the Certificate.- Config
Pulumi.
Google Native. Privateca. V1. Inputs. Certificate Config Args Immutable. A description of the certificate and key that does not require X.509 or ASN.1.
- string
Optional. The resource ID of the CertificateAuthority that should issue the certificate. This optional field will ignore the load-balancing scheme of the Pool and directly issue the certificate from the CA with the specified ID, contained in the same CaPool referenced by
parent
. Per-CA quota rules apply. If left empty, a CertificateAuthority will be chosen from the CaPool by the service. For example, to issue a Certificate from a Certificate Authority with resource name "projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca", you can set the parent to "projects/my-project/locations/us-central1/caPools/my-pool" and the issuing_certificate_authority_id to "my-ca".- Labels Dictionary<string, string>
Optional. Labels with user-defined metadata.
- Location string
- Pem
Csr string Immutable. A pem-encoded X.509 certificate signing request (CSR).
- Project string
- Request
Id string Optional. An ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
- Subject
Mode Pulumi.Google Native. Privateca. V1. Certificate Subject Mode Immutable. Specifies how the Certificate's identity fields are to be decided. If this is omitted, the
DEFAULT
subject mode will be used.- Validate
Only bool Optional. If this is true, no Certificate resource will be persisted regardless of the CaPool's tier, and the returned Certificate will not contain the pem_certificate field.
- Ca
Pool stringId - Lifetime string
Immutable. The desired lifetime of a certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate. Note that the lifetime may be truncated if it would extend past the life of any certificate authority in the issuing chain.
- Certificate
Id string Optional. It must be unique within a location and match the regular expression
[a-zA-Z0-9_-]{1,63}
. This field is required when using a CertificateAuthority in the Enterprise CertificateAuthority.Tier, but is optional and its value is ignored otherwise.- Certificate
Template string Immutable. The resource name for a CertificateTemplate used to issue this certificate, in the format
projects/*/locations/*/certificateTemplates/*
. If this is specified, the caller must have the necessary permission to use this template. If this is omitted, no template will be used. This template must be in the same location as the Certificate.- Config
Certificate
Config Args Immutable. A description of the certificate and key that does not require X.509 or ASN.1.
- string
Optional. The resource ID of the CertificateAuthority that should issue the certificate. This optional field will ignore the load-balancing scheme of the Pool and directly issue the certificate from the CA with the specified ID, contained in the same CaPool referenced by
parent
. Per-CA quota rules apply. If left empty, a CertificateAuthority will be chosen from the CaPool by the service. For example, to issue a Certificate from a Certificate Authority with resource name "projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca", you can set the parent to "projects/my-project/locations/us-central1/caPools/my-pool" and the issuing_certificate_authority_id to "my-ca".- Labels map[string]string
Optional. Labels with user-defined metadata.
- Location string
- Pem
Csr string Immutable. A pem-encoded X.509 certificate signing request (CSR).
- Project string
- Request
Id string Optional. An ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
- Subject
Mode CertificateSubject Mode Immutable. Specifies how the Certificate's identity fields are to be decided. If this is omitted, the
DEFAULT
subject mode will be used.- Validate
Only bool Optional. If this is true, no Certificate resource will be persisted regardless of the CaPool's tier, and the returned Certificate will not contain the pem_certificate field.
- ca
Pool StringId - lifetime String
Immutable. The desired lifetime of a certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate. Note that the lifetime may be truncated if it would extend past the life of any certificate authority in the issuing chain.
- certificate
Id String Optional. It must be unique within a location and match the regular expression
[a-zA-Z0-9_-]{1,63}
. This field is required when using a CertificateAuthority in the Enterprise CertificateAuthority.Tier, but is optional and its value is ignored otherwise.- certificate
Template String Immutable. The resource name for a CertificateTemplate used to issue this certificate, in the format
projects/*/locations/*/certificateTemplates/*
. If this is specified, the caller must have the necessary permission to use this template. If this is omitted, no template will be used. This template must be in the same location as the Certificate.- config
Certificate
Config Args Immutable. A description of the certificate and key that does not require X.509 or ASN.1.
- String
Optional. The resource ID of the CertificateAuthority that should issue the certificate. This optional field will ignore the load-balancing scheme of the Pool and directly issue the certificate from the CA with the specified ID, contained in the same CaPool referenced by
parent
. Per-CA quota rules apply. If left empty, a CertificateAuthority will be chosen from the CaPool by the service. For example, to issue a Certificate from a Certificate Authority with resource name "projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca", you can set the parent to "projects/my-project/locations/us-central1/caPools/my-pool" and the issuing_certificate_authority_id to "my-ca".- labels Map<String,String>
Optional. Labels with user-defined metadata.
- location String
- pem
Csr String Immutable. A pem-encoded X.509 certificate signing request (CSR).
- project String
- request
Id String Optional. An ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
- subject
Mode CertificateSubject Mode Immutable. Specifies how the Certificate's identity fields are to be decided. If this is omitted, the
DEFAULT
subject mode will be used.- validate
Only Boolean Optional. If this is true, no Certificate resource will be persisted regardless of the CaPool's tier, and the returned Certificate will not contain the pem_certificate field.
- ca
Pool stringId - lifetime string
Immutable. The desired lifetime of a certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate. Note that the lifetime may be truncated if it would extend past the life of any certificate authority in the issuing chain.
- certificate
Id string Optional. It must be unique within a location and match the regular expression
[a-zA-Z0-9_-]{1,63}
. This field is required when using a CertificateAuthority in the Enterprise CertificateAuthority.Tier, but is optional and its value is ignored otherwise.- certificate
Template string Immutable. The resource name for a CertificateTemplate used to issue this certificate, in the format
projects/*/locations/*/certificateTemplates/*
. If this is specified, the caller must have the necessary permission to use this template. If this is omitted, no template will be used. This template must be in the same location as the Certificate.- config
Certificate
Config Args Immutable. A description of the certificate and key that does not require X.509 or ASN.1.
- string
Optional. The resource ID of the CertificateAuthority that should issue the certificate. This optional field will ignore the load-balancing scheme of the Pool and directly issue the certificate from the CA with the specified ID, contained in the same CaPool referenced by
parent
. Per-CA quota rules apply. If left empty, a CertificateAuthority will be chosen from the CaPool by the service. For example, to issue a Certificate from a Certificate Authority with resource name "projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca", you can set the parent to "projects/my-project/locations/us-central1/caPools/my-pool" and the issuing_certificate_authority_id to "my-ca".- labels {[key: string]: string}
Optional. Labels with user-defined metadata.
- location string
- pem
Csr string Immutable. A pem-encoded X.509 certificate signing request (CSR).
- project string
- request
Id string Optional. An ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
- subject
Mode CertificateSubject Mode Immutable. Specifies how the Certificate's identity fields are to be decided. If this is omitted, the
DEFAULT
subject mode will be used.- validate
Only boolean Optional. If this is true, no Certificate resource will be persisted regardless of the CaPool's tier, and the returned Certificate will not contain the pem_certificate field.
- ca_
pool_ strid - lifetime str
Immutable. The desired lifetime of a certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate. Note that the lifetime may be truncated if it would extend past the life of any certificate authority in the issuing chain.
- certificate_
id str Optional. It must be unique within a location and match the regular expression
[a-zA-Z0-9_-]{1,63}
. This field is required when using a CertificateAuthority in the Enterprise CertificateAuthority.Tier, but is optional and its value is ignored otherwise.- certificate_
template str Immutable. The resource name for a CertificateTemplate used to issue this certificate, in the format
projects/*/locations/*/certificateTemplates/*
. If this is specified, the caller must have the necessary permission to use this template. If this is omitted, no template will be used. This template must be in the same location as the Certificate.- config
Certificate
Config Args Immutable. A description of the certificate and key that does not require X.509 or ASN.1.
