Skip to content

Commit cd7fed3

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add RDN sequence
feat: add User Defined Access URLs feat: add backdate duration feat: adds tbs_certificate_digest to CertificateDescription PiperOrigin-RevId: 780300269
1 parent 15c2796 commit cd7fed3

File tree

3 files changed

+210
-60
lines changed

3 files changed

+210
-60
lines changed

‎google/cloud/security/privateca/v1/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ proto_library(
2828
"//google/api:annotations_proto",
2929
"//google/api:client_proto",
3030
"//google/api:field_behavior_proto",
31+
"//google/api:field_info_proto",
3132
"//google/api:resource_proto",
3233
"//google/longrunning:operations_proto",
3334
"//google/type:expr_proto",

‎google/cloud/security/privateca/v1/resources.proto‎

Lines changed: 143 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import "google/protobuf/duration.proto";
2222
import "google/protobuf/timestamp.proto";
2323
import "google/type/expr.proto";
2424

25-
option cc_enable_arenas = true;
2625
option csharp_namespace = "Google.Cloud.Security.PrivateCA.V1";
2726
option go_package = "cloud.google.com/go/security/privateca/apiv1/privatecapb;privatecapb";
2827
option java_multiple_files = true;
@@ -180,10 +179,32 @@ message CertificateAuthority {
180179
EC_P384_SHA384 = 5;
181180
}
182181

183-
// Output only. The resource name for this
182+
// User-defined URLs for accessing content published by this
183+
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority].
184+
message UserDefinedAccessUrls {
185+
// Optional. A list of URLs where the issuer CA certificate may be
186+
// downloaded, which appears in the "Authority Information Access" extension
187+
// in the certificate. If specified, the default [Cloud Storage
188+
// URLs][google.cloud.security.privateca.v1.CertificateAuthority.AccessUrls.ca_certificate_access_url]
189+
// will be omitted.
190+
repeated string aia_issuing_certificate_urls = 1
191+
[(google.api.field_behavior) = OPTIONAL];
192+
193+
// Optional. A list of URLs where to obtain CRL information, i.e.
194+
// the DistributionPoint.fullName described by
195+
// https://tools.ietf.org/html/rfc5280#section-4.2.1.13.
196+
// If specified, the default
197+
// [Cloud Storage
198+
// URLs][google.cloud.security.privateca.v1.CertificateAuthority.AccessUrls.crl_access_urls]
199+
// will be omitted.
200+
repeated string crl_access_urls = 2
201+
[(google.api.field_behavior) = OPTIONAL];
202+
}
203+
204+
// Identifier. The resource name for this
184205
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
185206
// in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
186-
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
207+
string name = 1 [(google.api.field_behavior) = IDENTIFIER];
187208

188209
// Required. Immutable. The
189210
// [Type][google.cloud.security.privateca.v1.CertificateAuthority.Type] of
@@ -302,6 +323,18 @@ message CertificateAuthority {
302323

303324
// Optional. Labels with user-defined metadata.
304325
map<string, string> labels = 17 [(google.api.field_behavior) = OPTIONAL];
326+
327+
// Optional. User-defined URLs for CA certificate and CRLs. The service does
328+
// not publish content to these URLs. It is up to the user to mirror content
329+
// to these URLs.
330+
UserDefinedAccessUrls user_defined_access_urls = 18
331+
[(google.api.field_behavior) = OPTIONAL];
332+
333+
// Output only. Reserved for future use.
334+
bool satisfies_pzs = 19 [(google.api.field_behavior) = OUTPUT_ONLY];
335+
336+
// Output only. Reserved for future use.
337+
bool satisfies_pzi = 20 [(google.api.field_behavior) = OUTPUT_ONLY];
305338
}
306339

307340
// A [CaPool][google.cloud.security.privateca.v1.CaPool] represents a group of
@@ -472,6 +505,16 @@ message CaPool {
472505
repeated AllowedKeyType allowed_key_types = 1
473506
[(google.api.field_behavior) = OPTIONAL];
474507

508+
// Optional. The duration to backdate all certificates issued from this
509+
// [CaPool][google.cloud.security.privateca.v1.CaPool]. If not set, the
510+
// certificates will be issued with a not_before_time of the issuance time
511+
// (i.e. the current time). If set, the certificates will be issued with a
512+
// not_before_time of the issuance time minus the backdate_duration. The
513+
// not_after_time will be adjusted to preserve the requested lifetime. The
514+
// backdate_duration must be less than or equal to 48 hours.
515+
google.protobuf.Duration backdate_duration = 7
516+
[(google.api.field_behavior) = OPTIONAL];
517+
475518
// Optional. The maximum lifetime allowed for issued
476519
// [Certificates][google.cloud.security.privateca.v1.Certificate]. Note that
477520
// if the issuing
@@ -529,10 +572,10 @@ message CaPool {
529572
[(google.api.field_behavior) = OPTIONAL];
530573
}
531574

