Class: Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/cloud/security/privateca/v1/resources.rb

Overview

Defines controls over all certificate issuance within a CaPool.

Defined Under Namespace

Classes: AllowedKeyType, IssuanceModes

Instance Attribute Summary collapse

Instance Attribute Details

#allowed_issuance_modes ⇒ ::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes

Returns Optional. If specified, then only methods allowed in the IssuanceModes may be used to issue Certificates.

Returns:



490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
 
# File 'proto_docs/google/cloud/security/privateca/v1/resources.rb', line 490

class IssuancePolicy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Describes a "type" of key that may be used in a
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
  # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. Note that a single
  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType}
  # may refer to either a fully-qualified key algorithm, such as RSA 4096, or
  # a family of key algorithms, such as any RSA key.
  # @!attribute [rw] rsa
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
  #     Represents an allowed RSA key type.
  #
  #     Note: The following fields are mutually exclusive: `rsa`, `elliptic_curve`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  # @!attribute [rw] elliptic_curve
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
  #     Represents an allowed Elliptic Curve key type.
  #
  #     Note: The following fields are mutually exclusive: `elliptic_curve`, `rsa`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  class AllowedKeyType
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # Describes an RSA key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] min_modulus_size
    #   @return [::Integer]
    #     Optional. The minimum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service-level min RSA
    #     modulus size will continue to apply.
    # @!attribute [rw] max_modulus_size
    #   @return [::Integer]
    #     Optional. The maximum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service will not enforce
    #     an explicit upper bound on RSA modulus sizes.
    class RsaKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Describes an Elliptic Curve key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] signature_algorithm
    #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
    #     Optional. A signature algorithm that must be used. If this is
    #     omitted, any EC-based signature algorithm will be allowed.
    class EcKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # Describes an elliptic curve-based signature algorithm that may be
      # used in a
      # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
      # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
      module EcSignatureAlgorithm
        # Not specified. Signifies that any signature algorithm may be used.
        EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-256 curve.
        ECDSA_P256 = 1

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-384 curve.
        ECDSA_P384 = 2

        # Refers to the Edwards-curve Digital Signature Algorithm over curve
        # 25519, as described in RFC 8410.
        EDDSA_25519 = 3
      end
    end
  end

  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes}
  # specifies the allowed ways in which
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be
  # requested from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
  # @!attribute [rw] allow_csr_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a CSR.
  # @!attribute [rw] allow_config_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a
  #     {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
  class IssuanceModes
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#allowed_key_types ⇒ ::Array<::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType>

Returns Optional. If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used.

Returns:



490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
 
# File 'proto_docs/google/cloud/security/privateca/v1/resources.rb', line 490

class IssuancePolicy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Describes a "type" of key that may be used in a
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
  # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. Note that a single
  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType}
  # may refer to either a fully-qualified key algorithm, such as RSA 4096, or
  # a family of key algorithms, such as any RSA key.
  # @!attribute [rw] rsa
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
  #     Represents an allowed RSA key type.
  #
  #     Note: The following fields are mutually exclusive: `rsa`, `elliptic_curve`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  # @!attribute [rw] elliptic_curve
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
  #     Represents an allowed Elliptic Curve key type.
  #
  #     Note: The following fields are mutually exclusive: `elliptic_curve`, `rsa`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  class AllowedKeyType
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # Describes an RSA key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] min_modulus_size
    #   @return [::Integer]
    #     Optional. The minimum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service-level min RSA
    #     modulus size will continue to apply.
    # @!attribute [rw] max_modulus_size
    #   @return [::Integer]
    #     Optional. The maximum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service will not enforce
    #     an explicit upper bound on RSA modulus sizes.
    class RsaKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Describes an Elliptic Curve key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] signature_algorithm
    #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
    #     Optional. A signature algorithm that must be used. If this is
    #     omitted, any EC-based signature algorithm will be allowed.
    class EcKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # Describes an elliptic curve-based signature algorithm that may be
      # used in a
      # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
      # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
      module EcSignatureAlgorithm
        # Not specified. Signifies that any signature algorithm may be used.
        EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-256 curve.
        ECDSA_P256 = 1

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-384 curve.
        ECDSA_P384 = 2

        # Refers to the Edwards-curve Digital Signature Algorithm over curve
        # 25519, as described in RFC 8410.
        EDDSA_25519 = 3
      end
    end
  end

  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes}
  # specifies the allowed ways in which
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be
  # requested from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
  # @!attribute [rw] allow_csr_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a CSR.
  # @!attribute [rw] allow_config_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a
  #     {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
  class IssuanceModes
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#backdate_duration ⇒ ::Google::Protobuf::Duration

Returns Optional. The duration to backdate all certificates issued from this CaPool. If not set, the certificates will be issued with a not_before_time of the issuance time (i.e. the current time). If set, the certificates will be issued with a not_before_time of the issuance time minus the backdate_duration. The not_after_time will be adjusted to preserve the requested lifetime. The backdate_duration must be less than or equal to 48 hours.