- str
Optional. The resource ID of the CertificateAuthority that should issue the certificate. This optional field will ignore the load-balancing scheme of the Pool and directly issue the certificate from the CA with the specified ID, contained in the same CaPool referenced by
parent
. Per-CA quota rules apply. If left empty, a CertificateAuthority will be chosen from the CaPool by the service. For example, to issue a Certificate from a Certificate Authority with resource name "projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca", you can set the parent to "projects/my-project/locations/us-central1/caPools/my-pool" and the issuing_certificate_authority_id to "my-ca".- labels Mapping[str, str]
Optional. Labels with user-defined metadata.
- location str
- pem_
csr str Immutable. A pem-encoded X.509 certificate signing request (CSR).
- project str
- request_
id str Optional. An ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
- subject_
mode CertificateSubject Mode Immutable. Specifies how the Certificate's identity fields are to be decided. If this is omitted, the
DEFAULT
subject mode will be used.- validate_
only bool Optional. If this is true, no Certificate resource will be persisted regardless of the CaPool's tier, and the returned Certificate will not contain the pem_certificate field.
- ca
Pool StringId - lifetime String
Immutable. The desired lifetime of a certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate. Note that the lifetime may be truncated if it would extend past the life of any certificate authority in the issuing chain.
- certificate
Id String Optional. It must be unique within a location and match the regular expression
[a-zA-Z0-9_-]{1,63}
. This field is required when using a CertificateAuthority in the Enterprise CertificateAuthority.Tier, but is optional and its value is ignored otherwise.- certificate
Template String Immutable. The resource name for a CertificateTemplate used to issue this certificate, in the format
projects/*/locations/*/certificateTemplates/*
. If this is specified, the caller must have the necessary permission to use this template. If this is omitted, no template will be used. This template must be in the same location as the Certificate.- config Property Map
Immutable. A description of the certificate and key that does not require X.509 or ASN.1.
- String
Optional. The resource ID of the CertificateAuthority that should issue the certificate. This optional field will ignore the load-balancing scheme of the Pool and directly issue the certificate from the CA with the specified ID, contained in the same CaPool referenced by
parent
. Per-CA quota rules apply. If left empty, a CertificateAuthority will be chosen from the CaPool by the service. For example, to issue a Certificate from a Certificate Authority with resource name "projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca", you can set the parent to "projects/my-project/locations/us-central1/caPools/my-pool" and the issuing_certificate_authority_id to "my-ca".- labels Map<String>
Optional. Labels with user-defined metadata.
- location String
- pem
Csr String Immutable. A pem-encoded X.509 certificate signing request (CSR).
- project String
- request
Id String Optional. An ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
- subject
Mode "SUBJECT_REQUEST_MODE_UNSPECIFIED" | "DEFAULT" | "REFLECTED_SPIFFE" Immutable. Specifies how the Certificate's identity fields are to be decided. If this is omitted, the
DEFAULT
subject mode will be used.- validate
Only Boolean Optional. If this is true, no Certificate resource will be persisted regardless of the CaPool's tier, and the returned Certificate will not contain the pem_certificate field.
Outputs
All input properties are implicitly available as output properties. Additionally, the Certificate resource produces the following output properties:
- Certificate
Description Pulumi.Google Native. Privateca. V1. Outputs. Certificate Description Response A structured description of the issued X.509 certificate.
- Create
Time string The time at which this Certificate was created.
- Id string
The provider-assigned unique ID for this managed resource.
- string
The resource name of the issuing CertificateAuthority in the format
projects/*/locations/*/caPools/*/certificateAuthorities/*
.- Name string
The resource name for this Certificate in the format
projects/*/locations/*/caPools/*/certificates/*
.- Pem
Certificate string The pem-encoded, signed X.509 certificate.
- Pem
Certificate List<string>Chain The chain that may be used to verify the X.509 certificate. Expected to be in issuer-to-root order according to RFC 5246.
- Revocation
Details Pulumi.Google Native. Privateca. V1. Outputs. Revocation Details Response Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
- Update
Time string The time at which this Certificate was updated.
- Certificate
Description CertificateDescription Response A structured description of the issued X.509 certificate.
- Create
Time string The time at which this Certificate was created.
- Id string
The provider-assigned unique ID for this managed resource.
- string
The resource name of the issuing CertificateAuthority in the format
projects/*/locations/*/caPools/*/certificateAuthorities/*
.- Name string
The resource name for this Certificate in the format
projects/*/locations/*/caPools/*/certificates/*
.- Pem
Certificate string The pem-encoded, signed X.509 certificate.
- Pem
Certificate []stringChain The chain that may be used to verify the X.509 certificate. Expected to be in issuer-to-root order according to RFC 5246.
- Revocation
Details RevocationDetails Response Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
- Update
Time string The time at which this Certificate was updated.
- certificate
Description CertificateDescription Response A structured description of the issued X.509 certificate.
- create
Time String The time at which this Certificate was created.
- id String
The provider-assigned unique ID for this managed resource.
- String
The resource name of the issuing CertificateAuthority in the format
projects/*/locations/*/caPools/*/certificateAuthorities/*
.- name String
The resource name for this Certificate in the format
projects/*/locations/*/caPools/*/certificates/*
.- pem
Certificate String The pem-encoded, signed X.509 certificate.
- pem
Certificate List<String>Chain The chain that may be used to verify the X.509 certificate. Expected to be in issuer-to-root order according to RFC 5246.
- revocation
Details RevocationDetails Response Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
- update
Time String The time at which this Certificate was updated.
- certificate
Description CertificateDescription Response A structured description of the issued X.509 certificate.
- create
Time string The time at which this Certificate was created.
- id string
The provider-assigned unique ID for this managed resource.
- string
The resource name of the issuing CertificateAuthority in the format
projects/*/locations/*/caPools/*/certificateAuthorities/*
.- name string
The resource name for this Certificate in the format
projects/*/locations/*/caPools/*/certificates/*
.- pem
Certificate string The pem-encoded, signed X.509 certificate.
- pem
Certificate string[]Chain The chain that may be used to verify the X.509 certificate. Expected to be in issuer-to-root order according to RFC 5246.
- revocation
Details RevocationDetails Response Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
- update
Time string The time at which this Certificate was updated.
- certificate_
description CertificateDescription Response A structured description of the issued X.509 certificate.
- create_
time str The time at which this Certificate was created.
- id str
The provider-assigned unique ID for this managed resource.
- str
The resource name of the issuing CertificateAuthority in the format
projects/*/locations/*/caPools/*/certificateAuthorities/*
.- name str
The resource name for this Certificate in the format
projects/*/locations/*/caPools/*/certificates/*
.- pem_
certificate str The pem-encoded, signed X.509 certificate.
- pem_
certificate_ Sequence[str]chain The chain that may be used to verify the X.509 certificate. Expected to be in issuer-to-root order according to RFC 5246.
- revocation_
details RevocationDetails Response Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
- update_
time str The time at which this Certificate was updated.
- certificate
Description Property Map A structured description of the issued X.509 certificate.
- create
Time String The time at which this Certificate was created.
- id String
The provider-assigned unique ID for this managed resource.
- String
The resource name of the issuing CertificateAuthority in the format
projects/*/locations/*/caPools/*/certificateAuthorities/*
.- name String
The resource name for this Certificate in the format
projects/*/locations/*/caPools/*/certificates/*
.- pem
Certificate String The pem-encoded, signed X.509 certificate.
- pem
Certificate List<String>Chain The chain that may be used to verify the X.509 certificate. Expected to be in issuer-to-root order according to RFC 5246.
- revocation
Details Property Map Details regarding the revocation of this Certificate. This Certificate is considered revoked if and only if this field is present.
