Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Ibm Provider
  3. API Docs
  4. getSmPrivateCertificateConfigurationTemplate
ibm 1.78.0 published on Wednesday, Apr 30, 2025 by ibm-cloud
ibm-cloud/terraform-provider-ibm

ibm.getSmPrivateCertificateConfigurationTemplate

Explore with Pulumi AI

ibm logo
ibm 1.78.0 published on Wednesday, Apr 30, 2025 by ibm-cloud
ibm-cloud/terraform-provider-ibm

    Provides a read-only data source for the configuration of a private certificate template. You can then reference the fields of the data source in other resources within the same configuration using interpolation syntax.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as ibm from "@pulumi/ibm";

const privateCertificateTemplate = ibm.getSmPrivateCertificateConfigurationTemplate({
    instanceId: ibm_resource_instance.sm_instance.guid,
    region: "us-south",
    name: "configuration-name",
});

    import pulumi
import pulumi_ibm as ibm

private_certificate_template = ibm.get_sm_private_certificate_configuration_template(instance_id=ibm_resource_instance["sm_instance"]["guid"],
    region="us-south",
    name="configuration-name")

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ibm.LookupSmPrivateCertificateConfigurationTemplate(ctx, &ibm.LookupSmPrivateCertificateConfigurationTemplateArgs{
			InstanceId: ibm_resource_instance.Sm_instance.Guid,
			Region:     pulumi.StringRef("us-south"),
			Name:       "configuration-name",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Ibm = Pulumi.Ibm;

return await Deployment.RunAsync(() => 
{
    var privateCertificateTemplate = Ibm.GetSmPrivateCertificateConfigurationTemplate.Invoke(new()
    {
        InstanceId = ibm_resource_instance.Sm_instance.Guid,
        Region = "us-south",
        Name = "configuration-name",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.ibm.IbmFunctions;
import com.pulumi.ibm.inputs.GetSmPrivateCertificateConfigurationTemplateArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var privateCertificateTemplate = IbmFunctions.getSmPrivateCertificateConfigurationTemplate(GetSmPrivateCertificateConfigurationTemplateArgs.builder()
            .instanceId(ibm_resource_instance.sm_instance().guid())
            .region("us-south")
            .name("configuration-name")
            .build());

    }
}

    variables:
  privateCertificateTemplate:
    fn::invoke:
      function: ibm:getSmPrivateCertificateConfigurationTemplate
      arguments:
        instanceId: ${ibm_resource_instance.sm_instance.guid}
        region: us-south
        name: configuration-name

    Using getSmPrivateCertificateConfigurationTemplate

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getSmPrivateCertificateConfigurationTemplate(args: GetSmPrivateCertificateConfigurationTemplateArgs, opts?: InvokeOptions): Promise<GetSmPrivateCertificateConfigurationTemplateResult>
function getSmPrivateCertificateConfigurationTemplateOutput(args: GetSmPrivateCertificateConfigurationTemplateOutputArgs, opts?: InvokeOptions): Output<GetSmPrivateCertificateConfigurationTemplateResult>
    def get_sm_private_certificate_configuration_template(endpoint_type: Optional[str] = None,
                                                      id: Optional[str] = None,
                                                      instance_id: Optional[str] = None,
                                                      name: Optional[str] = None,
                                                      region: Optional[str] = None,
                                                      opts: Optional[InvokeOptions] = None) -> GetSmPrivateCertificateConfigurationTemplateResult
def get_sm_private_certificate_configuration_template_output(endpoint_type: Optional[pulumi.Input[str]] = None,
                                                      id: Optional[pulumi.Input[str]] = None,
                                                      instance_id: Optional[pulumi.Input[str]] = None,
                                                      name: Optional[pulumi.Input[str]] = None,
                                                      region: Optional[pulumi.Input[str]] = None,
                                                      opts: Optional[InvokeOptions] = None) -> Output[GetSmPrivateCertificateConfigurationTemplateResult]
    func LookupSmPrivateCertificateConfigurationTemplate(ctx *Context, args *LookupSmPrivateCertificateConfigurationTemplateArgs, opts ...InvokeOption) (*LookupSmPrivateCertificateConfigurationTemplateResult, error)
func LookupSmPrivateCertificateConfigurationTemplateOutput(ctx *Context, args *LookupSmPrivateCertificateConfigurationTemplateOutputArgs, opts ...InvokeOption) LookupSmPrivateCertificateConfigurationTemplateResultOutput

    > Note: This function is named LookupSmPrivateCertificateConfigurationTemplate in the Go SDK.

    public static class GetSmPrivateCertificateConfigurationTemplate 
{
    public static Task<GetSmPrivateCertificateConfigurationTemplateResult> InvokeAsync(GetSmPrivateCertificateConfigurationTemplateArgs args, InvokeOptions? opts = null)
    public static Output<GetSmPrivateCertificateConfigurationTemplateResult> Invoke(GetSmPrivateCertificateConfigurationTemplateInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetSmPrivateCertificateConfigurationTemplateResult> getSmPrivateCertificateConfigurationTemplate(GetSmPrivateCertificateConfigurationTemplateArgs args, InvokeOptions options)
public static Output<GetSmPrivateCertificateConfigurationTemplateResult> getSmPrivateCertificateConfigurationTemplate(GetSmPrivateCertificateConfigurationTemplateArgs args, InvokeOptions options)

    fn::invoke:
  function: ibm:index/getSmPrivateCertificateConfigurationTemplate:getSmPrivateCertificateConfigurationTemplate
  arguments:
    # arguments dictionary

    The following arguments are supported:

    InstanceId string
    The GUID of the Secrets Manager instance.
    Name string
    The name of the configuration.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    EndpointType string
    The endpoint type. If not provided the endpoint type is determined by the visibility argument provided in the provider configuration.

