Package google.cloud.certificatemanager.v1

Index

CertificateManager

API Overview

Certificates Manager API allows customers to see and manage all their TLS certificates.

Certificates Manager API service provides methods to manage certificates, group them into collections, and create serving configuration that can be easily applied to other Cloud resources e.g. Target Proxies.

Data Model

The Certificates Manager service exposes the following resources:

  • Certificate that describes a single TLS certificate.
  • CertificateMap that describes a collection of certificates that can be attached to a target resource.
  • CertificateMapEntry that describes a single configuration entry that consists of a SNI and a group of certificates. It's a subresource of CertificateMap.

Certificate, CertificateMap and CertificateMapEntry IDs have to fully match the regexp [a-z0-9-]{1,63}. In other words, - only lower case letters, digits, and hyphen are allowed - length of the resource ID has to be in [1,63] range.

Provides methods to manage Cloud Certificate Manager entities.

CreateCertificate

rpc CreateCertificate(CreateCertificateRequest) returns (Operation)

Creates a new Certificate in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
CreateCertificateIssuanceConfig

rpc CreateCertificateIssuanceConfig(CreateCertificateIssuanceConfigRequest) returns (Operation)

Creates a new CertificateIssuanceConfig in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
CreateCertificateMap

rpc CreateCertificateMap(CreateCertificateMapRequest) returns (Operation)

Creates a new CertificateMap in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
CreateCertificateMapEntry

rpc CreateCertificateMapEntry(CreateCertificateMapEntryRequest) returns (Operation)

Creates a new CertificateMapEntry in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
CreateDnsAuthorization

rpc CreateDnsAuthorization(CreateDnsAuthorizationRequest) returns (Operation)

Creates a new DnsAuthorization in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
CreateTrustConfig

rpc CreateTrustConfig(CreateTrustConfigRequest) returns (Operation)

Creates a new TrustConfig in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteCertificate

rpc DeleteCertificate(DeleteCertificateRequest) returns (Operation)

Deletes a single Certificate.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteCertificateIssuanceConfig

rpc DeleteCertificateIssuanceConfig(DeleteCertificateIssuanceConfigRequest) returns (Operation)

Deletes a single CertificateIssuanceConfig.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteCertificateMap

rpc DeleteCertificateMap(DeleteCertificateMapRequest) returns (Operation)

Deletes a single CertificateMap. A Certificate Map can't be deleted if it contains Certificate Map Entries. Remove all the entries from the map before calling this method.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteCertificateMapEntry

rpc DeleteCertificateMapEntry(DeleteCertificateMapEntryRequest) returns (Operation)

Deletes a single CertificateMapEntry.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteDnsAuthorization

rpc DeleteDnsAuthorization(DeleteDnsAuthorizationRequest) returns (Operation)

Deletes a single DnsAuthorization.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteTrustConfig

rpc DeleteTrustConfig(DeleteTrustConfigRequest) returns (Operation)

Deletes a single TrustConfig.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetCertificate

rpc GetCertificate(GetCertificateRequest) returns (Certificate)

Gets details of a single Certificate.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetCertificateIssuanceConfig

rpc GetCertificateIssuanceConfig(GetCertificateIssuanceConfigRequest) returns (CertificateIssuanceConfig)

Gets details of a single CertificateIssuanceConfig.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetCertificateMap

rpc GetCertificateMap(GetCertificateMapRequest) returns (CertificateMap)

Gets details of a single CertificateMap.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetCertificateMapEntry

rpc GetCertificateMapEntry(GetCertificateMapEntryRequest) returns (CertificateMapEntry)

Gets details of a single CertificateMapEntry.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetDnsAuthorization

rpc GetDnsAuthorization(GetDnsAuthorizationRequest) returns (DnsAuthorization)

Gets details of a single DnsAuthorization.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetTrustConfig

rpc GetTrustConfig(GetTrustConfigRequest) returns (TrustConfig)

Gets details of a single TrustConfig.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListCertificateIssuanceConfigs

rpc ListCertificateIssuanceConfigs(ListCertificateIssuanceConfigsRequest) returns (ListCertificateIssuanceConfigsResponse)

Lists CertificateIssuanceConfigs in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListCertificateMapEntries

rpc ListCertificateMapEntries(ListCertificateMapEntriesRequest) returns (ListCertificateMapEntriesResponse)

