public sealed class CaPool.Types.IssuancePolicy : IMessage<CaPool.Types.IssuancePolicy>, IEquatable<CaPool.Types.IssuancePolicy>, IDeepCloneable<CaPool.Types.IssuancePolicy>, IBufferMessage, IMessage
Reference documentation and code samples for the Certificate Authority v1 API class CaPool.Types.IssuancePolicy.
Defines controls over all certificate issuance within a
[CaPool][google.cloud.security.privateca.v1.CaPool].
public CaPool.Types.IssuancePolicy.Types.IssuanceModes AllowedIssuanceModes { get; set; }
Optional. If specified, then only methods allowed in the
[IssuanceModes][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes]
may be used to issue
[Certificates][google.cloud.security.privateca.v1.Certificate].
public RepeatedField<CaPool.Types.IssuancePolicy.Types.AllowedKeyType> AllowedKeyTypes { get; }
Optional. If any
[AllowedKeyType][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType]
is specified, then the certificate request's public key must match one of
the key types listed here. Otherwise, any key may be used.
Optional. The duration to backdate all certificates issued from this
[CaPool][google.cloud.security.privateca.v1.CaPool]. If not set, the
certificates will be issued with a not_before_time of the issuance time
(i.e. the current time). If set, the certificates will be issued with a
not_before_time of the issuance time minus the backdate_duration. The
not_after_time will be adjusted to preserve the requested lifetime. The
backdate_duration must be less than or equal to 48 hours.
public X509Parameters BaselineValues { get; set; }
Optional. A set of X.509 values that will be applied to all certificates
issued through this [CaPool][google.cloud.security.privateca.v1.CaPool].
If a certificate request includes conflicting values for the same
properties, they will be overwritten by the values defined here. If a
certificate request uses a
[CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
that defines conflicting
[predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
for the same properties, the certificate issuance request will fail.
public CertificateIdentityConstraints IdentityConstraints { get; set; }
Optional. Describes constraints on identities that may appear in
[Certificates][google.cloud.security.privateca.v1.Certificate] issued
through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If this
is omitted, then this [CaPool][google.cloud.security.privateca.v1.CaPool]
will not add restrictions on a certificate's identity.
Optional. The maximum lifetime allowed for issued
[Certificates][google.cloud.security.privateca.v1.Certificate]. Note that
if the issuing
[CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
expires before a
[Certificate][google.cloud.security.privateca.v1.Certificate] resource's
requested maximum_lifetime, the effective lifetime will be explicitly
truncated to match it.
public CertificateExtensionConstraints PassthroughExtensions { get; set; }
Optional. Describes the set of X.509 extensions that may appear in a
[Certificate][google.cloud.security.privateca.v1.Certificate] issued
through this [CaPool][google.cloud.security.privateca.v1.CaPool]. If a
certificate request sets extensions that don't appear in the
[passthrough_extensions][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions],
those extensions will be dropped. If a certificate request uses a
[CertificateTemplate][google.cloud.security.privateca.v1.CertificateTemplate]
with
[predefined_values][google.cloud.security.privateca.v1.CertificateTemplate.predefined_values]
that don't appear here, the certificate issuance request will fail. If
this is omitted, then this
[CaPool][google.cloud.security.privateca.v1.CaPool] will not add
restrictions on a certificate's X.509 extensions. These constraints do
not apply to X.509 extensions set in this
[CaPool][google.cloud.security.privateca.v1.CaPool]'s
[baseline_values][google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values].
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThe webpage provides documentation for the \u003ccode\u003eCaPool.Types.IssuancePolicy\u003c/code\u003e class within the Google Cloud Security Private CA v1 API.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eCaPool.Types.IssuancePolicy\u003c/code\u003e class controls certificate issuance within a specified CA Pool, defining constraints and limitations.\u003c/p\u003e\n"],["\u003cp\u003eThe latest version of the documentation provided is version 3.9.0, but versions dating back to 1.0.0 are also accessible.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003eIssuancePolicy\u003c/code\u003e offers customizable properties including allowed key types, issuance modes, X.509 values, identity constraints, maximum certificate lifetime, and passthrough extensions, allowing fine-grained control over certificate issuance.\u003c/p\u003e\n"]]],[],null,["# Certificate Authority v1 API - Class CaPool.Types.IssuancePolicy (3.10.0)\n\nVersion latestkeyboard_arrow_down\n\n- [3.10.0 (latest)](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.9.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.9.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.8.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.8.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.7.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.7.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.6.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.6.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.5.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.5.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.4.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.4.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.3.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.3.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.2.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.2.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.1.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.1.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [3.0.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/3.0.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [2.3.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/2.3.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [2.2.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/2.2.