- update
Time String The time at which this Certificate was updated.
Supporting Types
CaOptions
- Is
Ca bool Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- Max
Issuer intPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- Is
Ca bool Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- Max
Issuer intPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is
Ca Boolean Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max
Issuer IntegerPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is
Ca boolean Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max
Issuer numberPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is_
ca bool Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max_
issuer_ intpath_ length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is
Ca Boolean Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max
Issuer NumberPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
CaOptionsResponse
- Is
Ca bool Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- Max
Issuer intPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- Is
Ca bool Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- Max
Issuer intPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is
Ca Boolean Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max
Issuer IntegerPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is
Ca boolean Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max
Issuer numberPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is_
ca bool Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max_
issuer_ intpath_ length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
- is
Ca Boolean Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
- max
Issuer NumberPath Length Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
CertificateConfig
- Subject
Config Pulumi.Google Native. Privateca. V1. Inputs. Subject Config Specifies some of the values in a certificate that are related to the subject.
- X509Config
Pulumi.
Google Native. Privateca. V1. Inputs. X509Parameters Describes how some of the technical X.509 fields in a certificate should be populated.
- Public
Key Pulumi.Google Native. Privateca. V1. Inputs. Public Key Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- Subject
Config SubjectConfig Specifies some of the values in a certificate that are related to the subject.
- X509Config X509Parameters
Describes how some of the technical X.509 fields in a certificate should be populated.
- Public
Key PublicKey Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject
Config SubjectConfig Specifies some of the values in a certificate that are related to the subject.
- x509Config X509Parameters
Describes how some of the technical X.509 fields in a certificate should be populated.
- public
Key PublicKey Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject
Config SubjectConfig Specifies some of the values in a certificate that are related to the subject.
- x509Config X509Parameters
Describes how some of the technical X.509 fields in a certificate should be populated.
- public
Key PublicKey Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject_
config SubjectConfig Specifies some of the values in a certificate that are related to the subject.
- x509_
config X509Parameters Describes how some of the technical X.509 fields in a certificate should be populated.
- public_
key PublicKey Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject
Config Property Map Specifies some of the values in a certificate that are related to the subject.
- x509Config Property Map
Describes how some of the technical X.509 fields in a certificate should be populated.
- public
Key Property Map Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
CertificateConfigResponse
- Public
Key Pulumi.Google Native. Privateca. V1. Inputs. Public Key Response Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- Subject
Config Pulumi.Google Native. Privateca. V1. Inputs. Subject Config Response Specifies some of the values in a certificate that are related to the subject.
- X509Config
Pulumi.
Google Native. Privateca. V1. Inputs. X509Parameters Response Describes how some of the technical X.509 fields in a certificate should be populated.
- Public
Key PublicKey Response Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- Subject
Config SubjectConfig Response Specifies some of the values in a certificate that are related to the subject.
- X509Config
X509Parameters
Response Describes how some of the technical X.509 fields in a certificate should be populated.
- public
Key PublicKey Response Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject
Config SubjectConfig Response Specifies some of the values in a certificate that are related to the subject.
- x509Config
X509Parameters
Response Describes how some of the technical X.509 fields in a certificate should be populated.
- public
Key PublicKey Response Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject
Config SubjectConfig Response Specifies some of the values in a certificate that are related to the subject.
- x509Config
X509Parameters
Response Describes how some of the technical X.509 fields in a certificate should be populated.
- public_
key PublicKey Response Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject_
config SubjectConfig Response Specifies some of the values in a certificate that are related to the subject.
- x509_
config X509ParametersResponse Describes how some of the technical X.509 fields in a certificate should be populated.
- public
Key Property Map Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.
- subject
Config Property Map Specifies some of the values in a certificate that are related to the subject.
- x509Config Property Map
Describes how some of the technical X.509 fields in a certificate should be populated.
CertificateDescriptionResponse
- Aia
Issuing List<string>Certificate Urls Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
- Pulumi.
Google Native. Privateca. V1. Inputs. Key Id Response Identifies the subject_key_id of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
- Cert
Fingerprint Pulumi.Google Native. Privateca. V1. Inputs. Certificate Fingerprint Response The hash of the x.509 certificate.
- Crl
Distribution List<string>Points Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
- Public
Key Pulumi.Google Native. Privateca. V1. Inputs. Public Key Response The public key that corresponds to an issued certificate.
- Subject
Description Pulumi.Google Native. Privateca. V1. Inputs. Subject Description Response Describes some of the values in a certificate that are related to the subject and lifetime.
- Subject
Key Pulumi.Id Google Native. Privateca. V1. Inputs. Key Id Response Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
- X509Description
Pulumi.
Google Native. Privateca. V1. Inputs. X509Parameters Response Describes some of the technical X.509 fields in a certificate.
- Aia
Issuing []stringCertificate Urls Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
- Key
Id Response Identifies the subject_key_id of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
- Cert
Fingerprint CertificateFingerprint Response The hash of the x.509 certificate.
- Crl
Distribution []stringPoints Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
- Public
Key PublicKey Response The public key that corresponds to an issued certificate.
- Subject
Description SubjectDescription Response Describes some of the values in a certificate that are related to the subject and lifetime.
- Subject
Key KeyId Id Response Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
- X509Description
X509Parameters
Response Describes some of the technical X.509 fields in a certificate.
- aia
Issuing List<String>Certificate Urls Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
- Key
Id Response Identifies the subject_key_id of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
- cert
Fingerprint CertificateFingerprint Response The hash of the x.509 certificate.
- crl
Distribution List<String>Points Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
- public
Key PublicKey Response The public key that corresponds to an issued certificate.
- subject
Description SubjectDescription Response Describes some of the values in a certificate that are related to the subject and lifetime.
- subject
Key KeyId Id Response Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
- x509Description
X509Parameters
Response Describes some of the technical X.509 fields in a certificate.
- aia
Issuing string[]Certificate Urls Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
- Key
Id Response Identifies the subject_key_id of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
- cert
Fingerprint CertificateFingerprint Response The hash of the x.509 certificate.
- crl
Distribution string[]Points Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
- public
Key PublicKey Response The public key that corresponds to an issued certificate.
- subject
Description SubjectDescription Response Describes some of the values in a certificate that are related to the subject and lifetime.
- subject
Key KeyId Id Response Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
- x509Description
X509Parameters
Response Describes some of the technical X.509 fields in a certificate.
- aia_
issuing_ Sequence[str]certificate_ urls Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
- Key
Id Response Identifies the subject_key_id of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
- cert_
fingerprint CertificateFingerprint Response The hash of the x.509 certificate.
- crl_
distribution_ Sequence[str]points Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
- public_
key PublicKey Response The public key that corresponds to an issued certificate.
- subject_
description SubjectDescription Response Describes some of the values in a certificate that are related to the subject and lifetime.
- subject_
key_ Keyid Id Response Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
- x509_
description X509ParametersResponse Describes some of the technical X.509 fields in a certificate.
- aia
Issuing List<String>Certificate Urls Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
- Property Map
Identifies the subject_key_id of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
- cert
Fingerprint Property Map The hash of the x.509 certificate.
- crl
Distribution List<String>Points Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
- public
Key Property Map The public key that corresponds to an issued certificate.
- subject
Description Property Map Describes some of the values in a certificate that are related to the subject and lifetime.
- subject
Key Property MapId Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
- x509Description Property Map
Describes some of the technical X.509 fields in a certificate.
CertificateFingerprintResponse
- Sha256Hash string
The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
- Sha256Hash string
The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
- sha256Hash String
The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
- sha256Hash string
The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
- sha256_
hash str The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
- sha256Hash String
The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
CertificateSubjectMode
- Subject
Request Mode Unspecified - SUBJECT_REQUEST_MODE_UNSPECIFIED
Not specified.
