# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities
from . import outputs

__all__ = [
    'AuthorityAccessUrl',
    'AuthorityConfig',
    'AuthorityConfigSubjectConfig',
    'AuthorityConfigSubjectConfigSubject',
    'AuthorityConfigSubjectConfigSubjectAltName',
    'AuthorityConfigX509Config',
    'AuthorityConfigX509ConfigAdditionalExtension',
    'AuthorityConfigX509ConfigAdditionalExtensionObjectId',
    'AuthorityConfigX509ConfigCaOptions',
    'AuthorityConfigX509ConfigKeyUsage',
    'AuthorityConfigX509ConfigKeyUsageBaseKeyUsage',
    'AuthorityConfigX509ConfigKeyUsageExtendedKeyUsage',
    'AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsage',
    'AuthorityConfigX509ConfigPolicyId',
    'AuthorityKeySpec',
    'AuthoritySubordinateConfig',
    'AuthoritySubordinateConfigPemIssuerChain',
    'CaPoolIamBindingCondition',
    'CaPoolIamMemberCondition',
    'CaPoolIssuancePolicy',
    'CaPoolIssuancePolicyAllowedIssuanceModes',
    'CaPoolIssuancePolicyAllowedKeyType',
    'CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve',
    'CaPoolIssuancePolicyAllowedKeyTypeRsa',
    'CaPoolIssuancePolicyBaselineValues',
    'CaPoolIssuancePolicyBaselineValuesAdditionalExtension',
    'CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId',
    'CaPoolIssuancePolicyBaselineValuesCaOptions',
    'CaPoolIssuancePolicyBaselineValuesKeyUsage',
    'CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage',
    'CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage',
    'CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage',
    'CaPoolIssuancePolicyBaselineValuesPolicyId',
    'CaPoolIssuancePolicyIdentityConstraints',
    'CaPoolIssuancePolicyIdentityConstraintsCelExpression',
    'CaPoolPublishingOptions',
    'CertificateCertificateDescription',
    'CertificateCertificateDescriptionAuthorityKeyId',
    'CertificateCertificateDescriptionCertFingerprint',
    'CertificateCertificateDescriptionConfigValue',
    'CertificateCertificateDescriptionConfigValueKeyUsage',
    'CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsage',
    'CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOption',
    'CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsage',
    'CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsage',
    'CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectId',
    'CertificateCertificateDescriptionPublicKey',
    'CertificateCertificateDescriptionSubjectDescription',
    'CertificateCertificateDescriptionSubjectDescriptionSubject',
    'CertificateCertificateDescriptionSubjectDescriptionSubjectAltName',
    'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan',
    'CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectId',
    'CertificateCertificateDescriptionSubjectKeyId',
    'CertificateCertificateDescriptionX509Description',
    'CertificateCertificateDescriptionX509DescriptionAdditionalExtension',
    'CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectId',
    'CertificateCertificateDescriptionX509DescriptionCaOption',
    'CertificateCertificateDescriptionX509DescriptionKeyUsage',
    'CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsage',
    'CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsage',
    'CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsage',
    'CertificateCertificateDescriptionX509DescriptionPolicyId',
    'CertificateConfig',
    'CertificateConfigPublicKey',
    'CertificateConfigSubjectConfig',
    'CertificateConfigSubjectConfigSubject',
    'CertificateConfigSubjectConfigSubjectAltName',
    'CertificateConfigX509Config',
    'CertificateConfigX509ConfigAdditionalExtension',
    'CertificateConfigX509ConfigAdditionalExtensionObjectId',
    'CertificateConfigX509ConfigCaOptions',
    'CertificateConfigX509ConfigKeyUsage',
    'CertificateConfigX509ConfigKeyUsageBaseKeyUsage',
    'CertificateConfigX509ConfigKeyUsageExtendedKeyUsage',
    'CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsage',
    'CertificateConfigX509ConfigPolicyId',
    'CertificateRevocationDetail',
    'CertificateTemplateIamBindingCondition',
    'CertificateTemplateIamMemberCondition',
    'CertificateTemplateIdentityConstraints',
    'CertificateTemplateIdentityConstraintsCelExpression',
    'CertificateTemplatePassthroughExtensions',
    'CertificateTemplatePassthroughExtensionsAdditionalExtension',
    'CertificateTemplatePredefinedValues',
    'CertificateTemplatePredefinedValuesAdditionalExtension',
    'CertificateTemplatePredefinedValuesAdditionalExtensionObjectId',
    'CertificateTemplatePredefinedValuesCaOptions',
    'CertificateTemplatePredefinedValuesKeyUsage',
    'CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage',
    'CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage',
    'CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsage',
    'CertificateTemplatePredefinedValuesPolicyId',
    'GetAuthorityAccessUrlResult',
    'GetAuthorityConfigResult',
    'GetAuthorityConfigSubjectConfigResult',
    'GetAuthorityConfigSubjectConfigSubjectResult',
    'GetAuthorityConfigSubjectConfigSubjectAltNameResult',
    'GetAuthorityConfigX509ConfigResult',
    'GetAuthorityConfigX509ConfigAdditionalExtensionResult',
    'GetAuthorityConfigX509ConfigAdditionalExtensionObjectIdResult',
    'GetAuthorityConfigX509ConfigCaOptionResult',
    'GetAuthorityConfigX509ConfigKeyUsageResult',
    'GetAuthorityConfigX509ConfigKeyUsageBaseKeyUsageResult',
    'GetAuthorityConfigX509ConfigKeyUsageExtendedKeyUsageResult',
    'GetAuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageResult',
    'GetAuthorityConfigX509ConfigPolicyIdResult',
    'GetAuthorityKeySpecResult',
    'GetAuthoritySubordinateConfigResult',
    'GetAuthoritySubordinateConfigPemIssuerChainResult',
]

@pulumi.output_type
class AuthorityAccessUrl(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "caCertificateAccessUrl":
            suggest = "ca_certificate_access_url"
        elif key == "crlAccessUrls":
            suggest = "crl_access_urls"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityAccessUrl. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityAccessUrl.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityAccessUrl.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 ca_certificate_access_url: Optional[str] = None,
                 crl_access_urls: Optional[Sequence[str]] = None):
        """
        :param str ca_certificate_access_url: The URL where this CertificateAuthority's CA certificate is published. This will only be
               set for CAs that have been activated.
        :param Sequence[str] crl_access_urls: The URL where this CertificateAuthority's CRLs are published. This will only be set for
               CAs that have been activated.
        """
        if ca_certificate_access_url is not None:
            pulumi.set(__self__, "ca_certificate_access_url", ca_certificate_access_url)
        if crl_access_urls is not None:
            pulumi.set(__self__, "crl_access_urls", crl_access_urls)

    @property
    @pulumi.getter(name="caCertificateAccessUrl")
    def ca_certificate_access_url(self) -> Optional[str]:
        """
        The URL where this CertificateAuthority's CA certificate is published. This will only be
        set for CAs that have been activated.
        """
        return pulumi.get(self, "ca_certificate_access_url")

    @property
    @pulumi.getter(name="crlAccessUrls")
    def crl_access_urls(self) -> Optional[Sequence[str]]:
        """
        The URL where this CertificateAuthority's CRLs are published. This will only be set for
        CAs that have been activated.
        """
        return pulumi.get(self, "crl_access_urls")


@pulumi.output_type
class AuthorityConfig(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "subjectConfig":
            suggest = "subject_config"
        elif key == "x509Config":
            suggest = "x509_config"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfig. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfig.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfig.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 subject_config: 'outputs.AuthorityConfigSubjectConfig',
                 x509_config: 'outputs.AuthorityConfigX509Config'):
        """
        :param 'AuthorityConfigSubjectConfigArgs' subject_config: Specifies some of the values in a certificate that are related to the subject.
               Structure is documented below.
        :param 'AuthorityConfigX509ConfigArgs' x509_config: Describes how some of the technical X.509 fields in a certificate should be populated.
               Structure is documented below.
        """
        pulumi.set(__self__, "subject_config", subject_config)
        pulumi.set(__self__, "x509_config", x509_config)

    @property
    @pulumi.getter(name="subjectConfig")
    def subject_config(self) -> 'outputs.AuthorityConfigSubjectConfig':
        """
        Specifies some of the values in a certificate that are related to the subject.
        Structure is documented below.
        """
        return pulumi.get(self, "subject_config")

    @property
    @pulumi.getter(name="x509Config")
    def x509_config(self) -> 'outputs.AuthorityConfigX509Config':
        """
        Describes how some of the technical X.509 fields in a certificate should be populated.
        Structure is documented below.
        """
        return pulumi.get(self, "x509_config")


@pulumi.output_type
class AuthorityConfigSubjectConfig(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "subjectAltName":
            suggest = "subject_alt_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigSubjectConfig. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigSubjectConfig.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigSubjectConfig.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 subject: 'outputs.AuthorityConfigSubjectConfigSubject',
                 subject_alt_name: Optional['outputs.AuthorityConfigSubjectConfigSubjectAltName'] = None):
        """
        :param 'AuthorityConfigSubjectConfigSubjectArgs' subject: Contains distinguished name fields such as the location and organization.
               Structure is documented below.
        :param 'AuthorityConfigSubjectConfigSubjectAltNameArgs' subject_alt_name: The subject alternative name fields.
               Structure is documented below.
        """
        pulumi.set(__self__, "subject", subject)
        if subject_alt_name is not None:
            pulumi.set(__self__, "subject_alt_name", subject_alt_name)

    @property
    @pulumi.getter
    def subject(self) -> 'outputs.AuthorityConfigSubjectConfigSubject':
        """
        Contains distinguished name fields such as the location and organization.
        Structure is documented below.
        """
        return pulumi.get(self, "subject")

    @property
    @pulumi.getter(name="subjectAltName")
    def subject_alt_name(self) -> Optional['outputs.AuthorityConfigSubjectConfigSubjectAltName']:
        """
        The subject alternative name fields.
        Structure is documented below.
        """
        return pulumi.get(self, "subject_alt_name")


@pulumi.output_type
class AuthorityConfigSubjectConfigSubject(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "commonName":
            suggest = "common_name"
        elif key == "countryCode":
            suggest = "country_code"
        elif key == "organizationalUnit":
            suggest = "organizational_unit"
        elif key == "postalCode":
            suggest = "postal_code"
        elif key == "streetAddress":
            suggest = "street_address"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigSubjectConfigSubject. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigSubjectConfigSubject.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigSubjectConfigSubject.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 common_name: str,
                 organization: str,
                 country_code: Optional[str] = None,
                 locality: Optional[str] = None,
                 organizational_unit: Optional[str] = None,
                 postal_code: Optional[str] = None,
                 province: Optional[str] = None,
                 street_address: Optional[str] = None):
        """
        :param str common_name: The common name of the distinguished name.
        :param str organization: The organization of the subject.
        :param str country_code: The country code of the subject.
        :param str locality: The locality or city of the subject.
        :param str organizational_unit: The organizational unit of the subject.
        :param str postal_code: The postal code of the subject.
        :param str province: The province, territory, or regional state of the subject.
        :param str street_address: The street address of the subject.
        """
        pulumi.set(__self__, "common_name", common_name)
        pulumi.set(__self__, "organization", organization)
        if country_code is not None:
            pulumi.set(__self__, "country_code", country_code)
        if locality is not None:
            pulumi.set(__self__, "locality", locality)
        if organizational_unit is not None:
            pulumi.set(__self__, "organizational_unit", organizational_unit)
        if postal_code is not None:
            pulumi.set(__self__, "postal_code", postal_code)
        if province is not None:
            pulumi.set(__self__, "province", province)
        if street_address is not None:
            pulumi.set(__self__, "street_address", street_address)

    @property
    @pulumi.getter(name="commonName")
    def common_name(self) -> str:
        """
        The common name of the distinguished name.
        """
        return pulumi.get(self, "common_name")

    @property
    @pulumi.getter
    def organization(self) -> str:
        """
        The organization of the subject.
        """
        return pulumi.get(self, "organization")

    @property
    @pulumi.getter(name="countryCode")
    def country_code(self) -> Optional[str]:
        """
        The country code of the subject.
        """
        return pulumi.get(self, "country_code")

    @property
    @pulumi.getter
    def locality(self) -> Optional[str]:
        """
        The locality or city of the subject.
        """
        return pulumi.get(self, "locality")

    @property
    @pulumi.getter(name="organizationalUnit")
    def organizational_unit(self) -> Optional[str]:
        """
        The organizational unit of the subject.
        """
        return pulumi.get(self, "organizational_unit")

    @property
    @pulumi.getter(name="postalCode")
    def postal_code(self) -> Optional[str]:
        """
        The postal code of the subject.
        """
        return pulumi.get(self, "postal_code")

    @property
    @pulumi.getter
    def province(self) -> Optional[str]:
        """
        The province, territory, or regional state of the subject.
        """
        return pulumi.get(self, "province")

    @property
    @pulumi.getter(name="streetAddress")
    def street_address(self) -> Optional[str]:
        """
        The street address of the subject.
        """
        return pulumi.get(self, "street_address")