    • Constraints: Allowable values are: private, public.
    Id string
    The unique identifier of the data source.
    Region string
    The region of the Secrets Manager instance. If not provided defaults to the region defined in the IBM provider configuration.
    InstanceId string
    The GUID of the Secrets Manager instance.
    Name string
    The name of the configuration.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    EndpointType string
    The endpoint type. If not provided the endpoint type is determined by the visibility argument provided in the provider configuration.

    • Constraints: Allowable values are: private, public.
    Id string
    The unique identifier of the data source.
    Region string
    The region of the Secrets Manager instance. If not provided defaults to the region defined in the IBM provider configuration.
    instanceId String
    The GUID of the Secrets Manager instance.
    name String
    The name of the configuration.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    endpointType String
    The endpoint type. If not provided the endpoint type is determined by the visibility argument provided in the provider configuration.

    • Constraints: Allowable values are: private, public.
    id String
    The unique identifier of the data source.
    region String
    The region of the Secrets Manager instance. If not provided defaults to the region defined in the IBM provider configuration.
    instanceId string
    The GUID of the Secrets Manager instance.
    name string
    The name of the configuration.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    endpointType string
    The endpoint type. If not provided the endpoint type is determined by the visibility argument provided in the provider configuration.

    • Constraints: Allowable values are: private, public.
    id string
    The unique identifier of the data source.
    region string
    The region of the Secrets Manager instance. If not provided defaults to the region defined in the IBM provider configuration.
    instance_id str
    The GUID of the Secrets Manager instance.
    name str
    The name of the configuration.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    endpoint_type str
    The endpoint type. If not provided the endpoint type is determined by the visibility argument provided in the provider configuration.

    • Constraints: Allowable values are: private, public.
    id str
    The unique identifier of the data source.
    region str
    The region of the Secrets Manager instance. If not provided defaults to the region defined in the IBM provider configuration.
    instanceId String
    The GUID of the Secrets Manager instance.
    name String
    The name of the configuration.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    endpointType String
    The endpoint type. If not provided the endpoint type is determined by the visibility argument provided in the provider configuration.

    • Constraints: Allowable values are: private, public.
    id String
    The unique identifier of the data source.
    region String
    The region of the Secrets Manager instance. If not provided defaults to the region defined in the IBM provider configuration.

    getSmPrivateCertificateConfigurationTemplate Result

    The following output properties are available:

    AllowAnyName bool
    (Boolean) Determines whether to allow clients to request a private certificate that matches any common name.
    AllowBareDomains bool
    (Boolean) Determines whether to allow clients to request private certificates that match the value of the actual domains on the final certificate.For example, if you specify example.com in the allowed_domains field, you grant clients the ability to request a certificate that contains the name example.com as one of the DNS values on the final certificate.Important: In some scenarios, allowing bare domains can be considered a security risk.
    AllowGlobDomains bool
    (Boolean) Determines whether to allow glob patterns, for example, ftp*.example.com, in the names that are specified in the allowed_domains field.If set to true, clients are allowed to request private certificates with names that match the glob patterns.
    AllowIpSans bool
    (Boolean) Determines whether to allow clients to request a private certificate with IP Subject Alternative Names.
    AllowLocalhost bool
    (Boolean) Determines whether to allow localhost to be included as one of the requested common names.
    AllowSubdomains bool
    (Boolean) Determines whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This includes wildcard subdomains.For example, if allowed_domains has a value of example.com and allow_subdomainsis set to true, then the following subdomains are allowed: foo.example.com, bar.example.com, *.example.com.Note: This field is redundant if you use the allow_any_name option.
    AllowedDomains List<string>
    (List) The domains to define for the certificate template. This property is used along with the allow_bare_domains and allow_subdomains options.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    AllowedDomainsTemplate bool
    (Boolean) Determines whether to allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates.
    AllowedOtherSans List<string>
    (List) The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates.The format for each element in the list is the same as OpenSSL: <oid>:<type>:<value> where the current valid type is UTF8. To allow any value for an OID, use * as its value. Alternatively, specify a single * to allow any other_sans input.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    AllowedSecretGroups string
    (String) Scopes the creation of private certificates to only the secret groups that you specify.This field can be supplied as a comma-delimited list of secret group IDs.

    • Constraints: The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.
    AllowedUriSans List<string>
    (List) The URI Subject Alternative Names to allow for private certificates.Values can contain glob patterns, for example spiffe://hostname/_*.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    BasicConstraintsValidForNonCa bool
    (Boolean) Determines whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates.
    CertificateAuthority string
    (String) The name of the intermediate certificate authority.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    ClientFlag bool
    (Boolean) Determines whether private certificates are flagged for client use.
    CodeSigningFlag bool
    (Boolean) Determines whether private certificates are flagged for code signing use.
    ConfigType string
    (String) Th configuration type.

    • Constraints: Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.
    Countries List<string>
    (List) The Country (C) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    CreatedAt string
    (String) The date when a resource was created. The date format follows RFC 3339.
    CreatedBy string
    (String) The unique identifier that is associated with the entity that created the secret.