Lists CertificateMapEntries in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListCertificateMaps

rpc ListCertificateMaps(ListCertificateMapsRequest) returns (ListCertificateMapsResponse)

Lists CertificateMaps in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListCertificates

rpc ListCertificates(ListCertificatesRequest) returns (ListCertificatesResponse)

Lists Certificates in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListDnsAuthorizations

rpc ListDnsAuthorizations(ListDnsAuthorizationsRequest) returns (ListDnsAuthorizationsResponse)

Lists DnsAuthorizations in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListTrustConfigs

rpc ListTrustConfigs(ListTrustConfigsRequest) returns (ListTrustConfigsResponse)

Lists TrustConfigs in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateCertificate

rpc UpdateCertificate(UpdateCertificateRequest) returns (Operation)

Updates a Certificate.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateCertificateIssuanceConfig

rpc UpdateCertificateIssuanceConfig(UpdateCertificateIssuanceConfigRequest) returns (Operation)

Updates a CertificateIssuanceConfig.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateCertificateMap

rpc UpdateCertificateMap(UpdateCertificateMapRequest) returns (Operation)

Updates a CertificateMap.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateCertificateMapEntry

rpc UpdateCertificateMapEntry(UpdateCertificateMapEntryRequest) returns (Operation)

Updates a CertificateMapEntry.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateDnsAuthorization

rpc UpdateDnsAuthorization(UpdateDnsAuthorizationRequest) returns (Operation)

Updates a DnsAuthorization.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateTrustConfig

rpc UpdateTrustConfig(UpdateTrustConfigRequest) returns (Operation)

Updates a TrustConfig.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

Certificate

Defines TLS certificate.

Fields
name

string

Identifier. A user-defined name of the certificate. Certificate names must be unique globally and match pattern projects/*/locations/*/certificates/*.
description

string

Optional. One or more paragraphs of text description of a certificate.
create_time

Timestamp

Output only. The creation timestamp of a Certificate.
update_time

Timestamp

Output only. The last update timestamp of a Certificate.
labels

map<string, string>

Optional. Set of labels associated with a Certificate.
san_dnsnames[]

string

Output only. The list of Subject Alternative Names of dnsName type defined in the certificate (see RFC 5280 4.2.1.6). Managed certificates that haven't been provisioned yet have this field populated with a value of the managed.domains field.
pem_certificate

string

Output only. The PEM-encoded certificate chain.
expire_time

Timestamp

Output only. The expiry timestamp of a Certificate.
scope

Scope

Optional. Immutable. The scope of the certificate.
Union field type. Type of the certificate. Required. type can be only one of the following:
self_managed

SelfManagedCertificate

If set, defines data of a self-managed certificate.
managed

ManagedCertificate

If set, contains configuration and state of a managed certificate.

ManagedCertificate

Configuration and state of a Managed Certificate. Certificate Manager provisions and renews Managed Certificates automatically, for as long as it's authorized to do so.

Fields
domains[]

string

Optional. Immutable. The domains for which a managed SSL certificate will be generated. Wildcard domains are only supported with DNS challenge resolution.
dns_authorizations[]

string

Optional. Immutable. Authorizations that will be used for performing domain authorization.

Authorization requires the following IAM permission on the specified resource dnsAuthorizations:

  • certificatemanager.dnsauthorizations.use
issuance_config

string

Optional. Immutable. The resource name for a CertificateIssuanceConfig used to configure private PKI certificates in the format projects/*/locations/*/certificateIssuanceConfigs/*. If this field is not set, the certificates will instead be publicly signed as documented at https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs#caa.

Authorization requires the following IAM permission on the specified resource issuanceConfig:

  • certificatemanager.certissuanceconfigs.use
state

State

Output only. State of the managed certificate resource.
provisioning_issue

ProvisioningIssue

Output only. Information about issues with provisioning a Managed Certificate.
authorization_attempt_info[]

AuthorizationAttemptInfo

Output only. Detailed state of the latest authorization attempt for each domain specified for managed certificate resource.

AuthorizationAttemptInfo

State of the latest attempt to authorize a domain for certificate issuance.

Fields
domain

string

Output only. Domain name of the authorization attempt.
state

State

Output only. State of the domain for managed certificate issuance.
failure_reason

FailureReason

Output only. Reason for failure of the authorization attempt for the domain.
details

string

Output only. Human readable explanation for reaching the state. Provided to help address the configuration issues. Not guaranteed to be stable. For programmatic access use FailureReason enum.