- Default
- DEFAULT
The default mode used in most cases. Indicates that the certificate's Subject and/or SubjectAltNames are specified in the certificate request. This mode requires the caller to have the
privateca.certificates.create
permission. - Reflected
Spiffe - REFLECTED_SPIFFE
A mode reserved for special cases. Indicates that the certificate should have one or more SPIFFE SubjectAltNames set by the service based on the caller's identity. This mode will ignore any explicitly specified Subject and/or SubjectAltNames in the certificate request. This mode requires the caller to have the
privateca.certificates.createForSelf
permission.
- Certificate
Subject Mode Subject Request Mode Unspecified - SUBJECT_REQUEST_MODE_UNSPECIFIED
Not specified.
- Certificate
Subject Mode Default - DEFAULT
The default mode used in most cases. Indicates that the certificate's Subject and/or SubjectAltNames are specified in the certificate request. This mode requires the caller to have the
privateca.certificates.create
permission. - Certificate
Subject Mode Reflected Spiffe - REFLECTED_SPIFFE
A mode reserved for special cases. Indicates that the certificate should have one or more SPIFFE SubjectAltNames set by the service based on the caller's identity. This mode will ignore any explicitly specified Subject and/or SubjectAltNames in the certificate request. This mode requires the caller to have the
privateca.certificates.createForSelf
permission.
- Subject
Request Mode Unspecified - SUBJECT_REQUEST_MODE_UNSPECIFIED
Not specified.
- Default
- DEFAULT
The default mode used in most cases. Indicates that the certificate's Subject and/or SubjectAltNames are specified in the certificate request. This mode requires the caller to have the
privateca.certificates.create
permission. - Reflected
Spiffe - REFLECTED_SPIFFE
A mode reserved for special cases. Indicates that the certificate should have one or more SPIFFE SubjectAltNames set by the service based on the caller's identity. This mode will ignore any explicitly specified Subject and/or SubjectAltNames in the certificate request. This mode requires the caller to have the
privateca.certificates.createForSelf
permission.
- Subject
Request Mode Unspecified - SUBJECT_REQUEST_MODE_UNSPECIFIED
Not specified.
- Default
- DEFAULT
The default mode used in most cases. Indicates that the certificate's Subject and/or SubjectAltNames are specified in the certificate request. This mode requires the caller to have the
privateca.certificates.create
permission. - Reflected
Spiffe - REFLECTED_SPIFFE
A mode reserved for special cases. Indicates that the certificate should have one or more SPIFFE SubjectAltNames set by the service based on the caller's identity. This mode will ignore any explicitly specified Subject and/or SubjectAltNames in the certificate request. This mode requires the caller to have the
privateca.certificates.createForSelf
permission.
- SUBJECT_REQUEST_MODE_UNSPECIFIED
- SUBJECT_REQUEST_MODE_UNSPECIFIED
Not specified.
- DEFAULT
- DEFAULT
The default mode used in most cases. Indicates that the certificate's Subject and/or SubjectAltNames are specified in the certificate request. This mode requires the caller to have the
privateca.certificates.create
permission. - REFLECTED_SPIFFE
- REFLECTED_SPIFFE
A mode reserved for special cases. Indicates that the certificate should have one or more SPIFFE SubjectAltNames set by the service based on the caller's identity. This mode will ignore any explicitly specified Subject and/or SubjectAltNames in the certificate request. This mode requires the caller to have the
privateca.certificates.createForSelf
permission.
- "SUBJECT_REQUEST_MODE_UNSPECIFIED"
- SUBJECT_REQUEST_MODE_UNSPECIFIED
Not specified.
- "DEFAULT"
- DEFAULT
The default mode used in most cases. Indicates that the certificate's Subject and/or SubjectAltNames are specified in the certificate request. This mode requires the caller to have the
privateca.certificates.create
permission. - "REFLECTED_SPIFFE"
- REFLECTED_SPIFFE
A mode reserved for special cases. Indicates that the certificate should have one or more SPIFFE SubjectAltNames set by the service based on the caller's identity. This mode will ignore any explicitly specified Subject and/or SubjectAltNames in the certificate request. This mode requires the caller to have the
privateca.certificates.createForSelf
permission.
ExtendedKeyUsageOptions
- Client
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- Code
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- Email
Protection bool Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- Ocsp
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- Server
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- Time
Stamping bool Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- Client
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- Code
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- Email
Protection bool Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- Ocsp
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- Server
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- Time
Stamping bool Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email
Protection Boolean Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time
Stamping Boolean Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client
Auth boolean Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code
Signing boolean Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email
Protection boolean Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp
Signing boolean Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server
Auth boolean Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time
Stamping boolean Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client_
auth bool Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code_
signing bool Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email_
protection bool Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp_
signing bool Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server_
auth bool Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time_
stamping bool Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email
Protection Boolean Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time
Stamping Boolean Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
ExtendedKeyUsageOptionsResponse
- Client
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- Code
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- Email
Protection bool Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- Ocsp
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- Server
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- Time
Stamping bool Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- Client
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- Code
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- Email
Protection bool Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- Ocsp
Signing bool Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- Server
Auth bool Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- Time
Stamping bool Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email
Protection Boolean Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time
Stamping Boolean Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client
Auth boolean Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code
Signing boolean Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email
Protection boolean Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp
Signing boolean Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server
Auth boolean Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time
Stamping boolean Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client_
auth bool Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code_
signing bool Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email_
protection bool Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp_
signing bool Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server_
auth bool Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time_
stamping bool Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
- client
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
- code
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
- email
Protection Boolean Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
- ocsp
Signing Boolean Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
- server
Auth Boolean Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
- time
Stamping Boolean Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
KeyIdResponse
- Key
Id string Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
- Key
Id string Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
- key
Id String Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
- key
Id string Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
- key_
id str Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
- key
Id String Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
KeyUsage
- Base
Key Pulumi.Usage Google Native. Privateca. V1. Inputs. Key Usage Options Describes high-level ways in which a key may be used.
- Extended
Key Pulumi.Usage Google Native. Privateca. V1. Inputs. Extended Key Usage Options Detailed scenarios in which a key may be used.
- Unknown
Extended List<Pulumi.Key Usages Google Native. Privateca. V1. Inputs. Object Id> Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- Base
Key KeyUsage Usage Options Describes high-level ways in which a key may be used.
- Extended
Key ExtendedUsage Key Usage Options Detailed scenarios in which a key may be used.
- Unknown
Extended []ObjectKey Usages Id Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base
Key KeyUsage Usage Options Describes high-level ways in which a key may be used.
- extended
Key ExtendedUsage Key Usage Options Detailed scenarios in which a key may be used.
- unknown
Extended List<ObjectKey Usages Id> Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base
Key KeyUsage Usage Options Describes high-level ways in which a key may be used.
- extended
Key ExtendedUsage Key Usage Options Detailed scenarios in which a key may be used.
- unknown
Extended ObjectKey Usages Id[] Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base_
key_ Keyusage Usage Options Describes high-level ways in which a key may be used.
- extended_
key_ Extendedusage Key Usage Options Detailed scenarios in which a key may be used.
- unknown_
extended_ Sequence[Objectkey_ usages Id] Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base
Key Property MapUsage Describes high-level ways in which a key may be used.
- extended
Key Property MapUsage Detailed scenarios in which a key may be used.
- unknown
Extended List<Property Map>Key Usages Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
KeyUsageOptions
- Cert
Sign bool The key may be used to sign certificates.
- Content
Commitment bool The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- Crl
Sign bool The key may be used sign certificate revocation lists.
- Data
Encipherment bool The key may be used to encipher data.
- Decipher
Only bool The key may be used to decipher only.
- Digital
Signature bool The key may be used for digital signatures.
- Encipher
Only bool The key may be used to encipher only.
- Key
Agreement bool The key may be used in a key agreement protocol.
- Key
Encipherment bool The key may be used to encipher other keys.