    • Constraints: The maximum length is 128 characters. The minimum length is 4 characters.
    EmailProtectionFlag bool
    (Boolean) Determines whether private certificates are flagged for email protection use.
    EnforceHostnames bool
    (Boolean) Determines whether to enforce only valid host names for common names, DNS Subject Alternative Names, and the host section of email addresses.
    ExtKeyUsageOids List<string>
    (List) A list of extended key usage Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    ExtKeyUsages List<string>
    (List) The allowed extended key usage constraint on private certificates.You can find valid values in the Go x509 package documentation. Omit the ExtKeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    Id string
    The unique identifier of the data source.
    InstanceId string
    KeyBits double
    (Integer) The number of bits to use to generate the private key.Allowable values for RSA keys are: 2048 and 4096. Allowable values for EC keys are: 224, 256, 384, and 521. The default for RSA keys is 2048. The default for EC keys is 256.
    KeyType string
    (String) The type of private key to generate.

    • Constraints: Allowable values are: rsa, ec.
    KeyUsages List<string>
    (List) The allowed key usage constraint to define for private certificates.You can find valid values in the Go x509 package documentation. Omit the KeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    Localities List<string>
    (List) The Locality (L) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    MaxTtlSeconds double
    (Integer) The maximum time-to-live (TTL) for certificates that are created by this CA in seconds.
    Name string
    NotBeforeDurationSeconds double
    (Integer) The duration in seconds by which to backdate the not_before property of an issued private certificate.
    Organizations List<string>
    (List) The Organization (O) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    Ous List<string>
    (List) The Organizational Unit (OU) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    PolicyIdentifiers List<string>
    (List) A list of policy Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    PostalCodes List<string>
    (List) The postal code values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    Provinces List<string>
    (List) The Province (ST) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    Region string
    RequireCn bool
    (Boolean) Determines whether to require a common name to create a private certificate.By default, a common name is required to generate a certificate. To make the common_name field optional, set the require_cn option to false.
    SecretType string
    (String) The secret type. Supported types are arbitrary, certificates (imported, public, and private), IAM credentials, key-value, and user credentials.

    • Constraints: Allowable values are: arbitrary, imported_cert, public_cert, iam_credentials, kv, username_password, private_cert.
    SerialNumber string
    (String) The serial number to assign to the generated certificate. To assign a random serial number, you can omit this field.

    • Constraints: The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.
    ServerFlag bool
    (Boolean) Determines whether private certificates are flagged for server use.
    StreetAddresses List<string>
    (List) The street address values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    TtlSeconds double
    (Integer) The requested Time To Live, after which the certificate will be expired.
    UpdatedAt string
    (String) The date when a resource was recently modified. The date format follows RFC 3339.
    UseCsrCommonName bool
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the common name (CN) from a certificate signing request (CSR) instead of the CN that's included in the data of the certificate.Does not include any requested Subject Alternative Names (SANs) in the CSR. To use the alternative names, include the use_csr_sans property.
    UseCsrSans bool
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the Subject Alternative Names(SANs) from a certificate signing request (CSR) instead of the SANs that are included in the data of the certificate.Does not include the common name in the CSR. To use the common name, include the use_csr_common_name property.
    EndpointType string
    AllowAnyName bool
    (Boolean) Determines whether to allow clients to request a private certificate that matches any common name.
    AllowBareDomains bool
    (Boolean) Determines whether to allow clients to request private certificates that match the value of the actual domains on the final certificate.For example, if you specify example.com in the allowed_domains field, you grant clients the ability to request a certificate that contains the name example.com as one of the DNS values on the final certificate.Important: In some scenarios, allowing bare domains can be considered a security risk.
    AllowGlobDomains bool
    (Boolean) Determines whether to allow glob patterns, for example, ftp*.example.com, in the names that are specified in the allowed_domains field.If set to true, clients are allowed to request private certificates with names that match the glob patterns.
    AllowIpSans bool
    (Boolean) Determines whether to allow clients to request a private certificate with IP Subject Alternative Names.
    AllowLocalhost bool
    (Boolean) Determines whether to allow localhost to be included as one of the requested common names.
    AllowSubdomains bool
    (Boolean) Determines whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This includes wildcard subdomains.For example, if allowed_domains has a value of example.com and allow_subdomainsis set to true, then the following subdomains are allowed: foo.example.com, bar.example.com, *.example.com.Note: This field is redundant if you use the allow_any_name option.
    AllowedDomains []string
    (List) The domains to define for the certificate template. This property is used along with the allow_bare_domains and allow_subdomains options.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    AllowedDomainsTemplate bool
    (Boolean) Determines whether to allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates.
    AllowedOtherSans []string
    (List) The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates.The format for each element in the list is the same as OpenSSL: <oid>:<type>:<value> where the current valid type is UTF8. To allow any value for an OID, use * as its value. Alternatively, specify a single * to allow any other_sans input.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    AllowedSecretGroups string
    (String) Scopes the creation of private certificates to only the secret groups that you specify.This field can be supplied as a comma-delimited list of secret group IDs.

    • Constraints: The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.
    AllowedUriSans []string
    (List) The URI Subject Alternative Names to allow for private certificates.Values can contain glob patterns, for example spiffe://hostname/_*.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    BasicConstraintsValidForNonCa bool
    (Boolean) Determines whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates.
    CertificateAuthority string
    (String) The name of the intermediate certificate authority.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    ClientFlag bool
    (Boolean) Determines whether private certificates are flagged for client use.
    CodeSigningFlag bool
    (Boolean) Determines whether private certificates are flagged for code signing use.
    ConfigType string
    (String) Th configuration type.

    • Constraints: Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.
    Countries []string
    (List) The Country (C) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    CreatedAt string
    (String) The date when a resource was created. The date format follows RFC 3339.
    CreatedBy string
    (String) The unique identifier that is associated with the entity that created the secret.