FailureReason

Reason for failure of the authorization attempt for the domain.

Enums
FAILURE_REASON_UNSPECIFIED FailureReason is unspecified.
CONFIG There was a problem with the user's DNS or load balancer configuration for this domain.
CAA Certificate issuance forbidden by an explicit CAA record for the domain or a failure to check CAA records for the domain.
RATE_LIMITED Reached a CA or internal rate-limit for the domain, e.g. for certificates per top-level private domain.

State

State of the domain for managed certificate issuance.

Enums
STATE_UNSPECIFIED State is unspecified.
AUTHORIZING Certificate provisioning for this domain is under way. Google Cloud will attempt to authorize the domain.
AUTHORIZED A managed certificate can be provisioned, no issues for this domain.
FAILED Attempt to authorize the domain failed. This prevents the Managed Certificate from being issued. See failure_reason and details fields for more information.

ProvisioningIssue

Information about issues with provisioning a Managed Certificate.

Fields
reason

Reason

Output only. Reason for provisioning failures.
details

string

Output only. Human readable explanation about the issue. Provided to help address the configuration issues. Not guaranteed to be stable. For programmatic access use Reason enum.

Reason

Reason for provisioning failures.

Enums
REASON_UNSPECIFIED Reason is unspecified.
AUTHORIZATION_ISSUE Certificate provisioning failed due to an issue with one or more of the domains on the certificate. For details of which domains failed, consult the authorization_attempt_info field.
RATE_LIMITED Exceeded Certificate Authority quotas or internal rate limits of the system. Provisioning may take longer to complete.

State

State of the managed certificate resource.

Enums
STATE_UNSPECIFIED State is unspecified.
PROVISIONING Certificate Manager attempts to provision or renew the certificate. If the process takes longer than expected, consult the provisioning_issue field.
FAILED Multiple certificate provisioning attempts failed and Certificate Manager gave up. To try again, delete and create a new managed Certificate resource. For details see the provisioning_issue field.
ACTIVE The certificate management is working, and a certificate has been provisioned.

Scope

Certificate scope.

Enums
DEFAULT Certificates with default scope are served from core Google data centers. If unsure, choose this option.
EDGE_CACHE Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence. See https://cloud.google.com/vpc/docs/edge-locations.
ALL_REGIONS Certificates with ALL_REGIONS scope are served from all Google Cloud regions. See https://cloud.google.com/compute/docs/regions-zones.

SelfManagedCertificate

Certificate data for a SelfManaged Certificate. SelfManaged Certificates are uploaded by the user. Updating such certificates before they expire remains the user's responsibility.

Fields
pem_certificate

string

Optional. Input only. The PEM-encoded certificate chain. Leaf certificate comes first, followed by intermediate ones if any.
pem_private_key

string

Optional. Input only. The PEM-encoded private key of the leaf certificate.

CertificateIssuanceConfig

CertificateIssuanceConfig specifies how to issue and manage a certificate.

Fields
name

string

Identifier. A user-defined name of the certificate issuance config. CertificateIssuanceConfig names must be unique globally and match pattern projects/*/locations/*/certificateIssuanceConfigs/*.
create_time

Timestamp

Output only. The creation timestamp of a CertificateIssuanceConfig.
update_time

Timestamp

Output only. The last update timestamp of a CertificateIssuanceConfig.
labels

map<string, string>

Optional. Set of labels associated with a CertificateIssuanceConfig.
description

string

Optional. One or more paragraphs of text description of a CertificateIssuanceConfig.
certificate_authority_config

CertificateAuthorityConfig

Required. The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc.
lifetime

Duration

Required. Workload certificate lifetime requested.
rotation_window_percentage

int32

Required. Specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate. Must be a number between 1-99, inclusive.
key_algorithm

KeyAlgorithm

Required. The key algorithm to use when generating the private key.

CertificateAuthorityConfig

The CA that issues the workload certificate. It includes CA address, type, authentication to CA service, etc.

Fields
Union field kind. The kind of CA config. kind can be only one of the following:
certificate_authority_service_config

CertificateAuthorityServiceConfig

Defines a CertificateAuthorityServiceConfig.

CertificateAuthorityServiceConfig

Contains information required to contact CA service.

Fields
ca_pool

string

Required. A CA pool resource used to issue a certificate. The CA pool string has a relative resource path following the form "projects/{project}/locations/{location}/caPools/{ca_pool}".

