Enable, disable, and restore certificate authorities

This document explains how you can manage the state of your certificate authority (CA).

Enable a CA

All subordinate CAs are created in the AWAITING_USER_ACTIVATION state, and they are set to the STAGED state after activation. All root CAs are created in the STAGED state by default. You must change the CA state to ENABLED to include it in a CA pool's certificate issuance rotation. For more information about the operational states of a CA, see Certificate authority states.

To enable a CA that is in the STAGED or DISABLED state, use the following instructions:

Console

  1. In the Google Cloud console, go to the Certificate authorities page.

    Go to Certificate authorities

  2. Under Certificate authorities, select your target CA.

  3. Click Enable.

  4. In the dialog that opens, click Confirm.

gcloud

To enable a root CA, use the following command:

gcloud privateca roots enable CA_ID --location LOCATION --pool POOL_ID

Replace the following:

  • CA_ID: the unique identifier of the CA
  • LOCATION: the location of the CA pool. For the complete list of locations, see Locations.
  • POOL_ID: the unique identifier of the CA pool that the CA belongs to

For more information about the gcloud privateca roots enable command, see gcloud privateca roots enable.

Go

To authenticate to CA Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment. 

import (
	"context"
	"fmt"
	"io"

	privateca "cloud.google.com/go/security/privateca/apiv1"
	"cloud.google.com/go/security/privateca/apiv1/privatecapb"
)

// Enable the Certificate Authority present in the given ca pool.
// CA cannot be enabled if it has been already deleted.
func enableCa(w io.Writer, projectId string, location string, caPoolId string, caId string) error {
	// projectId := "your_project_id"
	// location := "us-central1"	// For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
	// caPoolId := "ca-pool-id"		// The id of the CA pool under which the CA is present.
	// caId := "ca-id"				// The id of the CA to be enabled.

	ctx := context.Background()
	caClient, err := privateca.NewCertificateAuthorityClient(ctx)
	if err != nil {
		return fmt.Errorf("NewCertificateAuthorityClient creation failed: %w", err)
	}
	defer caClient.Close()

	fullCaName := fmt.Sprintf("projects/%s/locations/%s/caPools/%s/certificateAuthorities/%s",
		projectId, location, caPoolId, caId)

	// Create the EnableCertificateAuthorityRequest.
	// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#EnableCertificateAuthorityRequest.
	req := &privatecapb.EnableCertificateAuthorityRequest{Name: fullCaName}

	op, err := caClient.EnableCertificateAuthority(ctx, req)
	if err != nil {
		return fmt.Errorf("EnableCertificateAuthority failed: %w", err)
	}

	var caResp *privatecapb.CertificateAuthority
	if caResp, err = op.Wait(ctx); err != nil {
		return fmt.Errorf("EnableCertificateAuthority failed during wait: %w",