Google 会使用 AI 技术将内容翻译成您偏好的语言。AI 翻译可能包含错误。

创建从属证书授权机构

本页面介绍了如何在 CA 池中创建从属证书授权机构 (CA)。

从属 CA 负责直接向最终实体（例如用户、计算机和设备）颁发证书。从属 CA 由父级 CA（通常是根 CA）进行加密签名。因此，信任根 CA 的系统会自动信任从属 CA 以及从属 CA 颁发的最终实体证书。

准备工作

确保您拥有 CA Service Operation Manager (roles/privateca.caManager) 或 CA Service Admin (roles/privateca.admin) IAM 角色。如需了解相关信息，请参阅配置 IAM 政策。
创建 CA 池。
选择您的根 CA。
如果包含颁发根 CA 的 CA 池配置了证书颁发政策，请验证其 baselineValues 是否允许颁发 CA 证书 caOptions.isCa: true、keyUsage.baseKeyUsage.certSign: true 和 keyUsage.baseKeyUsage.crlSign: true。否则，激活从属 CA 会失败，并显示 Fields in the CSR were modified or removed in the signed CA certificate 出错提示。

创建从属 CA

从属 CA 比根 CA 更容易撤消和轮替。如果您有多个证书颁发场景，可以为每种场景创建一个从属 CA。在 CA 池中添加多个从属 CA 有助于您更好地对证书请求进行负载均衡，并提高总有效 QPS。

如需创建从属 CA，请执行以下操作：

控制台

前往Google Cloud 控制台中的 Certificate Authority Service 页面。

前往 Certificate Authority Service
点击 CA 管理器标签页。
点击创建 CA。

选择 CA 类型

点击从属 CA。
点击根 CA 位于 Google Cloud 中。
在有效期字段中，输入您希望 CA 证书有效的时长。
可选：选择 CA 的层级。默认层级为企业版。如需了解详情，请参阅选择操作层级。
点击区域，为 CA 选择一个位置。如需了解详情，请参阅位置。
可选：在初始化状态下，选择要在其中创建 CA 的操作状态。
可选：在设置颁发场景下，点击证书配置文件，然后从列表中选择最符合您要求的证书配置文件。如需了解详情，请参阅证书配置文件。
点击下一步。

配置 CA 主题名称

可选：在组织 (O) 字段中，输入贵公司的名称。
可选：在组织部门 (OU) 字段中，输入公司下属机构或业务单位。
可选：在国家/地区名称 (C) 字段中，输入由两个字母组成的国家/地区代码。
可选：在州或省/自治区/直辖市名称字段中，输入您所在州的名称。
可选：在地区名称字段中，输入您所在城市的名称。
在 CA 通用名称 (CN) 字段中，输入 CA 名称。
点击继续。

配置 CA 密钥大小和算法

选择最符合您需求的密钥算法。如需详细了解签名密钥选项，请参阅配置 CA 签名密钥。
如需使用客户管理的签名密钥，请选择客户管理的密钥，并提供 Cloud Key Management Service 加密密钥版本。
点击继续。

配置 CA 工件

选择是要使用 Google 管理的 Cloud Storage 存储桶，还是使用客户管理的 Cloud Storage 存储桶。

对于 Google 管理的 Cloud Storage 存储桶，CA Service 会在 CA 所在的位置创建 Google 管理的存储桶。
对于客户管理的 Cloud Storage 存储桶，请点击“浏览”，然后选择一个现有的 Cloud Storage 存储桶。

点击继续。

添加标签

以下步骤是可选的。

如果您想向 CA 添加标签，请执行以下操作：

点击 添加一项。
在键 1 字段中，输入标签键。
在值 1 字段中，输入标签值。
如果您想添加其他标签，请点击 添加项。然后，按照第 2 步和第 3 步中的说明添加标签键和值。
点击继续。

查看设置

仔细检查所有设置，然后点击完成以创建 CA。

gcloud

为从属 CA 创建 CA 池：
```
gcloud privateca pools create SUBORDINATE_POOL_ID --location=LOCATION
```
替换以下内容：
- SUBORDINATE_POOL_ID：CA 池的名称
- LOCATION：您要在其中创建 CA 池的位置。如需查看完整的位置列表，请参阅位置。
如需详细了解如何创建 CA 池，请参阅创建 CA 池。