Authorization requires the following IAM permission on the specified resource caPool:

  • privateca.caPools.use

KeyAlgorithm

The type of keypair to generate.

Enums
KEY_ALGORITHM_UNSPECIFIED Unspecified key algorithm.
RSA_2048 Specifies RSA with a 2048-bit modulus.
ECDSA_P256 Specifies ECDSA with curve P256.

CertificateMap

Defines a collection of certificate configurations.

Fields
name

string

Identifier. A user-defined name of the Certificate Map. Certificate Map names must be unique globally and match pattern projects/*/locations/*/certificateMaps/*.
description

string

Optional. One or more paragraphs of text description of a certificate map.
create_time

Timestamp

Output only. The creation timestamp of a Certificate Map.
update_time

Timestamp

Output only. The update timestamp of a Certificate Map.
labels

map<string, string>

Optional. Set of labels associated with a Certificate Map.
gclb_targets[]

GclbTarget

Output only. A list of GCLB targets that use this Certificate Map. A Target Proxy is only present on this list if it's attached to a Forwarding Rule.

GclbTarget

Describes a Target Proxy that uses this Certificate Map.

Fields
ip_configs[]

IpConfig

Output only. IP configurations for this Target Proxy where the Certificate Map is serving.
Union field target_proxy. A Target Proxy to which this map is attached to. target_proxy can be only one of the following:
target_https_proxy

string

Output only. This field returns the resource name in the following format: //compute.googleapis.com/projects/*/global/targetHttpsProxies/*.
target_ssl_proxy

string

Output only. This field returns the resource name in the following format: //compute.googleapis.com/projects/*/global/targetSslProxies/*.

IpConfig

Defines IP configuration where this Certificate Map is serving.

Fields
ip_address

string

Output only. An external IP address.
ports[]

uint32

Output only. Ports.

CertificateMapEntry

Defines a certificate map entry.

Fields
name

string

Identifier. A user-defined name of the Certificate Map Entry. Certificate Map Entry names must be unique globally and match pattern projects/*/locations/*/certificateMaps/*/certificateMapEntries/*.
description

string

Optional. One or more paragraphs of text description of a certificate map entry.
create_time

Timestamp

Output only. The creation timestamp of a Certificate Map Entry.
update_time

Timestamp

Output only. The update timestamp of a Certificate Map Entry.
labels

map<string, string>

Optional. Set of labels associated with a Certificate Map Entry.
certificates[]

string

Optional. A set of Certificates defines for the given hostname. There can be defined up to four certificates in each Certificate Map Entry. Each certificate must match pattern projects/*/locations/*/certificates/*.

Authorization requires the following IAM permission on the specified resource certificates:

  • certificatemanager.certs.use
state

ServingState

Output only. A serving state of this Certificate Map Entry.
Union field match. The matcher for this certificate map entry. Required. match can be only one of the following:
hostname

string

A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com) for a set of hostnames with common suffix. Used as Server Name Indication (SNI) for selecting a proper certificate.
matcher

Matcher

A predefined matcher for particular cases, other than SNI selection.

Matcher

Defines predefined cases other than SNI-hostname match when this configuration should be applied.

Enums
MATCHER_UNSPECIFIED A matcher has't been recognized.
PRIMARY A primary certificate that is served when SNI wasn't specified in the request or SNI couldn't be found in the map.

CreateCertificateIssuanceConfigRequest

Request for the CreateCertificateIssuanceConfig method.

Fields
parent

string

Required. The parent resource of the certificate issuance config. Must be in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certissuanceconfigs.create
certificate_issuance_config_id

string

Required. A user-provided name of the certificate config.
certificate_issuance_config

CertificateIssuanceConfig

Required. A definition of the certificate issuance config to create.

CreateCertificateMapEntryRequest

Request for the CreateCertificateMapEntry method.

Fields
parent

string

Required. The parent resource of the certificate map entry. Must be in the format projects/*/locations/*/certificateMaps/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certmapentries.create
certificate_map_entry_id

string

Required. A user-provided name of the certificate map entry.
certificate_map_entry

CertificateMapEntry

Required. A definition of the certificate map entry to create.

CreateCertificateMapRequest

Request for the CreateCertificateMap method.

