Skip to content

Commit b9638af

Browse files
Sita04gcf-owl-bot[bot]
Sita04
and
gcf-owl-bot[bot]
authored
docs(samples): adding client library samples (#242)
* feat: add samples for creating and activating subordinate ca * feat: add sample for filtering certificate. * feat: add sample for undeleting CA. * fix: adding all pem certificates in chain. * docs: lint fix * refactor: filter conditions changed to arg * test: added test cases * 🦉 Updates from OwlBot See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * fix: region tag mismatch * fix: correct region tag mismatch * refactor: added comments for certificate chain setting * 🦉 Updates from OwlBot See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * docs: lint fix * 🦉 Updates from OwlBot See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * 🦉 Updates from OwlBot See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 790977a commit b9638af

File tree

6 files changed

+679
-8
lines changed

6 files changed

+679
-8
lines changed

‎privateca/cloud-client/src/main/java/privateca/ActivateSubordinateCa.java

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
/*
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package privateca;
17+
18+
// [START privateca_activate_subordinateca]
19+
20+
import com.google.api.core.ApiFuture;
21+
import com.google.cloud.security.privateca.v1.ActivateCertificateAuthorityRequest;
22+
import com.google.cloud.security.privateca.v1.CertificateAuthorityName;
23+
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
24+
import com.google.cloud.security.privateca.v1.SubordinateConfig;
25+
import com.google.longrunning.Operation;
26+
import java.io.IOException;
27+
import java.util.concurrent.ExecutionException;
28+
import java.util.concurrent.TimeUnit;
29+
30+
public class ActivateSubordinateCa {
31+
32+
public static void main(String[] args)
33+
throws InterruptedException, ExecutionException, IOException {
34+
// TODO(developer): Replace these variables before running the sample.
35+
36+
// location: For a list of locations, see:
37+
// https://cloud.google.com/certificate-authority-service/docs/locations
38+
// pool_Id: Set a unique id for the CA pool.
39+
// subordinateCaName: The CA to be activated.
40+
// pemCACertificate: The signed certificate, obtained by signing the CSR.
41+
String project = "your-project-id";
42+
String location = "ca-location";
43+
String pool_Id = "ca-pool-id";
44+
String subordinateCaName = "subordinate-certificate-authority-name";
45+
String pemCACertificate =
46+
"-----BEGIN CERTIFICATE-----\n" + "sample-pem-certificate\n" + "-----END CERTIFICATE-----";
47+
48+
// certificateAuthorityName: The name of the certificate authority which signed the CSR.
49+
// If an external CA (CA not present in Google Cloud) was used for signing,
50+
// then use the CA's issuerCertificateChain.
51+
String certificateAuthorityName = "certificate-authority-name";
52+
53+
activateSubordinateCA(
54+
project, location, pool_Id, certificateAuthorityName, subordinateCaName, pemCACertificate);
55+
}
56+
57+
