Create a CA pool

This page describes how to create certificate authority (CA) pools.

A CA pool is a collection of multiple CAs with a common certificate issuance policy and Identity and Access Management (IAM) policy. A CA pool makes CA rotation management easier and lets you achieve higher total effective queries per second (QPS).

You must create a CA pool before you can use Certificate Authority Service to create a CA. For more information, see Overview of CA pools.

Before you begin

Make sure you have the CA Service Operation Manager (roles/privateca.caManager) IAM role. For information about granting an IAM to a principal, see Grant a single role.

Decide the CA pool's settings

This section describes the settings of a CA pool and provides recommendations for deciding the settings.

Permanent CA pool settings

The following CA pool settings can't be changed after creating the CA pool.

Location

Specify the CA pool's location. A CA pool is stored in a single Google Cloud location. We recommend that you create your CA pool in the same location or near the location where you intend to use it.

For the complete list of supported locations, see Locations.

Tier

Choose whether you want to create the CA pool with the DevOps or the Enterprise tier. This choice affects whether CA Service persists the created certificates, whether created certificates can later be revoked, and the maximum rate at which you can create certificates from the CAs in the CA pool. For more information, see Select the operation tiers.

Optional CA pool settings

Certificate issuance policy

A CA pool can have a certificate issuance policy. This issuance policy places restrictions on the certificates that the CAs in the CA pool are allowed to issue, such as allowed key types, maximum lifetimes, SAN constraints, and backdating options (backdate_duration or allow_requester_specified_not_before_time).

You can update the issuance policy of a CA pool after you create the CA pool. For more information, see Overview of templates and issuance policies.

For more information about configuring a certificate issuance policy, see Add a certificate issuance policy to a CA pool.

Publishing options

You can configure a CA pool to publish the CA certificates for each of its CAs. When issuing a certificate, the URL to this CA certificate is included in the certificate as an authority information access (AIA) extension. You can also specify custom AIA and CRL Distribution Point (CDP) URLs if you want to point to your own OCSP servers or CRL locations.

CAs in Enterprise tier CA pools can be permitted to publish certificate revocation lists (CRLs) to the associated Cloud Storage bucket. When issuing a certificate, a URL to this CRL is included in the certificate as the CRL Distribution Point (CDP) extension. You cannot find the CRL without the CDP extension in the certificate. For more information, see Revoke certificates.