Fields
parent

string

Required. The parent resource of the certificate map. Must be in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certmaps.create
certificate_map_id

string

Required. A user-provided name of the certificate map.
certificate_map

CertificateMap

Required. A definition of the certificate map to create.

CreateCertificateRequest

Request for the CreateCertificate method.

Fields
parent

string

Required. The parent resource of the certificate. Must be in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certs.create
certificate_id

string

Required. A user-provided name of the certificate.
certificate

Certificate

Required. A definition of the certificate to create.

CreateDnsAuthorizationRequest

Request for the CreateDnsAuthorization method.

Fields
parent

string

Required. The parent resource of the dns authorization. Must be in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.dnsauthorizations.create
dns_authorization_id

string

Required. A user-provided name of the dns authorization.
dns_authorization

DnsAuthorization

Required. A definition of the dns authorization to create.

CreateTrustConfigRequest

Request for the CreateTrustConfig method.

Fields
parent

string

Required. The parent resource of the TrustConfig. Must be in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.trustconfigs.create
trust_config_id

string

Required. A user-provided name of the TrustConfig. Must match the regexp [a-z0-9-]{1,63}.
trust_config

TrustConfig

Required. A definition of the TrustConfig to create.

DeleteCertificateIssuanceConfigRequest

Request for the DeleteCertificateIssuanceConfig method.

Fields
name

string

Required. A name of the certificate issuance config to delete. Must be in the format projects/*/locations/*/certificateIssuanceConfigs/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certissuanceconfigs.delete

DeleteCertificateMapEntryRequest

Request for the DeleteCertificateMapEntry method.

Fields
name

string

Required. A name of the certificate map entry to delete. Must be in the format projects/*/locations/*/certificateMaps/*/certificateMapEntries/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certmapentries.delete

DeleteCertificateMapRequest

Request for the DeleteCertificateMap method.

Fields
name

string

Required. A name of the certificate map to delete. Must be in the format projects/*/locations/*/certificateMaps/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certmaps.delete

DeleteCertificateRequest

Request for the DeleteCertificate method.

Fields
name

string

Required. A name of the certificate to delete. Must be in the format projects/*/locations/*/certificates/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certs.delete

DeleteDnsAuthorizationRequest

Request for the DeleteDnsAuthorization method.

Fields
name

string

Required. A name of the dns authorization to delete. Must be in the format projects/*/locations/*/dnsAuthorizations/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.dnsauthorizations.delete

DeleteTrustConfigRequest

Request for the DeleteTrustConfig method.

Fields
name

string

Required. A name of the TrustConfig to delete. Must be in the format projects/*/locations/*/trustConfigs/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.trustconfigs.delete
etag

string

Optional. The current etag of the TrustConfig. If an etag is provided and does not match the current etag of the resource, deletion will be blocked and an ABORTED error will be returned.

DnsAuthorization

A DnsAuthorization resource describes a way to perform domain authorization for certificate issuance.

Fields
name

string

Identifier. A user-defined name of the dns authorization. DnsAuthorization names must be unique globally and match pattern projects/*/locations/*/dnsAuthorizations/*.
create_time

Timestamp

Output only. The creation timestamp of a DnsAuthorization.
update_time

Timestamp

Output only. The last update timestamp of a DnsAuthorization.
labels

map<string, string>

Optional. Set of labels associated with a DnsAuthorization.
description

string

Optional. One or more paragraphs of text description of a DnsAuthorization.
domain

string

Required. Immutable. A domain that is being authorized. A DnsAuthorization resource covers a single domain and its wildcard, e.g. authorization for example.com can be used to issue certificates for example.com and *.example.com.
dns_resource_record

DnsResourceRecord

Output only. DNS Resource Record that needs to be added to DNS configuration.
type

Type

Optional. Immutable. Type of DnsAuthorization. If unset during resource creation the following default will be used: - in location global: FIXED_RECORD, - in other locations: PER_PROJECT_RECORD.

DnsResourceRecord

The structure describing the DNS Resource Record that needs to be added to DNS configuration for the authorization to be usable by certificate.

Fields
name

string

Output only. Fully qualified name of the DNS Resource Record. e.g. _acme-challenge.example.com
type

string

Output only. Type of the DNS Resource Record. Currently always set to "CNAME".
data

string

Output only. Data of the DNS Resource Record.

Type

DnsAuthorization type.