Returns:

  • (::Google::Protobuf::Duration) —

    Optional. The duration to backdate all certificates issued from this CaPool. If not set, the certificates will be issued with a not_before_time of the issuance time (i.e. the current time). If set, the certificates will be issued with a not_before_time of the issuance time minus the backdate_duration. The not_after_time will be adjusted to preserve the requested lifetime. The backdate_duration must be less than or equal to 48 hours.



490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
 
# File 'proto_docs/google/cloud/security/privateca/v1/resources.rb', line 490

class IssuancePolicy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Describes a "type" of key that may be used in a
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
  # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. Note that a single
  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType}
  # may refer to either a fully-qualified key algorithm, such as RSA 4096, or
  # a family of key algorithms, such as any RSA key.
  # @!attribute [rw] rsa
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
  #     Represents an allowed RSA key type.
  #
  #     Note: The following fields are mutually exclusive: `rsa`, `elliptic_curve`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  # @!attribute [rw] elliptic_curve
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
  #     Represents an allowed Elliptic Curve key type.
  #
  #     Note: The following fields are mutually exclusive: `elliptic_curve`, `rsa`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  class AllowedKeyType
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # Describes an RSA key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] min_modulus_size
    #   @return [::Integer]
    #     Optional. The minimum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service-level min RSA
    #     modulus size will continue to apply.
    # @!attribute [rw] max_modulus_size
    #   @return [::Integer]
    #     Optional. The maximum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service will not enforce
    #     an explicit upper bound on RSA modulus sizes.
    class RsaKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Describes an Elliptic Curve key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] signature_algorithm
    #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
    #     Optional. A signature algorithm that must be used. If this is
    #     omitted, any EC-based signature algorithm will be allowed.
    class EcKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # Describes an elliptic curve-based signature algorithm that may be
      # used in a
      # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
      # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
      module EcSignatureAlgorithm
        # Not specified. Signifies that any signature algorithm may be used.
        EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-256 curve.
        ECDSA_P256 = 1

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-384 curve.
        ECDSA_P384 = 2

        # Refers to the Edwards-curve Digital Signature Algorithm over curve
        # 25519, as described in RFC 8410.
        EDDSA_25519 = 3
      end
    end
  end

  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes}
  # specifies the allowed ways in which
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be
  # requested from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
  # @!attribute [rw] allow_csr_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a CSR.
  # @!attribute [rw] allow_config_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a
  #     {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
  class IssuanceModes
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#baseline_values ⇒ ::Google::Cloud::Security::PrivateCA::V1::X509Parameters

Returns Optional. A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a CertificateTemplate that defines conflicting predefined_values for the same properties, the certificate issuance request will fail.

Returns:



490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
 
# File 'proto_docs/google/cloud/security/privateca/v1/resources.rb', line 490

class IssuancePolicy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Describes a "type" of key that may be used in a
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
  # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. Note that a single
  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType}
  # may refer to either a fully-qualified key algorithm, such as RSA 4096, or
  # a family of key algorithms, such as any RSA key.
  # @!attribute [rw] rsa
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
  #     Represents an allowed RSA key type.
  #
  #     Note: The following fields are mutually exclusive: `rsa`, `elliptic_curve`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  # @!attribute [rw] elliptic_curve
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
  #     Represents an allowed Elliptic Curve key type.
  #
  #     Note: The following fields are mutually exclusive: `elliptic_curve`, `rsa`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  class AllowedKeyType
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # Describes an RSA key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] min_modulus_size
    #   @return [::Integer]
    #     Optional. The minimum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service-level min RSA
    #     modulus size will continue to apply.
    # @!attribute [rw] max_modulus_size
    #   @return [::Integer]
    #     Optional. The maximum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service will not enforce
    #     an explicit upper bound on RSA modulus sizes.
    class RsaKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Describes an Elliptic Curve key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] signature_algorithm
    #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
    #     Optional. A signature algorithm that must be used. If this is
    #     omitted, any EC-based signature algorithm will be allowed.
    class EcKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # Describes an elliptic curve-based signature algorithm that may be
      # used in a
      # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
      # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
      module EcSignatureAlgorithm
        # Not specified. Signifies that any signature algorithm may be used.
        EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-256 curve.
        ECDSA_P256 = 1