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [2.1.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/2.1.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [2.0.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/2.0.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy)\n- [1.0.0](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/1.0.0/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy) \n\n public sealed class CaPool.Types.IssuancePolicy : IMessage\u003cCaPool.Types.IssuancePolicy\u003e, IEquatable\u003cCaPool.Types.IssuancePolicy\u003e, IDeepCloneable\u003cCaPool.Types.IssuancePolicy\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Certificate Authority v1 API class CaPool.Types.IssuancePolicy.\n\nDefines controls over all certificate issuance within a\n\\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\]. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e CaPool.Types.IssuancePolicy \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[CaPool](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool)[Types](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool.Types)[IssuancePolicy](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[CaPool](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool)[Types](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool.Types)[IssuancePolicy](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[CaPool](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool)[Types](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool.Types)[IssuancePolicy](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1.CaPool.Types.IssuancePolicy), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Cloud.Security.PrivateCA.V1](/dotnet/docs/reference/Google.Cloud.Security.PrivateCA.V1/latest/Google.Cloud.Security.PrivateCA.V1)\n\nAssembly\n--------\n\nGoogle.Cloud.Security.PrivateCA.V1.dll\n\nConstructors\n------------\n\n### IssuancePolicy()\n\n public IssuancePolicy()\n\n### IssuancePolicy(IssuancePolicy)\n\n public IssuancePolicy(CaPool.Types.IssuancePolicy other)\n\nProperties\n----------\n\n### AllowedIssuanceModes\n\n public CaPool.Types.IssuancePolicy.Types.IssuanceModes AllowedIssuanceModes { get; set; }\n\nOptional. If specified, then only methods allowed in the\n\\[IssuanceModes\\]\\[google.cloud.security.privateca.v1.CaPool.IssuancePolicy.IssuanceModes\\]\nmay be used to issue\n\\[Certificates\\]\\[google.cloud.security.privateca.v1.Certificate\\].\n\n### AllowedKeyTypes\n\n public RepeatedField\u003cCaPool.Types.IssuancePolicy.Types.AllowedKeyType\u003e AllowedKeyTypes { get; }\n\nOptional. If any\n\\[AllowedKeyType\\]\\[google.cloud.security.privateca.v1.CaPool.IssuancePolicy.AllowedKeyType\\]\nis specified, then the certificate request's public key must match one of\nthe key types listed here. Otherwise, any key may be used.\n\n### BackdateDuration\n\n public Duration BackdateDuration { get; set; }\n\nOptional. The duration to backdate all certificates issued from this\n\\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\]. If not set, the\ncertificates will be issued with a not_before_time of the issuance time\n(i.e. the current time). If set, the certificates will be issued with a\nnot_before_time of the issuance time minus the backdate_duration. The\nnot_after_time will be adjusted to preserve the requested lifetime. The\nbackdate_duration must be less than or equal to 48 hours.\n\n### BaselineValues\n\n public X509Parameters BaselineValues { get; set; }\n\nOptional. A set of X.509 values that will be applied to all certificates\nissued through this \\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\].\nIf a certificate request includes conflicting values for the same\nproperties, they will be overwritten by the values defined here. If a\ncertificate request uses a\n\\[CertificateTemplate\\]\\[google.cloud.security.privateca.v1.CertificateTemplate\\]\nthat defines conflicting\n\\[predefined_values\\]\\[google.cloud.security.privateca.v1.CertificateTemplate.predefined_values\\]\nfor the same properties, the certificate issuance request will fail.\n\n### IdentityConstraints\n\n public CertificateIdentityConstraints IdentityConstraints { get; set; }\n\nOptional. Describes constraints on identities that may appear in\n\\[Certificates\\]\\[google.cloud.security.privateca.v1.Certificate\\] issued\nthrough this \\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\]. If this\nis omitted, then this \\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\]\nwill not add restrictions on a certificate's identity.\n\n### MaximumLifetime\n\n public Duration MaximumLifetime { get; set; }\n\nOptional. The maximum lifetime allowed for issued\n\\[Certificates\\]\\[google.cloud.security.privateca.v1.Certificate\\]. Note that\nif the issuing\n\\[CertificateAuthority\\]\\[google.cloud.security.privateca.v1.CertificateAuthority\\]\nexpires before a\n\\[Certificate\\]\\[google.cloud.security.privateca.v1.Certificate\\] resource's\nrequested maximum_lifetime, the effective lifetime will be explicitly\ntruncated to match it.\n\n### PassthroughExtensions\n\n public CertificateExtensionConstraints PassthroughExtensions { get; set; }\n\nOptional. Describes the set of X.509 extensions that may appear in a\n\\[Certificate\\]\\[google.cloud.security.privateca.v1.Certificate\\] issued\nthrough this \\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\]. If a\ncertificate request sets extensions that don't appear in the\n\\[passthrough_extensions\\]\\[google.cloud.security.privateca.v1.CaPool.IssuancePolicy.passthrough_extensions\\],\nthose extensions will be dropped. If a certificate request uses a\n\\[CertificateTemplate\\]\\[google.cloud.security.privateca.v1.CertificateTemplate\\]\nwith\n\\[predefined_values\\]\\[google.cloud.security.privateca.v1.CertificateTemplate.predefined_values\\]\nthat don't appear here, the certificate issuance request will fail. If\nthis is omitted, then this\n\\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\] will not add\nrestrictions on a certificate's X.509 extensions. These constraints do\nnot apply to X.509 extensions set in this\n\\[CaPool\\]\\[google.cloud.security.privateca.v1.CaPool\\]'s\n\\[baseline_values\\]\\[google.cloud.security.privateca.v1.CaPool.IssuancePolicy.baseline_values\\]."]]