Enums
TYPE_UNSPECIFIED Type is unspecified.
FIXED_RECORD FIXED_RECORD DNS authorization uses DNS-01 validation method.
PER_PROJECT_RECORD PER_PROJECT_RECORD DNS authorization allows for independent management of Google-managed certificates with DNS authorization across multiple projects.

GetCertificateIssuanceConfigRequest

Request for the GetCertificateIssuanceConfig method.

Fields
name

string

Required. A name of the certificate issuance config to describe. Must be in the format projects/*/locations/*/certificateIssuanceConfigs/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certissuanceconfigs.get

GetCertificateMapEntryRequest

Request for the GetCertificateMapEntry method.

Fields
name

string

Required. A name of the certificate map entry to describe. Must be in the format projects/*/locations/*/certificateMaps/*/certificateMapEntries/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certmapentries.get

GetCertificateMapRequest

Request for the GetCertificateMap method.

Fields
name

string

Required. A name of the certificate map to describe. Must be in the format projects/*/locations/*/certificateMaps/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certmaps.get

GetCertificateRequest

Request for the GetCertificate method.

Fields
name

string

Required. A name of the certificate to describe. Must be in the format projects/*/locations/*/certificates/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.certs.get

GetDnsAuthorizationRequest

Request for the GetDnsAuthorization method.

Fields
name

string

Required. A name of the dns authorization to describe. Must be in the format projects/*/locations/*/dnsAuthorizations/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.dnsauthorizations.get

GetTrustConfigRequest

Request for the GetTrustConfig method.

Fields
name

string

Required. A name of the TrustConfig to describe. Must be in the format projects/*/locations/*/trustConfigs/*.

Authorization requires the following IAM permission on the specified resource name:

  • certificatemanager.trustconfigs.get

ListCertificateIssuanceConfigsRequest

Request for the ListCertificateIssuanceConfigs method.

Fields
parent

string

Required. The project and location from which the certificate should be listed, specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certissuanceconfigs.list
page_size

int32

Optional. Maximum number of certificate configs to return per call.
page_token

string

Optional. The value returned by the last ListCertificateIssuanceConfigsResponse. Indicates that this is a continuation of a prior ListCertificateIssuanceConfigs call, and that the system should return the next page of data.
filter

string

Optional. Filter expression to restrict the Certificates Configs returned.
order_by

string

Optional. A list of Certificate Config field names used to specify the order of the returned results. The default sorting order is ascending. To specify descending order for a field, add a suffix " desc".

ListCertificateIssuanceConfigsResponse

Response for the ListCertificateIssuanceConfigs method.

Fields
certificate_issuance_configs[]

CertificateIssuanceConfig

A list of certificate configs for the parent resource.
next_page_token

string

If there might be more results than those appearing in this response, then next_page_token is included. To get the next set of results, call this method again using the value of next_page_token as page_token.
unreachable[]

string

Locations that could not be reached.

ListCertificateMapEntriesRequest

Request for the ListCertificateMapEntries method.

Fields
parent

string

Required. The project, location and certificate map from which the certificate map entries should be listed, specified in the format projects/*/locations/*/certificateMaps/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certmapentries.list
page_size

int32

Optional. Maximum number of certificate map entries to return. The service may return fewer than this value. If unspecified, at most 50 certificate map entries will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.
page_token

string

Optional. The value returned by the last ListCertificateMapEntriesResponse. Indicates that this is a continuation of a prior ListCertificateMapEntries call, and that the system should return the next page of data.
filter

string

Optional. Filter expression to restrict the returned Certificate Map Entries.
order_by

string

Optional. A list of Certificate Map Entry field names used to specify the order of the returned results. The default sorting order is ascending. To specify descending order for a field, add a suffix " desc".

ListCertificateMapEntriesResponse

Response for the ListCertificateMapEntries method.

Fields
certificate_map_entries[]

CertificateMapEntry

A list of certificate map entries for the parent resource.
next_page_token

string

If there might be more results than those appearing in this response, then next_page_token is included. To get the next set of results, call this method again using the value of next_page_token as page_token.
unreachable[]

string

Locations that could not be reached.

ListCertificateMapsRequest

Request for the ListCertificateMaps method.

Fields
parent

string

Required. The project and location from which the certificate maps should be listed, specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certmaps.list
page_size

int32

Optional. Maximum number of certificate maps to return per call.
page_token

string

Optional. The value returned by the last ListCertificateMapsResponse. Indicates that this is a continuation of a prior ListCertificateMaps call, and that the system should return the next page of data.
filter

string

Optional. Filter expression to restrict the Certificates Maps returned.
order_by

string

Optional. A list of Certificate Map field names used to specify the order of the returned results. The default sorting order is ascending. To specify descending order for a field, add a suffix " desc".