如需详细了解 gcloud privateca pools create 命令，请参阅 gcloud privateca pools create。
在创建的 CA 池中创建从属 CA。

注意： 您可以通过从 create 命令中复制 ID 或使用 gcloud privateca pools list 命令来获取颁发者的资源 ID (ISSUER_POOL_ID)。

确保 --issuer-pool 指定的是颁发 CA 池的 ID（而非根 CA 的资源 ID）。此外，如果颁发 CA 池配置了颁发政策，则其 baselineValues 必须允许 CA 证书：
```
baselineValues:
  caOptions:
    isCa: true
  keyUsage:
    baseKeyUsage:
      certSign: true
      crlSign: true
```
如果签发 CA 池限制仅向最终实体证书签发，则激活从属 CA 会失败，并显示 Fields in the CSR were modified or removed in the signed CA certificate 出错提示。
```
gcloud privateca subordinates create SUBORDINATE_CA_ID \
    --pool=SUBORDINATE_POOL_ID \
    --location=LOCATION \
    --issuer-pool=ISSUER_POOL_ID \
    --issuer-location=ISSUER_LOCATION \
    --key-algorithm="ec-p256-sha256" \
    --subject="CN=Example Server TLS CA, O=Example LLC"
```
替换以下内容：
- SUBORDINATE_CA_ID：从属 CA 的唯一标识符
- SUBORDINATE_POOL_ID：CA 池的名称
- LOCATION：CA 池的位置
- ISSUER_POOL_ID：包含颁发 CA 的 CA 池的名称
- ISSUER_LOCATION：包含颁发 CA 的 CA 池的位置
  
  --key-algorithm 标志指定您要用于为 CA 创建代管式 Cloud HSM 密钥的加密算法。
  
  --subject 标志指定证书主体的 X.501 名称。
如需使用客户管理的签名密钥创建从属 CA，请运行以下命令：
```
gcloud privateca subordinates create SUBORDINATE_CA_ID \
    --pool=SUBORDINATE_POOL_ID \
    --location=LOCATION \
    --issuer-pool=ISSUER_POOL_ID \
    --issuer-location=ISSUER_LOCATION \
    --kms-key-version=KMS_KEY_VERSION \
    --subject="CN=Example Server TLS CA, O=Example LLC"
```
替换以下内容：
- SUBORDINATE_POOL_ID：CA 池的名称
- LOCATION：CA 池的位置
- ISSUER_POOL_ID：包含颁发 CA 的 CA 池的名称
- ISSUER_LOCATION：包含颁发 CA 的 CA 池的位置
- KMS_KEY_VERSION：要用作签名密钥的客户管理的 Cloud KMS 加密密钥版本的完整资源 ID
如需详细了解签名密钥选项和准备客户管理的签名密钥，请参阅配置 CA 签名密钥。

创建从属 CA 时，系统会返回以下语句。
```
Created Certificate Authority [projects/my-project-pki/locations/us-west1/caPools/SUBORDINATE_POOL_ID/certificateAuthorities/SUBORDINATE_CA_ID].
```
如需指定自定义授权信息访问 (AIA) 和 CRL 分发点 (CDP) 访问网址，请使用 --custom-aia-urls 和 --custom-cdp-urls 标志。如果指定，这些网址将包含在 CA 颁发的所有证书中，并取代默认的 Cloud Storage 存储桶访问网址。

如需查看设置的详尽列表，请运行以下 gcloud 命令：
```
gcloud privateca subordinates create --help
```
该命令会返回创建颁发者位于 CA Service 或其他位置的从属 CA 的示例。

Terraform

resource "google_privateca_certificate_authority" "root_ca" {
  // This example assumes this pool already exists.
  // Pools cannot be deleted in normal test circumstances, so we depend on static pools
  pool                                   = "my-pool"
  certificate_authority_id               = "my-certificate-authority-root"
  location                               = "us-central1"
  deletion_protection                    = false # set to true to prevent destruction of the resource
  ignore_active_certificates_on_deletion = true
  config {
    subject_config {
      subject {
        organization = "ACME"
        common_name  = "my-certificate-authority"
      }
    }
    x509_config {
      ca_options {
        # is_ca *MUST* be true for certificate authorities
        is_ca = true
      }
      key_usage {
        base_key_usage {
          # cert_sign and crl_sign *MUST* be true for certificate authorities
          cert_sign = true
          crl_sign  = true
        }
        extended_key_usage {
        }
      }
    }
  }
  key_spec {
    algorithm = "RSA_PKCS1_4096_SHA256"
  }
  // valid for 10 years
  lifetime = "${10 * 365 * 24 * 3600}s"
}