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-384 curve.
        ECDSA_P384 = 2

        # Refers to the Edwards-curve Digital Signature Algorithm over curve
        # 25519, as described in RFC 8410.
        EDDSA_25519 = 3
      end
    end
  end

  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes}
  # specifies the allowed ways in which
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be
  # requested from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
  # @!attribute [rw] allow_csr_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a CSR.
  # @!attribute [rw] allow_config_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a
  #     {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
  class IssuanceModes
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#identity_constraints ⇒ ::Google::Cloud::Security::PrivateCA::V1::CertificateIdentityConstraints

Returns Optional. Describes constraints on identities that may appear in Certificates issued through this CaPool. If this is omitted, then this CaPool will not add restrictions on a certificate's identity.

Returns:



490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
 
# File 'proto_docs/google/cloud/security/privateca/v1/resources.rb', line 490

class IssuancePolicy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Describes a "type" of key that may be used in a
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
  # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. Note that a single
  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType}
  # may refer to either a fully-qualified key algorithm, such as RSA 4096, or
  # a family of key algorithms, such as any RSA key.
  # @!attribute [rw] rsa
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
  #     Represents an allowed RSA key type.
  #
  #     Note: The following fields are mutually exclusive: `rsa`, `elliptic_curve`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  # @!attribute [rw] elliptic_curve
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
  #     Represents an allowed Elliptic Curve key type.
  #
  #     Note: The following fields are mutually exclusive: `elliptic_curve`, `rsa`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  class AllowedKeyType
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # Describes an RSA key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] min_modulus_size
    #   @return [::Integer]
    #     Optional. The minimum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service-level min RSA
    #     modulus size will continue to apply.
    # @!attribute [rw] max_modulus_size
    #   @return [::Integer]
    #     Optional. The maximum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service will not enforce
    #     an explicit upper bound on RSA modulus sizes.
    class RsaKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Describes an Elliptic Curve key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] signature_algorithm
    #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
    #     Optional. A signature algorithm that must be used. If this is
    #     omitted, any EC-based signature algorithm will be allowed.
    class EcKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # Describes an elliptic curve-based signature algorithm that may be
      # used in a
      # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
      # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
      module EcSignatureAlgorithm
        # Not specified. Signifies that any signature algorithm may be used.
        EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-256 curve.
        ECDSA_P256 = 1

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-384 curve.
        ECDSA_P384 = 2

        # Refers to the Edwards-curve Digital Signature Algorithm over curve
        # 25519, as described in RFC 8410.
        EDDSA_25519 = 3
      end
    end
  end

  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes}
  # specifies the allowed ways in which
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be
  # requested from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
  # @!attribute [rw] allow_csr_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a CSR.
  # @!attribute [rw] allow_config_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a
  #     {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
  class IssuanceModes
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#maximum_lifetime ⇒ ::Google::Protobuf::Duration

Returns Optional. The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority expires before a Certificate resource's requested maximum_lifetime, the effective lifetime will be explicitly truncated to match it.

Returns:



490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
 
# File 'proto_docs/google/cloud/security/privateca/v1/resources.rb', line 490

class IssuancePolicy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Describes a "type" of key that may be used in a
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
  # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. Note that a single
  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType}
  # may refer to either a fully-qualified key algorithm, such as RSA 4096, or
  # a family of key algorithms, such as any RSA key.
  # @!attribute [rw] rsa
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
  #     Represents an allowed RSA key type.
  #
  #     Note: The following fields are mutually exclusive: `rsa`, `elliptic_curve`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  # @!attribute [rw] elliptic_curve
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
  #     Represents an allowed Elliptic Curve key type.
  #
  #     Note: The following fields are mutually exclusive: `elliptic_curve`, `rsa`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  class AllowedKeyType
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # Describes an RSA key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] min_modulus_size
    #   @return [::Integer]
    #     Optional. The minimum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service-level min RSA
    #     modulus size will continue to apply.
    # @!attribute [rw] max_modulus_size
    #   @return [::Integer]
    #     Optional. The maximum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service will not enforce
    #     an explicit upper bound on RSA modulus sizes.
    class RsaKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Describes an Elliptic Curve key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] signature_algorithm
    #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
    #     Optional. A signature algorithm that must be used. If this is
    #     omitted, any EC-based signature algorithm will be allowed.
    class EcKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # Describes an elliptic curve-based signature algorithm that may be
      # used in a
      # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
      # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
      module EcSignatureAlgorithm
        # Not specified. Signifies that any signature algorithm may be used.
        EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-256 curve.
        ECDSA_P256 = 1