- Cert
Sign bool The key may be used to sign certificates.
- Content
Commitment bool The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- Crl
Sign bool The key may be used sign certificate revocation lists.
- Data
Encipherment bool The key may be used to encipher data.
- Decipher
Only bool The key may be used to decipher only.
- Digital
Signature bool The key may be used for digital signatures.
- Encipher
Only bool The key may be used to encipher only.
- Key
Agreement bool The key may be used in a key agreement protocol.
- Key
Encipherment bool The key may be used to encipher other keys.
- cert
Sign Boolean The key may be used to sign certificates.
- content
Commitment Boolean The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl
Sign Boolean The key may be used sign certificate revocation lists.
- data
Encipherment Boolean The key may be used to encipher data.
- decipher
Only Boolean The key may be used to decipher only.
- digital
Signature Boolean The key may be used for digital signatures.
- encipher
Only Boolean The key may be used to encipher only.
- key
Agreement Boolean The key may be used in a key agreement protocol.
- key
Encipherment Boolean The key may be used to encipher other keys.
- cert
Sign boolean The key may be used to sign certificates.
- content
Commitment boolean The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl
Sign boolean The key may be used sign certificate revocation lists.
- data
Encipherment boolean The key may be used to encipher data.
- decipher
Only boolean The key may be used to decipher only.
- digital
Signature boolean The key may be used for digital signatures.
- encipher
Only boolean The key may be used to encipher only.
- key
Agreement boolean The key may be used in a key agreement protocol.
- key
Encipherment boolean The key may be used to encipher other keys.
- cert_
sign bool The key may be used to sign certificates.
- content_
commitment bool The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl_
sign bool The key may be used sign certificate revocation lists.
- data_
encipherment bool The key may be used to encipher data.
- decipher_
only bool The key may be used to decipher only.
- digital_
signature bool The key may be used for digital signatures.
- encipher_
only bool The key may be used to encipher only.
- key_
agreement bool The key may be used in a key agreement protocol.
- key_
encipherment bool The key may be used to encipher other keys.
- cert
Sign Boolean The key may be used to sign certificates.
- content
Commitment Boolean The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl
Sign Boolean The key may be used sign certificate revocation lists.
- data
Encipherment Boolean The key may be used to encipher data.
- decipher
Only Boolean The key may be used to decipher only.
- digital
Signature Boolean The key may be used for digital signatures.
- encipher
Only Boolean The key may be used to encipher only.
- key
Agreement Boolean The key may be used in a key agreement protocol.
- key
Encipherment Boolean The key may be used to encipher other keys.
KeyUsageOptionsResponse
- Cert
Sign bool The key may be used to sign certificates.
- Content
Commitment bool The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- Crl
Sign bool The key may be used sign certificate revocation lists.
- Data
Encipherment bool The key may be used to encipher data.
- Decipher
Only bool The key may be used to decipher only.
- Digital
Signature bool The key may be used for digital signatures.
- Encipher
Only bool The key may be used to encipher only.
- Key
Agreement bool The key may be used in a key agreement protocol.
- Key
Encipherment bool The key may be used to encipher other keys.
- Cert
Sign bool The key may be used to sign certificates.
- Content
Commitment bool The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- Crl
Sign bool The key may be used sign certificate revocation lists.
- Data
Encipherment bool The key may be used to encipher data.
- Decipher
Only bool The key may be used to decipher only.
- Digital
Signature bool The key may be used for digital signatures.
- Encipher
Only bool The key may be used to encipher only.
- Key
Agreement bool The key may be used in a key agreement protocol.
- Key
Encipherment bool The key may be used to encipher other keys.
- cert
Sign Boolean The key may be used to sign certificates.
- content
Commitment Boolean The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl
Sign Boolean The key may be used sign certificate revocation lists.
- data
Encipherment Boolean The key may be used to encipher data.
- decipher
Only Boolean The key may be used to decipher only.
- digital
Signature Boolean The key may be used for digital signatures.
- encipher
Only Boolean The key may be used to encipher only.
- key
Agreement Boolean The key may be used in a key agreement protocol.
- key
Encipherment Boolean The key may be used to encipher other keys.
- cert
Sign boolean The key may be used to sign certificates.
- content
Commitment boolean The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl
Sign boolean The key may be used sign certificate revocation lists.
- data
Encipherment boolean The key may be used to encipher data.
- decipher
Only boolean The key may be used to decipher only.
- digital
Signature boolean The key may be used for digital signatures.
- encipher
Only boolean The key may be used to encipher only.
- key
Agreement boolean The key may be used in a key agreement protocol.
- key
Encipherment boolean The key may be used to encipher other keys.
- cert_
sign bool The key may be used to sign certificates.
- content_
commitment bool The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl_
sign bool The key may be used sign certificate revocation lists.
- data_
encipherment bool The key may be used to encipher data.
- decipher_
only bool The key may be used to decipher only.
- digital_
signature bool The key may be used for digital signatures.
- encipher_
only bool The key may be used to encipher only.
- key_
agreement bool The key may be used in a key agreement protocol.
- key_
encipherment bool The key may be used to encipher other keys.
- cert
Sign Boolean The key may be used to sign certificates.
- content
Commitment Boolean The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
- crl
Sign Boolean The key may be used sign certificate revocation lists.
- data
Encipherment Boolean The key may be used to encipher data.
- decipher
Only Boolean The key may be used to decipher only.
- digital
Signature Boolean The key may be used for digital signatures.
- encipher
Only Boolean The key may be used to encipher only.
- key
Agreement Boolean The key may be used in a key agreement protocol.
- key
Encipherment Boolean The key may be used to encipher other keys.
KeyUsageResponse
- Base
Key Pulumi.Usage Google Native. Privateca. V1. Inputs. Key Usage Options Response Describes high-level ways in which a key may be used.
- Extended
Key Pulumi.Usage Google Native. Privateca. V1. Inputs. Extended Key Usage Options Response Detailed scenarios in which a key may be used.
- Unknown
Extended List<Pulumi.Key Usages Google Native. Privateca. V1. Inputs. Object Id Response> Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- Base
Key KeyUsage Usage Options Response Describes high-level ways in which a key may be used.
- Extended
Key ExtendedUsage Key Usage Options Response Detailed scenarios in which a key may be used.
- Unknown
Extended []ObjectKey Usages Id Response Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base
Key KeyUsage Usage Options Response Describes high-level ways in which a key may be used.
- extended
Key ExtendedUsage Key Usage Options Response Detailed scenarios in which a key may be used.
- unknown
Extended List<ObjectKey Usages Id Response> Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base
Key KeyUsage Usage Options Response Describes high-level ways in which a key may be used.
- extended
Key ExtendedUsage Key Usage Options Response Detailed scenarios in which a key may be used.
- unknown
Extended ObjectKey Usages Id Response[] Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base_
key_ Keyusage Usage Options Response Describes high-level ways in which a key may be used.
- extended_
key_ Extendedusage Key Usage Options Response Detailed scenarios in which a key may be used.
- unknown_
extended_ Sequence[Objectkey_ usages Id Response] Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
- base
Key Property MapUsage Describes high-level ways in which a key may be used.
- extended
Key Property MapUsage Detailed scenarios in which a key may be used.
- unknown
Extended List<Property Map>Key Usages Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
ObjectId
- Object
Id List<int>Path The parts of an OID path. The most significant parts of the path come first.
- Object
Id []intPath The parts of an OID path. The most significant parts of the path come first.
- object
Id List<Integer>Path The parts of an OID path. The most significant parts of the path come first.
- object
Id number[]Path The parts of an OID path. The most significant parts of the path come first.
- object_
id_ Sequence[int]path The parts of an OID path. The most significant parts of the path come first.
- object
Id List<Number>Path The parts of an OID path. The most significant parts of the path come first.
