// CreateCertificateAuthority creates a new root or intermediate certificate
// using Google Cloud CAS.
CreateCertificateAuthority creates a new root or intermediate certificate
using Google Cloud CAS.
// CreateCertificateAuthority creates a new root or intermediate certificate // using Google Cloud CAS .
func (c *CloudCAS) CreateCertificateAuthority(req *apiv1.CreateCertificateAuthorityRequest) (*apiv1.CreateCertificateAuthorityResponse, error) {
	switch {
	case c.project == "":
		return nil, errors.New("cloudCAS `project` cannot be empty")
	case c.location == "":
		return nil, errors.New("cloudCAS `location` cannot be empty")
	case req.Template == nil:
		return nil, errors.New("createCertificateAuthorityRequest `template` cannot be nil")
	case req.Lifetime == 0:
		return nil, errors.New("createCertificateAuthorityRequest `lifetime` cannot be 0")
	case req.Type == apiv1.IntermediateCA && req.Parent == nil:
		return nil, errors.New("createCertificateAuthorityRequest `parent` cannot be nil")
	case req.Type == apiv1.IntermediateCA && req.Parent.Name == "" && (req.Parent.Certificate == nil || req.Parent.Signer == nil):
		return nil, errors.New("createCertificateAuthorityRequest `parent.name` cannot be empty")
	}
	var caType pb.CertificateAuthority_Type
	switch req.Type {
	case apiv1.RootCA:
		caType = pb.CertificateAuthority_SELF_SIGNED
	case apiv1.IntermediateCA:
		caType = pb.CertificateAuthority_SUBORDINATE
	default:
		return nil, errors.Errorf("createCertificateAuthorityRequest `type=%d' is invalid or not supported", req.Type)
	}
	var err error
	var keySpec *pb.CertificateAuthority_KeyVersionSpec
	if req.CreateKey == nil {
		if keySpec, err = createKeyVersionSpec(0, 0); err != nil {
			return nil, errors.Wrap(err, "createCertificateAuthorityRequest `createKey` is not valid")
		}
	} else {
		if keySpec, err = createKeyVersionSpec(req.CreateKey.SignatureAlgorithm, req.CreateKey.Bits); err != nil {
			return nil, errors.Wrap(err, "createCertificateAuthorityRequest `createKey` is not valid")
		}
	}
	caID := normalizeCertificateAuthorityName(req.Name)
	if caID == "" {
		id, err := createCertificateID()
		if err != nil {
			return nil, err
		}
		caID = id
	}
	casExtension, err := apiv1.CreateCertificateAuthorityExtension(apiv1.CloudCAS, caID)
	if err != nil {
		return nil, err
	}
	req.Template.ExtraExtensions = append(req.Template.ExtraExtensions, casExtension)
	pbReq := &pb.CreateCertificateAuthorityRequest{
		Parent:                 "projects/" + c.project + "/locations/" + c.location,
		CertificateAuthorityId: caID,
		RequestId:              req.RequestID,
		CertificateAuthority: &pb.CertificateAuthority{
			Type: caType,
			Tier: pb.CertificateAuthority_ENTERPRISE,
			Config: &pb.CertificateConfig{
				SubjectConfig: &pb.CertificateConfig_SubjectConfig{
					Subject:    createSubject(req.Template),
					CommonName: req.Template.Subject.CommonName,
				},
				ReusableConfig: createReusableConfig(req.Template),
			},
			Lifetime: durationpb.New(req.Lifetime),
			KeySpec:  keySpec,
			IssuingOptions: &pb.CertificateAuthority_IssuingOptions{
				IncludeCaCertUrl:    true,
				IncludeCrlAccessUrl: true,
			},
			Labels: map[string]string{},
		},
	}
	ctx, cancel := defaultContext()
	defer cancel()
	resp, err := c.client.CreateCertificateAuthority(ctx, pbReq)
	if err != nil {
		return nil, errors.Wrap(err, "cloudCAS CreateCertificateAuthority failed")
	}
	ctx, cancel = defaultInitiatorContext()
	defer cancel()
	ca, err := resp.Wait(ctx)
	if err != nil {
		return nil, errors.Wrap(err, "cloudCAS CreateCertificateAuthority failed")
	}
	if req.Type == apiv1.IntermediateCA {
		ca, err = c.signIntermediateCA(ca.Name, req)
		if err != nil {
			return nil, err
		}
	}
	if len(ca.PemCaCertificates) == 0 {
		return nil, errors.New("cloudCAS CreateCertificateAuthority failed: PemCaCertificates is empty")
	}
	cert, err := parseCertificate(ca.PemCaCertificates[0])
	if err != nil {
		return nil, err
	}
	var chain []*x509.Certificate
	if pemChain := ca.PemCaCertificates[1:]; len(pemChain) > 0 {
		chain = make([]*x509.Certificate, len(pemChain))
		for i, s := range pemChain {
			if chain[i], err = parseCertificate(s); err != nil {
