Skip to content

Commit 3700b53

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: [google-cloud-private-ca] Add custom subject key identifier field (#12447)
BEGIN_COMMIT_OVERRIDE feat: Add custom subject key identifier field feat: Add support for fine-grained maximum certificate lifetime controls docs: A comment for field `subject` in message `.google.cloud.security.privateca.v1.CertificateConfig` is changed docs: A comment for method `FetchCaCerts` in service `CertificateAuthorityService` is changed docs: A comment for field `ca_certs` in message `.google.cloud.security.privateca.v1.FetchCaCertsResponse` is changed END_COMMIT_OVERRIDE - [ ] Regenerate this pull request now. feat: Add support for fine-grained maximum certificate lifetime controls docs: A comment for field `subject` in message `.google.cloud.security.privateca.v1.CertificateConfig` is changed docs: A comment for method `FetchCaCerts` in service `CertificateAuthorityService` is changed docs: A comment for field `ca_certs` in message `.google.cloud.security.privateca.v1.FetchCaCertsResponse` is changed PiperOrigin-RevId: 615112752 Source-Link: googleapis/googleapis@1793994 Source-Link: googleapis/googleapis-gen@ba61c00 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLXByaXZhdGUtY2EvLk93bEJvdC55YW1sIiwiaCI6ImJhNjFjMDA4OWZiNTMwMGYyY2QxZGIwMzM3Njc2NzY4MmRiMTc0NzYifQ== --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 7510768 commit 3700b53

File tree

7 files changed

+69
-22
lines changed

7 files changed

+69
-22
lines changed

‎packages/google-cloud-private-ca/google/cloud/security/privateca_v1/services/certificate_authority_service/async_client.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2891,10 +2891,8 @@ async def fetch_ca_certs(
28912891
) -> service.FetchCaCertsResponse:
28922892
r"""FetchCaCerts returns the current trust anchor for the
28932893
[CaPool][google.cloud.security.privateca.v1.CaPool]. This will
2894-
include CA certificate chains for all ACTIVE
2895-
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
2896-
resources in the
2897-
[CaPool][google.cloud.security.privateca.v1.CaPool].
2894+
include CA certificate chains for all Certificate Authorities in
2895+
the ENABLED, DISABLED, or STAGED states.
28982896
28992897
.. code-block:: python
29002898

‎packages/google-cloud-private-ca/google/cloud/security/privateca_v1/services/certificate_authority_service/client.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3395,10 +3395,8 @@ def fetch_ca_certs(
33953395
) -> service.FetchCaCertsResponse:
33963396
r"""FetchCaCerts returns the current trust anchor for the
33973397
[CaPool][google.cloud.security.privateca.v1.CaPool]. This will
3398-
include CA certificate chains for all ACTIVE
3399-
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
3400-
resources in the
3401-
[CaPool][google.cloud.security.privateca.v1.CaPool].
3398+
include CA certificate chains for all Certificate Authorities in
3399+
the ENABLED, DISABLED, or STAGED states.
34023400
34033401
.. code-block:: python
34043402

‎packages/google-cloud-private-ca/google/cloud/security/privateca_v1/services/certificate_authority_service/transports/grpc.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -845,10 +845,8 @@ def fetch_ca_certs(
845845
846846
FetchCaCerts returns the current trust anchor for the
847847
[CaPool][google.cloud.security.privateca.v1.CaPool]. This will
848-
include CA certificate chains for all ACTIVE
849-
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
850-
resources in the
851-
[CaPool][google.cloud.security.privateca.v1.CaPool].
848+
include CA certificate chains for all Certificate Authorities in
849+
the ENABLED, DISABLED, or STAGED states.
852850
853851
Returns:
854852
Callable[[~.FetchCaCertsRequest],