    • Constraints: The maximum length is 128 characters. The minimum length is 4 characters.
    EmailProtectionFlag bool
    (Boolean) Determines whether private certificates are flagged for email protection use.
    EnforceHostnames bool
    (Boolean) Determines whether to enforce only valid host names for common names, DNS Subject Alternative Names, and the host section of email addresses.
    ExtKeyUsageOids []string
    (List) A list of extended key usage Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    ExtKeyUsages []string
    (List) The allowed extended key usage constraint on private certificates.You can find valid values in the Go x509 package documentation. Omit the ExtKeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    Id string
    The unique identifier of the data source.
    InstanceId string
    KeyBits float64
    (Integer) The number of bits to use to generate the private key.Allowable values for RSA keys are: 2048 and 4096. Allowable values for EC keys are: 224, 256, 384, and 521. The default for RSA keys is 2048. The default for EC keys is 256.
    KeyType string
    (String) The type of private key to generate.

    • Constraints: Allowable values are: rsa, ec.
    KeyUsages []string
    (List) The allowed key usage constraint to define for private certificates.You can find valid values in the Go x509 package documentation. Omit the KeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    Localities []string
    (List) The Locality (L) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    MaxTtlSeconds float64
    (Integer) The maximum time-to-live (TTL) for certificates that are created by this CA in seconds.
    Name string
    NotBeforeDurationSeconds float64
    (Integer) The duration in seconds by which to backdate the not_before property of an issued private certificate.
    Organizations []string
    (List) The Organization (O) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    Ous []string
    (List) The Organizational Unit (OU) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    PolicyIdentifiers []string
    (List) A list of policy Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    PostalCodes []string
    (List) The postal code values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    Provinces []string
    (List) The Province (ST) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    Region string
    RequireCn bool
    (Boolean) Determines whether to require a common name to create a private certificate.By default, a common name is required to generate a certificate. To make the common_name field optional, set the require_cn option to false.
    SecretType string
    (String) The secret type. Supported types are arbitrary, certificates (imported, public, and private), IAM credentials, key-value, and user credentials.

    • Constraints: Allowable values are: arbitrary, imported_cert, public_cert, iam_credentials, kv, username_password, private_cert.
    SerialNumber string
    (String) The serial number to assign to the generated certificate. To assign a random serial number, you can omit this field.

    • Constraints: The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.
    ServerFlag bool
    (Boolean) Determines whether private certificates are flagged for server use.
    StreetAddresses []string
    (List) The street address values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    TtlSeconds float64
    (Integer) The requested Time To Live, after which the certificate will be expired.
    UpdatedAt string
    (String) The date when a resource was recently modified. The date format follows RFC 3339.
    UseCsrCommonName bool
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the common name (CN) from a certificate signing request (CSR) instead of the CN that's included in the data of the certificate.Does not include any requested Subject Alternative Names (SANs) in the CSR. To use the alternative names, include the use_csr_sans property.
    UseCsrSans bool
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the Subject Alternative Names(SANs) from a certificate signing request (CSR) instead of the SANs that are included in the data of the certificate.Does not include the common name in the CSR. To use the common name, include the use_csr_common_name property.
    EndpointType string
    allowAnyName Boolean
    (Boolean) Determines whether to allow clients to request a private certificate that matches any common name.
    allowBareDomains Boolean
    (Boolean) Determines whether to allow clients to request private certificates that match the value of the actual domains on the final certificate.For example, if you specify example.com in the allowed_domains field, you grant clients the ability to request a certificate that contains the name example.com as one of the DNS values on the final certificate.Important: In some scenarios, allowing bare domains can be considered a security risk.
    allowGlobDomains Boolean
    (Boolean) Determines whether to allow glob patterns, for example, ftp*.example.com, in the names that are specified in the allowed_domains field.If set to true, clients are allowed to request private certificates with names that match the glob patterns.
    allowIpSans Boolean
    (Boolean) Determines whether to allow clients to request a private certificate with IP Subject Alternative Names.
    allowLocalhost Boolean
    (Boolean) Determines whether to allow localhost to be included as one of the requested common names.
    allowSubdomains Boolean
    (Boolean) Determines whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This includes wildcard subdomains.For example, if allowed_domains has a value of example.com and allow_subdomainsis set to true, then the following subdomains are allowed: foo.example.com, bar.example.com, *.example.com.Note: This field is redundant if you use the allow_any_name option.
    allowedDomains List<String>
    (List) The domains to define for the certificate template. This property is used along with the allow_bare_domains and allow_subdomains options.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowedDomainsTemplate Boolean
    (Boolean) Determines whether to allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates.
    allowedOtherSans List<String>
    (List) The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates.The format for each element in the list is the same as OpenSSL: <oid>:<type>:<value> where the current valid type is UTF8. To allow any value for an OID, use * as its value. Alternatively, specify a single * to allow any other_sans input.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowedSecretGroups String
    (String) Scopes the creation of private certificates to only the secret groups that you specify.This field can be supplied as a comma-delimited list of secret group IDs.

    • Constraints: The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.
    allowedUriSans List<String>
    (List) The URI Subject Alternative Names to allow for private certificates.Values can contain glob patterns, for example spiffe://hostname/_*.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    basicConstraintsValidForNonCa Boolean
    (Boolean) Determines whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates.
    certificateAuthority String
    (String) The name of the intermediate certificate authority.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    clientFlag Boolean
    (Boolean) Determines whether private certificates are flagged for client use.
    codeSigningFlag Boolean
    (Boolean) Determines whether private certificates are flagged for code signing use.
    configType String
    (String) Th configuration type.