ObjectIdResponse
- Object
Id List<int>Path The parts of an OID path. The most significant parts of the path come first.
- Object
Id []intPath The parts of an OID path. The most significant parts of the path come first.
- object
Id List<Integer>Path The parts of an OID path. The most significant parts of the path come first.
- object
Id number[]Path The parts of an OID path. The most significant parts of the path come first.
- object_
id_ Sequence[int]path The parts of an OID path. The most significant parts of the path come first.
- object
Id List<Number>Path The parts of an OID path. The most significant parts of the path come first.
PublicKey
- Format
Pulumi.
Google Native. Privateca. V1. Public Key Format The format of the public key.
- Key string
A public key. The padding and encoding must match with the
KeyFormat
value specified for theformat
field.
- Format
Public
Key Format The format of the public key.
- Key string
A public key. The padding and encoding must match with the
KeyFormat
value specified for theformat
field.
- format
Public
Key Format The format of the public key.
- key String
A public key. The padding and encoding must match with the
KeyFormat
value specified for theformat
field.
- format
Public
Key Format The format of the public key.
- key string
A public key. The padding and encoding must match with the
KeyFormat
value specified for theformat
field.
- format
Public
Key Format The format of the public key.
- key str
A public key. The padding and encoding must match with the
KeyFormat
value specified for theformat
field.
- format "KEY_FORMAT_UNSPECIFIED" | "PEM"
The format of the public key.
- key String
A public key. The padding and encoding must match with the
KeyFormat
value specified for theformat
field.
PublicKeyFormat
- Key
Format Unspecified - KEY_FORMAT_UNSPECIFIED
Default unspecified value.
- Pem
- PEM
The key is PEM-encoded as defined in RFC 7468. It can be any of the following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey structure, an RFC 5280 SubjectPublicKeyInfo or a PEM-encoded X.509 certificate signing request (CSR). If a SubjectPublicKeyInfo is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified, it will used solely for the purpose of extracting the public key. When generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key.
- Public
Key Format Key Format Unspecified - KEY_FORMAT_UNSPECIFIED
Default unspecified value.
- Public
Key Format Pem - PEM
The key is PEM-encoded as defined in RFC 7468. It can be any of the following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey structure, an RFC 5280 SubjectPublicKeyInfo or a PEM-encoded X.509 certificate signing request (CSR). If a SubjectPublicKeyInfo is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified, it will used solely for the purpose of extracting the public key. When generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key.
- Key
Format Unspecified - KEY_FORMAT_UNSPECIFIED
Default unspecified value.
- Pem
- PEM
The key is PEM-encoded as defined in RFC 7468. It can be any of the following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey structure, an RFC 5280 SubjectPublicKeyInfo or a PEM-encoded X.509 certificate signing request (CSR). If a SubjectPublicKeyInfo is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified, it will used solely for the purpose of extracting the public key. When generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key.
- Key
Format Unspecified - KEY_FORMAT_UNSPECIFIED
Default unspecified value.
- Pem
- PEM
The key is PEM-encoded as defined in RFC 7468. It can be any of the following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey structure, an RFC 5280 SubjectPublicKeyInfo or a PEM-encoded X.509 certificate signing request (CSR). If a SubjectPublicKeyInfo is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified, it will used solely for the purpose of extracting the public key. When generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key.
- KEY_FORMAT_UNSPECIFIED
- KEY_FORMAT_UNSPECIFIED
Default unspecified value.
- PEM
- PEM
The key is PEM-encoded as defined in RFC 7468. It can be any of the following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey structure, an RFC 5280 SubjectPublicKeyInfo or a PEM-encoded X.509 certificate signing request (CSR). If a SubjectPublicKeyInfo is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified, it will used solely for the purpose of extracting the public key. When generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key.
- "KEY_FORMAT_UNSPECIFIED"
- KEY_FORMAT_UNSPECIFIED
Default unspecified value.
- "PEM"
- PEM
The key is PEM-encoded as defined in RFC 7468. It can be any of the following: a PEM-encoded PKCS#1/RFC 3447 RSAPublicKey structure, an RFC 5280 SubjectPublicKeyInfo or a PEM-encoded X.509 certificate signing request (CSR). If a SubjectPublicKeyInfo is specified, it can contain a A PEM-encoded PKCS#1/RFC 3447 RSAPublicKey or a NIST P-256/secp256r1/prime256v1 or P-384 key. If a CSR is specified, it will used solely for the purpose of extracting the public key. When generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key.
PublicKeyResponse
RevocationDetailsResponse
- Revocation
State string Indicates why a Certificate was revoked.
- Revocation
Time string The time at which this Certificate was revoked.
- Revocation
State string Indicates why a Certificate was revoked.
- Revocation
Time string The time at which this Certificate was revoked.
- revocation
State String Indicates why a Certificate was revoked.
- revocation
Time String The time at which this Certificate was revoked.
- revocation
State string Indicates why a Certificate was revoked.
- revocation
Time string The time at which this Certificate was revoked.
- revocation_
state str Indicates why a Certificate was revoked.
- revocation_
time str The time at which this Certificate was revoked.
- revocation
State String Indicates why a Certificate was revoked.
- revocation
Time String The time at which this Certificate was revoked.
Subject
- Common
Name string The "common name" of the subject.
- Country
Code string The country code of the subject.
- Locality string
The locality or city of the subject.
- Organization string
The organization of the subject.
- Organizational
Unit string The organizational_unit of the subject.
- Postal
Code string The postal code of the subject.
- Province string
The province, territory, or regional state of the subject.
- Street
Address string The street address of the subject.
- Common
Name string The "common name" of the subject.
- Country
Code string The country code of the subject.
- Locality string
The locality or city of the subject.
- Organization string
The organization of the subject.
- Organizational
Unit string The organizational_unit of the subject.
- Postal
Code string The postal code of the subject.
- Province string
The province, territory, or regional state of the subject.
- Street
Address string The street address of the subject.
- common
Name String The "common name" of the subject.
- country
Code String The country code of the subject.
- locality String
The locality or city of the subject.
- organization String
The organization of the subject.
- organizational
Unit String The organizational_unit of the subject.
- postal
Code String The postal code of the subject.
- province String
The province, territory, or regional state of the subject.
- street
Address String The street address of the subject.
- common
Name string The "common name" of the subject.
- country
Code string The country code of the subject.
- locality string
The locality or city of the subject.
- organization string
The organization of the subject.
- organizational
Unit string The organizational_unit of the subject.
- postal
Code string The postal code of the subject.
- province string
The province, territory, or regional state of the subject.
- street
Address string The street address of the subject.
- common_
name str The "common name" of the subject.
- country_
code str The country code of the subject.
- locality str
The locality or city of the subject.
- organization str
The organization of the subject.
- organizational_
unit str The organizational_unit of the subject.
- postal_
code str The postal code of the subject.
- province str
The province, territory, or regional state of the subject.
- street_
address str The street address of the subject.
- common
Name String The "common name" of the subject.
- country
Code String The country code of the subject.
- locality String
The locality or city of the subject.
- organization String
The organization of the subject.
- organizational
Unit String The organizational_unit of the subject.
- postal
Code String The postal code of the subject.
- province String
The province, territory, or regional state of the subject.
- street
Address String The street address of the subject.
SubjectAltNames
- Custom
Sans List<Pulumi.Google Native. Privateca. V1. Inputs. X509Extension> Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- Dns
Names List<string> Contains only valid, fully-qualified host names.
- Email
Addresses List<string> Contains only valid RFC 2822 E-mail addresses.
- Ip
Addresses List<string> Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- Uris List<string>
Contains only valid RFC 3986 URIs.
- Custom
Sans []X509Extension Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- Dns
Names []string Contains only valid, fully-qualified host names.
