--- title: "POST /v1/{+parent}/certificateAuthorities" method: POST path: "/v1/{+parent}/certificateAuthorities" tags: ["projects"] --- # POST /v1/{+parent}/certificateAuthorities `POST /v1/{+parent}/certificateAuthorities` Create a new CertificateAuthority in a given Project and Location. ## Path parameters - `parent` string, required ## Query parameters - `certificateAuthorityId` string - `requestId` string ## Request body - CertificateAuthority — A CertificateAuthority represents an individual Certificate Authority. A CertificateAuthority can be used to create Certificates. - `subordinateConfig` SubordinateConfig — Describes a subordinate CA's issuers. This is either a resource name to a known issuing CertificateAuthority, or a PEM issuer certificate chain. - `certificateAuthority` string — Required. This can refer to a CertificateAuthority that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`. - `pemIssuerChain` SubordinateConfigChain — This message describes a subordinate CA's issuer certificate chain. This wrapper exists for compatibility reasons. - `pemCertificates` string[] — Required. Expected to be in leaf-to-root order according to RFC 5246. - `updateTime` string, google-datetime — Output only. The time at which this CertificateAuthority was last updated. - `satisfiesPzs` boolean — Output only. Reserved for future use. - `state` 'STATE_UNSPECIFIED' | 'ENABLED' | 'DISABLED' | 'STAGED' | 'AWAITING_USER_ACTIVATION' | 'DELETED' — Output only. The State for this CertificateAuthority. - `pemCaCertificates` string[] — Output only. This CertificateAuthority's certificate chain, including the current CertificateAuthority's certificate. Ordered such that the root issuer is the final element (consistent with RFC 5246). For a self-signed CA, this will only list the current CertificateAuthority's certificate. - `lifetime` string, google-duration — Required. Immutable. The desired lifetime of the CA certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate. - `userDefinedAccessUrls` UserDefinedAccessUrls — User-defined URLs for accessing content published by this CertificateAuthority. - `aiaIssuingCertificateUrls` string[] — Optional. A list of URLs where the issuer CA certificate may be downloaded, which appears in the "Authority Information Access" extension in the certificate. If specified, the default Cloud Storage URLs will be omitted. - `crlAccessUrls` string[] — Optional. A list of URLs where to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13. If specified, the default Cloud Storage URLs will be omitted. - `type` 'TYPE_UNSPECIFIED' | 'SELF_SIGNED' | 'SUBORDINATE' — Required. Immutable. The Type of this CertificateAuthority. - `deleteTime` string, google-datetime — Output only. The time at which this CertificateAuthority was soft deleted, if it is in the DELETED state. - `keySpec` KeyVersionSpec — A Cloud KMS key configuration that a CertificateAuthority will use. - `cloudKmsKeyVersion` string — The resource name for an existing Cloud KMS CryptoKeyVersion in the format `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`. This option enables full flexibility in the key's capabilities and properties. - `algorithm` 'SIGN_HASH_ALGORITHM_UNSPECIFIED' | 'RSA_PSS_2048_SHA256' | 'RSA_PSS_3072_SHA256' | 'RSA_PSS_4096_SHA256' | 'RSA_PKCS1_2048_SHA256' | 'RSA_PKCS1_3072_SHA256' | 'RSA_PKCS1_4096_SHA256' | 'EC_P256_SHA256' | 'EC_P384_SHA384' — The algorithm to use for creating a managed Cloud KMS key for a for a simplified experience. All managed keys will be have their ProtectionLevel as `HSM`. - `tier` 'TIER_UNSPECIFIED' | 'ENTERPRISE' | 'DEVOPS' — Output only. The CaPool.Tier of the CaPool that includes this CertificateAuthority. - `labels` object — Optional. Labels with user-defined metadata. - `config` CertificateConfig — A CertificateConfig describes an X.509 certificate or CSR that is to be created, as an alternative to using ASN.1. - `subjectConfig` SubjectConfig — These values are used to create the distinguished name and subject alternative name fields in an X.509 certificate. - `subjectAltName` SubjectAltNames — SubjectAltNames corresponds to a more modern way of listing what the asserted identity is in a certificate (i.e., compared to the "common name" in the distinguished name). - `ipAddresses` string[] — Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses. - `uris` string[] — Contains only valid RFC 3986 URIs. - `emailAddresses` string[] — Contains only valid RFC 2822 E-mail addresses. - `customSans` X509Extension[] — Contains additional subject alternative name values. For each custom_san, the `value` field must contain an ASN.1 encoded UTF8String. - `objectId` ObjectId — An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `critical` boolean — Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error). - `value` string, byte — Required. The value of this X.509 extension. - `dnsNames` string[] — Contains only valid, fully-qualified host names. - `subject` Subject — Subject describes parts of a distinguished name that, in turn, describes the subject of the certificate. - `rdnSequence` RelativeDistinguishedName[] — This field can be used in place of the named subject fields. - `attributes` AttributeTypeAndValue[] — Attributes describes the attribute value assertions in the RDN. - `type` 'ATTRIBUTE_TYPE_UNSPECIFIED' | 'COMMON_NAME' | 