resource "google_privateca_certificate_authority" "sub_ca" {
  // This example assumes this pool already exists.
  // Pools cannot be deleted in normal test circumstances, so we depend on static pools
  pool                     = "my-sub-pool"
  certificate_authority_id = "my-certificate-authority-sub"
  location                 = "us-central1"
  deletion_protection      = false # set to true to prevent destruction of the resource
  subordinate_config {
    certificate_authority = google_privateca_certificate_authority.root_ca.name
  }
  config {
    subject_config {
      subject {
        organization = "ACME"
        common_name  = "my-subordinate-authority"
      }
    }
    x509_config {
      ca_options {
        is_ca = true
        # Force the sub CA to only issue leaf certs.
        # Use e.g.
        #    max_issuer_path_length = 1
        # if you need to chain more subordinates.
        zero_max_issuer_path_length = true
      }
      key_usage {
        base_key_usage {
          cert_sign = true
          crl_sign  = true
        }
        extended_key_usage {
        }
      }
    }
  }
  // valid for 5 years
  lifetime = "${5 * 365 * 24 * 3600}s"
  key_spec {
    algorithm = "RSA_PKCS1_2048_SHA256"
  }
  type = "SUBORDINATE"
}

Java

如需向 CA Service 进行身份验证，请设置应用默认凭据。如需了解详情，请参阅为本地开发环境设置身份验证。


import com.google.api.core.ApiFuture;
import com.google.cloud.security.privateca.v1.CaPoolName;
import com.google.cloud.security.privateca.v1.CertificateAuthority;
import com.google.cloud.security.privateca.v1.CertificateAuthority.KeyVersionSpec;
import com.google.cloud.security.privateca.v1.CertificateAuthority.SignHashAlgorithm;
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
import com.google.cloud.security.privateca.v1.CertificateConfig;
import com.google.cloud.security.privateca.v1.CertificateConfig.SubjectConfig;
import com.google.cloud.security.privateca.v1.CreateCertificateAuthorityRequest;
import com.google.cloud.security.privateca.v1.KeyUsage;
import com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions;
import com.google.cloud.security.privateca.v1.Subject;
import com.google.cloud.security.privateca.v1.SubjectAltNames;
import com.google.cloud.security.privateca.v1.X509Parameters;
import com.google.cloud.security.privateca.v1.X509Parameters.CaOptions;
import com.google.longrunning.Operation;
import com.google.protobuf.Duration;
import java.io.IOException;
import java.util.concurrent.ExecutionException;

public class CreateSubordinateCa {

  public static void main(String[] args)
      throws InterruptedException, ExecutionException, IOException {
    // TODO(developer): Replace these variables before running the sample.
    // location: For a list of locations, see:
    // https://cloud.google.com/certificate-authority-service/docs/locations
    // poolId: Set it to the CA Pool under which the CA should be created.
    // subordinateCaName: Unique name for the Subordinate CA.
    String project = "your-project-id";
    String location = "ca-location";
    String poolId = "ca-pool-id";
    String subordinateCaName = "subordinate-certificate-authority-name";

    createSubordinateCertificateAuthority(project, location, poolId, subordinateCaName);
  }

  public static void createSubordinateCertificateAuthority(
      String project, String location, String poolId, String subordinateCaName)
      throws IOException, ExecutionException, InterruptedException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the `certificateAuthorityServiceClient.close()` method on the client to safely
    // clean up any remaining background resources.
    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
        CertificateAuthorityServiceClient.create()) {

      String commonName = "commonname";
      String orgName = "csr-org-name";
      String domainName = "dns.example.com";
      int caDuration = 100000; // Validity of this CA in seconds.

