This page describes how you can create a certificate request in Certificate Authority Service.
You can request a certificate using the following methods:
To obtain a certificate, you generate a CSR, which you then use to request the certificate.
For detailed instructions on how to generate a CSR using OpenSSL, see How to generate CSR with OpenSSL. You can also use the following sample configuration file as a reference when generating your CSR.
To use the sample configuration file, follow these steps:
cat csr.cnf [req] distinguished_name = req_distinguished_name req_extensions = v3_req prompt = no [req_distinguished_name] CN = example.com [v3_req] keyUsage = critical, digitalSignature, keyEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = example.com DNS.2 = www.example.com EOF Modify the parameters as required. To use the x509v3_config configuration file format to define extensions for X.509 certificates and CSRs, refer to the OpenSSL documentation.
openssl req -newkey rsa:2048 -out csr.pem -keyout key.pem -config csr.cnf Use the csr.pem file in your certificate request.
To request a certificate using the CSR, follow these steps:
Download the signed certificate
gcloud privateca certificates create CERT_ID \ --issuer-pool POOL_ID \ --csr CSR_FILENAME \ --cert-output-file CERT_FILENAME \ --validity "P30D" Replace the following:
The --validity flag defines the duration the certificate is valid. It is an optional flag whose default value is 30 days.
For more information about the gcloud privateca certificates create command, see gcloud privateca certificates create.
Note: You can omit the certificate ID to have one automatically generated for you with the following naming format: --
resource "google_privateca_certificate_authority" "test_ca" < pool = "my-pool" certificate_authority_id = "my-certificate-authority" location = "us-central1" deletion_protection = false # set to true to prevent destruction of the resource config < subject_config < subject < organization = "HashiCorp" common_name = "my-certificate-authority" >subject_alt_name < dns_names = ["hashicorp.com"] >> x509_config < ca_options < # is_ca *MUST* be true for certificate authorities is_ca = true >key_usage < base_key_usage < # cert_sign and crl_sign *MUST* be true for certificate authorities cert_sign = true crl_sign = true >extended_key_usage < server_auth = false >> > > key_spec < algorithm = "RSA_PKCS1_4096_SHA256" >> resource "google_privateca_certificate" "default" < pool = "my-pool" location = "us-central1" certificate_authority = google_privateca_certificate_authority.test_ca.certificate_authority_id lifetime = "860s" name = "my-certificate" pem_csr = tls_cert_request.example.cert_request_pem >resource "tls_private_key" "example" < algorithm = "RSA" >resource "tls_cert_request" "example" < private_key_pem = tls_private_key.example.private_key_pem subject < common_name = "example.com" organization = "ACME Examples, Inc" >> -----BEGIN CERTIFICATE REQUEST-----\nMIIChTCCAW0CAQAwQDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ8wDQYDVQQK\nDAZKb29uaXgxEzARBgNVBAMMCmpvb25peC5uZXQwggEiMA0GCSqGSIb3DQEBAQUA\nA4IBDwAwggEKAoIBAQCnyy+5vcRQUBPqAse3ojmWjyUvhcJK6eLRXpp0teEUF5kg\nHb2ov8gYXb9sSim5fnvs09dGYDKibSrL4Siy7lA/NzMzWtKwyQQeLIQq/cLUJVcd\ndItJ0VRcqr+UPkTCii2vrdcocNDChHM1J8chDdl6DkpYieSTqZwlPcWlQBGAINmT\nT3Q0ZarIVM5l74j13WPuToGrhbVOIZXWxWqJjlHbBA8B/VKtSRCzM1qG60y8Pu2f\n6c78Dfg8+CGRzGwnz8aFS0Yf9czT9luNHSadS/RHjvE9FPZCsinz+6mJlXRcphi1\nKaHsDbstUAhse1h5E9Biyr9SFYRHxY7qRv9aSJ/dAgMBAAGgADANBgkqhkiG9w0B\nAQsFAAOCAQEAZz+I9ff1Rf3lTewXRUpA7nr5HVO1ojCR93Pf27tI/hvNH7z7GwnS\noScoJlClxeRqABOCnfmVoRChullb/KmER4BZ/lF0GQpEtbqbjgjkEDpVlBKCb0+L\nHE9psplIz6H9nfFS3Ouoiodk902vrMEh0LyDYNQuqFoyCZuuepUlK3NmtmkexlgT\n0pJg/5FV0iaQ+GiFXSZhTC3drfiM/wDnXGiqpbW9WmebSij5O+3BNYXKBUgqmT3r\nbryFydNq4qSOIbnN/MNb4UoKno3ve7mnGk9lIDf9UMPvhl+bT7C3OLQLGadJroME\npYnKLoZUvRwEdtZpbNL9QhCAm2QiJ6w+6g==\n-----END CERTIFICATE REQUEST----- POST https://privateca.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/caPools/POOL_ID/certificates?certificate_id=CERTIFICATE_IDRequest JSON body:
< "lifetime": < "seconds": 3600, "nanos": 0 >, "pem_csr": "PEM_CSR" >To send your request, expand one of these options:
Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list . Save the request body in a file named request.json , and execute the following command:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://privateca.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/caPools/POOL_ID/certificates?certificate_id=CERTIFICATE_ID"
Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list . Save the request body in a file named request.json , and execute the following command:
$cred = gcloud auth print-access-tokenYou should receive a JSON response similar to the following:
$headers = @< "Authorization" = "Bearer $cred" >
Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://privateca.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/caPools/POOL_ID/certificates?certificate_id=CERTIFICATE_ID" | Select-Object -Expand Content
You can use Google Cloud console to generate client or server TLS certificates.
Add domain name
Extended key usage
Configure the key size and algorithm
Download the signed certificate
To use the auto-generated key feature, you need to install the Python Cryptographic Authority (PyCA) library. For instructions about installing the Pyca cryptography library, see Including the Pyca cryptography library.
To create a certificate, use the following gcloud command:
gcloud privateca certificates create \ --issuer-pool POOL_ID \ --generate-key \ --key-output-file KEY_FILENAME \ --cert-output-file CERT_FILENAME \ --dns-san "DNS_NAME" \ --use-preset-profile "CERTIFICATE_PROFILE" Replace the following:
The gcloud command mentions the following flags:
You can also use any combination of the following flags:
For more information about the gcloud privateca certificates create command, see gcloud privateca certificates create.
To authenticate to CA Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
import ( "context" "fmt" "io" privateca "cloud.google.com/go/security/privateca/apiv1" "cloud.google.com/go/security/privateca/apiv1/privatecapb" "google.golang.org/protobuf/types/known/durationpb" ) // Create a Certificate which is issued by the Certificate Authority present in the CA Pool. // The key used to sign the certificate is created by the Cloud KMS. func createCertificate( w io.Writer, projectId string, location string, caPoolId string, caId string, certId string, commonName string, domainName string, certDuration int64, publicKeyBytes []byte) error < // projectId := "your_project_id" // location := "us-central1" // For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations. // caPoolId := "ca-pool-id" // The CA Pool id in which the certificate authority exists. // caId := "ca-id" // The name of the certificate authority which issues the certificate. // certId := "certificate" // A unique name for the certificate. // commonName := "cert-name" // A common name for the certificate. // domainName := "cert.example.com" // Fully qualified domain name for the certificate. // certDuration := int64(31536000) // The validity of the certificate in seconds. // publicKeyBytes // The public key used in signing the certificates. ctx := context.Background() caClient, err := privateca.NewCertificateAuthorityClient(ctx) if err != nil < return fmt.Errorf("NewCertificateAuthorityClient creation failed: %w", err) >defer caClient.Close() // Set the Public Key and its format. publicKey := &privatecapb.PublicKey < Key: publicKeyBytes, Format: privatecapb.PublicKey_PEM, >// Set Certificate subject config. subjectConfig := &privatecapb.CertificateConfig_SubjectConfig< Subject: &privatecapb.Subject< CommonName: commonName, >, SubjectAltName: &privatecapb.SubjectAltNames< DnsNames: []string, >, > // Set the X.509 fields required for the certificate. x509Parameters := &privatecapb.X509Parameters< KeyUsage: &privatecapb.KeyUsage< BaseKeyUsage: &privatecapb.KeyUsage_KeyUsageOptions< DigitalSignature: true, KeyEncipherment: true, >, ExtendedKeyUsage: &privatecapb.KeyUsage_ExtendedKeyUsageOptions< ServerAuth: true, ClientAuth: true, >, >, > // Set certificate settings. cert := &privatecapb.Certificate< CertificateConfig: &privatecapb.Certificate_Config< Config: &privatecapb.CertificateConfig< PublicKey: publicKey, SubjectConfig: subjectConfig, X509Config: x509Parameters, >, >, Lifetime: &durationpb.Duration< Seconds: certDuration, >, > fullCaPoolName := fmt.Sprintf("projects/%s/locations/%s/caPools/%s", projectId, location, caPoolId) // Create the CreateCertificateRequest. // See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#CreateCertificateRequest. req := &privatecapb.CreateCertificateRequest < Parent: fullCaPoolName, CertificateId: certId, Certificate: cert, IssuingCertificateAuthorityId: caId, >_, err = caClient.CreateCertificate(ctx, req) if err != nil < return fmt.Errorf("CreateCertificate failed: %w", err) >fmt.Fprintf(w, "Certificate %s created", certId) return nil > To authenticate to CA Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