    • Constraints: Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.
    countries List<String>
    (List) The Country (C) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    createdAt String
    (String) The date when a resource was created. The date format follows RFC 3339.
    createdBy String
    (String) The unique identifier that is associated with the entity that created the secret.

    • Constraints: The maximum length is 128 characters. The minimum length is 4 characters.
    emailProtectionFlag Boolean
    (Boolean) Determines whether private certificates are flagged for email protection use.
    enforceHostnames Boolean
    (Boolean) Determines whether to enforce only valid host names for common names, DNS Subject Alternative Names, and the host section of email addresses.
    extKeyUsageOids List<String>
    (List) A list of extended key usage Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    extKeyUsages List<String>
    (List) The allowed extended key usage constraint on private certificates.You can find valid values in the Go x509 package documentation. Omit the ExtKeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    id String
    The unique identifier of the data source.
    instanceId String
    keyBits Double
    (Integer) The number of bits to use to generate the private key.Allowable values for RSA keys are: 2048 and 4096. Allowable values for EC keys are: 224, 256, 384, and 521. The default for RSA keys is 2048. The default for EC keys is 256.
    keyType String
    (String) The type of private key to generate.

    • Constraints: Allowable values are: rsa, ec.
    keyUsages List<String>
    (List) The allowed key usage constraint to define for private certificates.You can find valid values in the Go x509 package documentation. Omit the KeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    localities List<String>
    (List) The Locality (L) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    maxTtlSeconds Double
    (Integer) The maximum time-to-live (TTL) for certificates that are created by this CA in seconds.
    name String
    notBeforeDurationSeconds Double
    (Integer) The duration in seconds by which to backdate the not_before property of an issued private certificate.
    organizations List<String>
    (List) The Organization (O) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ous List<String>
    (List) The Organizational Unit (OU) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    policyIdentifiers List<String>
    (List) A list of policy Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    postalCodes List<String>
    (List) The postal code values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    provinces List<String>
    (List) The Province (ST) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    region String
    requireCn Boolean
    (Boolean) Determines whether to require a common name to create a private certificate.By default, a common name is required to generate a certificate. To make the common_name field optional, set the require_cn option to false.
    secretType String
    (String) The secret type. Supported types are arbitrary, certificates (imported, public, and private), IAM credentials, key-value, and user credentials.

    • Constraints: Allowable values are: arbitrary, imported_cert, public_cert, iam_credentials, kv, username_password, private_cert.
    serialNumber String
    (String) The serial number to assign to the generated certificate. To assign a random serial number, you can omit this field.

    • Constraints: The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.
    serverFlag Boolean
    (Boolean) Determines whether private certificates are flagged for server use.
    streetAddresses List<String>
    (List) The street address values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ttlSeconds Double
    (Integer) The requested Time To Live, after which the certificate will be expired.
    updatedAt String
    (String) The date when a resource was recently modified. The date format follows RFC 3339.
    useCsrCommonName Boolean
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the common name (CN) from a certificate signing request (CSR) instead of the CN that's included in the data of the certificate.Does not include any requested Subject Alternative Names (SANs) in the CSR. To use the alternative names, include the use_csr_sans property.
    useCsrSans Boolean
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the Subject Alternative Names(SANs) from a certificate signing request (CSR) instead of the SANs that are included in the data of the certificate.Does not include the common name in the CSR. To use the common name, include the use_csr_common_name property.
    endpointType String
    allowAnyName boolean
    (Boolean) Determines whether to allow clients to request a private certificate that matches any common name.
    allowBareDomains boolean
    (Boolean) Determines whether to allow clients to request private certificates that match the value of the actual domains on the final certificate.For example, if you specify example.com in the allowed_domains field, you grant clients the ability to request a certificate that contains the name example.com as one of the DNS values on the final certificate.Important: In some scenarios, allowing bare domains can be considered a security risk.
    allowGlobDomains boolean
    (Boolean) Determines whether to allow glob patterns, for example, ftp*.example.com, in the names that are specified in the allowed_domains field.If set to true, clients are allowed to request private certificates with names that match the glob patterns.
    allowIpSans boolean
    (Boolean) Determines whether to allow clients to request a private certificate with IP Subject Alternative Names.
    allowLocalhost boolean
    (Boolean) Determines whether to allow localhost to be included as one of the requested common names.
    allowSubdomains boolean
    (Boolean) Determines whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This includes wildcard subdomains.For example, if allowed_domains has a value of example.com and allow_subdomainsis set to true, then the following subdomains are allowed: foo.example.com, bar.example.com, *.example.com.Note: This field is redundant if you use the allow_any_name option.
    allowedDomains string[]
    (List) The domains to define for the certificate template. This property is used along with the allow_bare_domains and allow_subdomains options.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowedDomainsTemplate boolean
    (Boolean) Determines whether to allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates.
    allowedOtherSans string[]
    (List) The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates.The format for each element in the list is the same as OpenSSL: <oid>:<type>:<value> where the current valid type is UTF8. To allow any value for an OID, use * as its value. Alternatively, specify a single * to allow any other_sans input.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowedSecretGroups string
    (String) Scopes the creation of private certificates to only the secret groups that you specify.This field can be supplied as a comma-delimited list of secret group IDs.

