Skip to content

Commit

Permalink
feat: Add encoding format to `.google.cloud.security.privateca.v1.CaP…
Browse files Browse the repository at this point in the history 
…ool` Resource

docs: A comment for field `maximum_lifetime` in message `.google.cloud.security.privateca.v1.CaPool` is changed
docs: A comment for field `maximum_lifetime` in message `.google.cloud.security.privateca.v1.CertificateTemplate` is changed
docs: A comment for field `subject_key_id` in message `.google.cloud.security.privateca.v1.CertificateConfig` is changed
docs: A comment for method `FetchCaCerts` in service `CertificateAuthorityService` is changed
docs: A comment for field `ignore_dependent_resources` in message `.google.cloud.security.privateca.v1.DisableCertificateAuthorityRequest` is changed
docs: A comment for field `ignore_dependent_resources` in message `.google.cloud.security.privateca.v1.DeleteCertificateAuthorityRequest` is changed
docs: A comment for field `ignore_dependent_resources` in message `.google.cloud.security.privateca.v1.DeleteCaPoolRequest` is changed
docs: A comment for field `ca_certs` in message `.google.cloud.security.privateca.v1.FetchCaCertsResponse` is changed

PiperOrigin-RevId: 620969058
  • Loading branch information
Google APIs authored and Copybara-Service committed Apr 1, 2024
1 parent 3644169 commit 8d326d5
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 12 deletions.
34 changes: 28 additions & 6 deletions google/cloud/security/privateca/v1/resources.proto
View file
Expand Up @@ -338,6 +338,22 @@ message CaPool {
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
// in the [CaPool][google.cloud.security.privateca.v1.CaPool].
message PublishingOptions {
// Supported encoding formats for publishing.
enum EncodingFormat {
// Not specified. By default, PEM format will be used.
ENCODING_FORMAT_UNSPECIFIED = 0;

// The
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
// CA certificate and CRLs will be published in PEM format.
PEM = 1;

// The
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
// CA certificate and CRLs will be published in DER format.
DER = 2;
}

// Optional. When true, publishes each
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
// CA certificate and includes its URL in the "Authority Information Access"
Expand All @@ -357,6 +373,12 @@ message CaPool {
// days from their creation. However, we will rebuild daily. CRLs are also
// rebuilt shortly after a certificate is revoked.
bool publish_crl = 2 [(google.api.field_behavior) = OPTIONAL];

// Optional. Specifies the encoding format of each
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
// resource's CA certificate and CRLs. If this is omitted, CA certificates
// and CRLs will be published in PEM.
EncodingFormat encoding_format = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Defines controls over all certificate issuance within a
Expand Down Expand Up @@ -455,9 +477,9 @@ message CaPool {
// if the issuing
// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
// expires before a
// [Certificate][google.cloud.security.privateca.v1.Certificate]'s requested
// maximum_lifetime, the effective lifetime will be explicitly truncated to
// match it.
// [Certificate][google.cloud.security.privateca.v1.Certificate] resource's
// requested maximum_lifetime, the effective lifetime will be explicitly
// truncated to match it.
google.protobuf.Duration maximum_lifetime = 2
[(google.api.field_behavior) = OPTIONAL];

Expand Down Expand Up @@ -773,7 +795,7 @@ message CertificateTemplate {
// Optional. The maximum lifetime allowed for issued
// [Certificates][google.cloud.security.privateca.v1.Certificate] that use
// this template. If the issuing
// [CaPool][google.cloud.security.privateca.v1.CaPool]'s
// [CaPool][google.cloud.security.privateca.v1.CaPool] resource's
// [IssuancePolicy][google.cloud.security.privateca.v1.CaPool.IssuancePolicy]
// specifies a
// [maximum_lifetime][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.maximum_lifetime]
Expand Down Expand Up @@ -1062,8 +1084,8 @@ message CertificateConfig {

// Optional. When specified this provides a custom SKI to be used in the
// certificate. This should only be used to maintain a SKI of an existing CA
// originally created outside CAS, which was not generated using method (1)
// described in RFC 5280 section 4.2.1.2.
// originally created outside CA service, which was not generated using method
// (1) described in RFC 5280 section 4.2.1.2.
KeyId subject_key_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

Expand Down
12 changes: 6 additions & 6 deletions google/cloud/security/privateca/v1/service.proto
View file
Expand Up @@ -301,7 +301,7 @@ service CertificateAuthorityService {

// FetchCaCerts returns the current trust anchor for the
// [CaPool][google.cloud.security.privateca.v1.CaPool]. This will include CA
// certificate chains for all Certificate Authorities in the ENABLED,
// certificate chains for all certificate authorities in the ENABLED,
// DISABLED, or STAGED states.
rpc FetchCaCerts(FetchCaCertsRequest) returns (FetchCaCertsResponse) {
option (google.api.http) = {
Expand Down Expand Up @@ -723,7 +723,7 @@ message DisableCertificateAuthorityRequest {

// Optional. This field allows this CA to be disabled even if it's being
// depended on by another resource. However, doing so may result in unintended
// and unrecoverable effects on any dependent resource(s) since the CA will
// and unrecoverable effects on any dependent resources since the CA will
// no longer be able to issue certificates.
bool ignore_dependent_resources = 3 [(google.api.field_behavior) = OPTIONAL];
}
Expand Down Expand Up @@ -910,9 +910,9 @@ message DeleteCertificateAuthorityRequest {
// been allowed. If you proceed, there will be no way to recover this CA.
bool skip_grace_period = 5 [(google.api.field_behavior) = OPTIONAL];

// Optional. This field allows this ca to be deleted even if it's being
// Optional. This field allows this CA to be deleted even if it's being
// depended on by another resource. However, doing so may result in unintended
// and unrecoverable effects on any dependent resource(s) since the CA will
// and unrecoverable effects on any dependent resources since the CA will
// no longer be able to issue certificates.
bool ignore_dependent_resources = 6 [(google.api.field_behavior) = OPTIONAL];
}
Expand Down Expand Up @@ -1040,7 +1040,7 @@ message DeleteCaPoolRequest {

// Optional. This field allows this pool to be deleted even if it's being
// depended on by another resource. However, doing so may result in unintended
// and unrecoverable effects on any dependent resource(s) since the pool will
// and unrecoverable effects on any dependent resources since the pool will
// no longer be able to issue certificates.
bool ignore_dependent_resources = 4 [(google.api.field_behavior) = OPTIONAL];
}
Expand Down Expand Up @@ -1082,7 +1082,7 @@ message FetchCaCertsResponse {
repeated string certificates = 1;
}

// The PEM encoded CA certificate chains of all Certificate Authorities in
// The PEM encoded CA certificate chains of all certificate authorities in
// this [CaPool][google.cloud.security.privateca.v1.CaPool] in the ENABLED,
// DISABLED, or STAGED states.
repeated CertChain ca_certs = 1;
Expand Down

0 comments on commit 8d326d5

Please sign in to comment.