CertificateIdentityConstraints

JSON representation

Describes constraints on a Certificate's Subject and SubjectAltNames.

JSON representation
{ "celExpression": { object (`Expr`) }, "allowSubjectPassthrough": boolean, "allowSubjectAltNamesPassthrough": boolean }

Fields

Fields
`celExpression`	`object (Expr)` Optional. A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/using-cel
`allowSubjectPassthrough`	`boolean` Required. If this is true, the `Subject` field may be copied from a certificate request into the signed certificate. Otherwise, the requested `Subject` will be discarded.
`allowSubjectAltNamesPassthrough`	`boolean` Required. If this is true, the `SubjectAltNames` extension may be copied from a certificate request into the signed certificate. Otherwise, the requested `SubjectAltNames` will be discarded.

celExpression

object (Expr)

Optional. A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/using-cel

allowSubjectPassthrough

boolean

Required. If this is true, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.

allowSubjectAltNamesPassthrough

boolean

Required. If this is true, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.