    • Constraints: The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.
    allowedUriSans string[]
    (List) The URI Subject Alternative Names to allow for private certificates.Values can contain glob patterns, for example spiffe://hostname/_*.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    basicConstraintsValidForNonCa boolean
    (Boolean) Determines whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates.
    certificateAuthority string
    (String) The name of the intermediate certificate authority.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    clientFlag boolean
    (Boolean) Determines whether private certificates are flagged for client use.
    codeSigningFlag boolean
    (Boolean) Determines whether private certificates are flagged for code signing use.
    configType string
    (String) Th configuration type.

    • Constraints: Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.
    countries string[]
    (List) The Country (C) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    createdAt string
    (String) The date when a resource was created. The date format follows RFC 3339.
    createdBy string
    (String) The unique identifier that is associated with the entity that created the secret.

    • Constraints: The maximum length is 128 characters. The minimum length is 4 characters.
    emailProtectionFlag boolean
    (Boolean) Determines whether private certificates are flagged for email protection use.
    enforceHostnames boolean
    (Boolean) Determines whether to enforce only valid host names for common names, DNS Subject Alternative Names, and the host section of email addresses.
    extKeyUsageOids string[]
    (List) A list of extended key usage Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    extKeyUsages string[]
    (List) The allowed extended key usage constraint on private certificates.You can find valid values in the Go x509 package documentation. Omit the ExtKeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    id string
    The unique identifier of the data source.
    instanceId string
    keyBits number
    (Integer) The number of bits to use to generate the private key.Allowable values for RSA keys are: 2048 and 4096. Allowable values for EC keys are: 224, 256, 384, and 521. The default for RSA keys is 2048. The default for EC keys is 256.
    keyType string
    (String) The type of private key to generate.

    • Constraints: Allowable values are: rsa, ec.
    keyUsages string[]
    (List) The allowed key usage constraint to define for private certificates.You can find valid values in the Go x509 package documentation. Omit the KeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    localities string[]
    (List) The Locality (L) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    maxTtlSeconds number
    (Integer) The maximum time-to-live (TTL) for certificates that are created by this CA in seconds.
    name string
    notBeforeDurationSeconds number
    (Integer) The duration in seconds by which to backdate the not_before property of an issued private certificate.
    organizations string[]
    (List) The Organization (O) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ous string[]
    (List) The Organizational Unit (OU) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    policyIdentifiers string[]
    (List) A list of policy Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    postalCodes string[]
    (List) The postal code values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    provinces string[]
    (List) The Province (ST) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    region string
    requireCn boolean
    (Boolean) Determines whether to require a common name to create a private certificate.By default, a common name is required to generate a certificate. To make the common_name field optional, set the require_cn option to false.
    secretType string
    (String) The secret type. Supported types are arbitrary, certificates (imported, public, and private), IAM credentials, key-value, and user credentials.

    • Constraints: Allowable values are: arbitrary, imported_cert, public_cert, iam_credentials, kv, username_password, private_cert.
    serialNumber string
    (String) The serial number to assign to the generated certificate. To assign a random serial number, you can omit this field.

    • Constraints: The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.
    serverFlag boolean
    (Boolean) Determines whether private certificates are flagged for server use.
    streetAddresses string[]
    (List) The street address values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ttlSeconds number
    (Integer) The requested Time To Live, after which the certificate will be expired.
    updatedAt string
    (String) The date when a resource was recently modified. The date format follows RFC 3339.
    useCsrCommonName boolean
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the common name (CN) from a certificate signing request (CSR) instead of the CN that's included in the data of the certificate.Does not include any requested Subject Alternative Names (SANs) in the CSR. To use the alternative names, include the use_csr_sans property.
    useCsrSans boolean
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the Subject Alternative Names(SANs) from a certificate signing request (CSR) instead of the SANs that are included in the data of the certificate.Does not include the common name in the CSR. To use the common name, include the use_csr_common_name property.
    endpointType string
    allow_any_name bool
    (Boolean) Determines whether to allow clients to request a private certificate that matches any common name.
    allow_bare_domains bool
    (Boolean) Determines whether to allow clients to request private certificates that match the value of the actual domains on the final certificate.For example, if you specify example.com in the allowed_domains field, you grant clients the ability to request a certificate that contains the name example.com as one of the DNS values on the final certificate.Important: In some scenarios, allowing bare domains can be considered a security risk.
    allow_glob_domains bool
    (Boolean) Determines whether to allow glob patterns, for example, ftp*.example.com, in the names that are specified in the allowed_domains field.If set to true, clients are allowed to request private certificates with names that match the glob patterns.
    allow_ip_sans bool
    (Boolean) Determines whether to allow clients to request a private certificate with IP Subject Alternative Names.
    allow_localhost bool
    (Boolean) Determines whether to allow localhost to be included as one of the requested common names.
    allow_subdomains bool
    (Boolean) Determines whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This includes wildcard subdomains.For example, if allowed_domains has a value of example.com and allow_subdomainsis set to true, then the following subdomains are allowed: foo.example.com, bar.example.com, *.example.com.Note: This field is redundant if you use the allow_any_name option.
    allowed_domains Sequence[str]
    (List) The domains to define for the certificate template. This property is used along with the allow_bare_domains and allow_subdomains options.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowed_domains_template bool
    (Boolean) Determines whether to allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates.
    allowed_other_sans Sequence[str]
    (List) The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates.The format for each element in the list is the same as OpenSSL: <oid>:<type>:<value> where the current valid type is UTF8. To allow any value for an OID, use * as its value. Alternatively, specify a single * to allow any other_sans input.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowed_secret_groups str
    (String) Scopes the creation of private certificates to only the secret groups that you specify.This field can be supplied as a comma-delimited list of secret group IDs.

