使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
已知限制
此页面记录了 Certificate Authority Service 的已知限制。
撤消支持
仅支持通过证书吊销列表 (CRL) 吊销证书。CA 服务不支持在线证书状态协议 (OCSP)，但您可以实现和运行委派 OCSP 响应程序。
如需详细了解如何实现 OCSP 响应器，请参阅 OCSP 支持。
客户端生成的密钥
Google Cloud CLI 和 Google Cloud 控制台界面支持在颁发证书时自动生成不对称密钥对，以提高便利性。使用 Google Cloud CLI 生成的密钥仅限于 RSA-2048，而使用 Google Cloud 控制台生成的密钥支持更多算法。
证书主题
CA Service 仅支持证书正文中的以下属性类型：
- 公用名 (CN)
- 国家/地区代码 (C)
- 组织 (O)
- 组织部门 (OU)
- 明度 (L)
- 省 (ST)
- 街道地址
- 邮政编码
此限制适用于 CA 证书和最终实体证书中的正文字段。每种属性类型都只能有一个值。
如需了解详情，请参阅 REST API 文档中的主题消息。
后续步骤
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-12。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-12。"],[[["\u003cp\u003eCertificate revocation is only supported through Certificate Revocation Lists (CRLs), with Online Certificate Status Protocol (OCSP) not directly supported but able to be implemented separately.\u003c/p\u003e\n"],["\u003cp\u003eClient-generated keys through Google Cloud CLI are limited to RSA-2048, while the Google Cloud console supports a wider range of algorithms.\u003c/p\u003e\n"],["\u003cp\u003eThe Certificate Authority Service only supports a restricted set of attribute types within the certificate subject, including Common Name, Country Code, Organization, Organizational Unit, Locality, Province, Street Address, and Postal Code, each limited to a single value.\u003c/p\u003e\n"],["\u003cp\u003eThe certificate subject limitations apply to both CA certificates and end-entity certificates.\u003c/p\u003e\n"]]],[],null,["# Known limitations\n=================\n\nThis page documents the known limitations of Certificate Authority Service.\n\nRevocation support\n------------------\n\nCertificate revocation is only supported through Certificate Revocation Lists\n(CRLs). Online Certificate Status Protocol (OCSP) isn't supported by CA Service, but you can implement and run a delegated OCSP responder.\n\nFor more information on implementing an OCSP responder, see [OCSP support](/certificate-authority-service/docs/ocsp-support).\n\nClient-generated keys\n---------------------\n\nThe Google Cloud CLI and Google Cloud console surfaces support\nautomatically generating an asymmetric key-pair when issuing certificates for\nadded convenience. Keys generated using Google Cloud CLI are limited to RSA-2048,\nwhile keys generated using Google Cloud console support a wider selection of\nalgorithms.\n\nCertificate subject\n-------------------\n\nCA Service only supports the following attribute types in the subject of a certificate:\n\n- Common Name (CN)\n- Country Code (C)\n- Organization (O)\n- Organizational Unit (OU)\n- Locality (L)\n- Province (ST)\n- Street Address\n- Postal Code\n\nThis limitation applies to the subject field in both CA certificates and\nend-entity certificates. Each of these attribute types is limited to only one\nvalue.\n\nFor more information, see the [Subject](/certificate-authority-service/docs/reference/rest/v1/Subject) message in the REST API documentation.\n\nWhat's next\n-----------\n\n- Read answers to the [frequently asked questions](/certificate-authority-service/docs/faqs).\n- Learn how to [troubleshoot common issues encountered in CA Service](/certificate-authority-service/docs/troubleshooting)."]]