      // Set the type of Algorithm.
      KeyVersionSpec keyVersionSpec =
          KeyVersionSpec.newBuilder().setAlgorithm(SignHashAlgorithm.RSA_PKCS1_4096_SHA256).build();

      // Set CA subject config.
      SubjectConfig subjectConfig =
          SubjectConfig.newBuilder()
              .setSubject(
                  Subject.newBuilder().setCommonName(commonName).setOrganization(orgName).build())
              // Set the fully qualified domain name.
              .setSubjectAltName(SubjectAltNames.newBuilder().addDnsNames(domainName).build())
              .build();

      //  Set the key usage options for X.509 fields.
      X509Parameters x509Parameters =
          X509Parameters.newBuilder()
              .setKeyUsage(
                  KeyUsage.newBuilder()
                      .setBaseKeyUsage(
                          KeyUsageOptions.newBuilder().setCrlSign(true).setCertSign(true).build())
                      .build())
              .setCaOptions(CaOptions.newBuilder().setIsCa(true).build())
              .build();

      // Set certificate authority settings.
      CertificateAuthority subCertificateAuthority =
          CertificateAuthority.newBuilder()
              .setType(CertificateAuthority.Type.SUBORDINATE)
              .setKeySpec(keyVersionSpec)
              .setConfig(
                  CertificateConfig.newBuilder()
                      .setSubjectConfig(subjectConfig)
                      .setX509Config(x509Parameters)
                      .build())
              // Set the CA validity duration.
              .setLifetime(Duration.newBuilder().setSeconds(caDuration).build())
              .build();

      // Create the CertificateAuthorityRequest.
      CreateCertificateAuthorityRequest subCertificateAuthorityRequest =
          CreateCertificateAuthorityRequest.newBuilder()
              .setParent(CaPoolName.of(project, location, poolId).toString())
              .setCertificateAuthorityId(subordinateCaName)
              .setCertificateAuthority(subCertificateAuthority)
              .build();

      // Create Subordinate CA.
      ApiFuture<Operation> futureCall =
          certificateAuthorityServiceClient
              .createCertificateAuthorityCallable()
              .futureCall(subCertificateAuthorityRequest);

      Operation response = futureCall.get();

      if (response.hasError()) {
        System.out.println("Error while creating Subordinate CA !" + response.getError());
        return;
      }

      System.out.println(
          "Subordinate Certificate Authority created successfully : " + subordinateCaName);
    }
  }
}

Python

如需向 CA Service 进行身份验证，请设置应用默认凭据。如需了解详情，请参阅为本地开发环境设置身份验证。

import google.cloud.security.privateca_v1 as privateca_v1
from google.protobuf import duration_pb2


def create_subordinate_ca(
    project_id: str,
    location: str,
    ca_pool_name: str,
    subordinate_ca_name: str,
    common_name: str,
    organization: str,
    domain: str,
    ca_duration: int,
) -> None:
    """
    Create Certificate Authority (CA) which is the subordinate CA in the given CA Pool.
    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
        ca_pool_name: set it to the CA Pool under which the CA should be created.
        subordinate_ca_name: unique name for the Subordinate CA.
        common_name: a title for your certificate authority.
        organization: the name of your company for your certificate authority.
        domain: the name of your company for your certificate authority.
        ca_duration: the validity of the certificate authority in seconds.
    """

    ca_service_client = privateca_v1.CertificateAuthorityServiceClient()

    # Set the type of Algorithm
    key_version_spec = privateca_v1.CertificateAuthority.KeyVersionSpec(
        algorithm=privateca_v1.CertificateAuthority.SignHashAlgorithm.RSA_PKCS1_4096_SHA256
    )

    # Set CA subject config.
    subject_config = privateca_v1.CertificateConfig.SubjectConfig(
        subject=privateca_v1.Subject(
            common_name=common_name, organization=organization
        ),
        # Set the fully qualified domain name.
        subject_alt_name=privateca_v1.SubjectAltNames(dns_names=[domain]),
    )

    # Set the key usage options for X.509 fields.
    x509_parameters = privateca_v1.X509Parameters(
        key_usage=privateca_v1.KeyUsage(
            base_key_usage=privateca_v1.KeyUsage.KeyUsageOptions(
                crl_sign=True,
                cert_sign=True,
            )
        ),
        ca_options=privateca_v1.X509Parameters.CaOptions(
            is_ca=True,
        ),
    )