‎packages/google-cloud-private-ca/google/cloud/security/privateca_v1/services/certificate_authority_service/transports/grpc_asyncio.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -862,10 +862,8 @@ def fetch_ca_certs(
862862
863863
FetchCaCerts returns the current trust anchor for the
864864
[CaPool][google.cloud.security.privateca.v1.CaPool]. This will
865-
include CA certificate chains for all ACTIVE
866-
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
867-
resources in the
868-
[CaPool][google.cloud.security.privateca.v1.CaPool].
865+
include CA certificate chains for all Certificate Authorities in
866+
the ENABLED, DISABLED, or STAGED states.
869867
870868
Returns:
871869
Callable[[~.FetchCaCertsRequest],

‎packages/google-cloud-private-ca/google/cloud/security/privateca_v1/types/resources.py‎

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1209,6 +1209,23 @@ class CertificateTemplate(proto.Message):
12091209
[CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
12101210
in the format
12111211
``projects/*/locations/*/certificateTemplates/*``.
1212+
maximum_lifetime (google.protobuf.duration_pb2.Duration):
1213+
Optional. The maximum lifetime allowed for issued
1214+
[Certificates][google.cloud.security.privateca.v1.Certificate]
1215+
that use this template. If the issuing
1216+
[CaPool][google.cloud.security.privateca.v1.CaPool]'s
1217+
[IssuancePolicy][google.cloud.security.privateca.v1.CaPool.IssuancePolicy]
1218+
specifies a
1219+
[maximum_lifetime][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.maximum_lifetime]
1220+
the minimum of the two durations will be the maximum
1221+
lifetime for issued
1222+
[Certificates][google.cloud.security.privateca.v1.Certificate].
1223+
Note that if the issuing
1224+
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
1225+
expires before a
1226+
[Certificate][google.cloud.security.privateca.v1.Certificate]'s
1227+
requested maximum_lifetime, the effective lifetime will be
1228+
explicitly truncated to match it.
12121229
predefined_values (google.cloud.security.privateca_v1.types.X509Parameters):
12131230
Optional. A set of X.509 values that will be applied to all
12141231
issued certificates that use this template. If the
@@ -1267,6 +1284,11 @@ class CertificateTemplate(proto.Message):
12671284
proto.STRING,
12681285
number=1,
12691286
)
1287+
maximum_lifetime: duration_pb2.Duration = proto.Field(
1288+
proto.MESSAGE,
1289+
number=9,
1290+
message=duration_pb2.Duration,
1291+
)
12701292
predefined_values: "X509Parameters" = proto.Field(
12711293
proto.MESSAGE,
12721294
number=2,
@@ -1629,6 +1651,13 @@ class CertificateConfig(proto.Message):
16291651
or
16301652
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
16311653
CSR.
1654+
subject_key_id (google.cloud.security.privateca_v1.types.CertificateConfig.KeyId):
1655+
Optional. When specified this provides a
1656+
custom SKI to be used in the certificate. This
1657+
should only be used to maintain a SKI of an
1658+
existing CA originally created outside CAS,
1659+
which was not generated using method (1)
1660+
described in RFC 5280 section 4.2.1.2.
16321661
"""
16331662

16341663
class SubjectConfig(proto.Message):
@@ -1637,7 +1666,7 @@ class SubjectConfig(proto.Message):
16371666
16381667
Attributes:
16391668
subject (google.cloud.security.privateca_v1.types.Subject):
1640-
Required. Contains distinguished name fields
1669+
Optional. Contains distinguished name fields
16411670
such as the common name, location and
16421671
organization.
16431672
subject_alt_name (google.cloud.security.privateca_v1.types.SubjectAltNames):
@@ -1656,6 +1685,22 @@ class SubjectConfig(proto.Message):
16561685
message="SubjectAltNames",
16571686
)
16581687

1688+
class KeyId(proto.Message):
1689+
r"""A KeyId identifies a specific public key, usually by hashing
1690+
the public key.
1691+
1692+
Attributes:
1693+
key_id (str):
1694+
Required. The value of this KeyId encoded in
1695+
lowercase hexadecimal. This is most likely the
1696+
160 bit SHA-1 hash of the public key.
1697+
"""
1698+
1699+
key_id: str = proto.Field(
1700+
proto.STRING,
1701+
number=1,
1702+
)
1703+
16591704
subject_config: SubjectConfig = proto.Field(
16601705
proto.MESSAGE,
16611706
number=1,
@@ -1671,6 +1716,11 @@ class SubjectConfig(proto.Message):
16711716
number=3,
16721717
message="PublicKey",
16731718
)
1719+
subject_key_id: KeyId = proto.Field(
1720+
proto.MESSAGE,
1721+
number=4,
1722+
message=KeyId,
1723+
)
16741724