532-
// Output only. The resource name for this
575+
// Identifier. The resource name for this
533576
// [CaPool][google.cloud.security.privateca.v1.CaPool] in the format
534577
// `projects/*/locations/*/caPools/*`.
535-
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
578+
string name = 1 [(google.api.field_behavior) = IDENTIFIER];
536579

537580
// Required. Immutable. The
538581
// [Tier][google.cloud.security.privateca.v1.CaPool.Tier] of this
@@ -610,11 +653,11 @@ message CertificateRevocationList {
610653
SUPERSEDED = 2;
611654
}
612655

613-
// Output only. The resource name for this
656+
// Identifier. The resource name for this
614657
// [CertificateRevocationList][google.cloud.security.privateca.v1.CertificateRevocationList]
615658
// in the format `projects/*/locations/*/caPools/*certificateAuthorities/*/
616659
// certificateRevocationLists/*`.
617-
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
660+
string name = 1 [(google.api.field_behavior) = IDENTIFIER];
618661

619662
// Output only. The CRL sequence number that appears in pem_crl.
620663
int64 sequence_number = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
@@ -680,15 +723,10 @@ message Certificate {
680723
google.protobuf.Timestamp revocation_time = 2;
681724
}
682725

683-
// Output only. The resource name for this
726+
// Identifier. The resource name for this
684727
// [Certificate][google.cloud.security.privateca.v1.Certificate] in the format
685728
// `projects/*/locations/*/caPools/*/certificates/*`.
686-
string name = 1 [
687-
(google.api.field_behavior) = OUTPUT_ONLY,
688-
(google.api.resource_reference) = {
689-
type: "privateca.googleapis.com/Certificate"
690-
}
691-
];
729+
string name = 1 [(google.api.field_behavior) = IDENTIFIER];
692730

693731
// The config used to create a signed X.509 certificate.
694732
oneof certificate_config {
@@ -782,15 +820,10 @@ message CertificateTemplate {
782820
pattern: "projects/{project}/locations/{location}/certificateTemplates/{certificate_template}"
783821
};
784822

785-
// Output only. The resource name for this
823+
// Identifier. The resource name for this
786824
// [CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
787825
// in the format `projects/*/locations/*/certificateTemplates/*`.
788-
string name = 1 [
789-
(google.api.field_behavior) = OUTPUT_ONLY,
790-
(google.api.resource_reference) = {
791-
type: "privateca.googleapis.com/CertificateTemplate"
792-
}
793-
];
826+
string name = 1 [(google.api.field_behavior) = IDENTIFIER];
794827

795828
// Optional. The maximum lifetime allowed for issued
796829
// [Certificates][google.cloud.security.privateca.v1.Certificate] that use
@@ -873,19 +906,19 @@ message CertificateTemplate {
873906
// usage fields, fields specific to CA certificates, certificate policy
874907
// extensions and custom extensions.
875908
message X509Parameters {
876-
// Describes values that are relevant in a CA certificate.
909+
// Describes the X.509 basic constraints extension, per [RFC 5280
910+
// section 4.2.1.9](https://tools.ietf.org/html/rfc5280#section-4.2.1.9)
877911
message CaOptions {
878-
// Optional. Refers to the "CA" X.509 extension, which is a boolean value.
879-
// When this value is missing, the extension will be omitted from the CA
880-
// certificate.
912+
// Optional. Refers to the "CA" boolean field in the X.509 extension.
913+
// When this value is missing, the basic constraints extension will be
914+
// omitted from the certificate.
881915
optional bool is_ca = 1 [(google.api.field_behavior) = OPTIONAL];
882916

883-
// Optional. Refers to the path length restriction X.509 extension. For a CA
884-
// certificate, this value describes the depth of subordinate CA
885-
// certificates that are allowed.
886-
// If this value is less than 0, the request will fail.
887-
// If this value is missing, the max path length will be omitted from the
888-
// CA certificate.
917+
// Optional. Refers to the path length constraint field in the X.509
918+
// extension. For a CA certificate, this value describes the depth of
919+
// subordinate CA certificates that are allowed. If this value is less than
920+
// 0, the request will fail. If this value is missing, the max path length
921+
// will be omitted from the certificate.
889922
optional int32 max_issuer_path_length = 2
890923
[(google.api.field_behavior) = OPTIONAL];
891924
}
@@ -951,7 +984,9 @@ message X509Parameters {
951984

952985
// Optional. Describes options in this
953986
// [X509Parameters][google.cloud.security.privateca.v1.X509Parameters] that
954-
// are relevant in a CA certificate.
987+
// are relevant in a CA certificate. If not specified, a default basic
988+
// constraints extension with `is_ca=false` will be added for leaf
989+
// certificates.
955990
CaOptions ca_options = 2 [(google.api.field_behavior) = OPTIONAL];
956991

957992
// Optional. Describes the X.509 certificate policy object identifiers, per
@@ -1163,6 +1198,12 @@ message CertificateDescription {
11631198