    # Set certificate authority settings.
    certificate_authority = privateca_v1.CertificateAuthority(
        type_=privateca_v1.CertificateAuthority.Type.SUBORDINATE,
        key_spec=key_version_spec,
        config=privateca_v1.CertificateConfig(
            subject_config=subject_config,
            x509_config=x509_parameters,
        ),
        # Set the CA validity duration.
        lifetime=duration_pb2.Duration(seconds=ca_duration),
    )

    ca_pool_path = ca_service_client.ca_pool_path(project_id, location, ca_pool_name)

    # Create the CertificateAuthorityRequest.
    request = privateca_v1.CreateCertificateAuthorityRequest(
        parent=ca_pool_path,
        certificate_authority_id=subordinate_ca_name,
        certificate_authority=certificate_authority,
    )

    operation = ca_service_client.create_certificate_authority(request=request)
    result = operation.result()

    print(f"Operation result: {result}")

启用从属 CA

如需启用从属 CA，请执行以下操作：

控制台

前往Google Cloud 控制台中的 Certificate Authority Service 页面。

前往 Certificate Authority Service
点击 CA 管理器标签页。
在证书授权机构下，选择要启用的 CA。
点击 play_circle启用。

gcloud

如需启用新创建的从属 CA，请运行以下命令：

gcloud privateca subordinates enable SUBORDINATE_CA_ID \
--pool=SUBORDINATE_POOL_ID \
--location=LOCATION

替换以下内容：

SUBORDINATE_CA_ID：从属 CA 的唯一标识符
SUBORDINATE_POOL_ID：包含从属 CA 的 CA 池的名称
LOCATION：CA 池的位置。如需查看完整的位置列表，请参阅位置。

如需详细了解 gcloud privateca subordinates enable 命令，请参阅 gcloud privateca subordinates enable。

Terraform

在从属 CA 上将 desired_state 字段设置为 ENABLED，然后运行 terraform apply。

Java

如需使用签名证书激活从属 CA，请调用 ActivateCertificateAuthority RPC：


import com.google.api.core.ApiFuture;
import com.google.cloud.security.privateca.v1.ActivateCertificateAuthorityRequest;
import com.google.cloud.security.privateca.v1.CertificateAuthorityName;
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
import com.google.cloud.security.privateca.v1.SubordinateConfig;
import com.google.longrunning.Operation;
import java.io.IOException;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;

public class ActivateSubordinateCa {

  public static void main(String[] args)
      throws InterruptedException, ExecutionException, IOException {
    // TODO(developer): Replace these variables before running the sample.

    // location: For a list of locations, see:
    // https://cloud.google.com/certificate-authority-service/docs/locations
    // poolId: Set a unique id for the CA pool.
    // subordinateCaName: The CA to be activated.
    // pemCaCertificate: The signed certificate, obtained by signing the CSR.
    String project = "your-project-id";
    String location = "ca-location";
    String poolId = "ca-pool-id";
    String subordinateCaName = "subordinate-certificate-authority-name";
    String pemCaCertificate =
        "-----BEGIN CERTIFICATE-----\n" + "sample-pem-certificate\n" + "-----END CERTIFICATE-----";

    // certificateAuthorityName: The name of the certificate authority which signed the CSR.
    // If an external CA (CA not present in Google Cloud) was used for signing,
    // then use the CA's issuerCertificateChain.
    String certificateAuthorityName = "certificate-authority-name";

    activateSubordinateCa(
        project, location, poolId, certificateAuthorityName, subordinateCaName, pemCaCertificate);
  }

  // Activate a subordinate CA.
  // *Prerequisite*: Get the CSR of the subordinate CA signed by another CA. Pass in the signed
  // certificate and (issuer CA's name or the issuer CA's Certificate chain).
  // *Post*: After activating the subordinate CA, it should be enabled before issuing certificates.
  public static void activateSubordinateCa(
      String project,
      String location,
      String poolId,
      String certificateAuthorityName,
      String subordinateCaName,
      String pemCaCertificate)
      throws ExecutionException, InterruptedException, IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the `certificateAuthorityServiceClient.close()` method on the client to safely
    // clean up any remaining background resources.
    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
        CertificateAuthorityServiceClient.create()) {
      // Subordinate CA parent.
      String subordinateCaParent =
          CertificateAuthorityName.of(project, location, poolId, subordinateCaName).toString();