    • Constraints: The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.
    allowed_uri_sans Sequence[str]
    (List) The URI Subject Alternative Names to allow for private certificates.Values can contain glob patterns, for example spiffe://hostname/_*.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    basic_constraints_valid_for_non_ca bool
    (Boolean) Determines whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates.
    certificate_authority str
    (String) The name of the intermediate certificate authority.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    client_flag bool
    (Boolean) Determines whether private certificates are flagged for client use.
    code_signing_flag bool
    (Boolean) Determines whether private certificates are flagged for code signing use.
    config_type str
    (String) Th configuration type.

    • Constraints: Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.
    countries Sequence[str]
    (List) The Country (C) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    created_at str
    (String) The date when a resource was created. The date format follows RFC 3339.
    created_by str
    (String) The unique identifier that is associated with the entity that created the secret.

    • Constraints: The maximum length is 128 characters. The minimum length is 4 characters.
    email_protection_flag bool
    (Boolean) Determines whether private certificates are flagged for email protection use.
    enforce_hostnames bool
    (Boolean) Determines whether to enforce only valid host names for common names, DNS Subject Alternative Names, and the host section of email addresses.
    ext_key_usage_oids Sequence[str]
    (List) A list of extended key usage Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    ext_key_usages Sequence[str]
    (List) The allowed extended key usage constraint on private certificates.You can find valid values in the Go x509 package documentation. Omit the ExtKeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    id str
    The unique identifier of the data source.
    instance_id str
    key_bits float
    (Integer) The number of bits to use to generate the private key.Allowable values for RSA keys are: 2048 and 4096. Allowable values for EC keys are: 224, 256, 384, and 521. The default for RSA keys is 2048. The default for EC keys is 256.
    key_type str
    (String) The type of private key to generate.

    • Constraints: Allowable values are: rsa, ec.
    key_usages Sequence[str]
    (List) The allowed key usage constraint to define for private certificates.You can find valid values in the Go x509 package documentation. Omit the KeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    localities Sequence[str]
    (List) The Locality (L) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    max_ttl_seconds float
    (Integer) The maximum time-to-live (TTL) for certificates that are created by this CA in seconds.
    name str
    not_before_duration_seconds float
    (Integer) The duration in seconds by which to backdate the not_before property of an issued private certificate.
    organizations Sequence[str]
    (List) The Organization (O) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ous Sequence[str]
    (List) The Organizational Unit (OU) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    policy_identifiers Sequence[str]
    (List) A list of policy Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    postal_codes Sequence[str]
    (List) The postal code values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    provinces Sequence[str]
    (List) The Province (ST) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    region str
    require_cn bool
    (Boolean) Determines whether to require a common name to create a private certificate.By default, a common name is required to generate a certificate. To make the common_name field optional, set the require_cn option to false.
    secret_type str
    (String) The secret type. Supported types are arbitrary, certificates (imported, public, and private), IAM credentials, key-value, and user credentials.

    • Constraints: Allowable values are: arbitrary, imported_cert, public_cert, iam_credentials, kv, username_password, private_cert.
    serial_number str
    (String) The serial number to assign to the generated certificate. To assign a random serial number, you can omit this field.

    • Constraints: The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.
    server_flag bool
    (Boolean) Determines whether private certificates are flagged for server use.
    street_addresses Sequence[str]
    (List) The street address values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ttl_seconds float
    (Integer) The requested Time To Live, after which the certificate will be expired.
    updated_at str
    (String) The date when a resource was recently modified. The date format follows RFC 3339.
    use_csr_common_name bool
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the common name (CN) from a certificate signing request (CSR) instead of the CN that's included in the data of the certificate.Does not include any requested Subject Alternative Names (SANs) in the CSR. To use the alternative names, include the use_csr_sans property.
    use_csr_sans bool
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the Subject Alternative Names(SANs) from a certificate signing request (CSR) instead of the SANs that are included in the data of the certificate.Does not include the common name in the CSR. To use the common name, include the use_csr_common_name property.
    endpoint_type str
    allowAnyName Boolean
    (Boolean) Determines whether to allow clients to request a private certificate that matches any common name.
    allowBareDomains Boolean
    (Boolean) Determines whether to allow clients to request private certificates that match the value of the actual domains on the final certificate.For example, if you specify example.com in the allowed_domains field, you grant clients the ability to request a certificate that contains the name example.com as one of the DNS values on the final certificate.Important: In some scenarios, allowing bare domains can be considered a security risk.
    allowGlobDomains Boolean
    (Boolean) Determines whether to allow glob patterns, for example, ftp*.example.com, in the names that are specified in the allowed_domains field.If set to true, clients are allowed to request private certificates with names that match the glob patterns.
    allowIpSans Boolean
    (Boolean) Determines whether to allow clients to request a private certificate with IP Subject Alternative Names.
    allowLocalhost Boolean
    (Boolean) Determines whether to allow localhost to be included as one of the requested common names.
    allowSubdomains Boolean
    (Boolean) Determines whether to allow clients to request private certificates with common names (CN) that are subdomains of the CNs that are allowed by the other certificate template options. This includes wildcard subdomains.For example, if allowed_domains has a value of example.com and allow_subdomainsis set to true, then the following subdomains are allowed: foo.example.com, bar.example.com, *.example.com.Note: This field is redundant if you use the allow_any_name option.
    allowedDomains List<String>
    (List) The domains to define for the certificate template. This property is used along with the allow_bare_domains and allow_subdomains options.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowedDomainsTemplate Boolean
    (Boolean) Determines whether to allow the domains that are supplied in the allowed_domains field to contain access control list (ACL) templates.
    allowedOtherSans List<String>
    (List) The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to allow for private certificates.The format for each element in the list is the same as OpenSSL: <oid>:<type>:<value> where the current valid type is UTF8. To allow any value for an OID, use * as its value. Alternatively, specify a single * to allow any other_sans input.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    allowedSecretGroups String
    (String) Scopes the creation of private certificates to only the secret groups that you specify.This field can be supplied as a comma-delimited list of secret group IDs.