				return nil, err
			}
		}
	}
	return &apiv1.CreateCertificateAuthorityResponse{
		Name:             ca.Name,
		Certificate:      cert,
		CertificateChain: chain,
	}, nil
}
func ( c * CloudCAS ) CreateCertificateAuthority ( req * apiv1 . CreateCertificateAuthorityRequest ) ( * apiv1 . CreateCertificateAuthorityResponse , error ) { switch { case c . project == " " : return nil , errors . New ( " " ) case c . location == " " : return nil , errors . New ( " " ) case req . Template == nil : return nil , errors . New ( " " ) case req . Lifetime == 0 : return nil , errors . New ( " " ) case req . Type == apiv1 . IntermediateCA && req . Parent == nil : return nil , errors . New ( " " ) case req . Type == apiv1 . IntermediateCA && req . Parent . Name == " " && ( req . Parent . Certificate == nil || req . Parent . Signer == nil ) : return nil , errors . New ( " " ) } var caType pb . CertificateAuthority_Type switch req . Type { case apiv1 . RootCA : caType = pb . CertificateAuthority_SELF_SIGNED case apiv1 . IntermediateCA : caType = pb . CertificateAuthority_SUBORDINATE default : return nil , errors . Errorf ( " " , req . Type ) } var err error var keySpec * pb . CertificateAuthority_KeyVersionSpec if req . CreateKey == nil { if keySpec , err = createKeyVersionSpec ( 0 , 0 ) ; err != nil { return nil , errors . Wrap ( err , " " ) } } else { if keySpec , err = createKeyVersionSpec ( req . CreateKey . SignatureAlgorithm , req . CreateKey . Bits ) ; err != nil { return nil , errors . Wrap ( err , " " ) } } caID := normalizeCertificateAuthorityName ( req . Name ) if caID == " " { id , err := createCertificateID ( ) if err != nil { return nil , err } caID = id } casExtension , err := apiv1 . CreateCertificateAuthorityExtension ( apiv1 . CloudCAS , caID ) if err != nil { return nil , err } req . Template . ExtraExtensions = append ( req . Template . ExtraExtensions , casExtension ) pbReq := & pb . CreateCertificateAuthorityRequest { Parent : " " + c . project + " " + c . location , CertificateAuthorityId : caID , RequestId : req . RequestID , CertificateAuthority : & pb . CertificateAuthority { Type : caType , Tier : pb . CertificateAuthority_ENTERPRISE , Config : & pb . CertificateConfig { SubjectConfig : & pb . CertificateConfig_SubjectConfig { Subject : createSubject ( req . Template ) , CommonName : req . Template . Subject . CommonName , } , ReusableConfig : createReusableConfig ( req . Template ) , } , Lifetime : durationpb . New ( req . Lifetime ) , KeySpec : keySpec , IssuingOptions : & pb . CertificateAuthority_IssuingOptions { IncludeCaCertUrl : true , IncludeCrlAccessUrl : true , } , Labels : map [ string ] string { } , } , } ctx , cancel := defaultContext ( ) defer cancel ( ) resp , err := c . client . CreateCertificateAuthority ( ctx , pbReq ) if err != nil { return nil , errors . Wrap ( err , " " ) } ctx , cancel = defaultInitiatorContext ( ) defer cancel ( ) ca , err := resp . Wait ( ctx ) if err != nil { return nil , errors . Wrap ( err , " " ) } if req . Type == apiv1 . IntermediateCA { ca , err = c . signIntermediateCA ( ca . Name , req ) if err != nil { return nil , err } } if len ( ca . PemCaCertificates ) == 0 { return nil , errors . New ( " " ) } cert , err := parseCertificate ( ca . PemCaCertificates [ 0 ] ) if err != nil { return nil , err } var chain [ ] * x509 . Certificate if pemChain := ca . PemCaCertificates [ 1 : ] ; len ( pemChain ) > 0 { chain = make ( [ ] * x509 . Certificate , len ( pemChain ) ) for i , s := range pemChain { if chain [ i ] , err = parseCertificate ( s ) ; err != nil { return nil , err } } } return & apiv1 . CreateCertificateAuthorityResponse { Name : ca . Name , Certificate : cert , CertificateChain : chain , } , nil }
CreateCertificateAuthority creates a new root or intermediate certificate
using Google Cloud CAS.
CreateCertificateAuthority creates a new root or intermediate certificate using Google Cloud CAS .
// Select key and signature algorithm to use // Normalize or generate id. // Add CertificateAuthority extension // Prepare CreateCertificateAuthorityRequest // Create certificate authority. // Wait for the long-running operation. // Sign Intermediate CAs with the parent.