@pulumi.output_type
class AuthorityConfigSubjectConfigSubjectAltName(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "dnsNames":
            suggest = "dns_names"
        elif key == "emailAddresses":
            suggest = "email_addresses"
        elif key == "ipAddresses":
            suggest = "ip_addresses"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigSubjectConfigSubjectAltName. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigSubjectConfigSubjectAltName.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigSubjectConfigSubjectAltName.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 dns_names: Optional[Sequence[str]] = None,
                 email_addresses: Optional[Sequence[str]] = None,
                 ip_addresses: Optional[Sequence[str]] = None,
                 uris: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] dns_names: Contains only valid, fully-qualified host names.
        :param Sequence[str] email_addresses: Contains only valid RFC 2822 E-mail addresses.
        :param Sequence[str] ip_addresses: Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
        :param Sequence[str] uris: Contains only valid RFC 3986 URIs.
        """
        if dns_names is not None:
            pulumi.set(__self__, "dns_names", dns_names)
        if email_addresses is not None:
            pulumi.set(__self__, "email_addresses", email_addresses)
        if ip_addresses is not None:
            pulumi.set(__self__, "ip_addresses", ip_addresses)
        if uris is not None:
            pulumi.set(__self__, "uris", uris)

    @property
    @pulumi.getter(name="dnsNames")
    def dns_names(self) -> Optional[Sequence[str]]:
        """
        Contains only valid, fully-qualified host names.
        """
        return pulumi.get(self, "dns_names")

    @property
    @pulumi.getter(name="emailAddresses")
    def email_addresses(self) -> Optional[Sequence[str]]:
        """
        Contains only valid RFC 2822 E-mail addresses.
        """
        return pulumi.get(self, "email_addresses")

    @property
    @pulumi.getter(name="ipAddresses")
    def ip_addresses(self) -> Optional[Sequence[str]]:
        """
        Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
        """
        return pulumi.get(self, "ip_addresses")

    @property
    @pulumi.getter
    def uris(self) -> Optional[Sequence[str]]:
        """
        Contains only valid RFC 3986 URIs.
        """
        return pulumi.get(self, "uris")


@pulumi.output_type
class AuthorityConfigX509Config(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "caOptions":
            suggest = "ca_options"
        elif key == "keyUsage":
            suggest = "key_usage"
        elif key == "additionalExtensions":
            suggest = "additional_extensions"
        elif key == "aiaOcspServers":
            suggest = "aia_ocsp_servers"
        elif key == "policyIds":
            suggest = "policy_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509Config. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509Config.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509Config.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 ca_options: 'outputs.AuthorityConfigX509ConfigCaOptions',
                 key_usage: 'outputs.AuthorityConfigX509ConfigKeyUsage',
                 additional_extensions: Optional[Sequence['outputs.AuthorityConfigX509ConfigAdditionalExtension']] = None,
                 aia_ocsp_servers: Optional[Sequence[str]] = None,
                 policy_ids: Optional[Sequence['outputs.AuthorityConfigX509ConfigPolicyId']] = None):
        """
        :param 'AuthorityConfigX509ConfigCaOptionsArgs' ca_options: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param 'AuthorityConfigX509ConfigKeyUsageArgs' key_usage: Indicates the intended use for keys that correspond to a certificate.
               Structure is documented below.
        :param Sequence['AuthorityConfigX509ConfigAdditionalExtensionArgs'] additional_extensions: Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
               Structure is documented below.
        :param Sequence[str] aia_ocsp_servers: Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
               "Authority Information Access" extension in the certificate.
        :param Sequence['AuthorityConfigX509ConfigPolicyIdArgs'] policy_ids: Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
               Structure is documented below.
        """
        pulumi.set(__self__, "ca_options", ca_options)
        pulumi.set(__self__, "key_usage", key_usage)
        if additional_extensions is not None:
            pulumi.set(__self__, "additional_extensions", additional_extensions)
        if aia_ocsp_servers is not None:
            pulumi.set(__self__, "aia_ocsp_servers", aia_ocsp_servers)
        if policy_ids is not None:
            pulumi.set(__self__, "policy_ids", policy_ids)

    @property
    @pulumi.getter(name="caOptions")
    def ca_options(self) -> 'outputs.AuthorityConfigX509ConfigCaOptions':
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "ca_options")

    @property
    @pulumi.getter(name="keyUsage")
    def key_usage(self) -> 'outputs.AuthorityConfigX509ConfigKeyUsage':
        """
        Indicates the intended use for keys that correspond to a certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "key_usage")

    @property
    @pulumi.getter(name="additionalExtensions")
    def additional_extensions(self) -> Optional[Sequence['outputs.AuthorityConfigX509ConfigAdditionalExtension']]:
        """
        Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
        Structure is documented below.
        """
        return pulumi.get(self, "additional_extensions")

    @property
    @pulumi.getter(name="aiaOcspServers")
    def aia_ocsp_servers(self) -> Optional[Sequence[str]]:
        """
        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
        "Authority Information Access" extension in the certificate.
        """
        return pulumi.get(self, "aia_ocsp_servers")

    @property
    @pulumi.getter(name="policyIds")
    def policy_ids(self) -> Optional[Sequence['outputs.AuthorityConfigX509ConfigPolicyId']]:
        """
        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
        Structure is documented below.
        """
        return pulumi.get(self, "policy_ids")


@pulumi.output_type
class AuthorityConfigX509ConfigAdditionalExtension(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectId":
            suggest = "object_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigAdditionalExtension. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigAdditionalExtension.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigAdditionalExtension.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 critical: bool,
                 object_id: 'outputs.AuthorityConfigX509ConfigAdditionalExtensionObjectId',
                 value: str):
        """
        :param bool critical: Indicates whether or not this extension is critical (i.e., if the client does not know how to
               handle this extension, the client should consider this to be an error).
        :param 'AuthorityConfigX509ConfigAdditionalExtensionObjectIdArgs' object_id: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param str value: The value of this X.509 extension. A base64-encoded string.
        """
        pulumi.set(__self__, "critical", critical)
        pulumi.set(__self__, "object_id", object_id)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def critical(self) -> bool:
        """
        Indicates whether or not this extension is critical (i.e., if the client does not know how to
        handle this extension, the client should consider this to be an error).
        """
        return pulumi.get(self, "critical")

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> 'outputs.AuthorityConfigX509ConfigAdditionalExtensionObjectId':
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "object_id")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of this X.509 extension. A base64-encoded string.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class AuthorityConfigX509ConfigAdditionalExtensionObjectId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigAdditionalExtensionObjectId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigAdditionalExtensionObjectId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigAdditionalExtensionObjectId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class AuthorityConfigX509ConfigCaOptions(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "isCa":
            suggest = "is_ca"
        elif key == "maxIssuerPathLength":
            suggest = "max_issuer_path_length"
        elif key == "nonCa":
            suggest = "non_ca"
        elif key == "zeroMaxIssuerPathLength":
            suggest = "zero_max_issuer_path_length"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigCaOptions. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigCaOptions.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigCaOptions.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 is_ca: bool,
                 max_issuer_path_length: Optional[int] = None,
                 non_ca: Optional[bool] = None,
                 zero_max_issuer_path_length: Optional[bool] = None):
        """
        :param bool is_ca: When true, the "CA" in Basic Constraints extension will be set to true.
        :param int max_issuer_path_length: Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
               subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. Setting the value to 0
               requires setting `zero_max_issuer_path_length = true`.
        :param bool non_ca: When true, the "CA" in Basic Constraints extension will be set to false.
               If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
        :param bool zero_max_issuer_path_length: When true, the "path length constraint" in Basic Constraints extension will be set to 0.
               If both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
               the max path length will be omitted from the CA certificate.
        """
        pulumi.set(__self__, "is_ca", is_ca)
        if max_issuer_path_length is not None:
            pulumi.set(__self__, "max_issuer_path_length", max_issuer_path_length)
        if non_ca is not None:
            pulumi.set(__self__, "non_ca", non_ca)
        if zero_max_issuer_path_length is not None:
            pulumi.set(__self__, "zero_max_issuer_path_length", zero_max_issuer_path_length)

    @property
    @pulumi.getter(name="isCa")
    def is_ca(self) -> bool:
        """
        When true, the "CA" in Basic Constraints extension will be set to true.
        """
        return pulumi.get(self, "is_ca")

    @property
    @pulumi.getter(name="maxIssuerPathLength")
    def max_issuer_path_length(self) -> Optional[int]:
        """
        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. Setting the value to 0
        requires setting `zero_max_issuer_path_length = true`.
        """
        return pulumi.get(self, "max_issuer_path_length")

    @property
    @pulumi.getter(name="nonCa")
    def non_ca(self) -> Optional[bool]:
        """
        When true, the "CA" in Basic Constraints extension will be set to false.
        If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
        """
        return pulumi.get(self, "non_ca")

    @property
    @pulumi.getter(name="zeroMaxIssuerPathLength")
    def zero_max_issuer_path_length(self) -> Optional[bool]:
        """
        When true, the "path length constraint" in Basic Constraints extension will be set to 0.
        If both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
        the max path length will be omitted from the CA certificate.
        """
        return pulumi.get(self, "zero_max_issuer_path_length")


@pulumi.output_type
class AuthorityConfigX509ConfigKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "baseKeyUsage":
            suggest = "base_key_usage"
        elif key == "extendedKeyUsage":
            suggest = "extended_key_usage"
        elif key == "unknownExtendedKeyUsages":
            suggest = "unknown_extended_key_usages"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 base_key_usage: 'outputs.AuthorityConfigX509ConfigKeyUsageBaseKeyUsage',
                 extended_key_usage: 'outputs.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsage',
                 unknown_extended_key_usages: Optional[Sequence['outputs.AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsage']] = None):
        """
        :param 'AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs' base_key_usage: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param 'AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs' extended_key_usage: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param Sequence['AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs'] unknown_extended_key_usages: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               Structure is documented below.
        """
        pulumi.set(__self__, "base_key_usage", base_key_usage)
        pulumi.set(__self__, "extended_key_usage", extended_key_usage)
        if unknown_extended_key_usages is not None:
            pulumi.set(__self__, "unknown_extended_key_usages", unknown_extended_key_usages)

    @property
    @pulumi.getter(name="baseKeyUsage")
    def base_key_usage(self) -> 'outputs.AuthorityConfigX509ConfigKeyUsageBaseKeyUsage':
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "base_key_usage")

    @property
    @pulumi.getter(name="extendedKeyUsage")
    def extended_key_usage(self) -> 'outputs.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsage':
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "extended_key_usage")

    @property
    @pulumi.getter(name="unknownExtendedKeyUsages")
    def unknown_extended_key_usages(self) -> Optional[Sequence['outputs.AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsage']]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        Structure is documented below.
        """
        return pulumi.get(self, "unknown_extended_key_usages")


@pulumi.output_type
class AuthorityConfigX509ConfigKeyUsageBaseKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certSign":
            suggest = "cert_sign"
        elif key == "contentCommitment":
            suggest = "content_commitment"
        elif key == "crlSign":
            suggest = "crl_sign"
        elif key == "dataEncipherment":
            suggest = "data_encipherment"
        elif key == "decipherOnly":
            suggest = "decipher_only"
        elif key == "digitalSignature":
            suggest = "digital_signature"
        elif key == "encipherOnly":
            suggest = "encipher_only"
        elif key == "keyAgreement":
            suggest = "key_agreement"
        elif key == "keyEncipherment":
            suggest = "key_encipherment"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigKeyUsageBaseKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigKeyUsageBaseKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigKeyUsageBaseKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 cert_sign: Optional[bool] = None,
                 content_commitment: Optional[bool] = None,
                 crl_sign: Optional[bool] = None,
                 data_encipherment: Optional[bool] = None,
                 decipher_only: Optional[bool] = None,
                 digital_signature: Optional[bool] = None,
                 encipher_only: Optional[bool] = None,
                 key_agreement: Optional[bool] = None,
                 key_encipherment: Optional[bool] = None):
        """
        :param bool cert_sign: The key may be used to sign certificates.
        :param bool content_commitment: The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        :param bool crl_sign: The key may be used sign certificate revocation lists.
        :param bool data_encipherment: The key may be used to encipher data.
        :param bool decipher_only: The key may be used to decipher only.
        :param bool digital_signature: The key may be used for digital signatures.
        :param bool encipher_only: The key may be used to encipher only.
        :param bool key_agreement: The key may be used in a key agreement protocol.
        :param bool key_encipherment: The key may be used to encipher other keys.
        """
        if cert_sign is not None:
            pulumi.set(__self__, "cert_sign", cert_sign)
        if content_commitment is not None:
            pulumi.set(__self__, "content_commitment", content_commitment)
        if crl_sign is not None:
            pulumi.set(__self__, "crl_sign", crl_sign)
        if data_encipherment is not None:
            pulumi.set(__self__, "data_encipherment", data_encipherment)
        if decipher_only is not None:
            pulumi.set(__self__, "decipher_only", decipher_only)
        if digital_signature is not None:
            pulumi.set(__self__, "digital_signature", digital_signature)
        if encipher_only is not None:
            pulumi.set(__self__, "encipher_only", encipher_only)
        if key_agreement is not None:
            pulumi.set(__self__, "key_agreement", key_agreement)
        if key_encipherment is not None:
            pulumi.set(__self__, "key_encipherment", key_encipherment)

    @property
    @pulumi.getter(name="certSign")
    def cert_sign(self) -> Optional[bool]:
        """
        The key may be used to sign certificates.
        """
        return pulumi.get(self, "cert_sign")

    @property
    @pulumi.getter(name="contentCommitment")
    def content_commitment(self) -> Optional[bool]:
        """
        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        """
        return pulumi.get(self, "content_commitment")