11641199
// The hash of the x.509 certificate.
11651200
CertificateFingerprint cert_fingerprint = 8;
1201+
1202+
// The hash of the pre-signed certificate, which will be signed by the CA.
1203+
// Corresponds to the TBS Certificate in
1204+
// https://tools.ietf.org/html/rfc5280#section-4.1.2. The field will always be
1205+
// populated.
1206+
string tbs_certificate_digest = 9;
11661207
}
11671208

11681209
// An [ObjectId][google.cloud.security.privateca.v1.ObjectId] specifies an
@@ -1267,6 +1308,31 @@ message KeyUsage {
12671308
repeated ObjectId unknown_extended_key_usages = 3;
12681309
}
12691310

1311+
// [AttributeTypeAndValue][google.cloud.security.privateca.v1.AttributeTypeAndValue]
1312+
// specifies an attribute type and value. It can use either a OID or enum value
1313+
// to specify the attribute type.
1314+
message AttributeTypeAndValue {
1315+
// The attribute type for the attribute and value pair.
1316+
oneof attribute_type {
1317+
// The attribute type of the attribute and value pair.
1318+
AttributeType type = 1;
1319+
1320+
// Object ID for an attribute type of an attribute and value pair.
1321+
ObjectId object_id = 2;
1322+
}
1323+
1324+
// The value for the attribute type.
1325+
string value = 3;
1326+
}
1327+
1328+
// [RelativeDistinguishedName][google.cloud.security.privateca.v1.RelativeDistinguishedName]
1329+
// specifies a relative distinguished name which will be used to build a
1330+
// distinguished name.
1331+
message RelativeDistinguishedName {
1332+
// Attributes describes the attribute value assertions in the RDN.
1333+
repeated AttributeTypeAndValue attributes = 1;
1334+
}
1335+
12701336
// [Subject][google.cloud.security.privateca.v1.Subject] describes parts of a
12711337
// distinguished name that, in turn, describes the subject of the certificate.
12721338
message Subject {
@@ -1293,6 +1359,9 @@ message Subject {
12931359

12941360
// The postal code of the subject.
12951361
string postal_code = 8;
1362+
1363+
// This field can be used in place of the named subject fields.
1364+
repeated RelativeDistinguishedName rdn_sequence = 9;
12961365
}
12971366

12981367
// [SubjectAltNames][google.cloud.security.privateca.v1.SubjectAltNames]
@@ -1419,6 +1488,37 @@ message CertificateExtensionConstraints {
14191488
[(google.api.field_behavior) = OPTIONAL];
14201489
}
14211490

1491+
// [AttributeType][google.cloud.security.privateca.v1.AttributeType] specifies
1492+
// the type of Attribute in a relative distinguished name.
1493+
enum AttributeType {
1494+
// Attribute type is unspecified.
1495+
ATTRIBUTE_TYPE_UNSPECIFIED = 0;
1496+
1497+
// The "common name" of the subject.
1498+
COMMON_NAME = 1;
1499+
1500+
// The country code of the subject.
1501+
COUNTRY_CODE = 2;
1502+
1503+
// The organization of the subject.
1504+
ORGANIZATION = 3;
1505+
1506+
// The organizational unit of the subject.
1507+
ORGANIZATIONAL_UNIT = 4;
1508+
1509+
// The locality or city of the subject.
1510+
LOCALITY = 5;
1511+
1512+
// The province, territory, or regional state of the subject.
1513+
PROVINCE = 6;
1514+
1515+
// The street address of the subject.
1516+
STREET_ADDRESS = 7;
1517+
1518+
// The postal code of the subject.
1519+
POSTAL_CODE = 8;
1520+
}
1521+
14221522
// A [RevocationReason][google.cloud.security.privateca.v1.RevocationReason]
14231523
// indicates whether a
14241524
// [Certificate][google.cloud.security.privateca.v1.Certificate] has been
@@ -1484,6 +1584,17 @@ enum SubjectRequestMode {
14841584
// the `privateca.certificates.create` permission.
14851585
DEFAULT = 1;
14861586

1587+
// A mode used to get an accurate representation of the Subject
1588+
// field's distinguished name. Indicates that the certificate's
1589+
// [Subject][google.cloud.security.privateca.v1.Subject] and/or
1590+
// [SubjectAltNames][google.cloud.security.privateca.v1.SubjectAltNames] are
1591+
// specified in the certificate request. When parsing a PEM CSR this mode will
1592+
// maintain the sequence of RDNs found in the CSR's subject field in the
1593+
// issued [Certificate][google.cloud.security.privateca.v1.Certificate]. This
1594+
// mode requires the caller to have the `privateca.certificates.create`
1595+
// permission.
1596+
RDN_SEQUENCE = 3;
1597+
14871598
// A mode reserved for special cases. Indicates that the certificate should
14881599
// have one SPIFFE
14891600
// [SubjectAltNames][google.cloud.security.privateca.v1.SubjectAltNames] set

0 commit comments

Comments
 (0)