mmv1/products/privateca/Certificate.yaml [794:1102]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  the max path length will be omitted from the CA certificate.
                url_param_only: true
                immutable: true
          - name: 'keyUsage'
            type: NestedObject
            description: |
              Indicates the intended use for keys that correspond to a certificate.
            required: true
            immutable: true
            properties:
              - name: 'baseKeyUsage'
                type: NestedObject
                description: |
                  Describes high-level ways in which a key may be used.
                required: true
                immutable: true
                properties:
                  - name: 'digitalSignature'
                    type: Boolean
                    description: |
                      The key may be used for digital signatures.
                    immutable: true
                  - name: 'contentCommitment'
                    type: Boolean
                    description: |
                      The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
                    immutable: true
                  - name: 'keyEncipherment'
                    type: Boolean
                    description: |
                      The key may be used to encipher other keys.
                    immutable: true
                  - name: 'dataEncipherment'
                    type: Boolean
                    description: |
                      The key may be used to encipher data.
                    immutable: true
                  - name: 'keyAgreement'
                    type: Boolean
                    description: |
                      The key may be used in a key agreement protocol.
                    immutable: true
                  - name: 'certSign'
                    type: Boolean
                    description: |
                      The key may be used to sign certificates.
                    immutable: true
                  - name: 'crlSign'
                    type: Boolean
                    description: |
                      The key may be used sign certificate revocation lists.
                    immutable: true
                  - name: 'encipherOnly'
                    type: Boolean
                    description: |
                      The key may be used to encipher only.
                    immutable: true
                  - name: 'decipherOnly'
                    type: Boolean
                    description: |
                      The key may be used to decipher only.
                    immutable: true
              - name: 'extendedKeyUsage'
                type: NestedObject
                description: |
                  Describes high-level ways in which a key may be used.
                required: true
                immutable: true
                properties:
                  - name: 'serverAuth'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
                    immutable: true
                  - name: 'clientAuth'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
                    immutable: true
                  - name: 'codeSigning'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
                    immutable: true
                  - name: 'emailProtection'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
                    immutable: true
                  - name: 'timeStamping'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
                    immutable: true
                  - name: 'ocspSigning'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
                    immutable: true
              - name: 'unknownExtendedKeyUsages'
                type: Array
                description: |
                  An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
                immutable: true
                item_type:
                  type: NestedObject
                  properties:
                    - name: 'objectIdPath'
                      type: Array
                      description: |
                        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
                      required: true
                      immutable: true
                      item_type:
                        type: Integer
          - name: 'nameConstraints'
            type: NestedObject
            description: |
              Describes the X.509 name constraints extension.
            immutable: true
            properties:
              - name: 'critical'
                type: Boolean
                description:
                  Indicates whether or not the name constraints are marked
                  critical.
                required: true
                immutable: true
              - name: 'permittedDnsNames'
                type: Array
                description: |
                  Contains permitted DNS names. Any DNS name that can be
                  constructed by simply adding zero or more labels to
                  the left-hand side of the name satisfies the name constraint.
                  For example, `example.com`, `www.example.com`, `www.sub.example.com`
                  would satisfy `example.com` while `example1.com` does not.
                immutable: true
                item_type:
                  type: String
              - name: 'excludedDnsNames'
                type: Array
                description: |
                  Contains excluded DNS names. Any DNS name that can be
                  constructed by simply adding zero or more labels to
                  the left-hand side of the name satisfies the name constraint.
                  For example, `example.com`, `www.example.com`, `www.sub.example.com`
                  would satisfy `example.com` while `example1.com` does not.
                immutable: true
                item_type:
                  type: String
              - name: 'permittedIpRanges'
                type: Array
                description: |
                  Contains the permitted IP ranges. For IPv4 addresses, the ranges
                  are expressed using CIDR notation as specified in RFC 4632.
                  For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
                  addresses.
                immutable: true
                item_type:
                  type: String
              - name: 'excludedIpRanges'
                type: Array
                description: |
                  Contains the excluded IP ranges. For IPv4 addresses, the ranges
                  are expressed using CIDR notation as specified in RFC 4632.
                  For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
                  addresses.
                immutable: true
                item_type:
                  type: String
              - name: 'permittedEmailAddresses'
                type: Array
                description: |
                  Contains the permitted email addresses. The value can be a particular
                  email address, a hostname to indicate all email addresses on that host or
                  a domain with a leading period (e.g. `.example.com`) to indicate
                  all email addresses in that domain.
                immutable: true
                item_type:
                  type: String
              - name: 'excludedEmailAddresses'
                type: Array
                description: |
                  Contains the excluded email addresses. The value can be a particular
                  email address, a hostname to indicate all email addresses on that host or
                  a domain with a leading period (e.g. `.example.com`) to indicate
                  all email addresses in that domain.
                immutable: true
                item_type:
                  type: String
              - name: 'permittedUris'
                type: Array
                description: |
                  Contains the permitted URIs that apply to the host part of the name.
