@pulumi/tls
Version:
A Pulumi package to create TLS resources in Pulumi programs.
202 lines (201 loc) • 12.6 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
export declare class SelfSignedCert extends pulumi.CustomResource {
/**
* Get an existing SelfSignedCert resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: SelfSignedCertState, opts?: pulumi.CustomResourceOptions): SelfSignedCert;
/**
* Returns true if the given object is an instance of SelfSignedCert. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is SelfSignedCert;
/**
* List of key usages allowed for the issued certificate. Values are defined in [RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280) and combine flags defined by both [Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3) and [Extended Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12). Accepted values: `anyExtended`, `certSigning`, `clientAuth`, `codeSigning`, `contentCommitment`, `crlSigning`, `dataEncipherment`, `decipherOnly`, `digitalSignature`, `emailProtection`, `encipherOnly`, `ipsecEndSystem`, `ipsecTunnel`, `ipsecUser`, `keyAgreement`, `keyEncipherment`, `microsoftCommercialCodeSigning`, `microsoftKernelCodeSigning`, `microsoftServerGatedCrypto`, `netscapeServerGatedCrypto`, `ocspSigning`, `serverAuth`, `timestamping`.
*/
readonly allowedUses: pulumi.Output<string[]>;
/**
* Certificate data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format. **NOTE**: the [underlying](https://pkg.go.dev/encoding/pem#Encode) [libraries](https://pkg.go.dev/golang.org/x/crypto/ssh#MarshalAuthorizedKey) that generate this value append a `\n` at the end of the PEM. In case this disrupts your use case, we recommend using `trimspace()`.
*/
readonly certPem: pulumi.Output<string>;
/**
* List of DNS names for which a certificate is being requested (i.e. certificate subjects).
*/
readonly dnsNames: pulumi.Output<string[] | undefined>;
readonly earlyRenewalHours: pulumi.Output<number>;
/**
* List of IP addresses for which a certificate is being requested (i.e. certificate subjects).
*/
readonly ipAddresses: pulumi.Output<string[] | undefined>;
/**
* Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
*/
readonly isCaCertificate: pulumi.Output<boolean>;
/**
* Name of the algorithm used when generating the private key provided in `privateKeyPem`.
*/
readonly keyAlgorithm: pulumi.Output<string>;
/**
* Private key in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format, that the certificate will belong to.
*/
readonly privateKeyPem: pulumi.Output<string>;
/**
* Is the certificate either expired (i.e. beyond the `validityPeriodHours`) or ready for an early renewal (i.e. within the `earlyRenewalHours`)?
*/
readonly readyForRenewal: pulumi.Output<boolean>;
/**
* Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
readonly setAuthorityKeyId: pulumi.Output<boolean>;
/**
* Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
readonly setSubjectKeyId: pulumi.Output<boolean>;
/**
* The subject for which a certificate is being requested. The acceptable arguments are all optional and their naming is based upon [Issuer Distinguished Names (RFC5280)](https://tools.ietf.org/html/rfc5280#section-4.1.2.4) section.
*/
readonly subject: pulumi.Output<outputs.SelfSignedCertSubject | undefined>;
/**
* List of URIs for which a certificate is being requested (i.e. certificate subjects).
*/
readonly uris: pulumi.Output<string[] | undefined>;
/**
* The time until which the certificate is invalid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
readonly validityEndTime: pulumi.Output<string>;
/**
* Number of hours, after initial issuing, that the certificate will remain valid for.
*/
readonly validityPeriodHours: pulumi.Output<number>;
/**
* The time after which the certificate is valid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
readonly validityStartTime: pulumi.Output<string>;
/**
* Create a SelfSignedCert resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: SelfSignedCertArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering SelfSignedCert resources.
*/
export interface SelfSignedCertState {
/**
* List of key usages allowed for the issued certificate. Values are defined in [RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280) and combine flags defined by both [Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3) and [Extended Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12). Accepted values: `anyExtended`, `certSigning`, `clientAuth`, `codeSigning`, `contentCommitment`, `crlSigning`, `dataEncipherment`, `decipherOnly`, `digitalSignature`, `emailProtection`, `encipherOnly`, `ipsecEndSystem`, `ipsecTunnel`, `ipsecUser`, `keyAgreement`, `keyEncipherment`, `microsoftCommercialCodeSigning`, `microsoftKernelCodeSigning`, `microsoftServerGatedCrypto`, `netscapeServerGatedCrypto`, `ocspSigning`, `serverAuth`, `timestamping`.