    • Constraints: The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.*?)/.
    allowedUriSans List<String>
    (List) The URI Subject Alternative Names to allow for private certificates.Values can contain glob patterns, for example spiffe://hostname/_*.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    basicConstraintsValidForNonCa Boolean
    (Boolean) Determines whether to mark the Basic Constraints extension of an issued private certificate as valid for non-CA certificates.
    certificateAuthority String
    (String) The name of the intermediate certificate authority.

    • Constraints: The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9][A-Za-z0-9]*(?:_?-?\\.?[A-Za-z0-9]+)*$/.
    clientFlag Boolean
    (Boolean) Determines whether private certificates are flagged for client use.
    codeSigningFlag Boolean
    (Boolean) Determines whether private certificates are flagged for code signing use.
    configType String
    (String) Th configuration type.

    • Constraints: Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.
    countries List<String>
    (List) The Country (C) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    createdAt String
    (String) The date when a resource was created. The date format follows RFC 3339.
    createdBy String
    (String) The unique identifier that is associated with the entity that created the secret.

    • Constraints: The maximum length is 128 characters. The minimum length is 4 characters.
    emailProtectionFlag Boolean
    (Boolean) Determines whether private certificates are flagged for email protection use.
    enforceHostnames Boolean
    (Boolean) Determines whether to enforce only valid host names for common names, DNS Subject Alternative Names, and the host section of email addresses.
    extKeyUsageOids List<String>
    (List) A list of extended key usage Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    extKeyUsages List<String>
    (List) The allowed extended key usage constraint on private certificates.You can find valid values in the Go x509 package documentation. Omit the ExtKeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    id String
    The unique identifier of the data source.
    instanceId String
    keyBits Number
    (Integer) The number of bits to use to generate the private key.Allowable values for RSA keys are: 2048 and 4096. Allowable values for EC keys are: 224, 256, 384, and 521. The default for RSA keys is 2048. The default for EC keys is 256.
    keyType String
    (String) The type of private key to generate.

    • Constraints: Allowable values are: rsa, ec.
    keyUsages List<String>
    (List) The allowed key usage constraint to define for private certificates.You can find valid values in the Go x509 package documentation. Omit the KeyUsage part of the value. Values are not case-sensitive. To specify no key usage constraints, set this field to an empty list.

    • Constraints: The list items must match regular expression /^[a-zA-Z]+$/. The maximum length is 100 items. The minimum length is 0 items.
    localities List<String>
    (List) The Locality (L) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    maxTtlSeconds Number
    (Integer) The maximum time-to-live (TTL) for certificates that are created by this CA in seconds.
    name String
    notBeforeDurationSeconds Number
    (Integer) The duration in seconds by which to backdate the not_before property of an issued private certificate.
    organizations List<String>
    (List) The Organization (O) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ous List<String>
    (List) The Organizational Unit (OU) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    policyIdentifiers List<String>
    (List) A list of policy Object Identifiers (OIDs).

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 100 items. The minimum length is 0 items.
    postalCodes List<String>
    (List) The postal code values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    provinces List<String>
    (List) The Province (ST) values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    region String
    requireCn Boolean
    (Boolean) Determines whether to require a common name to create a private certificate.By default, a common name is required to generate a certificate. To make the common_name field optional, set the require_cn option to false.
    secretType String
    (String) The secret type. Supported types are arbitrary, certificates (imported, public, and private), IAM credentials, key-value, and user credentials.

    • Constraints: Allowable values are: arbitrary, imported_cert, public_cert, iam_credentials, kv, username_password, private_cert.
    serialNumber String
    (String) The serial number to assign to the generated certificate. To assign a random serial number, you can omit this field.

    • Constraints: The maximum length is 64 characters. The minimum length is 32 characters. The value must match regular expression /[^a-fA-F0-9]/.
    serverFlag Boolean
    (Boolean) Determines whether private certificates are flagged for server use.
    streetAddresses List<String>
    (List) The street address values to define in the subject field of the resulting certificate.

    • Constraints: The list items must match regular expression /(.*?)/. The maximum length is 10 items. The minimum length is 0 items.
    ttlSeconds Number
    (Integer) The requested Time To Live, after which the certificate will be expired.
    updatedAt String
    (String) The date when a resource was recently modified. The date format follows RFC 3339.
    useCsrCommonName Boolean
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the common name (CN) from a certificate signing request (CSR) instead of the CN that's included in the data of the certificate.Does not include any requested Subject Alternative Names (SANs) in the CSR. To use the alternative names, include the use_csr_sans property.
    useCsrSans Boolean
    (Boolean) When used with the private_cert_configuration_action_sign_csr action, this field determines whether to use the Subject Alternative Names(SANs) from a certificate signing request (CSR) instead of the SANs that are included in the data of the certificate.Does not include the common name in the CSR. To use the common name, include the use_csr_common_name property.
    endpointType String

    Package Details

    Repository
    ibm ibm-cloud/terraform-provider-ibm
    License
    Notes
    This Pulumi package is based on the ibm Terraform Provider.
    ibm logo
    ibm 1.78.0 published on Wednesday, Apr 30, 2025 by ibm-cloud
    ibm-cloud/terraform-provider-ibm