                  The value can be a hostname or a domain with a
                  leading period (like `.example.com`)
                immutable: true
                item_type:
                  type: String
              - name: 'excludedUris'
                type: Array
                description: |
                  Contains the excluded URIs that apply to the host part of the name.
                  The value can be a hostname or a domain with a
                  leading period (like `.example.com`)
                immutable: true
                item_type:
                  type: String
      - name: 'subjectConfig'
        type: NestedObject
        description: |
          Specifies some of the values in a certificate that are related to the subject.
        required: true
        immutable: true
        properties:
          - name: 'subject'
            type: NestedObject
            description:
              Contains distinguished name fields such as the location and
              organization.
            required: true
            immutable: true
            properties:
              - name: 'countryCode'
                type: String
                description: The country code of the subject.
                immutable: true
              - name: 'organization'
                type: String
                description: The organization of the subject.
                required: true
                immutable: true
              - name: 'organizationalUnit'
                type: String
                description: The organizational unit of the subject.
                immutable: true
              - name: 'locality'
                type: String
                description: The locality or city of the subject.
                immutable: true
              - name: 'province'
                type: String
                description:
                  The province, territory, or regional state of the subject.
                immutable: true
              - name: 'streetAddress'
                type: String
                description: The street address of the subject.
                immutable: true
              - name: 'postalCode'
                type: String
                description: The postal code of the subject.
                immutable: true
              - name: 'commonName'
                type: String
                description: The common name of the distinguished name.
                required: true
                immutable: true
          - name: 'subjectAltName'
            type: NestedObject
            description: The subject alternative name fields.
            immutable: true
            properties:
              - name: 'dnsNames'
                type: Array
                description: Contains only valid, fully-qualified host names.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
              - name: 'uris'
                type: Array
                description: Contains only valid RFC 3986 URIs.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
              - name: 'emailAddresses'
                type: Array
                description: Contains only valid RFC 2822 E-mail addresses.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
              - name: 'ipAddresses'
                type: Array
                description:
                  Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6
                  addresses.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



mmv1/products/privateca/CertificateAuthority.yaml [338:646]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  the max path length will be omitted from the CA certificate.
                url_param_only: true
                immutable: true
          - name: 'keyUsage'
            type: NestedObject
            description: |
              Indicates the intended use for keys that correspond to a certificate.
            required: true
            immutable: true
            properties:
              - name: 'baseKeyUsage'
                type: NestedObject
                description: |
                  Describes high-level ways in which a key may be used.
                required: true
                immutable: true
                properties:
                  - name: 'digitalSignature'
                    type: Boolean
                    description: |
                      The key may be used for digital signatures.
                    immutable: true
                  - name: 'contentCommitment'
                    type: Boolean
                    description: |
                      The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
                    immutable: true
                  - name: 'keyEncipherment'
                    type: Boolean
                    description: |
                      The key may be used to encipher other keys.
                    immutable: true
                  - name: 'dataEncipherment'
                    type: Boolean
                    description: |
                      The key may be used to encipher data.
                    immutable: true
                  - name: 'keyAgreement'
                    type: Boolean
                    description: |
                      The key may be used in a key agreement protocol.
                    immutable: true
                  - name: 'certSign'
                    type: Boolean
                    description: |
                      The key may be used to sign certificates.
                    immutable: true
                  - name: 'crlSign'
                    type: Boolean
                    description: |
                      The key may be used sign certificate revocation lists.
                    immutable: true
                  - name: 'encipherOnly'
                    type: Boolean
                    description: |
                      The key may be used to encipher only.
                    immutable: true
                  - name: 'decipherOnly'
                    type: Boolean
                    description: |
                      The key may be used to decipher only.
                    immutable: true
              - name: 'extendedKeyUsage'
                type: NestedObject
                description: |
                  Describes high-level ways in which a key may be used.
                required: true
                immutable: true
                properties:
                  - name: 'serverAuth'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
                    immutable: true
                  - name: 'clientAuth'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
                    immutable: true
                  - name: 'codeSigning'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
                    immutable: true
                  - name: 'emailProtection'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
                    immutable: true
                  - name: 'timeStamping'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
                    immutable: true
                  - name: 'ocspSigning'
                    type: Boolean
                    description: |
                      Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
                    immutable: true
              - name: 'unknownExtendedKeyUsages'
                type: Array
                description: |
                  An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
                immutable: true
                item_type:
                  type: NestedObject
                  properties:
                    - name: 'objectIdPath'
                      type: Array
                      description: |
                        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
                      required: true
                      immutable: true
                      item_type:
                        type: Integer
          - name: 'nameConstraints'
            type: NestedObject
            description: |
              Describes the X.509 name constraints extension.
            immutable: true
            properties:
              - name: 'critical'
                type: Boolean
                description:
                  Indicates whether or not the name constraints are marked
                  critical.
                required: true
                immutable: true
              - name: 'permittedDnsNames'
                type: Array
                description: |
                  Contains permitted DNS names. Any DNS name that can be
                  constructed by simply adding zero or more labels to
                  the left-hand side of the name satisfies the name constraint.