'COUNTRY_CODE' | 'ORGANIZATION' | 'ORGANIZATIONAL_UNIT' | 'LOCALITY' | 'PROVINCE' | 'STREET_ADDRESS' | 'POSTAL_CODE' — The attribute type of the attribute and value pair. - `objectId` ObjectId — An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. - … - `value` string — The value for the attribute type. - `streetAddress` string — The street address of the subject. - `commonName` string — The "common name" of the subject. - `countryCode` string — The country code of the subject. - `organizationalUnit` string — The organizational_unit of the subject. - `postalCode` string — The postal code of the subject. - `organization` string — The organization of the subject. - `province` string — The province, territory, or regional state of the subject. - `locality` string — The locality or city of the subject. - `publicKey` PublicKey — A PublicKey describes a public key. - `format` 'KEY_FORMAT_UNSPECIFIED' | 'PEM' — Required. The format of the public key. - `key` string, byte — Required. A public key. The padding and encoding must match with the `KeyFormat` value specified for the `format` field. - `x509Config` X509Parameters — An X509Parameters is used to describe certain fields of an X.509 certificate, such as the key usage fields, fields specific to CA certificates, certificate policy extensions and custom extensions. - `nameConstraints` NameConstraints — Describes the X.509 name constraints extension, per https://tools.ietf.org/html/rfc5280#section-4.2.1.10 - `excludedIpRanges` string[] — Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses. - `excludedEmailAddresses` string[] — Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. `.example.com`) to indicate all email addresses in that domain. - `permittedUris` string[] — Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like `.example.com`) - `permittedDnsNames` string[] — Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, `example.com`, `www.example.com`, `www.sub.example.com` would satisfy `example.com` while `example1.com` does not. - `critical` boolean — Indicates whether or not the name constraints are marked critical. - `excludedUris` string[] — Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like `.example.com`) - `excludedDnsNames` string[] — Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, `example.com`, `www.example.com`, `www.sub.example.com` would satisfy `example.com` while `example1.com` does not. - `permittedIpRanges` string[] — Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses. - `permittedEmailAddresses` string[] — Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. `.example.com`) to indicate all email addresses in that domain. - `additionalExtensions` X509Extension[] — Optional. Describes custom X.509 extensions. - `objectId` ObjectId — An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `critical` boolean — Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error). - `value` string, byte — Required. The value of this X.509 extension. - `keyUsage` KeyUsage — A KeyUsage describes key usage values that may appear in an X.509 certificate. - `baseKeyUsage` KeyUsageOptions — KeyUsage.KeyUsageOptions corresponds to the key usage values described in https://tools.ietf.org/html/rfc5280#section-4.2.1.3. - `certSign` boolean — The key may be used to sign certificates. - `keyAgreement` boolean — The key may be used in a key agreement protocol. - `dataEncipherment` boolean — The key may be used to encipher data. - `digitalSignature` boolean — The key may be used for digital signatures. - `contentCommitment` boolean — The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation". - `keyEncipherment` boolean — The key may be used to encipher other keys. - `encipherOnly` boolean — The key may be used to encipher only. - `decipherOnly` boolean — The key may be used to decipher only. - `crlSign` boolean — The key may be used sign certificate revocation lists. - `extendedKeyUsage` ExtendedKeyUsageOptions — KeyUsage.ExtendedKeyUsageOptions has fields that correspond to certain common OIDs that could be specified as an extended key usage value. - `serverAuth` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS. - `clientAuth` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS. - `codeSigning` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication". - `emailProtection` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection". - `ocspSigning` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses". - `timeStamping` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time". - `unknownExtendedKeyUsages` ObjectId[] — Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `policyIds` ObjectId[] — Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `caOptions` CaOptions — Describes the X.509 basic constraints extension, per [RFC 5280 section 4.2.1.9](https://tools.ietf.org/html/rfc5280#section-4.2.1.9) - `maxIssuerPathLength` integer — Optional. Refers to the path length constraint field in the X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the certificate. - `isCa` boolean — Optional. Refers to the "CA" boolean field in the X.509 extension. When this value is missing, the basic constraints extension will be omitted from the certificate. - `aiaOcspServers` string[] — Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate. - `subjectKeyId` CertificateConfigKeyId — A KeyId identifies a specific public key, usually by hashing the public key. - `keyId` string — Required. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key. - `createTime` string, google-datetime — Output only. The time at which this CertificateAuthority was created. - `name` string — Identifier. The resource name for this CertificateAuthority in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`. - `expireTime` string, google-datetime — Output only. The time at which this CertificateAuthority will be permanently purged, if it is in the DELETED state. - `caCertificateDescriptions` CertificateDescription[] — Output only. A structured description of this CertificateAuthority's CA certificate and its issuers. Ordered as self-to-root. - `publicKey` PublicKey — A PublicKey describes a public key. - `format` 'KEY_FORMAT_UNSPECIFIED' | 'PEM' — Required. The format of the public key. - `key` string, byte — Required. A public key. The padding and encoding must match with the `KeyFormat` value specified for the `format` field. - `certFingerprint` CertificateFingerprint — A group of fingerprints for the x509 certificate. - `sha256Hash` string — The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate. - `aiaIssuingCertificateUrls` string[] — Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate. - `x509Description` X509Parameters — An X509Parameters is used to describe certain fields of an X.509 certificate, such as the key usage fields, fields specific to CA certificates, certificate policy extensions and custom extensions. - `nameConstraints` NameConstraints — Describes the X.509 name constraints extension, per https://tools.ietf.org/html/rfc5280#section-4.2.1.10 - `excludedIpRanges` string[] — Contains the excluded IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses. - `excludedEmailAddresses` string[] — Contains the excluded email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. `.example.com`) to indicate all email addresses in that domain. - `permittedUris` string[] — Contains the permitted URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like `.example.com`) - `permittedDnsNames` string[] — Contains permitted DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, `example.com`, `www.example.com`, `www.sub.example.com` would satisfy `example.com` while `example1.com` does not. - `critical` boolean — Indicates whether or not the name constraints are marked critical. - `excludedUris` string[] — Contains the excluded URIs that apply to the host part of the name. The value can be a hostname or a domain with a leading period (like `.example.com`) - `excludedDnsNames` string[] — Contains excluded DNS names. Any DNS name that can be constructed by simply adding zero or more labels to the left-hand side of the name satisfies the name constraint. For example, `example.com`, `www.example.com`, `www.sub.example.com` would satisfy `example.com` while `example1.com` does not. - `permittedIpRanges` string[] — Contains the permitted IP ranges. For IPv4 addresses, the ranges are expressed using CIDR notation as specified in RFC 4632. For IPv6 addresses, the ranges are expressed in similar encoding as IPv4 addresses. - `permittedEmailAddresses` string[] — Contains the permitted email addresses. The value can be a particular email address, a hostname to indicate all email addresses on that host or a domain with a leading period (e.g. `.example.com`) to indicate all email addresses in that domain. - `additionalExtensions` X509Extension[] — Optional. Describes custom X.509 extensions. - `objectId` ObjectId — An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `critical` boolean — Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error). - `value` string, byte — Required. The value of this X.509 extension. - `keyUsage` KeyUsage — A KeyUsage describes key usage values that may appear in an X.509 certificate. - `baseKeyUsage` KeyUsageOptions — KeyUsage.KeyUsageOptions corresponds to the key usage values described in https://tools.ietf.org/html/rfc5280#section-4.2.1.3. - `certSign` boolean — The key may be used to sign certificates. - `keyAgreement` boolean — The key may be used in a key agreement protocol. - `dataEncipherment` boolean — The key may be used to encipher data. - `digitalSignature` boolean — The key may be used for digital signatures. - `contentCommitment` boolean — The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation". - `keyEncipherment` boolean — The key may be used to encipher other keys. - `encipherOnly` boolean — The key may be used to encipher only. - `decipherOnly` boolean — The key may be used to decipher only. - `crlSign` boolean — The key may be used sign certificate revocation lists. - `extendedKeyUsage` ExtendedKeyUsageOptions — KeyUsage.ExtendedKeyUsageOptions has fields that correspond to certain common OIDs that could be specified as an extended key usage value. - `serverAuth` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS. - `clientAuth` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS. - `codeSigning` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication". - `emailProtection` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection". - `ocspSigning` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses". - `timeStamping` boolean — Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time". - `unknownExtendedKeyUsages` ObjectId[] — Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `policyIds` ObjectId[] — Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `caOptions` CaOptions — Describes the X.509 basic constraints extension, per [RFC 5280 section 4.2.1.9](https://tools.ietf.org/html/rfc5280#section-4.2.1.9) - `maxIssuerPathLength` integer — Optional. Refers to the path length constraint field in the X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the certificate. - `isCa` boolean — Optional. Refers to the "CA" boolean field in the X.509 extension. When this value is missing, the basic constraints extension will be omitted from the certificate. - `aiaOcspServers` string[] — Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate. - `tbsCertificateDigest` string — The hash of the pre-signed certificate, which will be signed by the CA. Corresponds to the TBS Certificate in https://tools.ietf.org/html/rfc5280#section-4.1.2. The field will always be populated. - `subjectDescription` SubjectDescription — These values describe fields in an issued X.509 certificate such as the distinguished name, subject alternative names, serial number, and lifetime. - `notAfterTime` string, google-datetime — The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second. - `lifetime` string, google-duration — For convenience, the actual lifetime of an issued certificate. - `subject` Subject — Subject describes parts of a distinguished name that, in turn, describes the subject of the certificate. - `rdnSequence` RelativeDistinguishedName[] — This field can be used in place of the named subject fields. - `attributes` AttributeTypeAndValue[] — Attributes describes the attribute value assertions in the RDN. - `type` 'ATTRIBUTE_TYPE_UNSPECIFIED' | 'COMMON_NAME' | 'COUNTRY_CODE' | 'ORGANIZATION' | 'ORGANIZATIONAL_UNIT' | 'LOCALITY' | 'PROVINCE' | 'STREET_ADDRESS' | 'POSTAL_CODE' — The attribute type of the attribute and value pair. - `objectId` ObjectId — An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. - … - `value` string — The value for the attribute type. - `streetAddress` string — The street address of the subject. - `commonName` string — The "common name" of the subject. - `countryCode` string — The country code of the subject. - `organizationalUnit` string — The organizational_unit of the subject. - `postalCode` string — The postal code of the subject. - `organization` string — The organization of the subject. - `province` string — The province, territory, or regional state of the subject. - `locality` string — The locality or city of the subject. - `hexSerialNumber` string — The serial number encoded in lowercase hexadecimal. - `notBeforeTime` string, google-datetime — The time at which the certificate becomes valid. - `subjectAltName` SubjectAltNames — SubjectAltNames corresponds to a more modern way of listing what the asserted identity is in a certificate (i.e., compared to the "common name" in the distinguished name). - `ipAddresses` string[] — Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses. - `uris` string[] — Contains only valid RFC 3986 URIs. - `emailAddresses` string[] — Contains only valid RFC 2822 E-mail addresses. - `customSans` X509Extension[] — Contains additional subject alternative name values. For each custom_san, the `value` field must contain an ASN.1 encoded UTF8String. - `objectId` ObjectId — An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages. - `objectIdPath` integer[] — Required. The parts of an OID path. The most significant parts of the path come first. - `critical` boolean — Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error). - `value` string, byte — Required. The value of this X.509 extension. - `dnsNames` string[] — Contains only valid, fully-qualified host names. - `subjectKeyId` KeyId — A KeyId identifies a specific public key, usually by hashing the public key. - `keyId` string — Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key. - `crlDistributionPoints` string[] — Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13 - `authorityKeyId` KeyId — A KeyId identifies a specific public key, usually by hashing the public key. - `keyId` string — Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key. - `accessUrls` AccessUrls — URLs where a CertificateAuthority will publish content. - `caCertificateAccessUrl` string — The URL where this CertificateAuthority's CA certificate is published. This will only be set for CAs that have been activated. - `crlAccessUrls` string[] — The URLs where this CertificateAuthority's CRLs are published. This will only be set for CAs that have been activated. - `gcsBucket` string — Immutable. The name of a Cloud Storage bucket where this CertificateAuthority will publish content, such as the CA certificate and CRLs. This must be a bucket name, without any prefixes (such as `gs://`) or suffixes (such as `.googleapis.com`). For example, to use a bucket named `my-bucket`, you would simply specify `my-bucket`. If not specified, a managed bucket will be created. - `satisfiesPzi` boolean — Output only. Reserved for future use. ## Response `200` Successful response --- [API](https://skmtc.dev/google/apis/privateca.md) · [All operations](https://skmtc.dev/google/apis/privateca/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/privateca/revisions/23453098738d/schema)