// Activate a subordinate CA.
58+
// *Prerequisite*: Get the CSR of the subordinate CA signed by another CA. Pass in the signed
59+
// certificate and (issuer CA's name or the issuer CA's Certificate chain).
60+
// *Post*: After activating the subordinate CA, it should be enabled before issuing certificates.
61+
public static void activateSubordinateCA(
62+
String project,
63+
String location,
64+
String pool_Id,
65+
String certificateAuthorityName,
66+
String subordinateCaName,
67+
String pemCACertificate)
68+
throws ExecutionException, InterruptedException, IOException {
69+
// Initialize client that will be used to send requests. This client only needs to be created
70+
// once, and can be reused for multiple requests. After completing all of your requests, call
71+
// the `certificateAuthorityServiceClient.close()` method on the client to safely
72+
// clean up any remaining background resources.
73+
try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
74+
CertificateAuthorityServiceClient.create()) {
75+
// Subordinate CA parent.
76+
String subordinateCaParent =
77+
CertificateAuthorityName.of(project, location, pool_Id, subordinateCaName).toString();
78+
79+
// Construct the "Activate CA Request".
80+
ActivateCertificateAuthorityRequest activateCertificateAuthorityRequest =
81+
ActivateCertificateAuthorityRequest.newBuilder()
82+
.setName(subordinateCaParent)
83+
// The signed certificate.
84+
.setPemCaCertificate(pemCACertificate)
85+
.setSubordinateConfig(
86+
SubordinateConfig.newBuilder()
87+
// Follow one of the below methods:
88+
89+
// Method 1: If issuer CA is in Google Cloud, set the Certificate Authority
90+
// Name.
91+
.setCertificateAuthority(
92+
CertificateAuthorityName.of(
93+
project, location, pool_Id, certificateAuthorityName)
94+
.toString())
95+
96+
// Method 2: If issuer CA is external to Google Cloud, set the issuer's
97+
// certificate chain.
98+
// The certificate chain of the CA (which signed the CSR) from leaf to root.
99+
// .setPemIssuerChain(
100+
// SubordinateConfigChain.newBuilder()
101+
// .addAllPemCertificates(issuerCertificateChain)
102+
// .build())
103+
104+
.build())
105+
.build();
106+
107+
// Activate the CA.
108+
ApiFuture<Operation> futureCall =
109+
certificateAuthorityServiceClient
110+
.activateCertificateAuthorityCallable()
111+
.futureCall(activateCertificateAuthorityRequest);
112+
113+
Operation response = futureCall.get();
114+
115+
if (response.hasError()) {
116+
System.out.println("Error while activating the subordinate CA! " + response.getError());
117+
return;
118+
}
119+
120+
System.out.println(
121+
"Subordinate Certificate Authority activated successfully ! !" + subordinateCaName);
122+
TimeUnit.SECONDS.sleep(3);
123+
// The current state will be STAGED.
124+
// The Subordinate CA has to be ENABLED before issuing certificates.
125+
System.out.println(
126+
"Current State: "
127+
+ certificateAuthorityServiceClient
128+
.getCertificateAuthority(subordinateCaParent)
129+
.getState());
130+
}
131+
}
132+
}
133+
// [END privateca_activate_subordinateca]