import com.google.api.core.ApiFuture; import com.google.cloud.security.privateca.v1.CaPoolName; import com.google.cloud.security.privateca.v1.Certificate; import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient; import com.google.cloud.security.privateca.v1.CertificateConfig; import com.google.cloud.security.privateca.v1.CertificateConfig.SubjectConfig; import com.google.cloud.security.privateca.v1.CreateCertificateRequest; import com.google.cloud.security.privateca.v1.KeyUsage; import com.google.cloud.security.privateca.v1.KeyUsage.ExtendedKeyUsageOptions; import com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions; import com.google.cloud.security.privateca.v1.PublicKey; import com.google.cloud.security.privateca.v1.PublicKey.KeyFormat; import com.google.cloud.security.privateca.v1.Subject; import com.google.cloud.security.privateca.v1.SubjectAltNames; import com.google.cloud.security.privateca.v1.X509Parameters; import com.google.cloud.security.privateca.v1.X509Parameters.CaOptions; import com.google.protobuf.ByteString; import com.google.protobuf.Duration; import java.io.IOException; import java.util.concurrent.ExecutionException; public class CreateCertificate < public static void main(String[] args) throws InterruptedException, ExecutionException, IOException < // TODO(developer): Replace these variables before running the sample. // publicKeyBytes: Public key used in signing the certificates. // location: For a list of locations, see: // https://cloud.google.com/certificate-authority-service/docs/locations // poolId: Set a unique id for the CA pool. // certificateAuthorityName: The name of the certificate authority which issues the certificate. // certificateName: Set a unique name for the certificate. String project = "your-project-id"; ByteString publicKeyBytes = ByteString.copyFrom(new byte[]<>); String location = "ca-location"; String poolId = "ca-poolId"; String certificateAuthorityName = "certificate-authority-name"; String certificateName = "certificate-name"; createCertificate( project, location, poolId, certificateAuthorityName, certificateName, publicKeyBytes); > // Create a Certificate which is issued by the Certificate Authority present in the CA Pool. // The public key used to sign the certificate can be generated using any crypto // library/framework. public static void createCertificate( String project, String location, String poolId, String certificateAuthorityName, String certificateName, ByteString publicKeyBytes) throws InterruptedException, ExecutionException, IOException < // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `certificateAuthorityServiceClient.close()` method on the client to safely // clean up any remaining background resources. try (CertificateAuthorityServiceClient certificateAuthorityServiceClient = CertificateAuthorityServiceClient.create()) < // commonName: Enter a title for your certificate. // orgName: Provide the name of your company. // domainName: List the fully qualified domain name. // certificateLifetime: The validity of the certificate in seconds. String commonName = "commonname"; String orgName = "orgname"; String domainName = "dns.example.com"; long certificateLifetime = 1000L; // Set the Public Key and its format. PublicKey publicKey = PublicKey.newBuilder().setKey(publicKeyBytes).setFormat(KeyFormat.PEM).build(); SubjectConfig subjectConfig = SubjectConfig.newBuilder() // Set the common name and org name. .setSubject( Subject.newBuilder().setCommonName(commonName).setOrganization(orgName).build()) // Set the fully qualified domain name. .setSubjectAltName(SubjectAltNames.newBuilder().addDnsNames(domainName).build()) .build(); // Set the X.509 fields required