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-384 curve.
        ECDSA_P384 = 2

        # Refers to the Edwards-curve Digital Signature Algorithm over curve
        # 25519, as described in RFC 8410.
        EDDSA_25519 = 3
      end
    end
  end

  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes}
  # specifies the allowed ways in which
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be
  # requested from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
  # @!attribute [rw] allow_csr_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a CSR.
  # @!attribute [rw] allow_config_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a
  #     {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
  class IssuanceModes
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#passthrough_extensions ⇒ ::Google::Cloud::Security::PrivateCA::V1::CertificateExtensionConstraints

Returns Optional. Describes the set of X.509 extensions that may appear in a Certificate issued through this CaPool. If a certificate request sets extensions that don't appear in the passthrough_extensions, those extensions will be dropped. If a certificate request uses a CertificateTemplate with predefined_values that don't appear here, the certificate issuance request will fail. If this is omitted, then this CaPool will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this CaPool's baseline_values.

Returns:



490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
 
# File 'proto_docs/google/cloud/security/privateca/v1/resources.rb', line 490

class IssuancePolicy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Describes a "type" of key that may be used in a
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued from
  # a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}. Note that a single
  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType AllowedKeyType}
  # may refer to either a fully-qualified key algorithm, such as RSA 4096, or
  # a family of key algorithms, such as any RSA key.
  # @!attribute [rw] rsa
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::RsaKeyType]
  #     Represents an allowed RSA key type.
  #
  #     Note: The following fields are mutually exclusive: `rsa`, `elliptic_curve`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  # @!attribute [rw] elliptic_curve
  #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType]
  #     Represents an allowed Elliptic Curve key type.
  #
  #     Note: The following fields are mutually exclusive: `elliptic_curve`, `rsa`. If a field in that set is populated, all other fields in the set will automatically be cleared.
  class AllowedKeyType
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # Describes an RSA key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] min_modulus_size
    #   @return [::Integer]
    #     Optional. The minimum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service-level min RSA
    #     modulus size will continue to apply.
    # @!attribute [rw] max_modulus_size
    #   @return [::Integer]
    #     Optional. The maximum allowed RSA modulus size (inclusive), in bits.
    #     If this is not set, or if set to zero, the service will not enforce
    #     an explicit upper bound on RSA modulus sizes.
    class RsaKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Describes an Elliptic Curve key that may be used in a
    # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
    # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
    # @!attribute [rw] signature_algorithm
    #   @return [::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::AllowedKeyType::EcKeyType::EcSignatureAlgorithm]
    #     Optional. A signature algorithm that must be used. If this is
    #     omitted, any EC-based signature algorithm will be allowed.
    class EcKeyType
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # Describes an elliptic curve-based signature algorithm that may be
      # used in a
      # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificate} issued
      # from a {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
      module EcSignatureAlgorithm
        # Not specified. Signifies that any signature algorithm may be used.
        EC_SIGNATURE_ALGORITHM_UNSPECIFIED = 0

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-256 curve.
        ECDSA_P256 = 1

        # Refers to the Elliptic Curve Digital Signature Algorithm over the
        # NIST P-384 curve.
        ECDSA_P384 = 2

        # Refers to the Edwards-curve Digital Signature Algorithm over curve
        # 25519, as described in RFC 8410.
        EDDSA_25519 = 3
      end
    end
  end

  # {::Google::Cloud::Security::PrivateCA::V1::CaPool::IssuancePolicy::IssuanceModes IssuanceModes}
  # specifies the allowed ways in which
  # {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} may be
  # requested from this {::Google::Cloud::Security::PrivateCA::V1::CaPool CaPool}.
  # @!attribute [rw] allow_csr_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a CSR.
  # @!attribute [rw] allow_config_based_issuance
  #   @return [::Boolean]
  #     Optional. When true, allows callers to create
  #     {::Google::Cloud::Security::PrivateCA::V1::Certificate Certificates} by
  #     specifying a
  #     {::Google::Cloud::Security::PrivateCA::V1::CertificateConfig CertificateConfig}.
  class IssuanceModes
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end