‎privateca/cloud-client/src/main/java/privateca/CreateCertificate_CSR.java

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
/*
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package privateca;
17+
18+
// [START privateca_create_certificate_csr]
19+
20+
import com.google.api.core.ApiFuture;
21+
import com.google.cloud.security.privateca.v1.CaPoolName;
22+
import com.google.cloud.security.privateca.v1.Certificate;
23+
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
24+
import com.google.cloud.security.privateca.v1.CreateCertificateRequest;
25+
import com.google.protobuf.Duration;
26+
import java.io.IOException;
27+
import java.util.concurrent.ExecutionException;
28+
29+
public class CreateCertificate_CSR {
30+
31+
public static void main(String[] args)
32+
throws IOException, ExecutionException, InterruptedException {
33+
// TODO(developer): Replace these variables before running the sample.
34+
35+
// location: For a list of locations, see:
36+
// https://cloud.google.com/certificate-authority-service/docs/locations
37+
// pool_Id: Set a unique id for the CA pool.
38+
// certificateAuthorityName: The name of the certificate authority to sign the CSR.
39+
// certificateName: Set a unique name for the certificate.
40+
// pemCSR: Set the Certificate Issuing Request in the pem encoded format.
41+
String project = "your-project-id";
42+
String location = "ca-location";
43+
String pool_Id = "ca-pool-id";
44+
String certificateAuthorityName = "certificate-authority-name";
45+
String certificateName = "certificate-name";
46+
String pemCSR =
47+
"-----BEGIN CERTIFICATE REQUEST-----\n"
48+
+ "sample-pem-csr-format\n"
49+
+ "-----END CERTIFICATE REQUEST-----";
50+
51+
createCertificateWithCSR(
52+
project, location, pool_Id, certificateAuthorityName, certificateName, pemCSR);
53+
}
54+
55+
// Create a Certificate which is issued by the specified Certificate Authority.
56+
// The certificate details and the public key is provided as a CSR (Certificate Signing Request).
57+
public static void createCertificateWithCSR(
58+
String project,
59+
String location,
60+
String pool_Id,
61+
String certificateAuthorityName,
62+
String certificateName,
63+
String pemCSR)
64+
throws IOException, ExecutionException, InterruptedException {
65+
// Initialize client that will be used to send requests. This client only needs to be created
66+
// once, and can be reused for multiple requests. After completing all of your requests, call
67+
// the `certificateAuthorityServiceClient.close()` method on the client to safely
68+
// clean up any remaining background resources.
69+
try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
70+
CertificateAuthorityServiceClient.create()) {
71+
// certificateLifetime: The validity of the certificate in seconds.
72+
long certificateLifetime = 1000L;
73+
74+
// Create certificate with CSR.
75+
// The pemCSR contains the public key and the domain details required.
76+
Certificate certificate =
77+
Certificate.newBuilder()
78+
.setPemCsr(pemCSR)
79+
.setLifetime(Duration.newBuilder().setSeconds(certificateLifetime).build())
80+
.build();
81+
82+
// Create the Certificate Request.
83+
// Set the CA which is responsible for creating the certificate with the provided CSR.
84+
CreateCertificateRequest certificateRequest =
85+
CreateCertificateRequest.newBuilder()
86+
.setParent(CaPoolName.of(project, location, pool_Id).toString())
87+
.setIssuingCertificateAuthorityId(certificateAuthorityName)
88+
.setCertificateId(certificateName)
89+
.setCertificate(certificate)
90+
.build();
91+
92+
// Get the certificate response.
93+
ApiFuture<Certificate> future =
94+
certificateAuthorityServiceClient
95+
.createCertificateCallable()
96+
.futureCall(certificateRequest);
97+
98+
Certificate certificateResponse = future.get();
99+
100+
System.out.println("Certificate created successfully : " + certificateResponse.getName());
101+
102+
// Get the signed certificate and the issuer chain list.
103+
System.out.println("Signed certificate:\n " + certificateResponse.getPemCertificate());
104+
System.out.println("Issuer chain list:\n" + certificateResponse.getPemCertificateChainList());
105+
}
106+
}
107+
}
108+
// [END privateca_create_certificate_csr]