    @property
    @pulumi.getter(name="crlSign")
    def crl_sign(self) -> Optional[bool]:
        """
        The key may be used sign certificate revocation lists.
        """
        return pulumi.get(self, "crl_sign")

    @property
    @pulumi.getter(name="dataEncipherment")
    def data_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher data.
        """
        return pulumi.get(self, "data_encipherment")

    @property
    @pulumi.getter(name="decipherOnly")
    def decipher_only(self) -> Optional[bool]:
        """
        The key may be used to decipher only.
        """
        return pulumi.get(self, "decipher_only")

    @property
    @pulumi.getter(name="digitalSignature")
    def digital_signature(self) -> Optional[bool]:
        """
        The key may be used for digital signatures.
        """
        return pulumi.get(self, "digital_signature")

    @property
    @pulumi.getter(name="encipherOnly")
    def encipher_only(self) -> Optional[bool]:
        """
        The key may be used to encipher only.
        """
        return pulumi.get(self, "encipher_only")

    @property
    @pulumi.getter(name="keyAgreement")
    def key_agreement(self) -> Optional[bool]:
        """
        The key may be used in a key agreement protocol.
        """
        return pulumi.get(self, "key_agreement")

    @property
    @pulumi.getter(name="keyEncipherment")
    def key_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher other keys.
        """
        return pulumi.get(self, "key_encipherment")


@pulumi.output_type
class AuthorityConfigX509ConfigKeyUsageExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "clientAuth":
            suggest = "client_auth"
        elif key == "codeSigning":
            suggest = "code_signing"
        elif key == "emailProtection":
            suggest = "email_protection"
        elif key == "ocspSigning":
            suggest = "ocsp_signing"
        elif key == "serverAuth":
            suggest = "server_auth"
        elif key == "timeStamping":
            suggest = "time_stamping"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigKeyUsageExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 client_auth: Optional[bool] = None,
                 code_signing: Optional[bool] = None,
                 email_protection: Optional[bool] = None,
                 ocsp_signing: Optional[bool] = None,
                 server_auth: Optional[bool] = None,
                 time_stamping: Optional[bool] = None):
        """
        :param bool client_auth: Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        :param bool code_signing: Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        :param bool email_protection: Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        :param bool ocsp_signing: Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        :param bool server_auth: Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        :param bool time_stamping: Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        if client_auth is not None:
            pulumi.set(__self__, "client_auth", client_auth)
        if code_signing is not None:
            pulumi.set(__self__, "code_signing", code_signing)
        if email_protection is not None:
            pulumi.set(__self__, "email_protection", email_protection)
        if ocsp_signing is not None:
            pulumi.set(__self__, "ocsp_signing", ocsp_signing)
        if server_auth is not None:
            pulumi.set(__self__, "server_auth", server_auth)
        if time_stamping is not None:
            pulumi.set(__self__, "time_stamping", time_stamping)

    @property
    @pulumi.getter(name="clientAuth")
    def client_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "client_auth")

    @property
    @pulumi.getter(name="codeSigning")
    def code_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        """
        return pulumi.get(self, "code_signing")

    @property
    @pulumi.getter(name="emailProtection")
    def email_protection(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        """
        return pulumi.get(self, "email_protection")

    @property
    @pulumi.getter(name="ocspSigning")
    def ocsp_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        """
        return pulumi.get(self, "ocsp_signing")

    @property
    @pulumi.getter(name="serverAuth")
    def server_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "server_auth")

    @property
    @pulumi.getter(name="timeStamping")
    def time_stamping(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        return pulumi.get(self, "time_stamping")


@pulumi.output_type
class AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class AuthorityConfigX509ConfigPolicyId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityConfigX509ConfigPolicyId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityConfigX509ConfigPolicyId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityConfigX509ConfigPolicyId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class AuthorityKeySpec(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "cloudKmsKeyVersion":
            suggest = "cloud_kms_key_version"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthorityKeySpec. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthorityKeySpec.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthorityKeySpec.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 algorithm: Optional[str] = None,
                 cloud_kms_key_version: Optional[str] = None):
        """
        :param str algorithm: The algorithm to use for creating a managed Cloud KMS key for a for a simplified
               experience. All managed keys will be have their ProtectionLevel as HSM.
               Possible values are `SIGN_HASH_ALGORITHM_UNSPECIFIED`, `RSA_PSS_2048_SHA256`, `RSA_PSS_3072_SHA256`, `RSA_PSS_4096_SHA256`, `RSA_PKCS1_2048_SHA256`, `RSA_PKCS1_3072_SHA256`, `RSA_PKCS1_4096_SHA256`, `EC_P256_SHA256`, and `EC_P384_SHA384`.
        :param str cloud_kms_key_version: The resource name for an existing Cloud KMS CryptoKeyVersion in the format
               `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
        """
        if algorithm is not None:
            pulumi.set(__self__, "algorithm", algorithm)
        if cloud_kms_key_version is not None:
            pulumi.set(__self__, "cloud_kms_key_version", cloud_kms_key_version)

    @property
    @pulumi.getter
    def algorithm(self) -> Optional[str]:
        """
        The algorithm to use for creating a managed Cloud KMS key for a for a simplified
        experience. All managed keys will be have their ProtectionLevel as HSM.
        Possible values are `SIGN_HASH_ALGORITHM_UNSPECIFIED`, `RSA_PSS_2048_SHA256`, `RSA_PSS_3072_SHA256`, `RSA_PSS_4096_SHA256`, `RSA_PKCS1_2048_SHA256`, `RSA_PKCS1_3072_SHA256`, `RSA_PKCS1_4096_SHA256`, `EC_P256_SHA256`, and `EC_P384_SHA384`.
        """
        return pulumi.get(self, "algorithm")

    @property
    @pulumi.getter(name="cloudKmsKeyVersion")
    def cloud_kms_key_version(self) -> Optional[str]:
        """
        The resource name for an existing Cloud KMS CryptoKeyVersion in the format
        `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
        """
        return pulumi.get(self, "cloud_kms_key_version")


@pulumi.output_type
class AuthoritySubordinateConfig(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certificateAuthority":
            suggest = "certificate_authority"
        elif key == "pemIssuerChain":
            suggest = "pem_issuer_chain"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthoritySubordinateConfig. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthoritySubordinateConfig.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthoritySubordinateConfig.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 certificate_authority: Optional[str] = None,
                 pem_issuer_chain: Optional['outputs.AuthoritySubordinateConfigPemIssuerChain'] = None):
        """
        :param str certificate_authority: This can refer to a CertificateAuthority that was used to create a
               subordinate CertificateAuthority. This field is used for information
               and usability purposes only. The resource name is in the format
               `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
        :param 'AuthoritySubordinateConfigPemIssuerChainArgs' pem_issuer_chain: Contains the PEM certificate chain for the issuers of this CertificateAuthority,
               but not pem certificate for this CA itself.
               Structure is documented below.
        """
        if certificate_authority is not None:
            pulumi.set(__self__, "certificate_authority", certificate_authority)
        if pem_issuer_chain is not None:
            pulumi.set(__self__, "pem_issuer_chain", pem_issuer_chain)

    @property
    @pulumi.getter(name="certificateAuthority")
    def certificate_authority(self) -> Optional[str]:
        """
        This can refer to a CertificateAuthority that was used to create a
        subordinate CertificateAuthority. This field is used for information
        and usability purposes only. The resource name is in the format
        `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
        """
        return pulumi.get(self, "certificate_authority")

    @property
    @pulumi.getter(name="pemIssuerChain")
    def pem_issuer_chain(self) -> Optional['outputs.AuthoritySubordinateConfigPemIssuerChain']:
        """
        Contains the PEM certificate chain for the issuers of this CertificateAuthority,
        but not pem certificate for this CA itself.
        Structure is documented below.
        """
        return pulumi.get(self, "pem_issuer_chain")


@pulumi.output_type
class AuthoritySubordinateConfigPemIssuerChain(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "pemCertificates":
            suggest = "pem_certificates"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthoritySubordinateConfigPemIssuerChain. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthoritySubordinateConfigPemIssuerChain.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthoritySubordinateConfigPemIssuerChain.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 pem_certificates: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] pem_certificates: Expected to be in leaf-to-root order according to RFC 5246.
        """
        if pem_certificates is not None:
            pulumi.set(__self__, "pem_certificates", pem_certificates)

    @property
    @pulumi.getter(name="pemCertificates")
    def pem_certificates(self) -> Optional[Sequence[str]]:
        """
        Expected to be in leaf-to-root order according to RFC 5246.
        """
        return pulumi.get(self, "pem_certificates")


@pulumi.output_type
class CaPoolIamBindingCondition(dict):
    def __init__(__self__, *,
                 expression: str,
                 title: str,
                 description: Optional[str] = None):
        """
        :param str expression: Textual representation of an expression in Common Expression Language syntax.
        :param str title: A title for the expression, i.e. a short string describing its purpose.
        :param str description: An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        pulumi.set(__self__, "expression", expression)
        pulumi.set(__self__, "title", title)
        if description is not None:
            pulumi.set(__self__, "description", description)

    @property
    @pulumi.getter
    def expression(self) -> str:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def title(self) -> str:
        """
        A title for the expression, i.e. a short string describing its purpose.
        """
        return pulumi.get(self, "title")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")


@pulumi.output_type
class CaPoolIamMemberCondition(dict):
    def __init__(__self__, *,
                 expression: str,
                 title: str,
                 description: Optional[str] = None):
        """
        :param str expression: Textual representation of an expression in Common Expression Language syntax.
        :param str title: A title for the expression, i.e. a short string describing its purpose.
        :param str description: An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        pulumi.set(__self__, "expression", expression)
        pulumi.set(__self__, "title", title)
        if description is not None:
            pulumi.set(__self__, "description", description)

    @property
    @pulumi.getter
    def expression(self) -> str:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def title(self) -> str:
        """
        A title for the expression, i.e. a short string describing its purpose.
        """
        return pulumi.get(self, "title")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")


@pulumi.output_type
class CaPoolIssuancePolicy(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "allowedIssuanceModes":
            suggest = "allowed_issuance_modes"
        elif key == "allowedKeyTypes":
            suggest = "allowed_key_types"
        elif key == "baselineValues":
            suggest = "baseline_values"
        elif key == "identityConstraints":
            suggest = "identity_constraints"
        elif key == "maximumLifetime":
            suggest = "maximum_lifetime"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicy. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicy.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicy.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 allowed_issuance_modes: Optional['outputs.CaPoolIssuancePolicyAllowedIssuanceModes'] = None,
                 allowed_key_types: Optional[Sequence['outputs.CaPoolIssuancePolicyAllowedKeyType']] = None,
                 baseline_values: Optional['outputs.CaPoolIssuancePolicyBaselineValues'] = None,
                 identity_constraints: Optional['outputs.CaPoolIssuancePolicyIdentityConstraints'] = None,
                 maximum_lifetime: Optional[str] = None):
        """
        :param 'CaPoolIssuancePolicyAllowedIssuanceModesArgs' allowed_issuance_modes: IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool.
               Structure is documented below.
        :param Sequence['CaPoolIssuancePolicyAllowedKeyTypeArgs'] allowed_key_types: If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here.
               Otherwise, any key may be used.
               Structure is documented below.
        :param 'CaPoolIssuancePolicyBaselineValuesArgs' baseline_values: A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request
               includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate
               request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate
               issuance request will fail.
               Structure is documented below.
        :param 'CaPoolIssuancePolicyIdentityConstraintsArgs' identity_constraints: Describes constraints on identities that may appear in Certificates issued through this CaPool.
               If this is omitted, then this CaPool will not add restrictions on a certificate's identity.
               Structure is documented below.
        :param str maximum_lifetime: The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority
               expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.
        """
        if allowed_issuance_modes is not None:
            pulumi.set(__self__, "allowed_issuance_modes", allowed_issuance_modes)
        if allowed_key_types is not None:
            pulumi.set(__self__, "allowed_key_types", allowed_key_types)
        if baseline_values is not None:
            pulumi.set(__self__, "baseline_values", baseline_values)
        if identity_constraints is not None:
            pulumi.set(__self__, "identity_constraints", identity_constraints)
        if maximum_lifetime is not None:
            pulumi.set(__self__, "maximum_lifetime", maximum_lifetime)

    @property
    @pulumi.getter(name="allowedIssuanceModes")
    def allowed_issuance_modes(self) -> Optional['outputs.CaPoolIssuancePolicyAllowedIssuanceModes']:
        """
        IssuanceModes specifies the allowed ways in which Certificates may be requested from this CaPool.
        Structure is documented below.
        """
        return pulumi.get(self, "allowed_issuance_modes")

    @property
    @pulumi.getter(name="allowedKeyTypes")
    def allowed_key_types(self) -> Optional[Sequence['outputs.CaPoolIssuancePolicyAllowedKeyType']]:
        """
        If any AllowedKeyType is specified, then the certificate request's public key must match one of the key types listed here.
        Otherwise, any key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "allowed_key_types")

    @property
    @pulumi.getter(name="baselineValues")
    def baseline_values(self) -> Optional['outputs.CaPoolIssuancePolicyBaselineValues']:
        """
        A set of X.509 values that will be applied to all certificates issued through this CaPool. If a certificate request
        includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate
        request uses a CertificateTemplate that defines conflicting predefinedValues for the same properties, the certificate
        issuance request will fail.
        Structure is documented below.
        """
        return pulumi.get(self, "baseline_values")