      // Construct the "Activate CA Request".
      ActivateCertificateAuthorityRequest activateCertificateAuthorityRequest =
          ActivateCertificateAuthorityRequest.newBuilder()
              .setName(subordinateCaParent)
              // The signed certificate.
              .setPemCaCertificate(pemCaCertificate)
              .setSubordinateConfig(
                  SubordinateConfig.newBuilder()
                      // Follow one of the below methods:

                      // Method 1: If issuer CA is in Google Cloud, set the Certificate Authority
                      // Name.
                      .setCertificateAuthority(
                          CertificateAuthorityName.of(
                                  project, location, poolId, certificateAuthorityName)
                              .toString())

                      // Method 2: If issuer CA is external to Google Cloud, set the issuer's
                      // certificate chain.
                      // The certificate chain of the CA (which signed the CSR) from leaf to root.
                      // .setPemIssuerChain(
                      //     SubordinateConfigChain.newBuilder()
                      //         .addAllPemCertificates(issuerCertificateChain)
                      //         .build())

                      .build())
              .build();

      // Activate the CA.
      ApiFuture<Operation> futureCall =
          certificateAuthorityServiceClient
              .activateCertificateAuthorityCallable()
              .futureCall(activateCertificateAuthorityRequest);

      Operation response = futureCall.get();

      if (response.hasError()) {
        System.out.println("Error while activating the subordinate CA! " + response.getError());
        return;
      }

      System.out.println(
          "Subordinate Certificate Authority activated successfully ! !" + subordinateCaName);
      TimeUnit.SECONDS.sleep(3);
      // The current state will be STAGED.
      // The Subordinate CA has to be ENABLED before issuing certificates.
      System.out.println(
          "Current State: "
              + certificateAuthorityServiceClient
              .getCertificateAuthority(subordinateCaParent)
              .getState());
    }
  }
}

如需启用从属 CA 以便其可以颁发证书，请调用 EnableCertificateAuthority RPC：


import com.google.api.core.ApiFuture;
import com.google.cloud.security.privateca.v1.CertificateAuthority.State;
import com.google.cloud.security.privateca.v1.CertificateAuthorityName;
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
import com.google.cloud.security.privateca.v1.EnableCertificateAuthorityRequest;
import com.google.longrunning.Operation;
import java.io.IOException;
import java.util.concurrent.ExecutionException;

public class EnableCertificateAuthority {

  public static void main(String[] args)
      throws InterruptedException, ExecutionException, IOException {
    // TODO(developer): Replace these variables before running the sample.
    // location: For a list of locations, see:
    // https://cloud.google.com/certificate-authority-service/docs/locations
    // poolId: The id of the CA pool under which the CA is present.
    // certificateAuthorityName: The name of the CA to be enabled.
    String project = "your-project-id";
    String location = "ca-location";
    String poolId = "ca-pool-id";
    String certificateAuthorityName = "certificate-authority-name";
    enableCertificateAuthority(project, location, poolId, certificateAuthorityName);
  }

  // Enable the Certificate Authority present in the given ca pool.
  // CA cannot be enabled if it has been already deleted.
  public static void enableCertificateAuthority(
      String project, String location, String poolId, String certificateAuthorityName)
      throws IOException, ExecutionException, InterruptedException {
    try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
        CertificateAuthorityServiceClient.create()) {
      // Create the Certificate Authority Name.
      CertificateAuthorityName certificateAuthorityParent =
          CertificateAuthorityName.newBuilder()
              .setProject(project)
              .setLocation(location)
              .setCaPool(poolId)
              .setCertificateAuthority(certificateAuthorityName)
              .build();

      // Create the Enable Certificate Authority Request.
      EnableCertificateAuthorityRequest enableCertificateAuthorityRequest =
          EnableCertificateAuthorityRequest.newBuilder()
              .setName(certificateAuthorityParent.toString())
              .build();

      // Enable the Certificate Authority.
      ApiFuture<Operation> futureCall =
          certificateAuthorityServiceClient
              .enableCertificateAuthorityCallable()
              .futureCall(enableCertificateAuthorityRequest);
      Operation response = futureCall.get();

      if (response.hasError()) {
        System.out.println("Error while enabling Certificate Authority !" + response.getError());
        return;
      }

      // Get the current CA state.
      State caState =
          certificateAuthorityServiceClient
              .getCertificateAuthority(certificateAuthorityParent)
              .getState();