ListCertificateMapsResponse

Response for the ListCertificateMaps method.

Fields
certificate_maps[]

CertificateMap

A list of certificate maps for the parent resource.
next_page_token

string

If there might be more results than those appearing in this response, then next_page_token is included. To get the next set of results, call this method again using the value of next_page_token as page_token.
unreachable[]

string

Locations that could not be reached.

ListCertificatesRequest

Request for the ListCertificates method.

Fields
parent

string

Required. The project and location from which the certificate should be listed, specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.certs.list
page_size

int32

Optional. Maximum number of certificates to return per call.
page_token

string

Optional. The value returned by the last ListCertificatesResponse. Indicates that this is a continuation of a prior ListCertificates call, and that the system should return the next page of data.
filter

string

Optional. Filter expression to restrict the Certificates returned.
order_by

string

Optional. A list of Certificate field names used to specify the order of the returned results. The default sorting order is ascending. To specify descending order for a field, add a suffix " desc".

ListCertificatesResponse

Response for the ListCertificates method.

Fields
certificates[]

Certificate

A list of certificates for the parent resource.
next_page_token

string

If there might be more results than those appearing in this response, then next_page_token is included. To get the next set of results, call this method again using the value of next_page_token as page_token.
unreachable[]

string

A list of locations that could not be reached.

ListDnsAuthorizationsRequest

Request for the ListDnsAuthorizations method.

Fields
parent

string

Required. The project and location from which the dns authorizations should be listed, specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.dnsauthorizations.list
page_size

int32

Optional. Maximum number of dns authorizations to return per call.
page_token

string

Optional. The value returned by the last ListDnsAuthorizationsResponse. Indicates that this is a continuation of a prior ListDnsAuthorizations call, and that the system should return the next page of data.
filter

string

Optional. Filter expression to restrict the Dns Authorizations returned.
order_by

string

Optional. A list of Dns Authorization field names used to specify the order of the returned results. The default sorting order is ascending. To specify descending order for a field, add a suffix " desc".

ListDnsAuthorizationsResponse

Response for the ListDnsAuthorizations method.

Fields
dns_authorizations[]

DnsAuthorization

A list of dns authorizations for the parent resource.
next_page_token

string

If there might be more results than those appearing in this response, then next_page_token is included. To get the next set of results, call this method again using the value of next_page_token as page_token.
unreachable[]

string

Locations that could not be reached.

ListTrustConfigsRequest

Request for the ListTrustConfigs method.

Fields
parent

string

Required. The project and location from which the TrustConfigs should be listed, specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • certificatemanager.trustconfigs.list
page_size

int32

Optional. Maximum number of TrustConfigs to return per call.
page_token

string

Optional. The value returned by the last ListTrustConfigsResponse. Indicates that this is a continuation of a prior ListTrustConfigs call, and that the system should return the next page of data.
filter

string

Optional. Filter expression to restrict the TrustConfigs returned.
order_by

string

Optional. A list of TrustConfig field names used to specify the order of the returned results. The default sorting order is ascending. To specify descending order for a field, add a suffix " desc".

ListTrustConfigsResponse

Response for the ListTrustConfigs method.

Fields
trust_configs[]

TrustConfig

A list of TrustConfigs for the parent resource.
next_page_token

string

If there might be more results than those appearing in this response, then next_page_token is included. To get the next set of results, call this method again using the value of next_page_token as page_token.
unreachable[]

string

Locations that could not be reached.

OperationMetadata

Represents the metadata of the long-running operation. Output only.

Fields
create_time

Timestamp

The time the operation was created.
end_time

Timestamp

The time the operation finished running.
target

string

Server-defined resource path for the target of the operation.
verb

string

Name of the verb executed by the operation.
status_message

string

Human-readable status of the operation, if any.
requested_cancellation

bool

Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have [Operation.error][] value with a google.rpc.Status.code of 1, corresponding to Code.CANCELLED.
api_version

string

API version used to start the operation.

ServingState

Defines set of serving states associated with a resource.

Enums
SERVING_STATE_UNSPECIFIED The status is undefined.
ACTIVE The configuration is serving.
PENDING Update is in progress. Some frontends may serve this configuration.