    @property
    @pulumi.getter(name="identityConstraints")
    def identity_constraints(self) -> Optional['outputs.CaPoolIssuancePolicyIdentityConstraints']:
        """
        Describes constraints on identities that may appear in Certificates issued through this CaPool.
        If this is omitted, then this CaPool will not add restrictions on a certificate's identity.
        Structure is documented below.
        """
        return pulumi.get(self, "identity_constraints")

    @property
    @pulumi.getter(name="maximumLifetime")
    def maximum_lifetime(self) -> Optional[str]:
        """
        The maximum lifetime allowed for issued Certificates. Note that if the issuing CertificateAuthority
        expires before a Certificate's requested maximumLifetime, the effective lifetime will be explicitly truncated to match it.
        """
        return pulumi.get(self, "maximum_lifetime")


@pulumi.output_type
class CaPoolIssuancePolicyAllowedIssuanceModes(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "allowConfigBasedIssuance":
            suggest = "allow_config_based_issuance"
        elif key == "allowCsrBasedIssuance":
            suggest = "allow_csr_based_issuance"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyAllowedIssuanceModes. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyAllowedIssuanceModes.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyAllowedIssuanceModes.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 allow_config_based_issuance: bool,
                 allow_csr_based_issuance: bool):
        """
        :param bool allow_config_based_issuance: When true, allows callers to create Certificates by specifying a CertificateConfig.
        :param bool allow_csr_based_issuance: When true, allows callers to create Certificates by specifying a CSR.
        """
        pulumi.set(__self__, "allow_config_based_issuance", allow_config_based_issuance)
        pulumi.set(__self__, "allow_csr_based_issuance", allow_csr_based_issuance)

    @property
    @pulumi.getter(name="allowConfigBasedIssuance")
    def allow_config_based_issuance(self) -> bool:
        """
        When true, allows callers to create Certificates by specifying a CertificateConfig.
        """
        return pulumi.get(self, "allow_config_based_issuance")

    @property
    @pulumi.getter(name="allowCsrBasedIssuance")
    def allow_csr_based_issuance(self) -> bool:
        """
        When true, allows callers to create Certificates by specifying a CSR.
        """
        return pulumi.get(self, "allow_csr_based_issuance")


@pulumi.output_type
class CaPoolIssuancePolicyAllowedKeyType(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "ellipticCurve":
            suggest = "elliptic_curve"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyAllowedKeyType. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyAllowedKeyType.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyAllowedKeyType.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 elliptic_curve: Optional['outputs.CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve'] = None,
                 rsa: Optional['outputs.CaPoolIssuancePolicyAllowedKeyTypeRsa'] = None):
        """
        :param 'CaPoolIssuancePolicyAllowedKeyTypeEllipticCurveArgs' elliptic_curve: Represents an allowed Elliptic Curve key type.
               Structure is documented below.
        :param 'CaPoolIssuancePolicyAllowedKeyTypeRsaArgs' rsa: Describes an RSA key that may be used in a Certificate issued from a CaPool.
               Structure is documented below.
        """
        if elliptic_curve is not None:
            pulumi.set(__self__, "elliptic_curve", elliptic_curve)
        if rsa is not None:
            pulumi.set(__self__, "rsa", rsa)

    @property
    @pulumi.getter(name="ellipticCurve")
    def elliptic_curve(self) -> Optional['outputs.CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve']:
        """
        Represents an allowed Elliptic Curve key type.
        Structure is documented below.
        """
        return pulumi.get(self, "elliptic_curve")

    @property
    @pulumi.getter
    def rsa(self) -> Optional['outputs.CaPoolIssuancePolicyAllowedKeyTypeRsa']:
        """
        Describes an RSA key that may be used in a Certificate issued from a CaPool.
        Structure is documented below.
        """
        return pulumi.get(self, "rsa")


@pulumi.output_type
class CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "signatureAlgorithm":
            suggest = "signature_algorithm"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyAllowedKeyTypeEllipticCurve.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 signature_algorithm: str):
        """
        :param str signature_algorithm: The algorithm used.
               Possible values are `ECDSA_P256`, `ECDSA_P384`, and `EDDSA_25519`.
        """
        pulumi.set(__self__, "signature_algorithm", signature_algorithm)

    @property
    @pulumi.getter(name="signatureAlgorithm")
    def signature_algorithm(self) -> str:
        """
        The algorithm used.
        Possible values are `ECDSA_P256`, `ECDSA_P384`, and `EDDSA_25519`.
        """
        return pulumi.get(self, "signature_algorithm")


@pulumi.output_type
class CaPoolIssuancePolicyAllowedKeyTypeRsa(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "maxModulusSize":
            suggest = "max_modulus_size"
        elif key == "minModulusSize":
            suggest = "min_modulus_size"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyAllowedKeyTypeRsa. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyAllowedKeyTypeRsa.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyAllowedKeyTypeRsa.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 max_modulus_size: Optional[str] = None,
                 min_modulus_size: Optional[str] = None):
        """
        :param str max_modulus_size: The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the
               service will not enforce an explicit upper bound on RSA modulus sizes.
        :param str min_modulus_size: The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the
               service-level min RSA modulus size will continue to apply.
        """
        if max_modulus_size is not None:
            pulumi.set(__self__, "max_modulus_size", max_modulus_size)
        if min_modulus_size is not None:
            pulumi.set(__self__, "min_modulus_size", min_modulus_size)

    @property
    @pulumi.getter(name="maxModulusSize")
    def max_modulus_size(self) -> Optional[str]:
        """
        The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the
        service will not enforce an explicit upper bound on RSA modulus sizes.
        """
        return pulumi.get(self, "max_modulus_size")

    @property
    @pulumi.getter(name="minModulusSize")
    def min_modulus_size(self) -> Optional[str]:
        """
        The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the
        service-level min RSA modulus size will continue to apply.
        """
        return pulumi.get(self, "min_modulus_size")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValues(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "caOptions":
            suggest = "ca_options"
        elif key == "keyUsage":
            suggest = "key_usage"
        elif key == "additionalExtensions":
            suggest = "additional_extensions"
        elif key == "aiaOcspServers":
            suggest = "aia_ocsp_servers"
        elif key == "policyIds":
            suggest = "policy_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValues. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValues.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValues.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 ca_options: 'outputs.CaPoolIssuancePolicyBaselineValuesCaOptions',
                 key_usage: 'outputs.CaPoolIssuancePolicyBaselineValuesKeyUsage',
                 additional_extensions: Optional[Sequence['outputs.CaPoolIssuancePolicyBaselineValuesAdditionalExtension']] = None,
                 aia_ocsp_servers: Optional[Sequence[str]] = None,
                 policy_ids: Optional[Sequence['outputs.CaPoolIssuancePolicyBaselineValuesPolicyId']] = None):
        """
        :param 'CaPoolIssuancePolicyBaselineValuesCaOptionsArgs' ca_options: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param 'CaPoolIssuancePolicyBaselineValuesKeyUsageArgs' key_usage: Indicates the intended use for keys that correspond to a certificate.
               Structure is documented below.
        :param Sequence['CaPoolIssuancePolicyBaselineValuesAdditionalExtensionArgs'] additional_extensions: Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
               Structure is documented below.
        :param Sequence[str] aia_ocsp_servers: Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
               "Authority Information Access" extension in the certificate.
        :param Sequence['CaPoolIssuancePolicyBaselineValuesPolicyIdArgs'] policy_ids: Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
               Structure is documented below.
        """
        pulumi.set(__self__, "ca_options", ca_options)
        pulumi.set(__self__, "key_usage", key_usage)
        if additional_extensions is not None:
            pulumi.set(__self__, "additional_extensions", additional_extensions)
        if aia_ocsp_servers is not None:
            pulumi.set(__self__, "aia_ocsp_servers", aia_ocsp_servers)
        if policy_ids is not None:
            pulumi.set(__self__, "policy_ids", policy_ids)

    @property
    @pulumi.getter(name="caOptions")
    def ca_options(self) -> 'outputs.CaPoolIssuancePolicyBaselineValuesCaOptions':
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "ca_options")

    @property
    @pulumi.getter(name="keyUsage")
    def key_usage(self) -> 'outputs.CaPoolIssuancePolicyBaselineValuesKeyUsage':
        """
        Indicates the intended use for keys that correspond to a certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "key_usage")

    @property
    @pulumi.getter(name="additionalExtensions")
    def additional_extensions(self) -> Optional[Sequence['outputs.CaPoolIssuancePolicyBaselineValuesAdditionalExtension']]:
        """
        Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
        Structure is documented below.
        """
        return pulumi.get(self, "additional_extensions")

    @property
    @pulumi.getter(name="aiaOcspServers")
    def aia_ocsp_servers(self) -> Optional[Sequence[str]]:
        """
        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
        "Authority Information Access" extension in the certificate.
        """
        return pulumi.get(self, "aia_ocsp_servers")

    @property
    @pulumi.getter(name="policyIds")
    def policy_ids(self) -> Optional[Sequence['outputs.CaPoolIssuancePolicyBaselineValuesPolicyId']]:
        """
        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
        Structure is documented below.
        """
        return pulumi.get(self, "policy_ids")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesAdditionalExtension(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectId":
            suggest = "object_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesAdditionalExtension. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesAdditionalExtension.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesAdditionalExtension.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 critical: bool,
                 object_id: 'outputs.CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId',
                 value: str):
        """
        :param bool critical: Indicates whether or not this extension is critical (i.e., if the client does not know how to
               handle this extension, the client should consider this to be an error).
        :param 'CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectIdArgs' object_id: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param str value: The value of this X.509 extension. A base64-encoded string.
        """
        pulumi.set(__self__, "critical", critical)
        pulumi.set(__self__, "object_id", object_id)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def critical(self) -> bool:
        """
        Indicates whether or not this extension is critical (i.e., if the client does not know how to
        handle this extension, the client should consider this to be an error).
        """
        return pulumi.get(self, "critical")

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> 'outputs.CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId':
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "object_id")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of this X.509 extension. A base64-encoded string.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesAdditionalExtensionObjectId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesCaOptions(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "isCa":
            suggest = "is_ca"
        elif key == "maxIssuerPathLength":
            suggest = "max_issuer_path_length"
        elif key == "nonCa":
            suggest = "non_ca"
        elif key == "zeroMaxIssuerPathLength":
            suggest = "zero_max_issuer_path_length"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesCaOptions. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesCaOptions.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesCaOptions.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 is_ca: Optional[bool] = None,
                 max_issuer_path_length: Optional[int] = None,
                 non_ca: Optional[bool] = None,
                 zero_max_issuer_path_length: Optional[bool] = None):
        """
        :param bool is_ca: When true, the "CA" in Basic Constraints extension will be set to true.
        :param int max_issuer_path_length: Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
               subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
        :param bool non_ca: When true, the "CA" in Basic Constraints extension will be set to false.
               If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
        :param bool zero_max_issuer_path_length: When true, the "path length constraint" in Basic Constraints extension will be set to 0.
               if both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
               the max path length will be omitted from the CA certificate.
        """
        if is_ca is not None:
            pulumi.set(__self__, "is_ca", is_ca)
        if max_issuer_path_length is not None:
            pulumi.set(__self__, "max_issuer_path_length", max_issuer_path_length)
        if non_ca is not None:
            pulumi.set(__self__, "non_ca", non_ca)
        if zero_max_issuer_path_length is not None:
            pulumi.set(__self__, "zero_max_issuer_path_length", zero_max_issuer_path_length)

    @property
    @pulumi.getter(name="isCa")
    def is_ca(self) -> Optional[bool]:
        """
        When true, the "CA" in Basic Constraints extension will be set to true.
        """
        return pulumi.get(self, "is_ca")

    @property
    @pulumi.getter(name="maxIssuerPathLength")
    def max_issuer_path_length(self) -> Optional[int]:
        """
        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
        """
        return pulumi.get(self, "max_issuer_path_length")

    @property
    @pulumi.getter(name="nonCa")
    def non_ca(self) -> Optional[bool]:
        """
        When true, the "CA" in Basic Constraints extension will be set to false.
        If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
        """
        return pulumi.get(self, "non_ca")

    @property
    @pulumi.getter(name="zeroMaxIssuerPathLength")
    def zero_max_issuer_path_length(self) -> Optional[bool]:
        """
        When true, the "path length constraint" in Basic Constraints extension will be set to 0.
        if both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
        the max path length will be omitted from the CA certificate.
        """
        return pulumi.get(self, "zero_max_issuer_path_length")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "baseKeyUsage":
            suggest = "base_key_usage"
        elif key == "extendedKeyUsage":
            suggest = "extended_key_usage"
        elif key == "unknownExtendedKeyUsages":
            suggest = "unknown_extended_key_usages"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 base_key_usage: 'outputs.CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage',
                 extended_key_usage: 'outputs.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage',
                 unknown_extended_key_usages: Optional[Sequence['outputs.CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage']] = None):
        """
        :param 'CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs' base_key_usage: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param 'CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs' extended_key_usage: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param Sequence['CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsageArgs'] unknown_extended_key_usages: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               Structure is documented below.
        """
        pulumi.set(__self__, "base_key_usage", base_key_usage)
        pulumi.set(__self__, "extended_key_usage", extended_key_usage)
        if unknown_extended_key_usages is not None:
            pulumi.set(__self__, "unknown_extended_key_usages", unknown_extended_key_usages)

    @property
    @pulumi.getter(name="baseKeyUsage")
    def base_key_usage(self) -> 'outputs.CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage':
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "base_key_usage")