- Email
Addresses []string Contains only valid RFC 2822 E-mail addresses.
- Ip
Addresses []string Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- Uris []string
Contains only valid RFC 3986 URIs.
- custom
Sans List<X509Extension> Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns
Names List<String> Contains only valid, fully-qualified host names.
- email
Addresses List<String> Contains only valid RFC 2822 E-mail addresses.
- ip
Addresses List<String> Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris List<String>
Contains only valid RFC 3986 URIs.
- custom
Sans X509Extension[] Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns
Names string[] Contains only valid, fully-qualified host names.
- email
Addresses string[] Contains only valid RFC 2822 E-mail addresses.
- ip
Addresses string[] Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris string[]
Contains only valid RFC 3986 URIs.
- custom_
sans Sequence[X509Extension] Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns_
names Sequence[str] Contains only valid, fully-qualified host names.
- email_
addresses Sequence[str] Contains only valid RFC 2822 E-mail addresses.
- ip_
addresses Sequence[str] Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris Sequence[str]
Contains only valid RFC 3986 URIs.
- custom
Sans List<Property Map> Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns
Names List<String> Contains only valid, fully-qualified host names.
- email
Addresses List<String> Contains only valid RFC 2822 E-mail addresses.
- ip
Addresses List<String> Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris List<String>
Contains only valid RFC 3986 URIs.
SubjectAltNamesResponse
- Custom
Sans List<Pulumi.Google Native. Privateca. V1. Inputs. X509Extension Response> Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- Dns
Names List<string> Contains only valid, fully-qualified host names.
- Email
Addresses List<string> Contains only valid RFC 2822 E-mail addresses.
- Ip
Addresses List<string> Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- Uris List<string>
Contains only valid RFC 3986 URIs.
- Custom
Sans []X509ExtensionResponse Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- Dns
Names []string Contains only valid, fully-qualified host names.
- Email
Addresses []string Contains only valid RFC 2822 E-mail addresses.
- Ip
Addresses []string Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- Uris []string
Contains only valid RFC 3986 URIs.
- custom
Sans List<X509ExtensionResponse> Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns
Names List<String> Contains only valid, fully-qualified host names.
- email
Addresses List<String> Contains only valid RFC 2822 E-mail addresses.
- ip
Addresses List<String> Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris List<String>
Contains only valid RFC 3986 URIs.
- custom
Sans X509ExtensionResponse[] Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns
Names string[] Contains only valid, fully-qualified host names.
- email
Addresses string[] Contains only valid RFC 2822 E-mail addresses.
- ip
Addresses string[] Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris string[]
Contains only valid RFC 3986 URIs.
- custom_
sans Sequence[X509ExtensionResponse] Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns_
names Sequence[str] Contains only valid, fully-qualified host names.
- email_
addresses Sequence[str] Contains only valid RFC 2822 E-mail addresses.
- ip_
addresses Sequence[str] Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris Sequence[str]
Contains only valid RFC 3986 URIs.
- custom
Sans List<Property Map> Contains additional subject alternative name values. For each custom_san, the
value
field must contain an ASN.1 encoded UTF8String.- dns
Names List<String> Contains only valid, fully-qualified host names.
- email
Addresses List<String> Contains only valid RFC 2822 E-mail addresses.
- ip
Addresses List<String> Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
- uris List<String>
Contains only valid RFC 3986 URIs.
SubjectConfig
- Subject
Pulumi.
Google Native. Privateca. V1. Inputs. Subject Contains distinguished name fields such as the common name, location and organization.
- Subject
Alt Pulumi.Name Google Native. Privateca. V1. Inputs. Subject Alt Names Optional. The subject alternative name fields.
- Subject Subject
Contains distinguished name fields such as the common name, location and organization.
- Subject
Alt SubjectName Alt Names Optional. The subject alternative name fields.
- subject Subject
Contains distinguished name fields such as the common name, location and organization.
- subject
Alt SubjectName Alt Names Optional. The subject alternative name fields.
- subject Subject
Contains distinguished name fields such as the common name, location and organization.
- subject
Alt SubjectName Alt Names Optional. The subject alternative name fields.
- subject Subject
Contains distinguished name fields such as the common name, location and organization.
- subject_
alt_ Subjectname Alt Names Optional. The subject alternative name fields.
- subject Property Map
Contains distinguished name fields such as the common name, location and organization.
- subject
Alt Property MapName Optional. The subject alternative name fields.
SubjectConfigResponse
- Subject
Pulumi.
Google Native. Privateca. V1. Inputs. Subject Response Contains distinguished name fields such as the common name, location and organization.
- Subject
Alt Pulumi.Name Google Native. Privateca. V1. Inputs. Subject Alt Names Response Optional. The subject alternative name fields.
- Subject
Subject
Response Contains distinguished name fields such as the common name, location and organization.
- Subject
Alt SubjectName Alt Names Response Optional. The subject alternative name fields.
- subject
Subject
Response Contains distinguished name fields such as the common name, location and organization.
- subject
Alt SubjectName Alt Names Response Optional. The subject alternative name fields.
- subject
Subject
Response Contains distinguished name fields such as the common name, location and organization.
- subject
Alt SubjectName Alt Names Response Optional. The subject alternative name fields.
- subject
Subject
Response Contains distinguished name fields such as the common name, location and organization.
- subject_
alt_ Subjectname Alt Names Response Optional. The subject alternative name fields.
- subject Property Map
Contains distinguished name fields such as the common name, location and organization.
- subject
Alt Property MapName Optional. The subject alternative name fields.
SubjectDescriptionResponse
- Hex
Serial stringNumber The serial number encoded in lowercase hexadecimal.
- Lifetime string
For convenience, the actual lifetime of an issued certificate.
- Not
After stringTime The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second.
- Not
Before stringTime The time at which the certificate becomes valid.
- Subject
Pulumi.
Google Native. Privateca. V1. Inputs. Subject Response Contains distinguished name fields such as the common name, location and / organization.
- Subject
Alt Pulumi.Name Google Native. Privateca. V1. Inputs. Subject Alt Names Response The subject alternative name fields.
- Hex
Serial stringNumber The serial number encoded in lowercase hexadecimal.
- Lifetime string
For convenience, the actual lifetime of an issued certificate.
- Not
After stringTime The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second.
- Not
Before stringTime The time at which the certificate becomes valid.
- Subject
Subject
Response Contains distinguished name fields such as the common name, location and / organization.
- Subject
Alt SubjectName Alt Names Response The subject alternative name fields.
- hex
Serial StringNumber The serial number encoded in lowercase hexadecimal.
- lifetime String
For convenience, the actual lifetime of an issued certificate.
- not
After StringTime The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second.
- not
Before StringTime The time at which the certificate becomes valid.
- subject
Subject
Response Contains distinguished name fields such as the common name, location and / organization.
- subject
Alt SubjectName Alt Names Response The subject alternative name fields.
- hex
Serial stringNumber The serial number encoded in lowercase hexadecimal.
- lifetime string
For convenience, the actual lifetime of an issued certificate.
- not
After stringTime The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second.
- not
Before stringTime The time at which the certificate becomes valid.
- subject
Subject
Response Contains distinguished name fields such as the common name, location and / organization.
- subject
Alt SubjectName Alt Names Response The subject alternative name fields.
- hex_
serial_ strnumber The serial number encoded in lowercase hexadecimal.
- lifetime str
For convenience, the actual lifetime of an issued certificate.
- not_
after_ strtime The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second.
- not_
before_ strtime The time at which the certificate becomes valid.
- subject
Subject
Response Contains distinguished name fields such as the common name, location and / organization.
- subject_
alt_ Subjectname Alt Names Response The subject alternative name fields.
- hex
Serial StringNumber The serial number encoded in lowercase hexadecimal.
