CertificateAuthority

acmpca.services.k8s.aws/v1alpha1

Metadata#

Contains information about your private certificate authority (CA). Your private CA can issue and revoke X.509 digital certificates. Digital certificates verify that the entity named in the certificate Subject field owns or controls the public key contained in the Subject Public Key Info field. Call the CreateCertificateAuthority (https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html) action to create your private CA. You must then call the GetCertificateAuthorityCertificate (https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificateAuthorityCertificate.html) action to retrieve a private CA certificate signing request (CSR). Sign the CSR with your Amazon Web Services Private CA-hosted or on-premises root or subordinate CA certificate. Call the ImportCertificateAuthorityCertificate (https://docs.aws.amazon.com/privateca/latest/APIReference/API_ImportCertificateAuthorityCertificate.html) action to import the signed certificate into Certificate Manager (ACM).

Spec#

certificateAuthorityConfiguration: 
  csrExtensions: 
    keyUsage: 
      crlSign: boolean
      dataEncipherment: boolean
      decipherOnly: boolean
      digitalSignature: boolean
      encipherOnly: boolean
      keyAgreement: boolean
      keyCertSign: boolean
      keyEncipherment: boolean
      nonRepudiation: boolean
    subjectInformationAccess:
      accessLocation: 
        directoryName: 
          commonName: string
          country: string
          customAttributes:
          - objectIdentifier: string
            value: string
          distinguishedNameQualifier: string
          generationQualifier: string
          givenName: string
          initials: string
          locality: string
          organization: string
          organizationalUnit: string
          pseudonym: string
          serialNumber: string
          state: string
          surname: string
          title: string
        dnsName: string
        ediPartyName: 
          nameAssigner: string
          partyName: string
        ipAddress: string
        otherName: 
          typeID: string
          value: string
        registeredID: string
        rfc822Name: string
        uniformResourceIdentifier: string
      accessMethod: 
        accessMethodType: string
        customObjectIdentifier: string
  keyAlgorithm: string
  signingAlgorithm: string
  subject: 
    commonName: string
    country: string
    customAttributes:
    - objectIdentifier: string
      value: string
    distinguishedNameQualifier: string
    generationQualifier: string
    givenName: string
    initials: string
    locality: string
    organization: string
    organizationalUnit: string
    pseudonym: string
    serialNumber: string
    state: string
    surname: string
    title: string
certificateAuthorityType: string
keyStorageSecurityStandard: string
revocationConfiguration: 
  crlConfiguration: 
    customCNAME: string
    enabled: boolean
    expirationInDays: integer
    s3BucketName: string
    s3ObjectACL: string
  ocspConfiguration: 
    enabled: boolean
    ocspCustomCNAME: string
tags:
- key: string
  value: string
usageMode: string

Status#

ackResourceMetadata: 
  arn: string
  ownerAccountID: string
  region: string
conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
createdAt: string
csr: string
failureReason: string
lastStateChangeAt: string
notAfter: string
notBefore: string
ownerAccount: string
restorableUntil: string
serial: string
status: string