    @property
    @pulumi.getter(name="extendedKeyUsage")
    def extended_key_usage(self) -> 'outputs.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage':
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "extended_key_usage")

    @property
    @pulumi.getter(name="unknownExtendedKeyUsages")
    def unknown_extended_key_usages(self) -> Optional[Sequence['outputs.CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage']]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        Structure is documented below.
        """
        return pulumi.get(self, "unknown_extended_key_usages")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certSign":
            suggest = "cert_sign"
        elif key == "contentCommitment":
            suggest = "content_commitment"
        elif key == "crlSign":
            suggest = "crl_sign"
        elif key == "dataEncipherment":
            suggest = "data_encipherment"
        elif key == "decipherOnly":
            suggest = "decipher_only"
        elif key == "digitalSignature":
            suggest = "digital_signature"
        elif key == "encipherOnly":
            suggest = "encipher_only"
        elif key == "keyAgreement":
            suggest = "key_agreement"
        elif key == "keyEncipherment":
            suggest = "key_encipherment"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 cert_sign: Optional[bool] = None,
                 content_commitment: Optional[bool] = None,
                 crl_sign: Optional[bool] = None,
                 data_encipherment: Optional[bool] = None,
                 decipher_only: Optional[bool] = None,
                 digital_signature: Optional[bool] = None,
                 encipher_only: Optional[bool] = None,
                 key_agreement: Optional[bool] = None,
                 key_encipherment: Optional[bool] = None):
        """
        :param bool cert_sign: The key may be used to sign certificates.
        :param bool content_commitment: The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        :param bool crl_sign: The key may be used sign certificate revocation lists.
        :param bool data_encipherment: The key may be used to encipher data.
        :param bool decipher_only: The key may be used to decipher only.
        :param bool digital_signature: The key may be used for digital signatures.
        :param bool encipher_only: The key may be used to encipher only.
        :param bool key_agreement: The key may be used in a key agreement protocol.
        :param bool key_encipherment: The key may be used to encipher other keys.
        """
        if cert_sign is not None:
            pulumi.set(__self__, "cert_sign", cert_sign)
        if content_commitment is not None:
            pulumi.set(__self__, "content_commitment", content_commitment)
        if crl_sign is not None:
            pulumi.set(__self__, "crl_sign", crl_sign)
        if data_encipherment is not None:
            pulumi.set(__self__, "data_encipherment", data_encipherment)
        if decipher_only is not None:
            pulumi.set(__self__, "decipher_only", decipher_only)
        if digital_signature is not None:
            pulumi.set(__self__, "digital_signature", digital_signature)
        if encipher_only is not None:
            pulumi.set(__self__, "encipher_only", encipher_only)
        if key_agreement is not None:
            pulumi.set(__self__, "key_agreement", key_agreement)
        if key_encipherment is not None:
            pulumi.set(__self__, "key_encipherment", key_encipherment)

    @property
    @pulumi.getter(name="certSign")
    def cert_sign(self) -> Optional[bool]:
        """
        The key may be used to sign certificates.
        """
        return pulumi.get(self, "cert_sign")

    @property
    @pulumi.getter(name="contentCommitment")
    def content_commitment(self) -> Optional[bool]:
        """
        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        """
        return pulumi.get(self, "content_commitment")

    @property
    @pulumi.getter(name="crlSign")
    def crl_sign(self) -> Optional[bool]:
        """
        The key may be used sign certificate revocation lists.
        """
        return pulumi.get(self, "crl_sign")

    @property
    @pulumi.getter(name="dataEncipherment")
    def data_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher data.
        """
        return pulumi.get(self, "data_encipherment")

    @property
    @pulumi.getter(name="decipherOnly")
    def decipher_only(self) -> Optional[bool]:
        """
        The key may be used to decipher only.
        """
        return pulumi.get(self, "decipher_only")

    @property
    @pulumi.getter(name="digitalSignature")
    def digital_signature(self) -> Optional[bool]:
        """
        The key may be used for digital signatures.
        """
        return pulumi.get(self, "digital_signature")

    @property
    @pulumi.getter(name="encipherOnly")
    def encipher_only(self) -> Optional[bool]:
        """
        The key may be used to encipher only.
        """
        return pulumi.get(self, "encipher_only")

    @property
    @pulumi.getter(name="keyAgreement")
    def key_agreement(self) -> Optional[bool]:
        """
        The key may be used in a key agreement protocol.
        """
        return pulumi.get(self, "key_agreement")

    @property
    @pulumi.getter(name="keyEncipherment")
    def key_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher other keys.
        """
        return pulumi.get(self, "key_encipherment")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "clientAuth":
            suggest = "client_auth"
        elif key == "codeSigning":
            suggest = "code_signing"
        elif key == "emailProtection":
            suggest = "email_protection"
        elif key == "ocspSigning":
            suggest = "ocsp_signing"
        elif key == "serverAuth":
            suggest = "server_auth"
        elif key == "timeStamping":
            suggest = "time_stamping"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 client_auth: Optional[bool] = None,
                 code_signing: Optional[bool] = None,
                 email_protection: Optional[bool] = None,
                 ocsp_signing: Optional[bool] = None,
                 server_auth: Optional[bool] = None,
                 time_stamping: Optional[bool] = None):
        """
        :param bool client_auth: Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        :param bool code_signing: Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        :param bool email_protection: Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        :param bool ocsp_signing: Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        :param bool server_auth: Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        :param bool time_stamping: Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        if client_auth is not None:
            pulumi.set(__self__, "client_auth", client_auth)
        if code_signing is not None:
            pulumi.set(__self__, "code_signing", code_signing)
        if email_protection is not None:
            pulumi.set(__self__, "email_protection", email_protection)
        if ocsp_signing is not None:
            pulumi.set(__self__, "ocsp_signing", ocsp_signing)
        if server_auth is not None:
            pulumi.set(__self__, "server_auth", server_auth)
        if time_stamping is not None:
            pulumi.set(__self__, "time_stamping", time_stamping)

    @property
    @pulumi.getter(name="clientAuth")
    def client_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "client_auth")

    @property
    @pulumi.getter(name="codeSigning")
    def code_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        """
        return pulumi.get(self, "code_signing")

    @property
    @pulumi.getter(name="emailProtection")
    def email_protection(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        """
        return pulumi.get(self, "email_protection")

    @property
    @pulumi.getter(name="ocspSigning")
    def ocsp_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        """
        return pulumi.get(self, "ocsp_signing")

    @property
    @pulumi.getter(name="serverAuth")
    def server_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "server_auth")

    @property
    @pulumi.getter(name="timeStamping")
    def time_stamping(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        return pulumi.get(self, "time_stamping")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CaPoolIssuancePolicyBaselineValuesPolicyId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyBaselineValuesPolicyId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyBaselineValuesPolicyId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyBaselineValuesPolicyId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CaPoolIssuancePolicyIdentityConstraints(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "allowSubjectAltNamesPassthrough":
            suggest = "allow_subject_alt_names_passthrough"
        elif key == "allowSubjectPassthrough":
            suggest = "allow_subject_passthrough"
        elif key == "celExpression":
            suggest = "cel_expression"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolIssuancePolicyIdentityConstraints. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolIssuancePolicyIdentityConstraints.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolIssuancePolicyIdentityConstraints.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 allow_subject_alt_names_passthrough: bool,
                 allow_subject_passthrough: bool,
                 cel_expression: Optional['outputs.CaPoolIssuancePolicyIdentityConstraintsCelExpression'] = None):
        """
        :param bool allow_subject_alt_names_passthrough: If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate.
               Otherwise, the requested SubjectAltNames will be discarded.
        :param bool allow_subject_passthrough: If this is set, the Subject field may be copied from a certificate request into the signed certificate.
               Otherwise, the requested Subject will be discarded.
        :param 'CaPoolIssuancePolicyIdentityConstraintsCelExpressionArgs' cel_expression: A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a
               certificate is signed. To see the full allowed syntax and some examples,
               see https://cloud.google.com/certificate-authority-service/docs/cel-guide
               Structure is documented below.
        """
        pulumi.set(__self__, "allow_subject_alt_names_passthrough", allow_subject_alt_names_passthrough)
        pulumi.set(__self__, "allow_subject_passthrough", allow_subject_passthrough)
        if cel_expression is not None:
            pulumi.set(__self__, "cel_expression", cel_expression)

    @property
    @pulumi.getter(name="allowSubjectAltNamesPassthrough")
    def allow_subject_alt_names_passthrough(self) -> bool:
        """
        If this is set, the SubjectAltNames extension may be copied from a certificate request into the signed certificate.
        Otherwise, the requested SubjectAltNames will be discarded.
        """
        return pulumi.get(self, "allow_subject_alt_names_passthrough")

    @property
    @pulumi.getter(name="allowSubjectPassthrough")
    def allow_subject_passthrough(self) -> bool:
        """
        If this is set, the Subject field may be copied from a certificate request into the signed certificate.
        Otherwise, the requested Subject will be discarded.
        """
        return pulumi.get(self, "allow_subject_passthrough")

    @property
    @pulumi.getter(name="celExpression")
    def cel_expression(self) -> Optional['outputs.CaPoolIssuancePolicyIdentityConstraintsCelExpression']:
        """
        A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a
        certificate is signed. To see the full allowed syntax and some examples,
        see https://cloud.google.com/certificate-authority-service/docs/cel-guide
        Structure is documented below.
        """
        return pulumi.get(self, "cel_expression")


@pulumi.output_type
class CaPoolIssuancePolicyIdentityConstraintsCelExpression(dict):
    def __init__(__self__, *,
                 expression: str,
                 description: Optional[str] = None,
                 location: Optional[str] = None,
                 title: Optional[str] = None):
        """
        :param str expression: Textual representation of an expression in Common Expression Language syntax.
        :param str description: Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        :param str location: String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
        :param str title: Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
        """
        pulumi.set(__self__, "expression", expression)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if location is not None:
            pulumi.set(__self__, "location", location)
        if title is not None:
            pulumi.set(__self__, "title", title)

    @property
    @pulumi.getter
    def expression(self) -> str:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def location(self) -> Optional[str]:
        """
        String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
        """
        return pulumi.get(self, "location")

    @property
    @pulumi.getter
    def title(self) -> Optional[str]:
        """
        Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
        """
        return pulumi.get(self, "title")


@pulumi.output_type
class CaPoolPublishingOptions(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "publishCaCert":
            suggest = "publish_ca_cert"
        elif key == "publishCrl":
            suggest = "publish_crl"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CaPoolPublishingOptions. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CaPoolPublishingOptions.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CaPoolPublishingOptions.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 publish_ca_cert: bool,
                 publish_crl: bool):
        """
        :param bool publish_ca_cert: When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access"
               X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding
               X.509 extension will not be written in issued certificates.
        :param bool publish_crl: When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension
               in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not
               be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are
               also rebuilt shortly after a certificate is revoked.
        """
        pulumi.set(__self__, "publish_ca_cert", publish_ca_cert)
        pulumi.set(__self__, "publish_crl", publish_crl)

    @property
    @pulumi.getter(name="publishCaCert")
    def publish_ca_cert(self) -> bool:
        """
        When true, publishes each CertificateAuthority's CA certificate and includes its URL in the "Authority Information Access"
        X.509 extension in all issued Certificates. If this is false, the CA certificate will not be published and the corresponding
        X.509 extension will not be written in issued certificates.
        """
        return pulumi.get(self, "publish_ca_cert")

    @property
    @pulumi.getter(name="publishCrl")
    def publish_crl(self) -> bool:
        """
        When true, publishes each CertificateAuthority's CRL and includes its URL in the "CRL Distribution Points" X.509 extension
        in all issued Certificates. If this is false, CRLs will not be published and the corresponding X.509 extension will not
        be written in issued certificates. CRLs will expire 7 days from their creation. However, we will rebuild daily. CRLs are
        also rebuilt shortly after a certificate is revoked.
        """
        return pulumi.get(self, "publish_crl")