- lifetime String
For convenience, the actual lifetime of an issued certificate.
- not
After StringTime The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second.
- not
Before StringTime The time at which the certificate becomes valid.
- subject Property Map
Contains distinguished name fields such as the common name, location and / organization.
- subject
Alt Property MapName The subject alternative name fields.
SubjectResponse
- Common
Name string The "common name" of the subject.
- Country
Code string The country code of the subject.
- Locality string
The locality or city of the subject.
- Organization string
The organization of the subject.
- Organizational
Unit string The organizational_unit of the subject.
- Postal
Code string The postal code of the subject.
- Province string
The province, territory, or regional state of the subject.
- Street
Address string The street address of the subject.
- Common
Name string The "common name" of the subject.
- Country
Code string The country code of the subject.
- Locality string
The locality or city of the subject.
- Organization string
The organization of the subject.
- Organizational
Unit string The organizational_unit of the subject.
- Postal
Code string The postal code of the subject.
- Province string
The province, territory, or regional state of the subject.
- Street
Address string The street address of the subject.
- common
Name String The "common name" of the subject.
- country
Code String The country code of the subject.
- locality String
The locality or city of the subject.
- organization String
The organization of the subject.
- organizational
Unit String The organizational_unit of the subject.
- postal
Code String The postal code of the subject.
- province String
The province, territory, or regional state of the subject.
- street
Address String The street address of the subject.
- common
Name string The "common name" of the subject.
- country
Code string The country code of the subject.
- locality string
The locality or city of the subject.
- organization string
The organization of the subject.
- organizational
Unit string The organizational_unit of the subject.
- postal
Code string The postal code of the subject.
- province string
The province, territory, or regional state of the subject.
- street
Address string The street address of the subject.
- common_
name str The "common name" of the subject.
- country_
code str The country code of the subject.
- locality str
The locality or city of the subject.
- organization str
The organization of the subject.
- organizational_
unit str The organizational_unit of the subject.
- postal_
code str The postal code of the subject.
- province str
The province, territory, or regional state of the subject.
- street_
address str The street address of the subject.
- common
Name String The "common name" of the subject.
- country
Code String The country code of the subject.
- locality String
The locality or city of the subject.
- organization String
The organization of the subject.
- organizational
Unit String The organizational_unit of the subject.
- postal
Code String The postal code of the subject.
- province String
The province, territory, or regional state of the subject.
- street
Address String The street address of the subject.
X509Extension
- Object
Id Pulumi.Google Native. Privateca. V1. Inputs. Object Id The OID for this X.509 extension.
- Value string
The value of this X.509 extension.
- Critical bool
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
- object
Id Property Map The OID for this X.509 extension.
- value String
The value of this X.509 extension.
- critical Boolean
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
X509ExtensionResponse
- Critical bool
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
- Object
Id Pulumi.Google Native. Privateca. V1. Inputs. Object Id Response The OID for this X.509 extension.
- Value string
The value of this X.509 extension.
- Critical bool
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
- Object
Id ObjectId Response The OID for this X.509 extension.
- Value string
The value of this X.509 extension.
- critical Boolean
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
- object
Id ObjectId Response The OID for this X.509 extension.
- value String
The value of this X.509 extension.
- critical boolean
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
- object
Id ObjectId Response The OID for this X.509 extension.
- value string
The value of this X.509 extension.
- critical bool
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
- object_
id ObjectId Response The OID for this X.509 extension.
- value str
The value of this X.509 extension.
- critical Boolean
Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
- object
Id Property Map The OID for this X.509 extension.
- value String
The value of this X.509 extension.
X509Parameters
- Additional
Extensions List<Pulumi.Google Native. Privateca. V1. Inputs. X509Extension> Optional. Describes custom X.509 extensions.
- Aia
Ocsp List<string>Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- Ca
Options Pulumi.Google Native. Privateca. V1. Inputs. Ca Options Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- Key
Usage Pulumi.Google Native. Privateca. V1. Inputs. Key Usage Optional. Indicates the intended use for keys that correspond to a certificate.
- Policy
Ids List<Pulumi.Google Native. Privateca. V1. Inputs. Object Id> Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- Additional
Extensions []X509Extension Optional. Describes custom X.509 extensions.
- Aia
Ocsp []stringServers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- Ca
Options CaOptions Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- Key
Usage KeyUsage Optional. Indicates the intended use for keys that correspond to a certificate.
- Policy
Ids []ObjectId Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional
Extensions List<X509Extension> Optional. Describes custom X.509 extensions.
- aia
Ocsp List<String>Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca
Options CaOptions Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key
Usage KeyUsage Optional. Indicates the intended use for keys that correspond to a certificate.
- policy
Ids List<ObjectId> Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional
Extensions X509Extension[] Optional. Describes custom X.509 extensions.
- aia
Ocsp string[]Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca
Options CaOptions Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key
Usage KeyUsage Optional. Indicates the intended use for keys that correspond to a certificate.
- policy
Ids ObjectId[] Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional_
extensions Sequence[X509Extension] Optional. Describes custom X.509 extensions.
- aia_
ocsp_ Sequence[str]servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca_
options CaOptions Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key_
usage KeyUsage Optional. Indicates the intended use for keys that correspond to a certificate.
- policy_
ids Sequence[ObjectId] Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional
Extensions List<Property Map> Optional. Describes custom X.509 extensions.
- aia
Ocsp List<String>Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca
Options Property Map Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key
Usage Property Map Optional. Indicates the intended use for keys that correspond to a certificate.
- policy
Ids List<Property Map> Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
X509ParametersResponse
- Additional
Extensions List<Pulumi.Google Native. Privateca. V1. Inputs. X509Extension Response> Optional. Describes custom X.509 extensions.
- Aia
Ocsp List<string>Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- Ca
Options Pulumi.Google Native. Privateca. V1. Inputs. Ca Options Response Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- Key
Usage Pulumi.Google Native. Privateca. V1. Inputs. Key Usage Response Optional. Indicates the intended use for keys that correspond to a certificate.
- Policy
Ids List<Pulumi.Google Native. Privateca. V1. Inputs. Object Id Response> Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- Additional
Extensions []X509ExtensionResponse Optional. Describes custom X.509 extensions.
- Aia
Ocsp []stringServers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- Ca
Options CaOptions Response Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- Key
Usage KeyUsage Response Optional. Indicates the intended use for keys that correspond to a certificate.
- Policy
Ids []ObjectId Response Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional
Extensions List<X509ExtensionResponse> Optional. Describes custom X.509 extensions.
- aia
Ocsp List<String>Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca
Options CaOptions Response Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key
Usage KeyUsage Response Optional. Indicates the intended use for keys that correspond to a certificate.
- policy
Ids List<ObjectId Response> Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional
Extensions X509ExtensionResponse[] Optional. Describes custom X.509 extensions.
- aia
Ocsp string[]Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca
Options CaOptions Response Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key
Usage KeyUsage Response Optional. Indicates the intended use for keys that correspond to a certificate.
- policy
Ids ObjectId Response[] Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional_
extensions Sequence[X509ExtensionResponse] Optional. Describes custom X.509 extensions.
- aia_
ocsp_ Sequence[str]servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca_
options CaOptions Response Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key_
usage KeyUsage Response Optional. Indicates the intended use for keys that correspond to a certificate.
- policy_
ids Sequence[ObjectId Response] Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
- additional
Extensions List<Property Map> Optional. Describes custom X.509 extensions.
- aia
Ocsp List<String>Servers Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
- ca
Options Property Map Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
- key
Usage Property Map Optional. Indicates the intended use for keys that correspond to a certificate.
- policy
Ids List<Property Map> Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
Package Details
- Repository
- Google Cloud Native pulumi/pulumi-google-native
- License
- Apache-2.0