                  For example, `example.com`, `www.example.com`, `www.sub.example.com`
                  would satisfy `example.com` while `example1.com` does not.
                immutable: true
                item_type:
                  type: String
              - name: 'excludedDnsNames'
                type: Array
                description: |
                  Contains excluded DNS names. Any DNS name that can be
                  constructed by simply adding zero or more labels to
                  the left-hand side of the name satisfies the name constraint.
                  For example, `example.com`, `www.example.com`, `www.sub.example.com`
                  would satisfy `example.com` while `example1.com` does not.
                immutable: true
                item_type:
                  type: String
              - name: 'permittedIpRanges'
                type: Array
                description: |
                  Contains the permitted IP ranges. For IPv4 addresses, the ranges
                  are expressed using CIDR notation as specified in RFC 4632.
                  For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
                  addresses.
                immutable: true
                item_type:
                  type: String
              - name: 'excludedIpRanges'
                type: Array
                description: |
                  Contains the excluded IP ranges. For IPv4 addresses, the ranges
                  are expressed using CIDR notation as specified in RFC 4632.
                  For IPv6 addresses, the ranges are expressed in similar encoding as IPv4
                  addresses.
                immutable: true
                item_type:
                  type: String
              - name: 'permittedEmailAddresses'
                type: Array
                description: |
                  Contains the permitted email addresses. The value can be a particular
                  email address, a hostname to indicate all email addresses on that host or
                  a domain with a leading period (e.g. `.example.com`) to indicate
                  all email addresses in that domain.
                immutable: true
                item_type:
                  type: String
              - name: 'excludedEmailAddresses'
                type: Array
                description: |
                  Contains the excluded email addresses. The value can be a particular
                  email address, a hostname to indicate all email addresses on that host or
                  a domain with a leading period (e.g. `.example.com`) to indicate
                  all email addresses in that domain.
                immutable: true
                item_type:
                  type: String
              - name: 'permittedUris'
                type: Array
                description: |
                  Contains the permitted URIs that apply to the host part of the name.
                  The value can be a hostname or a domain with a
                  leading period (like `.example.com`)
                immutable: true
                item_type:
                  type: String
              - name: 'excludedUris'
                type: Array
                description: |
                  Contains the excluded URIs that apply to the host part of the name.
                  The value can be a hostname or a domain with a
                  leading period (like `.example.com`)
                immutable: true
                item_type:
                  type: String
      - name: 'subjectConfig'
        type: NestedObject
        description: |
          Specifies some of the values in a certificate that are related to the subject.
        required: true
        immutable: true
        properties:
          - name: 'subject'
            type: NestedObject
            description:
              Contains distinguished name fields such as the location and
              organization.
            required: true
            immutable: true
            properties:
              - name: 'countryCode'
                type: String
                description: The country code of the subject.
                immutable: true
              - name: 'organization'
                type: String
                description: The organization of the subject.
                required: true
                immutable: true
              - name: 'organizationalUnit'
                type: String
                description: The organizational unit of the subject.
                immutable: true
              - name: 'locality'
                type: String
                description: The locality or city of the subject.
                immutable: true
              - name: 'province'
                type: String
                description:
                  The province, territory, or regional state of the subject.
                immutable: true
              - name: 'streetAddress'
                type: String
                description: The street address of the subject.
                immutable: true
              - name: 'postalCode'
                type: String
                description: The postal code of the subject.
                immutable: true
              - name: 'commonName'
                type: String
                description: The common name of the distinguished name.
                required: true
                immutable: true
          - name: 'subjectAltName'
            type: NestedObject
            description: The subject alternative name fields.
            immutable: true
            properties:
              - name: 'dnsNames'
                type: Array
                description: Contains only valid, fully-qualified host names.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
              - name: 'uris'
                type: Array
                description: Contains only valid RFC 3986 URIs.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
              - name: 'emailAddresses'
                type: Array
                description: Contains only valid RFC 2822 E-mail addresses.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
              - name: 'ipAddresses'
                type: Array
                description:
                  Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6
                  addresses.
                immutable: true
                at_least_one_of:
                  - 'config.0.subject_config.0.subject_alt_name.0.dns_names'
                  - 'config.0.subject_config.0.subject_alt_name.0.uris'
                  - 'config.0.subject_config.0.subject_alt_name.0.email_addresses'
                  - 'config.0.subject_config.0.subject_alt_name.0.ip_addresses'
                item_type:
                  type: String
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