@pulumi.output_type
class CertificateCertificateDescription(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "aiaIssuingCertificateUrls":
            suggest = "aia_issuing_certificate_urls"
        elif key == "authorityKeyIds":
            suggest = "authority_key_ids"
        elif key == "certFingerprints":
            suggest = "cert_fingerprints"
        elif key == "configValues":
            suggest = "config_values"
        elif key == "crlDistributionPoints":
            suggest = "crl_distribution_points"
        elif key == "publicKeys":
            suggest = "public_keys"
        elif key == "subjectDescriptions":
            suggest = "subject_descriptions"
        elif key == "subjectKeyIds":
            suggest = "subject_key_ids"
        elif key == "x509Descriptions":
            suggest = "x509_descriptions"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescription. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescription.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescription.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 aia_issuing_certificate_urls: Optional[Sequence[str]] = None,
                 authority_key_ids: Optional[Sequence['outputs.CertificateCertificateDescriptionAuthorityKeyId']] = None,
                 cert_fingerprints: Optional[Sequence['outputs.CertificateCertificateDescriptionCertFingerprint']] = None,
                 config_values: Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValue']] = None,
                 crl_distribution_points: Optional[Sequence[str]] = None,
                 public_keys: Optional[Sequence['outputs.CertificateCertificateDescriptionPublicKey']] = None,
                 subject_descriptions: Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescription']] = None,
                 subject_key_ids: Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectKeyId']] = None,
                 x509_descriptions: Optional[Sequence['outputs.CertificateCertificateDescriptionX509Description']] = None):
        """
        :param Sequence[str] aia_issuing_certificate_urls: Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
        :param Sequence['CertificateCertificateDescriptionAuthorityKeyIdArgs'] authority_key_ids: Identifies the subjectKeyId of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionCertFingerprintArgs'] cert_fingerprints: The hash of the x.509 certificate.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionConfigValueArgs'] config_values: (Deprecated)
               Describes some of the technical fields in a certificate.
               Structure is documented below.
        :param Sequence[str] crl_distribution_points: Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
        :param Sequence['CertificateCertificateDescriptionPublicKeyArgs'] public_keys: A PublicKey describes a public key.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionSubjectDescriptionArgs'] subject_descriptions: Describes some of the values in a certificate that are related to the subject and lifetime.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionSubjectKeyIdArgs'] subject_key_ids: Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionX509DescriptionArgs'] x509_descriptions: A structured description of the issued X.509 certificate.
               Structure is documented below.
        """
        if aia_issuing_certificate_urls is not None:
            pulumi.set(__self__, "aia_issuing_certificate_urls", aia_issuing_certificate_urls)
        if authority_key_ids is not None:
            pulumi.set(__self__, "authority_key_ids", authority_key_ids)
        if cert_fingerprints is not None:
            pulumi.set(__self__, "cert_fingerprints", cert_fingerprints)
        if config_values is not None:
            pulumi.set(__self__, "config_values", config_values)
        if crl_distribution_points is not None:
            pulumi.set(__self__, "crl_distribution_points", crl_distribution_points)
        if public_keys is not None:
            pulumi.set(__self__, "public_keys", public_keys)
        if subject_descriptions is not None:
            pulumi.set(__self__, "subject_descriptions", subject_descriptions)
        if subject_key_ids is not None:
            pulumi.set(__self__, "subject_key_ids", subject_key_ids)
        if x509_descriptions is not None:
            pulumi.set(__self__, "x509_descriptions", x509_descriptions)

    @property
    @pulumi.getter(name="aiaIssuingCertificateUrls")
    def aia_issuing_certificate_urls(self) -> Optional[Sequence[str]]:
        """
        Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.
        """
        return pulumi.get(self, "aia_issuing_certificate_urls")

    @property
    @pulumi.getter(name="authorityKeyIds")
    def authority_key_ids(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionAuthorityKeyId']]:
        """
        Identifies the subjectKeyId of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1
        Structure is documented below.
        """
        return pulumi.get(self, "authority_key_ids")

    @property
    @pulumi.getter(name="certFingerprints")
    def cert_fingerprints(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionCertFingerprint']]:
        """
        The hash of the x.509 certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "cert_fingerprints")

    @property
    @pulumi.getter(name="configValues")
    def config_values(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValue']]:
        """
        (Deprecated)
        Describes some of the technical fields in a certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "config_values")

    @property
    @pulumi.getter(name="crlDistributionPoints")
    def crl_distribution_points(self) -> Optional[Sequence[str]]:
        """
        Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13
        """
        return pulumi.get(self, "crl_distribution_points")

    @property
    @pulumi.getter(name="publicKeys")
    def public_keys(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionPublicKey']]:
        """
        A PublicKey describes a public key.
        Structure is documented below.
        """
        return pulumi.get(self, "public_keys")

    @property
    @pulumi.getter(name="subjectDescriptions")
    def subject_descriptions(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescription']]:
        """
        Describes some of the values in a certificate that are related to the subject and lifetime.
        Structure is documented below.
        """
        return pulumi.get(self, "subject_descriptions")

    @property
    @pulumi.getter(name="subjectKeyIds")
    def subject_key_ids(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectKeyId']]:
        """
        Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
        Structure is documented below.
        """
        return pulumi.get(self, "subject_key_ids")

    @property
    @pulumi.getter(name="x509Descriptions")
    def x509_descriptions(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509Description']]:
        """
        A structured description of the issued X.509 certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "x509_descriptions")


@pulumi.output_type
class CertificateCertificateDescriptionAuthorityKeyId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "keyId":
            suggest = "key_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionAuthorityKeyId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionAuthorityKeyId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionAuthorityKeyId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 key_id: Optional[str] = None):
        """
        :param str key_id: Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
        """
        if key_id is not None:
            pulumi.set(__self__, "key_id", key_id)

    @property
    @pulumi.getter(name="keyId")
    def key_id(self) -> Optional[str]:
        """
        Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
        """
        return pulumi.get(self, "key_id")


@pulumi.output_type
class CertificateCertificateDescriptionCertFingerprint(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "sha256Hash":
            suggest = "sha256_hash"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionCertFingerprint. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionCertFingerprint.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionCertFingerprint.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 sha256_hash: Optional[str] = None):
        """
        :param str sha256_hash: The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
        """
        if sha256_hash is not None:
            pulumi.set(__self__, "sha256_hash", sha256_hash)

    @property
    @pulumi.getter(name="sha256Hash")
    def sha256_hash(self) -> Optional[str]:
        """
        The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.
        """
        return pulumi.get(self, "sha256_hash")


@pulumi.output_type
class CertificateCertificateDescriptionConfigValue(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "keyUsages":
            suggest = "key_usages"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionConfigValue. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionConfigValue.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionConfigValue.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsage']] = None):
        """
        :param Sequence['CertificateCertificateDescriptionConfigValueKeyUsageArgs'] key_usages: Indicates the intended use for keys that correspond to a certificate.
               Structure is documented below.
        """
        if key_usages is not None:
            pulumi.set(__self__, "key_usages", key_usages)

    @property
    @pulumi.getter(name="keyUsages")
    def key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsage']]:
        """
        Indicates the intended use for keys that correspond to a certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "key_usages")


@pulumi.output_type
class CertificateCertificateDescriptionConfigValueKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "baseKeyUsages":
            suggest = "base_key_usages"
        elif key == "extendedKeyUsages":
            suggest = "extended_key_usages"
        elif key == "unknownExtendedKeyUsages":
            suggest = "unknown_extended_key_usages"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionConfigValueKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 base_key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsage']] = None,
                 extended_key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsage']] = None,
                 unknown_extended_key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsage']] = None):
        """
        :param Sequence['CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageArgs'] base_key_usages: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsageArgs'] extended_key_usages: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageArgs'] unknown_extended_key_usages: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               Structure is documented below.
        """
        if base_key_usages is not None:
            pulumi.set(__self__, "base_key_usages", base_key_usages)
        if extended_key_usages is not None:
            pulumi.set(__self__, "extended_key_usages", extended_key_usages)
        if unknown_extended_key_usages is not None:
            pulumi.set(__self__, "unknown_extended_key_usages", unknown_extended_key_usages)

    @property
    @pulumi.getter(name="baseKeyUsages")
    def base_key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsage']]:
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "base_key_usages")

    @property
    @pulumi.getter(name="extendedKeyUsages")
    def extended_key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsage']]:
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "extended_key_usages")

    @property
    @pulumi.getter(name="unknownExtendedKeyUsages")
    def unknown_extended_key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsage']]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        Structure is documented below.
        """
        return pulumi.get(self, "unknown_extended_key_usages")


@pulumi.output_type
class CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "keyUsageOptions":
            suggest = "key_usage_options"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 key_usage_options: Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOption']] = None):
        """
        :param Sequence['CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOptionArgs'] key_usage_options: Describes high-level ways in which a key may be used.
               Structure is documented below.
        """
        if key_usage_options is not None:
            pulumi.set(__self__, "key_usage_options", key_usage_options)

    @property
    @pulumi.getter(name="keyUsageOptions")
    def key_usage_options(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOption']]:
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "key_usage_options")


@pulumi.output_type
class CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOption(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certSign":
            suggest = "cert_sign"
        elif key == "contentCommitment":
            suggest = "content_commitment"
        elif key == "crlSign":
            suggest = "crl_sign"
        elif key == "dataEncipherment":
            suggest = "data_encipherment"
        elif key == "decipherOnly":
            suggest = "decipher_only"
        elif key == "digitalSignature":
            suggest = "digital_signature"
        elif key == "encipherOnly":
            suggest = "encipher_only"
        elif key == "keyAgreement":
            suggest = "key_agreement"
        elif key == "keyEncipherment":
            suggest = "key_encipherment"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOption. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOption.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageBaseKeyUsageKeyUsageOption.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 cert_sign: Optional[bool] = None,
                 content_commitment: Optional[bool] = None,
                 crl_sign: Optional[bool] = None,
                 data_encipherment: Optional[bool] = None,
                 decipher_only: Optional[bool] = None,
                 digital_signature: Optional[bool] = None,
                 encipher_only: Optional[bool] = None,
                 key_agreement: Optional[bool] = None,
                 key_encipherment: Optional[bool] = None):
        """
        :param bool cert_sign: The key may be used to sign certificates.
        :param bool content_commitment: The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        :param bool crl_sign: The key may be used sign certificate revocation lists.
        :param bool data_encipherment: The key may be used to encipher data.
        :param bool decipher_only: The key may be used to decipher only.
        :param bool digital_signature: The key may be used for digital signatures.
        :param bool encipher_only: The key may be used to encipher only.
        :param bool key_agreement: The key may be used in a key agreement protocol.
        :param bool key_encipherment: The key may be used to encipher other keys.
        """
        if cert_sign is not None:
            pulumi.set(__self__, "cert_sign", cert_sign)
        if content_commitment is not None:
            pulumi.set(__self__, "content_commitment", content_commitment)
        if crl_sign is not None:
            pulumi.set(__self__, "crl_sign", crl_sign)
        if data_encipherment is not None:
            pulumi.set(__self__, "data_encipherment", data_encipherment)
        if decipher_only is not None:
            pulumi.set(__self__, "decipher_only", decipher_only)
        if digital_signature is not None:
            pulumi.set(__self__, "digital_signature", digital_signature)
        if encipher_only is not None:
            pulumi.set(__self__, "encipher_only", encipher_only)
        if key_agreement is not None:
            pulumi.set(__self__, "key_agreement", key_agreement)
        if key_encipherment is not None:
            pulumi.set(__self__, "key_encipherment", key_encipherment)

    @property
    @pulumi.getter(name="certSign")
    def cert_sign(self) -> Optional[bool]:
        """
        The key may be used to sign certificates.
        """
        return pulumi.get(self, "cert_sign")

    @property
    @pulumi.getter(name="contentCommitment")
    def content_commitment(self) -> Optional[bool]:
        """
        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        """
        return pulumi.get(self, "content_commitment")

    @property
    @pulumi.getter(name="crlSign")
    def crl_sign(self) -> Optional[bool]:
        """
        The key may be used sign certificate revocation lists.
        """
        return pulumi.get(self, "crl_sign")

    @property
    @pulumi.getter(name="dataEncipherment")
    def data_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher data.
        """
        return pulumi.get(self, "data_encipherment")

    @property
    @pulumi.getter(name="decipherOnly")
    def decipher_only(self) -> Optional[bool]:
        """
        The key may be used to decipher only.
        """
        return pulumi.get(self, "decipher_only")

    @property
    @pulumi.getter(name="digitalSignature")
    def digital_signature(self) -> Optional[bool]:
        """
        The key may be used for digital signatures.
        """
        return pulumi.get(self, "digital_signature")

    @property
    @pulumi.getter(name="encipherOnly")
    def encipher_only(self) -> Optional[bool]:
        """
        The key may be used to encipher only.
        """
        return pulumi.get(self, "encipher_only")

    @property
    @pulumi.getter(name="keyAgreement")
    def key_agreement(self) -> Optional[bool]:
        """
        The key may be used in a key agreement protocol.
        """
        return pulumi.get(self, "key_agreement")

    @property
    @pulumi.getter(name="keyEncipherment")
    def key_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher other keys.
        """
        return pulumi.get(self, "key_encipherment")


@pulumi.output_type
class CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "clientAuth":
            suggest = "client_auth"
        elif key == "codeSigning":
            suggest = "code_signing"
        elif key == "emailProtection":
            suggest = "email_protection"
        elif key == "ocspSigning":
            suggest = "ocsp_signing"
        elif key == "serverAuth":
            suggest = "server_auth"
        elif key == "timeStamping":
            suggest = "time_stamping"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 client_auth: Optional[bool] = None,
                 code_signing: Optional[bool] = None,
                 email_protection: Optional[bool] = None,
                 ocsp_signing: Optional[bool] = None,
                 server_auth: Optional[bool] = None,
                 time_stamping: Optional[bool] = None):
        """
        :param bool client_auth: Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        :param bool code_signing: Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        :param bool email_protection: Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        :param bool ocsp_signing: Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        :param bool server_auth: Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        :param bool time_stamping: Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        if client_auth is not None:
            pulumi.set(__self__, "client_auth", client_auth)
        if code_signing is not None:
            pulumi.set(__self__, "code_signing", code_signing)
        if email_protection is not None:
            pulumi.set(__self__, "email_protection", email_protection)
        if ocsp_signing is not None:
            pulumi.set(__self__, "ocsp_signing", ocsp_signing)
        if server_auth is not None:
            pulumi.set(__self__, "server_auth", server_auth)
        if time_stamping is not None:
            pulumi.set(__self__, "time_stamping", time_stamping)

    @property
    @pulumi.getter(name="clientAuth")
    def client_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "client_auth")

    @property
    @pulumi.getter(name="codeSigning")
    def code_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        """
        return pulumi.get(self, "code_signing")