      // Check if the CA is enabled.
      if (caState == State.ENABLED) {
        System.out.println("Enabled Certificate Authority : " + certificateAuthorityName);
      } else {
        System.out.println(
            "Cannot enable the Certificate Authority ! Current CA State: " + caState);
      }
    }
  }
}

Python

如需使用签名证书激活从属 CA，请调用 ActivateCertificateAuthority RPC：

import google.cloud.security.privateca_v1 as privateca_v1


def activate_subordinate_ca(
    project_id: str,
    location: str,
    ca_pool_name: str,
    subordinate_ca_name: str,
    pem_ca_certificate: str,
    ca_name: str,
) -> None:
    """
    Activate a subordinate Certificate Authority (CA).
    *Prerequisite*: Get the Certificate Signing Resource (CSR) of the subordinate CA signed by another CA. Pass in the signed
    certificate and (issuer CA's name or the issuer CA's Certificate chain).
    *Post*: After activating the subordinate CA, it should be enabled before issuing certificates.
    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
        ca_pool_name: set it to the CA Pool under which the CA should be created.
        pem_ca_certificate: the signed certificate, obtained by signing the CSR.
        subordinate_ca_name: the CA to be activated.
        ca_name: The name of the certificate authority which signed the CSR.
            If an external CA (CA not present in Google Cloud) was used for signing,
            then use the CA's issuerCertificateChain.
    """

    ca_service_client = privateca_v1.CertificateAuthorityServiceClient()

    subordinate_ca_path = ca_service_client.certificate_authority_path(
        project_id, location, ca_pool_name, subordinate_ca_name
    )
    ca_path = ca_service_client.certificate_authority_path(
        project_id, location, ca_pool_name, ca_name
    )

    # Set CA subordinate config.
    subordinate_config = privateca_v1.SubordinateConfig(
        # Follow one of the below methods:
        # Method 1: If issuer CA is in Google Cloud, set the Certificate Authority Name.
        certificate_authority=ca_path,
        # Method 2: If issuer CA is external to Google Cloud, set the issuer's certificate chain.
        # The certificate chain of the CA (which signed the CSR) from leaf to root.
        # pem_issuer_chain=privateca_v1.SubordinateConfig.SubordinateConfigChain(
        #     pem_certificates=issuer_certificate_chain,
        # )
    )

    # Construct the "Activate CA Request".
    request = privateca_v1.ActivateCertificateAuthorityRequest(
        name=subordinate_ca_path,
        # The signed certificate.
        pem_ca_certificate=pem_ca_certificate,
        subordinate_config=subordinate_config,
    )

    # Activate the CA
    operation = ca_service_client.activate_certificate_authority(request=request)
    result = operation.result()

    print("Operation result:", result)

    # The current state will be STAGED.
    # The Subordinate CA has to be ENABLED before issuing certificates.
    print(
        f"Current state: {ca_service_client.get_certificate_authority(name=subordinate_ca_path).state}"
    )

如需启用从属 CA 以便其可以颁发证书，请调用 EnableCertificateAuthority RPC：

import google.cloud.security.privateca_v1 as privateca_v1


def enable_certificate_authority(
    project_id: str, location: str, ca_pool_name: str, ca_name: str
) -> None:
    """
    Enable the Certificate Authority present in the given ca pool.
    CA cannot be enabled if it has been already deleted.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
        ca_pool_name: the name of the CA pool under which the CA is present.
        ca_name: the name of the CA to be enabled.
    """

    caServiceClient = privateca_v1.CertificateAuthorityServiceClient()
    ca_path = caServiceClient.certificate_authority_path(
        project_id, location, ca_pool_name, ca_name
    )

    # Create the Enable Certificate Authority Request.
    request = privateca_v1.EnableCertificateAuthorityRequest(
        name=ca_path,
    )

    # Enable the Certificate Authority.
    operation = caServiceClient.enable_certificate_authority(request=request)
    operation.result()

    # Get the current CA state.
    ca_state = caServiceClient.get_certificate_authority(name=ca_path).state

    # Check if the CA is enabled.
    if ca_state == privateca_v1.CertificateAuthority.State.ENABLED:
        print("Enabled Certificate Authority:", ca_name)
    else:
        print("Cannot enable the Certificate Authority ! Current CA State:", ca_state)

后续步骤

了解如何申请证书。
了解如何使用 CSR 提交证书请求。
了解模板和颁发政策。