for the certificate. X509Parameters x509Parameters = X509Parameters.newBuilder() .setKeyUsage( KeyUsage.newBuilder() .setBaseKeyUsage( KeyUsageOptions.newBuilder() .setDigitalSignature(true) .setKeyEncipherment(true) .setCertSign(true) .build()) .setExtendedKeyUsage( ExtendedKeyUsageOptions.newBuilder().setServerAuth(true).build()) .build()) .setCaOptions(CaOptions.newBuilder().setIsCa(true).buildPartial()) .build(); // Create certificate. Certificate certificate = Certificate.newBuilder() .setConfig( CertificateConfig.newBuilder() .setPublicKey(publicKey) .setSubjectConfig(subjectConfig) .setX509Config(x509Parameters) .build()) .setLifetime(Duration.newBuilder().setSeconds(certificateLifetime).build()) .build(); // Create the Certificate Request. CreateCertificateRequest certificateRequest = CreateCertificateRequest.newBuilder() .setParent(CaPoolName.of(project, location, poolId).toString()) .setCertificateId(certificateName) .setCertificate(certificate) .setIssuingCertificateAuthorityId(certificateAuthorityName) .build(); // Get the Certificate response. ApiFuturefuture = certificateAuthorityServiceClient .createCertificateCallable() .futureCall(certificateRequest); Certificate response = future.get(); // Get the PEM encoded, signed X.509 certificate. System.out.println(response.getPemCertificate()); // To verify the obtained certificate, use this intermediate chain list. System.out.println(response.getPemCertificateChainList()); > > >
To authenticate to CA Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
import google.cloud.security.privateca_v1 as privateca_v1 from google.protobuf import duration_pb2 def create_certificate( project_id: str, location: str, ca_pool_name: str, ca_name: str, certificate_name: str, common_name: str, domain_name: str, certificate_lifetime: int, public_key_bytes: bytes, ) -> None: """ Create a Certificate which is issued by the Certificate Authority present in the CA Pool. The key used to sign the certificate is created by the Cloud KMS. Args: project_id: project ID or project number of the Cloud project you want to use. location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations. ca_pool_name: set a unique name for the CA pool. ca_name: the name of the certificate authority which issues the certificate. certificate_name: set a unique name for the certificate. common_name: a title for your certificate. domain_name: fully qualified domain name for your certificate. certificate_lifetime: the validity of the certificate in seconds. public_key_bytes: public key used in signing the certificates. """ caServiceClient = privateca_v1.CertificateAuthorityServiceClient() # The public key used to sign the certificate can be generated using any crypto library/framework. # Also you can use Cloud KMS to retrieve an already created public key. # For more info, see: https://cloud.google.com/kms/docs/retrieve-public-key. # Set the Public Key and its format. public_key = privateca_v1.PublicKey( key=public_key_bytes, format_=privateca_v1.PublicKey.KeyFormat.PEM, ) subject_config = privateca_v1.CertificateConfig.SubjectConfig( subject=privateca_v1.Subject(common_name=common_name), subject_alt_name=privateca_v1.SubjectAltNames(dns_names=[domain_name]), ) # Set the X.509 fields required for the certificate. x509_parameters = privateca_v1.X509Parameters( key_usage=privateca_v1.KeyUsage( base_key_usage=privateca_v1.KeyUsage.KeyUsageOptions( digital_signature=True, key_encipherment=True, ), extended_key_usage=privateca_v1.KeyUsage.ExtendedKeyUsageOptions( server_auth=True, client_auth=True, ), ), ) # Create certificate. certificate = privateca_v1.Certificate( config=privateca_v1.CertificateConfig( public_key=public_key, subject_config=subject_config, x509_config=x509_parameters, ), lifetime=duration_pb2.Duration(seconds=certificate_lifetime), ) # Create the Certificate Request. request = privateca_v1.CreateCertificateRequest( parent=caServiceClient.ca_pool_path(project_id, location, ca_pool_name), certificate_id=certificate_name, certificate=certificate, issuing_certificate_authority_id=ca_name, ) result = caServiceClient.create_certificate(request=request) print("Certificate creation result:", result) You can only use Google Cloud CLI to request certificates using a Cloud KMS key.
