|
| 1 | +/* |
| 2 | + * Copyright 2021 Google LLC |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + * you may not use this file except in compliance with the License. |
| 6 | + * You may obtain a copy of the License at |
| 7 | + * |
| 8 | + * https://www.apache.org/licenses/LICENSE-2.0 |
| 9 | + * |
| 10 | + * Unless required by applicable law or agreed to in writing, software |
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + * See the License for the specific language governing permissions and |
| 14 | + * limitations under the License. |
| 15 | + */ |
| 16 | +package privateca; |
| 17 | + |
| 18 | +// [START privateca_create_certificate_template] |
| 19 | + |
| 20 | +import com.google.api.core.ApiFuture; |
| 21 | +import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient; |
| 22 | +import com.google.cloud.security.privateca.v1.CertificateIdentityConstraints; |
| 23 | +import com.google.cloud.security.privateca.v1.CertificateTemplate; |
| 24 | +import com.google.cloud.security.privateca.v1.CreateCertificateTemplateRequest; |
| 25 | +import com.google.cloud.security.privateca.v1.KeyUsage; |
| 26 | +import com.google.cloud.security.privateca.v1.KeyUsage.ExtendedKeyUsageOptions; |
| 27 | +import com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions; |
| 28 | +import com.google.cloud.security.privateca.v1.LocationName; |
| 29 | +import com.google.cloud.security.privateca.v1.X509Parameters; |
| 30 | +import com.google.cloud.security.privateca.v1.X509Parameters.CaOptions; |
| 31 | +import com.google.longrunning.Operation; |
| 32 | +import com.google.type.Expr; |
| 33 | +import java.io.IOException; |
| 34 | +import java.util.concurrent.ExecutionException; |
| 35 | +import java.util.concurrent.TimeUnit; |
| 36 | +import java.util.concurrent.TimeoutException; |
| 37 | + |
| 38 | +public class CreateCertificateTemplate { |
| 39 | + |
| 40 | + public static void main(String[] args) |
| 41 | + throws IOException, ExecutionException, InterruptedException, TimeoutException { |
| 42 | + /* TODO(developer): Replace these variables before running the sample. |
| 43 | + location: For a list of locations, see: |
| 44 | + https://cloud.google.com/certificate-authority-service/docs/locations */ |
| 45 | + String project = "your-project-id"; |
| 46 | + String location = "ca-location"; |
| 47 | + String certificateTemplateId = "certificate-template-id"; |
| 48 | + |
| 49 | + createCertificateTemplate(project, location, certificateTemplateId); |
| 50 | + } |
| 51 | + |
| 52 | + /* Creates a Certificate template. These templates can be reused for common |
| 53 | + certificate issuance scenarios. */ |
| 54 | + public static void createCertificateTemplate( |
| 55 | + String project, String location, String certificateTemplateId) |
| 56 | + throws IOException, ExecutionException, InterruptedException, TimeoutException { |
| 57 | + /* Initialize client that will be used to send requests. This client only needs to be created |
| 58 | + once, and can be reused for multiple requests. After completing all of your requests, call |
| 59 | + the `certificateAuthorityServiceClient.close()` method on the client to safely |
| 60 | + clean up any remaining background resources. */ |
| 61 | + try (CertificateAuthorityServiceClient certificateAuthorityServiceClient = |
| 62 | + CertificateAuthorityServiceClient.create()) { |
| 63 | + |
| 64 | + /* Describes any predefined X.509 values set by this template. |
| 65 | + The provided extensions are copied over to certificate requests that use this template.*/ |
| 66 | + KeyUsage keyUsage = |
| 67 | + KeyUsage.newBuilder() |
| 68 | + .setBaseKeyUsage( |
| 69 | + KeyUsageOptions.newBuilder() |
| 70 | + .setDigitalSignature(true) |
| 71 | + .setKeyEncipherment(true) |
| 72 | + .build()) |
| 73 | + .setExtendedKeyUsage(ExtendedKeyUsageOptions.newBuilder().setServerAuth(true).build()) |
| 74 | + .build(); |
| 75 | + |
| 76 | + CaOptions caOptions = CaOptions.newBuilder().setIsCa(false).build(); |
| 77 | + |
| 78 | + /* CEL expression that is evaluated against the Subject and |
| 79 | + Subject Alternative Name of the certificate before it is issued. */ |
| 80 | + Expr expr = |
| 81 | + Expr.newBuilder().setExpression("subject_alt_names.all(san, san.type == DNS)").build(); |
| 82 | + |
| 83 | + // Set the certificate issuance schema. |
| 84 | + CertificateTemplate certificateTemplate = |
| 85 | + CertificateTemplate.newBuilder() |
| 86 | + .setPredefinedValues( |
| 87 | + X509Parameters.newBuilder().setKeyUsage(keyUsage).setCaOptions(caOptions).build()) |
| 88 | + .setIdentityConstraints( |
| 89 | + CertificateIdentityConstraints.newBuilder() |
| 90 | + .setCelExpression(expr) |
| 91 | + .setAllowSubjectPassthrough(false) |
| 92 | + .setAllowSubjectAltNamesPassthrough(false) |
| 93 | + .build()) |
| 94 | + .build(); |
| 95 | + |
| 96 | + // Set the parent and certificate template properties. |
| 97 | + CreateCertificateTemplateRequest certificateTemplateRequest = |
| 98 | + CreateCertificateTemplateRequest.newBuilder() |
| 99 | + .setParent(LocationName.of(project, location).toString()) |
| 100 | + .setCertificateTemplate(certificateTemplate) |
| 101 | + .setCertificateTemplateId(certificateTemplateId) |
| 102 | + .build(); |
| 103 | + |
| 104 | + // Create Template request. |
| 105 | + ApiFuture<Operation> futureCall = |
| 106 | + certificateAuthorityServiceClient |
| 107 | + .createCertificateTemplateCallable() |
| 108 | + .futureCall(certificateTemplateRequest); |
| 109 | + |
| 110 | + Operation response = futureCall.get(60, TimeUnit.SECONDS); |
| 111 | + |
| 112 | + if (response.hasError()) { |
| 113 | + System.out.println("Error creating certificate template ! " + response.getError()); |
| 114 | + return; |
| 115 | + } |
| 116 | + |
| 117 | + System.out.println("Successfully created certificate template ! " + response.getName()); |
| 118 | + } |
| 119 | + } |
| 120 | +} |
| 121 | +// [END privateca_create_certificate_template] |
![gcf-owl-bot[bot]](https://avatars.githubusercontent.com/in/99011?v=4&size=40){kind=avatar}
0 commit comments