TrustConfig

Defines a trust config.

Fields
name

string

Identifier. A user-defined name of the trust config. TrustConfig names must be unique globally and match pattern projects/*/locations/*/trustConfigs/*.
create_time

Timestamp

Output only. The creation timestamp of a TrustConfig.
update_time

Timestamp

Output only. The last update timestamp of a TrustConfig.
labels

map<string, string>

Optional. Set of labels associated with a TrustConfig.
description

string

Optional. One or more paragraphs of text description of a TrustConfig.
etag

string

This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
trust_stores[]

TrustStore

Optional. Set of trust stores to perform validation against.

This field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation.

Only one TrustStore specified is currently allowed.
allowlisted_certificates[]

AllowlistedCertificate

Optional. A certificate matching an allowlisted certificate is always considered valid as long as the certificate is parseable, proof of private key possession is established, and constraints on the certificate's SAN field are met.

AllowlistedCertificate

Defines an allowlisted certificate.

Fields
pem_certificate

string

Required. PEM certificate that is allowlisted. The certificate can be up to 5k bytes, and must be a parseable X.509 certificate.

IntermediateCA

Defines an intermediate CA.

Fields
Union field kind. Kind of the intermediate CA. Required. kind can be only one of the following:
pem_certificate

string

PEM intermediate certificate used for building up paths for validation.

Each certificate provided in PEM format may occupy up to 5kB.

TrustAnchor

Defines a trust anchor.

Fields
Union field kind. Kind of the trust anchor. Required. kind can be only one of the following:
pem_certificate

string

PEM root certificate of the PKI used for validation.

Each certificate provided in PEM format may occupy up to 5kB.

TrustStore

Defines a trust store.

Fields
trust_anchors[]

TrustAnchor

Optional. List of Trust Anchors to be used while performing validation against a given TrustStore.
intermediate_cas[]

IntermediateCA

Optional. Set of intermediate CA certificates used for the path building phase of chain validation.

The field is currently not supported if TrustConfig is used for the workload certificate feature.

UpdateCertificateIssuanceConfigRequest

Request for the UpdateCertificateIssuanceConfig method.

Fields
certificate_issuance_config

CertificateIssuanceConfig

Required. A definition of the certificate issuance config to update.

Authorization requires the following IAM permission on the specified resource certificateIssuanceConfig:

  • certificatemanager.certissuanceconfigs.update
update_mask

FieldMask

Required. The update mask applies to the resource. For the FieldMask definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.

UpdateCertificateMapEntryRequest

Request for the UpdateCertificateMapEntry method.

Fields
certificate_map_entry

CertificateMapEntry

Required. A definition of the certificate map entry to create map entry.

Authorization requires the following IAM permission on the specified resource certificateMapEntry:

  • certificatemanager.certmapentries.update
update_mask

FieldMask

Required. The update mask applies to the resource. For the FieldMask definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.

UpdateCertificateMapRequest

Request for the UpdateCertificateMap method.

Fields
certificate_map

CertificateMap

Required. A definition of the certificate map to update.

Authorization requires the following IAM permission on the specified resource certificateMap:

  • certificatemanager.certmaps.update
update_mask

FieldMask

Required. The update mask applies to the resource. For the FieldMask definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.

UpdateCertificateRequest

Request for the UpdateCertificate method.

Fields
certificate

Certificate

Required. A definition of the certificate to update.

Authorization requires the following IAM permission on the specified resource certificate:

  • certificatemanager.certs.update
update_mask

FieldMask

Required. The update mask applies to the resource. For the FieldMask definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.

UpdateDnsAuthorizationRequest

Request for the UpdateDnsAuthorization method.

Fields
dns_authorization

DnsAuthorization

Required. A definition of the dns authorization to update.

Authorization requires the following IAM permission on the specified resource dnsAuthorization:

  • certificatemanager.dnsauthorizations.update
update_mask

FieldMask

Required. The update mask applies to the resource. For the FieldMask definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.

UpdateTrustConfigRequest

Request for the UpdateTrustConfig method.

Fields
trust_config

TrustConfig

Required. A definition of the TrustConfig to update.

Authorization requires the following IAM permission on the specified resource trustConfig:

  • certificatemanager.trustconfigs.update
update_mask

FieldMask

Required. The update mask applies to the resource. For the FieldMask definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.