To use a Cloud KMS key to create an end-entity server TLS certificate, run the following command:
gcloud privateca certificates create \ --issuer-pool POOL_ID \ --kms-key-version projects/PROJECT_ID/locations/LOCATION_ID/keyRings/KEY_RING/cryptoKeys/KEY/cryptoKeyVersions/KEY_VERSION \ --cert-output-file CERT_FILENAME \ --dns-san "DNS_NAME" \ --use-preset-profile "leaf_server_tls" Replace the following:
This section describes how to issue certificates from a specific CA in a CA pool.
Note: To ensure load balancing across all the CAs in a CA pool, we recommend that you select only the CA pool and let the certificate issuance be distributed across the enabled CAs in that CA pool.
To target a specific CA in the CA pool for certificate issuance, add the --ca flag with the CA_ID of the CA that must issue the certificate.
gcloud privateca certificates create \ --issuer-pool POOL_ID \ --ca CA_ID \ --generate-key \ --key-output-file KEY_FILENAME \ --cert-output-file CERT_FILENAME \ --dns-san "DNS_NAME" \ --use-preset-profile "leaf_server_tls" resource "google_privateca_certificate_authority" "authority" < // This example assumes this pool already exists. // Pools cannot be deleted in normal test circumstances, so we depend on static pools pool = "my-pool" certificate_authority_id = "my-sample-certificate-authority" location = "us-central1" deletion_protection = false # set to true to prevent destruction of the resource config < subject_config < subject < organization = "HashiCorp" common_name = "my-certificate-authority" >subject_alt_name < dns_names = ["hashicorp.com"] >> x509_config < ca_options < is_ca = true >key_usage < base_key_usage < digital_signature = true cert_sign = true crl_sign = true >extended_key_usage < server_auth = true >> > > lifetime = "86400s" key_spec < algorithm = "RSA_PKCS1_4096_SHA256" >> resource "google_privateca_certificate" "default" < pool = "my-pool" location = "us-central1" lifetime = "860s" name = "my-sample-certificate" config < subject_config < subject < common_name = "san1.example.com" country_code = "us" organization = "google" organizational_unit = "enterprise" locality = "mountain view" province = "california" street_address = "1600 amphitheatre parkway" postal_code = "94109" >> x509_config < ca_options < is_ca = false >key_usage < base_key_usage < crl_sign = true >extended_key_usage < server_auth = true >> > public_key < format = "PEM" key = base64encode(data.tls_public_key.example.public_key_pem) >> // Certificates require an authority to exist in the pool, though they don't // need to be explicitly connected to it depends_on = [google_privateca_certificate_authority.authority] > resource "tls_private_key" "example" < algorithm = "RSA" >data "tls_public_key" "example"
Requesting a certificate in validation mode creates an unsigned test certificate. This test certificate is not PEM encoded and incurs no charge. While you can't download the certificate, the hypothetical certificate description lets you confirm that you can successfully issue a signed certificate with your chosen parameters.
To request a certificate in validation mode, follow these steps:
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-08-30 UTC.