‎privateca/cloud-client/src/main/java/privateca/CreateSubordinateCa.java

+132
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
/*
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package privateca;
17+
18+
// [START privateca_create_subordinateca]
19+
20+
import com.google.api.core.ApiFuture;
21+
import com.google.cloud.security.privateca.v1.CaPoolName;
22+
import com.google.cloud.security.privateca.v1.CertificateAuthority;
23+
import com.google.cloud.security.privateca.v1.CertificateAuthority.KeyVersionSpec;
24+
import com.google.cloud.security.privateca.v1.CertificateAuthority.SignHashAlgorithm;
25+
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
26+
import com.google.cloud.security.privateca.v1.CertificateConfig;
27+
import com.google.cloud.security.privateca.v1.CertificateConfig.SubjectConfig;
28+
import com.google.cloud.security.privateca.v1.CreateCertificateAuthorityRequest;
29+
import com.google.cloud.security.privateca.v1.KeyUsage;
30+
import com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions;
31+
import com.google.cloud.security.privateca.v1.Subject;
32+
import com.google.cloud.security.privateca.v1.X509Parameters;
33+
import com.google.cloud.security.privateca.v1.X509Parameters.CaOptions;
34+
import com.google.longrunning.Operation;
35+
import com.google.protobuf.Duration;
36+
import java.io.IOException;
37+
import java.util.concurrent.ExecutionException;
38+
39+
public class CreateSubordinateCa {
40+
41+
public static void main(String[] args)
42+
throws InterruptedException, ExecutionException, IOException {
43+
// TODO(developer): Replace these variables before running the sample.
44+
// location: For a list of locations, see:
45+
// https://cloud.google.com/certificate-authority-service/docs/locations
46+
// pool_Id: Set it to the CA Pool under which the CA should be created.
47+
// subordinateCaName: Unique name for the Subordinate CA.
48+
String project = "your-project-id";
49+
String location = "ca-location";
50+
String pool_Id = "ca-pool-id";
51+
String subordinateCaName = "subordinate-certificate-authority-name";
52+
53+
createSubordinateCertificateAuthority(project, location, pool_Id, subordinateCaName);
54+
}
55+
56+
public static void createSubordinateCertificateAuthority(
57+
String project, String location, String pool_Id, String subordinateCaName)
58+
throws IOException, ExecutionException, InterruptedException {
59+
// Initialize client that will be used to send requests. This client only needs to be created
60+
// once, and can be reused for multiple requests. After completing all of your requests, call
61+
// the `certificateAuthorityServiceClient.close()` method on the client to safely
62+
// clean up any remaining background resources.
63+
try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
64+
CertificateAuthorityServiceClient.create()) {
65+
66+
String commonName = "common-name";
67+
String orgName = "csr-org-name";
68+
int caDuration = 100000; // Validity of this CA in seconds.
69+
70+
// Set the type of Algorithm.
71+
KeyVersionSpec keyVersionSpec =
72+
KeyVersionSpec.newBuilder().setAlgorithm(SignHashAlgorithm.RSA_PKCS1_4096_SHA256).build();
73+
74+
// Set CA subject config.
75+
SubjectConfig subjectConfig =
76+
SubjectConfig.newBuilder()
77+
.setSubject(
78+
Subject.newBuilder().setCommonName(commonName).setOrganization(orgName).build())
79+
.build();
80+
81+
// Set the key usage options for X.509 fields.
82+
X509Parameters x509Parameters =
83+
X509Parameters.newBuilder()
84+
.setKeyUsage(
85+
KeyUsage.newBuilder()
86+
.setBaseKeyUsage(
87+
KeyUsageOptions.newBuilder().setCrlSign(true).setCertSign(true).build())
88+
.build())
89+
.setCaOptions(CaOptions.newBuilder().setIsCa(true).build())
90+
.build();
91+
92+
// Set certificate authority settings.
93+
CertificateAuthority subCertificateAuthority =
94+
CertificateAuthority.newBuilder()
95+
.setType(CertificateAuthority.Type.SUBORDINATE)
96+
.setKeySpec(keyVersionSpec)
97+
.setConfig(
98+
CertificateConfig.newBuilder()
99+
.setSubjectConfig(subjectConfig)
100+
.setX509Config(x509Parameters)
101+
.build())
102+
// Set the CA validity duration.
103+
.setLifetime(Duration.newBuilder().setSeconds(caDuration).build())
104+
.build();
105+
106+
// Create the CertificateAuthorityRequest.
107+
CreateCertificateAuthorityRequest subCertificateAuthorityRequest =
108+
CreateCertificateAuthorityRequest.newBuilder()
109+
.setParent(CaPoolName.of(project, location, pool_Id).toString())
110+
.setCertificateAuthorityId(subordinateCaName)
111+
.setCertificateAuthority(subCertificateAuthority)
112+
.build();
113+
114+
// Create Subordinate CA.
115+
ApiFuture<Operation> futureCall =
116+
certificateAuthorityServiceClient
117+
.createCertificateAuthorityCallable()
118+
.futureCall(subCertificateAuthorityRequest);
119+
120+
Operation response = futureCall.get();
121+
122+
if (response.hasError()) {
123+
System.out.println("Error while creating Subordinate CA !" + response.getError());
124+
return;
125+
}
126+
127+
System.out.println(
128+
"Subordinate Certificate Authority created successfully : " + subordinateCaName);
129+
}
130+
}
131+
}
132+
// [END privateca_create_subordinateca]

0 commit comments

Comments
 (0)