    @property
    @pulumi.getter(name="emailProtection")
    def email_protection(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        """
        return pulumi.get(self, "email_protection")

    @property
    @pulumi.getter(name="ocspSigning")
    def ocsp_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        """
        return pulumi.get(self, "ocsp_signing")

    @property
    @pulumi.getter(name="serverAuth")
    def server_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "server_auth")

    @property
    @pulumi.getter(name="timeStamping")
    def time_stamping(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        return pulumi.get(self, "time_stamping")


@pulumi.output_type
class CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "obectIds":
            suggest = "obect_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 obect_ids: Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectId']] = None):
        """
        :param Sequence['CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectIdArgs'] obect_ids: Required. Describes how some of the technical fields in a certificate should be populated.
               Structure is documented below.
        """
        if obect_ids is not None:
            pulumi.set(__self__, "obect_ids", obect_ids)

    @property
    @pulumi.getter(name="obectIds")
    def obect_ids(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectId']]:
        """
        Required. Describes how some of the technical fields in a certificate should be populated.
        Structure is documented below.
        """
        return pulumi.get(self, "obect_ids")


@pulumi.output_type
class CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionConfigValueKeyUsageUnknownExtendedKeyUsageObectId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Optional[Sequence[int]] = None):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               (Required)
               An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               (Required)
               An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        if object_id_paths is not None:
            pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Optional[Sequence[int]]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        (Required)
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        (Required)
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateCertificateDescriptionPublicKey(dict):
    def __init__(__self__, *,
                 format: Optional[str] = None,
                 key: Optional[str] = None):
        """
        :param str format: The format of the public key. Currently, only PEM format is supported.
               Possible values are `KEY_TYPE_UNSPECIFIED` and `PEM`.
        :param str key: Required. A public key. When this is specified in a request, the padding and encoding can be any of the options described by the respective 'KeyType' value. When this is generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key. A base64-encoded string.
        """
        if format is not None:
            pulumi.set(__self__, "format", format)
        if key is not None:
            pulumi.set(__self__, "key", key)

    @property
    @pulumi.getter
    def format(self) -> Optional[str]:
        """
        The format of the public key. Currently, only PEM format is supported.
        Possible values are `KEY_TYPE_UNSPECIFIED` and `PEM`.
        """
        return pulumi.get(self, "format")

    @property
    @pulumi.getter
    def key(self) -> Optional[str]:
        """
        Required. A public key. When this is specified in a request, the padding and encoding can be any of the options described by the respective 'KeyType' value. When this is generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key. A base64-encoded string.
        """
        return pulumi.get(self, "key")


@pulumi.output_type
class CertificateCertificateDescriptionSubjectDescription(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "hexSerialNumber":
            suggest = "hex_serial_number"
        elif key == "notAfterTime":
            suggest = "not_after_time"
        elif key == "notBeforeTime":
            suggest = "not_before_time"
        elif key == "subjectAltNames":
            suggest = "subject_alt_names"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionSubjectDescription. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionSubjectDescription.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionSubjectDescription.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 hex_serial_number: Optional[str] = None,
                 lifetime: Optional[str] = None,
                 not_after_time: Optional[str] = None,
                 not_before_time: Optional[str] = None,
                 subject_alt_names: Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubjectAltName']] = None,
                 subjects: Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubject']] = None):
        """
        :param str hex_serial_number: The serial number encoded in lowercase hexadecimal.
        :param str lifetime: The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
               "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
               fractional digits, terminated by 's'. Example: "3.5s".
        :param str not_after_time: The time at which the certificate expires.
        :param str not_before_time: The time at which the certificate becomes valid.
        :param Sequence['CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameArgs'] subject_alt_names: The subject alternative name fields.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionSubjectDescriptionSubjectArgs'] subjects: Contains distinguished name fields such as the location and organization.
               Structure is documented below.
        """
        if hex_serial_number is not None:
            pulumi.set(__self__, "hex_serial_number", hex_serial_number)
        if lifetime is not None:
            pulumi.set(__self__, "lifetime", lifetime)
        if not_after_time is not None:
            pulumi.set(__self__, "not_after_time", not_after_time)
        if not_before_time is not None:
            pulumi.set(__self__, "not_before_time", not_before_time)
        if subject_alt_names is not None:
            pulumi.set(__self__, "subject_alt_names", subject_alt_names)
        if subjects is not None:
            pulumi.set(__self__, "subjects", subjects)

    @property
    @pulumi.getter(name="hexSerialNumber")
    def hex_serial_number(self) -> Optional[str]:
        """
        The serial number encoded in lowercase hexadecimal.
        """
        return pulumi.get(self, "hex_serial_number")

    @property
    @pulumi.getter
    def lifetime(self) -> Optional[str]:
        """
        The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
        "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
        fractional digits, terminated by 's'. Example: "3.5s".
        """
        return pulumi.get(self, "lifetime")

    @property
    @pulumi.getter(name="notAfterTime")
    def not_after_time(self) -> Optional[str]:
        """
        The time at which the certificate expires.
        """
        return pulumi.get(self, "not_after_time")

    @property
    @pulumi.getter(name="notBeforeTime")
    def not_before_time(self) -> Optional[str]:
        """
        The time at which the certificate becomes valid.
        """
        return pulumi.get(self, "not_before_time")

    @property
    @pulumi.getter(name="subjectAltNames")
    def subject_alt_names(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubjectAltName']]:
        """
        The subject alternative name fields.
        Structure is documented below.
        """
        return pulumi.get(self, "subject_alt_names")

    @property
    @pulumi.getter
    def subjects(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubject']]:
        """
        Contains distinguished name fields such as the location and organization.
        Structure is documented below.
        """
        return pulumi.get(self, "subjects")


@pulumi.output_type
class CertificateCertificateDescriptionSubjectDescriptionSubject(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "commonName":
            suggest = "common_name"
        elif key == "countryCode":
            suggest = "country_code"
        elif key == "organizationalUnit":
            suggest = "organizational_unit"
        elif key == "postalCode":
            suggest = "postal_code"
        elif key == "streetAddress":
            suggest = "street_address"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionSubjectDescriptionSubject. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubject.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubject.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 common_name: Optional[str] = None,
                 country_code: Optional[str] = None,
                 locality: Optional[str] = None,
                 organization: Optional[str] = None,
                 organizational_unit: Optional[str] = None,
                 postal_code: Optional[str] = None,
                 province: Optional[str] = None,
                 street_address: Optional[str] = None):
        """
        :param str common_name: The common name of the distinguished name.
        :param str country_code: The country code of the subject.
        :param str locality: The locality or city of the subject.
        :param str organization: The organization of the subject.
        :param str organizational_unit: The organizational unit of the subject.
        :param str postal_code: The postal code of the subject.
        :param str province: The province, territory, or regional state of the subject.
        :param str street_address: The street address of the subject.
        """
        if common_name is not None:
            pulumi.set(__self__, "common_name", common_name)
        if country_code is not None:
            pulumi.set(__self__, "country_code", country_code)
        if locality is not None:
            pulumi.set(__self__, "locality", locality)
        if organization is not None:
            pulumi.set(__self__, "organization", organization)
        if organizational_unit is not None:
            pulumi.set(__self__, "organizational_unit", organizational_unit)
        if postal_code is not None:
            pulumi.set(__self__, "postal_code", postal_code)
        if province is not None:
            pulumi.set(__self__, "province", province)
        if street_address is not None:
            pulumi.set(__self__, "street_address", street_address)

    @property
    @pulumi.getter(name="commonName")
    def common_name(self) -> Optional[str]:
        """
        The common name of the distinguished name.
        """
        return pulumi.get(self, "common_name")

    @property
    @pulumi.getter(name="countryCode")
    def country_code(self) -> Optional[str]:
        """
        The country code of the subject.
        """
        return pulumi.get(self, "country_code")

    @property
    @pulumi.getter
    def locality(self) -> Optional[str]:
        """
        The locality or city of the subject.
        """
        return pulumi.get(self, "locality")

    @property
    @pulumi.getter
    def organization(self) -> Optional[str]:
        """
        The organization of the subject.
        """
        return pulumi.get(self, "organization")

    @property
    @pulumi.getter(name="organizationalUnit")
    def organizational_unit(self) -> Optional[str]:
        """
        The organizational unit of the subject.
        """
        return pulumi.get(self, "organizational_unit")

    @property
    @pulumi.getter(name="postalCode")
    def postal_code(self) -> Optional[str]:
        """
        The postal code of the subject.
        """
        return pulumi.get(self, "postal_code")

    @property
    @pulumi.getter
    def province(self) -> Optional[str]:
        """
        The province, territory, or regional state of the subject.
        """
        return pulumi.get(self, "province")

    @property
    @pulumi.getter(name="streetAddress")
    def street_address(self) -> Optional[str]:
        """
        The street address of the subject.
        """
        return pulumi.get(self, "street_address")


@pulumi.output_type
class CertificateCertificateDescriptionSubjectDescriptionSubjectAltName(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "customSans":
            suggest = "custom_sans"
        elif key == "dnsNames":
            suggest = "dns_names"
        elif key == "emailAddresses":
            suggest = "email_addresses"
        elif key == "ipAddresses":
            suggest = "ip_addresses"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionSubjectDescriptionSubjectAltName. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubjectAltName.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubjectAltName.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 custom_sans: Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan']] = None,
                 dns_names: Optional[Sequence[str]] = None,
                 email_addresses: Optional[Sequence[str]] = None,
                 ip_addresses: Optional[Sequence[str]] = None,
                 uris: Optional[Sequence[str]] = None):
        """
        :param Sequence['CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanArgs'] custom_sans: Contains additional subject alternative name values.
               Structure is documented below.
        :param Sequence[str] dns_names: Contains only valid, fully-qualified host names.
        :param Sequence[str] email_addresses: Contains only valid RFC 2822 E-mail addresses.
        :param Sequence[str] ip_addresses: Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
        :param Sequence[str] uris: Contains only valid RFC 3986 URIs.
        """
        if custom_sans is not None:
            pulumi.set(__self__, "custom_sans", custom_sans)
        if dns_names is not None:
            pulumi.set(__self__, "dns_names", dns_names)
        if email_addresses is not None:
            pulumi.set(__self__, "email_addresses", email_addresses)
        if ip_addresses is not None:
            pulumi.set(__self__, "ip_addresses", ip_addresses)
        if uris is not None:
            pulumi.set(__self__, "uris", uris)

    @property
    @pulumi.getter(name="customSans")
    def custom_sans(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan']]:
        """
        Contains additional subject alternative name values.
        Structure is documented below.
        """
        return pulumi.get(self, "custom_sans")

    @property
    @pulumi.getter(name="dnsNames")
    def dns_names(self) -> Optional[Sequence[str]]:
        """
        Contains only valid, fully-qualified host names.
        """
        return pulumi.get(self, "dns_names")

    @property
    @pulumi.getter(name="emailAddresses")
    def email_addresses(self) -> Optional[Sequence[str]]:
        """
        Contains only valid RFC 2822 E-mail addresses.
        """
        return pulumi.get(self, "email_addresses")

    @property
    @pulumi.getter(name="ipAddresses")
    def ip_addresses(self) -> Optional[Sequence[str]]:
        """
        Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
        """
        return pulumi.get(self, "ip_addresses")

    @property
    @pulumi.getter
    def uris(self) -> Optional[Sequence[str]]:
        """
        Contains only valid RFC 3986 URIs.
        """
        return pulumi.get(self, "uris")


@pulumi.output_type
class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "obectIds":
            suggest = "obect_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSan.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 critical: Optional[bool] = None,
                 obect_ids: Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectId']] = None,
                 value: Optional[str] = None):
        """
        :param bool critical: Indicates whether or not this extension is critical (i.e., if the client does not know how to
               handle this extension, the client should consider this to be an error).
        :param Sequence['CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectIdArgs'] obect_ids: Required. Describes how some of the technical fields in a certificate should be populated.
               Structure is documented below.
        :param str value: The value of this X.509 extension. A base64-encoded string.
        """
        if critical is not None:
            pulumi.set(__self__, "critical", critical)
        if obect_ids is not None:
            pulumi.set(__self__, "obect_ids", obect_ids)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def critical(self) -> Optional[bool]:
        """
        Indicates whether or not this extension is critical (i.e., if the client does not know how to
        handle this extension, the client should consider this to be an error).
        """
        return pulumi.get(self, "critical")

    @property
    @pulumi.getter(name="obectIds")
    def obect_ids(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectId']]:
        """
        Required. Describes how some of the technical fields in a certificate should be populated.
        Structure is documented below.
        """
        return pulumi.get(self, "obect_ids")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value of this X.509 extension. A base64-encoded string.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionSubjectDescriptionSubjectAltNameCustomSanObectId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Optional[Sequence[int]] = None):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               (Required)
               An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               (Required)
               An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        if object_id_paths is not None:
            pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Optional[Sequence[int]]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        (Required)
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        (Required)
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateCertificateDescriptionSubjectKeyId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "keyId":
            suggest = "key_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionSubjectKeyId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionSubjectKeyId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionSubjectKeyId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 key_id: Optional[str] = None):
        """
        :param str key_id: Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
        """
        if key_id is not None:
            pulumi.set(__self__, "key_id", key_id)

    @property
    @pulumi.getter(name="keyId")
    def key_id(self) -> Optional[str]:
        """
        Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.
        """
        return pulumi.get(self, "key_id")