*/
allowedUses?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Certificate data in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format. **NOTE**: the [underlying](https://pkg.go.dev/encoding/pem#Encode) [libraries](https://pkg.go.dev/golang.org/x/crypto/ssh#MarshalAuthorizedKey) that generate this value append a `\n` at the end of the PEM. In case this disrupts your use case, we recommend using `trimspace()`.
*/
certPem?: pulumi.Input<string>;
/**
* List of DNS names for which a certificate is being requested (i.e. certificate subjects).
*/
dnsNames?: pulumi.Input<pulumi.Input<string>[]>;
earlyRenewalHours?: pulumi.Input<number>;
/**
* List of IP addresses for which a certificate is being requested (i.e. certificate subjects).
*/
ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
*/
isCaCertificate?: pulumi.Input<boolean>;
/**
* Name of the algorithm used when generating the private key provided in `privateKeyPem`.
*/
keyAlgorithm?: pulumi.Input<string>;
/**
* Private key in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format, that the certificate will belong to.
*/
privateKeyPem?: pulumi.Input<string>;
/**
* Is the certificate either expired (i.e. beyond the `validityPeriodHours`) or ready for an early renewal (i.e. within the `earlyRenewalHours`)?
*/
readyForRenewal?: pulumi.Input<boolean>;
/**
* Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
setAuthorityKeyId?: pulumi.Input<boolean>;
/**
* Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
setSubjectKeyId?: pulumi.Input<boolean>;
/**
* The subject for which a certificate is being requested. The acceptable arguments are all optional and their naming is based upon [Issuer Distinguished Names (RFC5280)](https://tools.ietf.org/html/rfc5280#section-4.1.2.4) section.
*/
subject?: pulumi.Input<inputs.SelfSignedCertSubject>;
/**
* List of URIs for which a certificate is being requested (i.e. certificate subjects).
*/
uris?: pulumi.Input<pulumi.Input<string>[]>;
/**
* The time until which the certificate is invalid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
validityEndTime?: pulumi.Input<string>;
/**
* Number of hours, after initial issuing, that the certificate will remain valid for.
*/
validityPeriodHours?: pulumi.Input<number>;
/**
* The time after which the certificate is valid, expressed as an [RFC3339](https://tools.ietf.org/html/rfc3339) timestamp.
*/
validityStartTime?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a SelfSignedCert resource.
*/
export interface SelfSignedCertArgs {
/**
* List of key usages allowed for the issued certificate. Values are defined in [RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280) and combine flags defined by both [Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3) and [Extended Key Usages](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12). Accepted values: `anyExtended`, `certSigning`, `clientAuth`, `codeSigning`, `contentCommitment`, `crlSigning`, `dataEncipherment`, `decipherOnly`, `digitalSignature`, `emailProtection`, `encipherOnly`, `ipsecEndSystem`, `ipsecTunnel`, `ipsecUser`, `keyAgreement`, `keyEncipherment`, `microsoftCommercialCodeSigning`, `microsoftKernelCodeSigning`, `microsoftServerGatedCrypto`, `netscapeServerGatedCrypto`, `ocspSigning`, `serverAuth`, `timestamping`.
*/
allowedUses: pulumi.Input<pulumi.Input<string>[]>;
/**
* List of DNS names for which a certificate is being requested (i.e. certificate subjects).
*/
dnsNames?: pulumi.Input<pulumi.Input<string>[]>;
earlyRenewalHours?: pulumi.Input<number>;
/**
* List of IP addresses for which a certificate is being requested (i.e. certificate subjects).
*/
ipAddresses?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Is the generated certificate representing a Certificate Authority (CA) (default: `false`).
*/
isCaCertificate?: pulumi.Input<boolean>;
/**
* Private key in [PEM (RFC 1421)](https://datatracker.ietf.org/doc/html/rfc1421) format, that the certificate will belong to.
*/
privateKeyPem: pulumi.Input<string>;
/**
* Should the generated certificate include an [authority key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1): for self-signed certificates this is the same value as the [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
setAuthorityKeyId?: pulumi.Input<boolean>;
/**
* Should the generated certificate include a [subject key identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2) (default: `false`).
*/
setSubjectKeyId?: pulumi.Input<boolean>;
/**
* The subject for which a certificate is being requested. The acceptable arguments are all optional and their naming is based upon [Issuer Distinguished Names (RFC5280)](https://tools.ietf.org/html/rfc5280#section-4.1.2.4) section.
*/
subject?: pulumi.Input<inputs.SelfSignedCertSubject>;
/**
* List of URIs for which a certificate is being requested (i.e. certificate subjects).
*/
uris?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Number of hours, after initial issuing, that the certificate will remain valid for.
*/
validityPeriodHours: pulumi.Input<number>;
}