使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
CA 池概览
证书授权机构 (CA) 池是包含多个 CA 的集合，它具有通用证书颁发政策和 Identity and Access Management (IAM) 政策。CA 池能够轮替信任链，而不中断或停止其负载。
CA 池在创建时为空。如需了解如何向 CA 池添加 CA，请参阅创建根 CA。
CA 池会维护受信任的 CA 证书列表。您必须使用证书请求者安装这些受信任的 CA 证书。
CA 池中 CA 的属性
下表列出了 CA 池中所有 CA 必须相同、可以不同和必须不同的功能。
| 对于 CA 池中的所有 CA，必须相同 |
对于 CA 池中的所有 CA，可以各不相同 |
对于 CA 池中的所有 CA，必须各不相同 |
- 证书颁发政策
- IAM Conditions
- 层级
- 位置
- 发布选项。例如，是否发布 CRL。
|
- 签名密钥的算法和大小
- CA 主题和 SAN
- 失效日期和有效期
- 标签
- 用于 CRL 和 AIA 的客户管理的 Cloud Storage 存储桶。
- 客户管理的 CA 密钥
- CA 证书扩展
|
|
实现更高的 QPS
Certificate Authority Service 会强制执行对您可以发送的请求数量的限制。例如，DevOps CA 的 createCertificate 请求的用量限额为 25 QPS。
如需提高总有效 QPS，您必须在 CA 池中拥有多个 CA。CA 池通过在ENABLED
状态下的所有 CA 之间分配传入的证书请求，来提高总有效 QPS。不过，您仍然可以从 CA 池中的特定 CA 请求证书。
您可以使用以下公式计算 CA 池允许的 QPS 上限：
Total effective QPS = min(100, number of CAs in the CA pool x QPS per CA)
例如，如果某个 CA 的有效 QPS 为 25 QPS，并且您在 CA 池中创建了 4 个 CA，则该 CA 池的总有效 QPS 为 100 QPS。
如需详细了解如何实现更高的总有效 QPS，请参阅使用 CA 池提高证书创建吞吐量。
管理 CA 轮替
一个 CA 池可以包含处于不同状态的 CA。CA 池可在 CA 池中已启用的 CA 之间对工作负载的证书颁发进行负载平衡。
CA 池会抽象化其中颁发证书的特定 CA。当 CA 过期时，CA 池的总有效 QPS 会降低。例如，如果某个 CA 池有 4 个已启用的 CA，则该 CA 池的总有效 QPS 为 100 QPS。但如果 CA 池中的一个 CA 过期，总有效 QPS 会降至 75 QPS。为确保 CA 池的总有效 QPS 在 CA 过期时不受影响，您必须在现有 CA 过期之前创建新的 CA。
如需了解详情，请参阅轮替 CA 池中的 CA。
如需了解如何申请增加配额，请参阅申请配额调整。
后续步骤
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-19。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eA CA pool is a collection of multiple CAs sharing a common certificate issuance and Identity and Access Management (IAM) policy, allowing for trust chain rotation without downtime.\u003c/p\u003e\n"],["\u003cp\u003eCA pools maintain a list of trusted CA certificates that must be installed with the certificate requester, and it is initially empty upon creation.\u003c/p\u003e\n"],["\u003cp\u003eAll CAs within a CA pool must have the same certificate issuance policies, IAM conditions, tier, location, and publishing options, but can have different algorithms, key sizes, subjects, expiration dates, and labels.\u003c/p\u003e\n"],["\u003cp\u003eUsing a CA pool with multiple CAs increases the total effective Queries Per Second (QPS) for certificate requests by distributing them across enabled CAs, calculated by the formula \u003ccode\u003eTotal effective QPS = min(100, number of CAs in the CA pool x QPS per CA)\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eTo maintain a consistent total effective QPS, new CAs must be created in the CA pool before existing ones expire, as the total effective QPS reduces upon CA expiration.\u003c/p\u003e\n"]]],[],null,["# Overview of CA pools\n====================\n\nA certificate authority (CA) pool is a collection of multiple CAs with a common\ncertificate issuance policy and Identity and Access Management (IAM) policy. CA\npools provide the ability to rotate trust chains without any outage or\ndowntime for their payloads.\n\nA CA pool is empty when you create it. For information about adding a CA to a\nCA pool, see [Create a root CA](/certificate-authority-service/docs/creating-certificate-authorities).\n\nThe CA pool maintains a list of trusted CA certificates. You must install these\ntrusted CA certificates with the certificate requester.\n\nProperties of CAs in a CA pool\n------------------------------\n\nThe following table lists the features that must be same, can be different, and\nmust be different for all CAs in a CA pool.\n\nAchieve higher QPS\n------------------\n\nCertificate Authority Service enforces [limits on the number of requests](/certificate-authority-service/quotas) you can\nsend. For example, the usage limit for the\n[createCertificate](/certificate-authority-service/docs/reference/rest/v1/projects.locations.caPools.certificates/create) request for a DevOps CA is 25\n[QPS](https://wikipedia.org/wiki/Queries_per_second).\n\nTo increase your total effective QPS, you must have multiple\nCAs in a CA pool. A CA pool increases the total effective QPS by\ndistributing the incoming certificate requests across all CAs in the `ENABLED`\n[state](/certificate-authority-service/docs/certificate-authority-states). However, you can still [request certificates from a particular\nCA in the CA pool](/certificate-authority-service/docs/requesting-certificates#issue-certificate-specific-ca).\n\nYou can use the following formula to calculate the maximum allowed QPS for a CA\npool:\n\n`Total effective QPS = min(100, number of CAs in the CA pool x QPS per CA)`\n\nFor example, if the effective QPS for a CA is 25 QPS and if you create 4 CAs in\na CA pool, then the total effective QPS of the CA pool is 100 QPS.\n\nFor more information about achieving a higher total effective QPS, see\n[Increase certificate creation throughput using a CA pool](/certificate-authority-service/docs/higher-qps).\n\nManage CA rotation\n------------------\n\nA CA pool can have CAs that are in different [states](/certificate-authority-service/docs/certificate-authority-states). A CA pool\nload-balances certificate issuance for workloads across the enabled CAs in a CA\npool.\n\nThe CA pool abstracts the specific CAs within it that issue certificates. When\na CA expires, the total effective QPS of the CA pool gets reduced. For example,\nif a CA pool has 4 enabled CAs, the total effective QPS for that CA pool is\n100 QPS. But if one CA in the CA pool expires, the total effective QPS gets\nreduced to 75 QPS. To ensure that the total effective QPS of the CA pool remains\nunaffected when a CA expires, you must create a new CA before the existing CA\nexpires.\n\nFor more information, see [Rotate CAs in a CA pool](/certificate-authority-service/docs/managing-ca-rotation).\n\nFor information about requesting an increase in quota, see\n[Requesting a quota adjustment](/docs/quotas/help/request_increase).\n\nWhat's next\n-----------\n\n- Learn how to [work with quotas](/docs/quotas/overview).\n- Learn how to [create a CA pool](/certificate-authority-service/docs/creating-ca-pool).\n- Learn how to [update and delete a CA pool](/certificate-authority-service/docs/operations-ca-pool)."]]