16751725

16761726
class CertificateDescription(proto.Message):

‎packages/google-cloud-private-ca/google/cloud/security/privateca_v1/types/service.py‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1112,11 +1112,10 @@ class FetchCaCertsResponse(proto.Message):
11121112
11131113
Attributes:
11141114
ca_certs (MutableSequence[google.cloud.security.privateca_v1.types.FetchCaCertsResponse.CertChain]):
1115-
The PEM encoded CA certificate chains of all
1116-
[ACTIVE][CertificateAuthority.State.ACTIVE]
1117-
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
1118-
resources in this
1119-
[CaPool][google.cloud.security.privateca.v1.CaPool].
1115+
The PEM encoded CA certificate chains of all Certificate
1116+
Authorities in this
1117+
[CaPool][google.cloud.security.privateca.v1.CaPool] in the
1118+
ENABLED, DISABLED, or STAGED states.
11201119
"""
11211120

11221121
class CertChain(proto.Message):

‎packages/google-cloud-private-ca/tests/unit/gapic/privateca_v1/test_certificate_authority_service.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9566,6 +9566,7 @@ def test_create_certificate_rest(request_type):
95669566
"additional_extensions": {},
95679567
},
95689568
"public_key": {"key": b"key_blob", "format_": 1},
9569+
"subject_key_id": {"key_id": "key_id_value"},
95699570
},
95709571
"issuer_certificate_authority": "issuer_certificate_authority_value",
95719572
"lifetime": {"seconds": 751, "nanos": 543},
@@ -11005,6 +11006,7 @@ def test_update_certificate_rest(request_type):
1100511006
"additional_extensions": {},
1100611007
},
1100711008
"public_key": {"key": b"key_blob", "format_": 1},
11009+
"subject_key_id": {"key_id": "key_id_value"},
1100811010
},
1100911011
"issuer_certificate_authority": "issuer_certificate_authority_value",
1101011012
"lifetime": {"seconds": 751, "nanos": 543},
@@ -11796,6 +11798,7 @@ def test_create_certificate_authority_rest(request_type):
1179611798
"additional_extensions": {},
1179711799
},
1179811800
"public_key": {"key": b"key_blob", "format_": 1},
11801+
"subject_key_id": {"key_id": "key_id_value"},
1179911802
},
1180011803
"lifetime": {"seconds": 751, "nanos": 543},
1180111804
"key_spec": {
@@ -14340,6 +14343,7 @@ def test_update_certificate_authority_rest(request_type):
1434014343
"additional_extensions": {},
1434114344
},
1434214345
"public_key": {"key": b"key_blob", "format_": 1},
14346+
"subject_key_id": {"key_id": "key_id_value"},
1434314347
},
1434414348
"lifetime": {"seconds": 751, "nanos": 543},
1434514349
"key_spec": {
@@ -17833,6 +17837,7 @@ def test_create_certificate_template_rest(request_type):
1783317837
request_init = {"parent": "projects/sample1/locations/sample2"}
1783417838
request_init["certificate_template"] = {
1783517839
"name": "name_value",
17840+
"maximum_lifetime": {"seconds": 751, "nanos": 543},
1783617841
"predefined_values": {
1783717842
"key_usage": {
1783817843
"base_key_usage": {
@@ -19184,6 +19189,7 @@ def test_update_certificate_template_rest(request_type):
1918419189
}
1918519190
request_init["certificate_template"] = {
1918619191
"name": "projects/sample1/locations/sample2/certificateTemplates/sample3",
19192+
"maximum_lifetime": {"seconds": 751, "nanos": 543},
1918719193
"predefined_values": {
1918819194
"key_usage": {
1918919195
"base_key_usage": {

0 commit comments

Comments
 (0)