@pulumi/tls
Version:
A Pulumi package to create TLS resources in Pulumi programs.
164 lines (163 loc) • 10.2 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
export declare class LocallySignedCert extends pulumi.CustomResource {
/**
* Get an existing LocallySignedCert resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: LocallySignedCertState, opts?: pulumi.CustomResourceOptions): LocallySignedCert;
/**
* Returns true if the given object is an instance of LocallySignedCert. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is LocallySignedCert;
/**
* List of key usages allowed for the issued certificate. Values are defined in [RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280) and combine flags defined by both [Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3) and [Extended Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12). Accepted values: `anyExtended`, `certSigning`, `clientAuth`, `codeSigning`, `contentCommitment`, `crlSigning`, `dataEncipherment`, `decipherOnly`, `digitalSignature`, `emailProtection`, `encipherOnly`, `ipsecEndSystem`, `ipsecTunnel`, `ipsecUser`, `keyAgreement`, `keyEncipherment`, `microsoftCommercialCodeSigning`, `microsoftKernelCodeSigning`, `microsoftServerGatedCrypto`, `netscapeServerGatedCrypto`, `ocspSigning`, `serverAuth`, `timestamping`.
*/
readonly allowedUses: pulumi.Output<string[]>;
/**
* Certificate data of the Certificate Authority (CA) in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
readonly caCertPem: pulumi.Output<string>;
/**
* Name of the algorithm used when generating the private key provided in `caPrivateKeyPem`.
*/
readonly caKeyAlgorithm: pulumi.Output<string>;
/**
* Private key of the Certificate Authority (CA) used to sign the certificate, in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
readonly caPrivateKeyPem: pulumi.Output<string>;
/**
* Certificate data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format. **NOTE**: the [underlying](https://pkg.go.dev/encoding/pem#Encode) [libraries](https://pkg.go.dev/golang.org/x/crypto/ssh#MarshalAuthorizedKey) that generate this value append a `\n` at the end of the PEM. In case this disrupts your use case, we recommend using `trimspace()`.
*/
readonly certPem: pulumi.Output<string>;
/**
* Certificate request data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
readonly certRequestPem: pulumi.Output<string>;
readonly earlyRenewalHours: pulumi.Output<number>;
/**
* Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
*/
readonly isCaCertificate: pulumi.Output<boolean>;
/**
* Is the certificate either expired (i.e. beyond the `validityPeriodHours`) or ready for an early renewal (i.e. within the `earlyRenewalHours`)?
*/
readonly readyForRenewal: pulumi.Output<boolean>;
/**
* Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
readonly setSubjectKeyId: pulumi.Output<boolean>;
/**
* The time until which the certificate is invalid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
readonly validityEndTime: pulumi.Output<string>;
/**
* Number of hours, after initial issuing, that the certificate will remain valid for.
*/
readonly validityPeriodHours: pulumi.Output<number>;
/**
* The time after which the certificate is valid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
readonly validityStartTime: pulumi.Output<string>;
/**
* Create a LocallySignedCert resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: LocallySignedCertArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering LocallySignedCert resources.
*/
export interface LocallySignedCertState {
/**
* List of key usages allowed for the issued certificate. Values are defined in [RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280) and combine flags defined by both [Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3) and [Extended Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12). Accepted values: `anyExtended`, `certSigning`, `clientAuth`, `codeSigning`, `contentCommitment`, `crlSigning`, `dataEncipherment`, `decipherOnly`, `digitalSignature`, `emailProtection`, `encipherOnly`, `ipsecEndSystem`, `ipsecTunnel`, `ipsecUser`, `keyAgreement`, `keyEncipherment`, `microsoftCommercialCodeSigning`, `microsoftKernelCodeSigning`, `microsoftServerGatedCrypto`, `netscapeServerGatedCrypto`, `ocspSigning`, `serverAuth`, `timestamping`.
*/
allowedUses?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Certificate data of the Certificate Authority (CA) in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
caCertPem?: pulumi.Input<string>;
/**
* Name of the algorithm used when generating the private key provided in `caPrivateKeyPem`.
*/
caKeyAlgorithm?: pulumi.Input<string>;
/**
* Private key of the Certificate Authority (CA) used to sign the certificate, in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
caPrivateKeyPem?: pulumi.Input<string>;
/**
* Certificate data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format. **NOTE**: the [underlying](https://pkg.go.dev/encoding/pem#Encode) [libraries](https://pkg.go.dev/golang.org/x/crypto/ssh#MarshalAuthorizedKey) that generate this value append a `\n` at the end of the PEM. In case this disrupts your use case, we recommend using `trimspace()`.
*/
certPem?: pulumi.Input<string>;
/**
* Certificate request data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
certRequestPem?: pulumi.Input<string>;
earlyRenewalHours?: pulumi.Input<number>;
/**
* Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
*/
isCaCertificate?: pulumi.Input<boolean>;
/**
* Is the certificate either expired (i.e. beyond the `validityPeriodHours`) or ready for an early renewal (i.e. within the `earlyRenewalHours`)?
*/
readyForRenewal?: pulumi.Input<boolean>;
/**
* Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
setSubjectKeyId?: pulumi.Input<boolean>;
/**
* The time until which the certificate is invalid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
validityEndTime?: pulumi.Input<string>;
/**
* Number of hours, after initial issuing, that the certificate will remain valid for.
*/
validityPeriodHours?: pulumi.Input<number>;
/**
* The time after which the certificate is valid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
validityStartTime?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a LocallySignedCert resource.
*/
export interface LocallySignedCertArgs {
/**
* List of key usages allowed for the issued certificate. Values are defined in [RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280) and combine flags defined by both [Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3) and [Extended Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12). Accepted values: `anyExtended`, `certSigning`, `clientAuth`, `codeSigning`, `contentCommitment`, `crlSigning`, `dataEncipherment`, `decipherOnly`, `digitalSignature`, `emailProtection`, `encipherOnly`, `ipsecEndSystem`, `ipsecTunnel`, `ipsecUser`, `keyAgreement`, `keyEncipherment`, `microsoftCommercialCodeSigning`, `microsoftKernelCodeSigning`, `microsoftServerGatedCrypto`, `netscapeServerGatedCrypto`, `ocspSigning`, `serverAuth`, `timestamping`.
*/
allowedUses: pulumi.Input<pulumi.Input<string>[]>;
/**
* Certificate data of the Certificate Authority (CA) in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
caCertPem: pulumi.Input<string>;
/**
* Private key of the Certificate Authority (CA) used to sign the certificate, in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
caPrivateKeyPem: pulumi.Input<string>;
/**
* Certificate request data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format.
*/
certRequestPem: pulumi.Input<string>;
earlyRenewalHours?: pulumi.Input<number>;
/**
* Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
*/
isCaCertificate?: pulumi.Input<boolean>;
/**
* Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
setSubjectKeyId?: pulumi.Input<boolean>;
/**
* Number of hours, after initial issuing, that the certificate will remain valid for.
*/
validityPeriodHours: pulumi.Input<number>;
}