@pulumi.output_type
class CertificateCertificateDescriptionX509Description(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "additionalExtensions":
            suggest = "additional_extensions"
        elif key == "aiaOcspServers":
            suggest = "aia_ocsp_servers"
        elif key == "caOptions":
            suggest = "ca_options"
        elif key == "keyUsages":
            suggest = "key_usages"
        elif key == "policyIds":
            suggest = "policy_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509Description. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509Description.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509Description.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 additional_extensions: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionAdditionalExtension']] = None,
                 aia_ocsp_servers: Optional[Sequence[str]] = None,
                 ca_options: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionCaOption']] = None,
                 key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsage']] = None,
                 policy_ids: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionPolicyId']] = None):
        """
        :param Sequence['CertificateCertificateDescriptionX509DescriptionAdditionalExtensionArgs'] additional_extensions: Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
               Structure is documented below.
        :param Sequence[str] aia_ocsp_servers: Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
               "Authority Information Access" extension in the certificate.
        :param Sequence['CertificateCertificateDescriptionX509DescriptionCaOptionArgs'] ca_options: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionX509DescriptionKeyUsageArgs'] key_usages: Indicates the intended use for keys that correspond to a certificate.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionX509DescriptionPolicyIdArgs'] policy_ids: Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
               Structure is documented below.
        """
        if additional_extensions is not None:
            pulumi.set(__self__, "additional_extensions", additional_extensions)
        if aia_ocsp_servers is not None:
            pulumi.set(__self__, "aia_ocsp_servers", aia_ocsp_servers)
        if ca_options is not None:
            pulumi.set(__self__, "ca_options", ca_options)
        if key_usages is not None:
            pulumi.set(__self__, "key_usages", key_usages)
        if policy_ids is not None:
            pulumi.set(__self__, "policy_ids", policy_ids)

    @property
    @pulumi.getter(name="additionalExtensions")
    def additional_extensions(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionAdditionalExtension']]:
        """
        Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
        Structure is documented below.
        """
        return pulumi.get(self, "additional_extensions")

    @property
    @pulumi.getter(name="aiaOcspServers")
    def aia_ocsp_servers(self) -> Optional[Sequence[str]]:
        """
        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
        "Authority Information Access" extension in the certificate.
        """
        return pulumi.get(self, "aia_ocsp_servers")

    @property
    @pulumi.getter(name="caOptions")
    def ca_options(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionCaOption']]:
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "ca_options")

    @property
    @pulumi.getter(name="keyUsages")
    def key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsage']]:
        """
        Indicates the intended use for keys that correspond to a certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "key_usages")

    @property
    @pulumi.getter(name="policyIds")
    def policy_ids(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionPolicyId']]:
        """
        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
        Structure is documented below.
        """
        return pulumi.get(self, "policy_ids")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionAdditionalExtension(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIds":
            suggest = "object_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionAdditionalExtension. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionAdditionalExtension.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionAdditionalExtension.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 critical: Optional[bool] = None,
                 object_ids: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectId']] = None,
                 value: Optional[str] = None):
        """
        :param bool critical: Indicates whether or not this extension is critical (i.e., if the client does not know how to
               handle this extension, the client should consider this to be an error).
        :param Sequence['CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectIdArgs'] object_ids: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param str value: The value of this X.509 extension. A base64-encoded string.
        """
        if critical is not None:
            pulumi.set(__self__, "critical", critical)
        if object_ids is not None:
            pulumi.set(__self__, "object_ids", object_ids)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def critical(self) -> Optional[bool]:
        """
        Indicates whether or not this extension is critical (i.e., if the client does not know how to
        handle this extension, the client should consider this to be an error).
        """
        return pulumi.get(self, "critical")

    @property
    @pulumi.getter(name="objectIds")
    def object_ids(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectId']]:
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "object_ids")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value of this X.509 extension. A base64-encoded string.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionAdditionalExtensionObjectId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Optional[Sequence[int]] = None):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        if object_id_paths is not None:
            pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Optional[Sequence[int]]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionCaOption(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "isCa":
            suggest = "is_ca"
        elif key == "maxIssuerPathLength":
            suggest = "max_issuer_path_length"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionCaOption. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionCaOption.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionCaOption.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 is_ca: Optional[bool] = None,
                 max_issuer_path_length: Optional[int] = None):
        """
        :param bool is_ca: When true, the "CA" in Basic Constraints extension will be set to true.
        :param int max_issuer_path_length: Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
               subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
        """
        if is_ca is not None:
            pulumi.set(__self__, "is_ca", is_ca)
        if max_issuer_path_length is not None:
            pulumi.set(__self__, "max_issuer_path_length", max_issuer_path_length)

    @property
    @pulumi.getter(name="isCa")
    def is_ca(self) -> Optional[bool]:
        """
        When true, the "CA" in Basic Constraints extension will be set to true.
        """
        return pulumi.get(self, "is_ca")

    @property
    @pulumi.getter(name="maxIssuerPathLength")
    def max_issuer_path_length(self) -> Optional[int]:
        """
        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
        """
        return pulumi.get(self, "max_issuer_path_length")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "baseKeyUsages":
            suggest = "base_key_usages"
        elif key == "extendedKeyUsages":
            suggest = "extended_key_usages"
        elif key == "unknownExtendedKeyUsages":
            suggest = "unknown_extended_key_usages"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 base_key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsage']] = None,
                 extended_key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsage']] = None,
                 unknown_extended_key_usages: Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsage']] = None):
        """
        :param Sequence['CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsageArgs'] base_key_usages: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsageArgs'] extended_key_usages: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param Sequence['CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsageArgs'] unknown_extended_key_usages: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               Structure is documented below.
        """
        if base_key_usages is not None:
            pulumi.set(__self__, "base_key_usages", base_key_usages)
        if extended_key_usages is not None:
            pulumi.set(__self__, "extended_key_usages", extended_key_usages)
        if unknown_extended_key_usages is not None:
            pulumi.set(__self__, "unknown_extended_key_usages", unknown_extended_key_usages)

    @property
    @pulumi.getter(name="baseKeyUsages")
    def base_key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsage']]:
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "base_key_usages")

    @property
    @pulumi.getter(name="extendedKeyUsages")
    def extended_key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsage']]:
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "extended_key_usages")

    @property
    @pulumi.getter(name="unknownExtendedKeyUsages")
    def unknown_extended_key_usages(self) -> Optional[Sequence['outputs.CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsage']]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        Structure is documented below.
        """
        return pulumi.get(self, "unknown_extended_key_usages")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certSign":
            suggest = "cert_sign"
        elif key == "contentCommitment":
            suggest = "content_commitment"
        elif key == "crlSign":
            suggest = "crl_sign"
        elif key == "dataEncipherment":
            suggest = "data_encipherment"
        elif key == "decipherOnly":
            suggest = "decipher_only"
        elif key == "digitalSignature":
            suggest = "digital_signature"
        elif key == "encipherOnly":
            suggest = "encipher_only"
        elif key == "keyAgreement":
            suggest = "key_agreement"
        elif key == "keyEncipherment":
            suggest = "key_encipherment"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsageBaseKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 cert_sign: Optional[bool] = None,
                 content_commitment: Optional[bool] = None,
                 crl_sign: Optional[bool] = None,
                 data_encipherment: Optional[bool] = None,
                 decipher_only: Optional[bool] = None,
                 digital_signature: Optional[bool] = None,
                 encipher_only: Optional[bool] = None,
                 key_agreement: Optional[bool] = None,
                 key_encipherment: Optional[bool] = None):
        """
        :param bool cert_sign: The key may be used to sign certificates.
        :param bool content_commitment: The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        :param bool crl_sign: The key may be used sign certificate revocation lists.
        :param bool data_encipherment: The key may be used to encipher data.
        :param bool decipher_only: The key may be used to decipher only.
        :param bool digital_signature: The key may be used for digital signatures.
        :param bool encipher_only: The key may be used to encipher only.
        :param bool key_agreement: The key may be used in a key agreement protocol.
        :param bool key_encipherment: The key may be used to encipher other keys.
        """
        if cert_sign is not None:
            pulumi.set(__self__, "cert_sign", cert_sign)
        if content_commitment is not None:
            pulumi.set(__self__, "content_commitment", content_commitment)
        if crl_sign is not None:
            pulumi.set(__self__, "crl_sign", crl_sign)
        if data_encipherment is not None:
            pulumi.set(__self__, "data_encipherment", data_encipherment)
        if decipher_only is not None:
            pulumi.set(__self__, "decipher_only", decipher_only)
        if digital_signature is not None:
            pulumi.set(__self__, "digital_signature", digital_signature)
        if encipher_only is not None:
            pulumi.set(__self__, "encipher_only", encipher_only)
        if key_agreement is not None:
            pulumi.set(__self__, "key_agreement", key_agreement)
        if key_encipherment is not None:
            pulumi.set(__self__, "key_encipherment", key_encipherment)

    @property
    @pulumi.getter(name="certSign")
    def cert_sign(self) -> Optional[bool]:
        """
        The key may be used to sign certificates.
        """
        return pulumi.get(self, "cert_sign")

    @property
    @pulumi.getter(name="contentCommitment")
    def content_commitment(self) -> Optional[bool]:
        """
        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        """
        return pulumi.get(self, "content_commitment")

    @property
    @pulumi.getter(name="crlSign")
    def crl_sign(self) -> Optional[bool]:
        """
        The key may be used sign certificate revocation lists.
        """
        return pulumi.get(self, "crl_sign")

    @property
    @pulumi.getter(name="dataEncipherment")
    def data_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher data.
        """
        return pulumi.get(self, "data_encipherment")

    @property
    @pulumi.getter(name="decipherOnly")
    def decipher_only(self) -> Optional[bool]:
        """
        The key may be used to decipher only.
        """
        return pulumi.get(self, "decipher_only")

    @property
    @pulumi.getter(name="digitalSignature")
    def digital_signature(self) -> Optional[bool]:
        """
        The key may be used for digital signatures.
        """
        return pulumi.get(self, "digital_signature")

    @property
    @pulumi.getter(name="encipherOnly")
    def encipher_only(self) -> Optional[bool]:
        """
        The key may be used to encipher only.
        """
        return pulumi.get(self, "encipher_only")

    @property
    @pulumi.getter(name="keyAgreement")
    def key_agreement(self) -> Optional[bool]:
        """
        The key may be used in a key agreement protocol.
        """
        return pulumi.get(self, "key_agreement")

    @property
    @pulumi.getter(name="keyEncipherment")
    def key_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher other keys.
        """
        return pulumi.get(self, "key_encipherment")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "clientAuth":
            suggest = "client_auth"
        elif key == "codeSigning":
            suggest = "code_signing"
        elif key == "emailProtection":
            suggest = "email_protection"
        elif key == "ocspSigning":
            suggest = "ocsp_signing"
        elif key == "serverAuth":
            suggest = "server_auth"
        elif key == "timeStamping":
            suggest = "time_stamping"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 client_auth: Optional[bool] = None,
                 code_signing: Optional[bool] = None,
                 email_protection: Optional[bool] = None,
                 ocsp_signing: Optional[bool] = None,
                 server_auth: Optional[bool] = None,
                 time_stamping: Optional[bool] = None):
        """
        :param bool client_auth: Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        :param bool code_signing: Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        :param bool email_protection: Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        :param bool ocsp_signing: Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        :param bool server_auth: Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        :param bool time_stamping: Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        if client_auth is not None:
            pulumi.set(__self__, "client_auth", client_auth)
        if code_signing is not None:
            pulumi.set(__self__, "code_signing", code_signing)
        if email_protection is not None:
            pulumi.set(__self__, "email_protection", email_protection)
        if ocsp_signing is not None:
            pulumi.set(__self__, "ocsp_signing", ocsp_signing)
        if server_auth is not None:
            pulumi.set(__self__, "server_auth", server_auth)
        if time_stamping is not None:
            pulumi.set(__self__, "time_stamping", time_stamping)

    @property
    @pulumi.getter(name="clientAuth")
    def client_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "client_auth")

    @property
    @pulumi.getter(name="codeSigning")
    def code_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        """
        return pulumi.get(self, "code_signing")

    @property
    @pulumi.getter(name="emailProtection")
    def email_protection(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        """
        return pulumi.get(self, "email_protection")

    @property
    @pulumi.getter(name="ocspSigning")
    def ocsp_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        """
        return pulumi.get(self, "ocsp_signing")

    @property
    @pulumi.getter(name="serverAuth")
    def server_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "server_auth")

    @property
    @pulumi.getter(name="timeStamping")
    def time_stamping(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        return pulumi.get(self, "time_stamping")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Optional[Sequence[int]] = None):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        if object_id_paths is not None:
            pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Optional[Sequence[int]]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateCertificateDescriptionX509DescriptionPolicyId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateCertificateDescriptionX509DescriptionPolicyId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateCertificateDescriptionX509DescriptionPolicyId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateCertificateDescriptionX509DescriptionPolicyId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Optional[Sequence[int]] = None):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        if object_id_paths is not None:
            pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Optional[Sequence[int]]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateConfig(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "publicKey":
            suggest = "public_key"
        elif key == "subjectConfig":
            suggest = "subject_config"
        elif key == "x509Config":
            suggest = "x509_config"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfig. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfig.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfig.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 public_key: 'outputs.CertificateConfigPublicKey',
                 subject_config: 'outputs.CertificateConfigSubjectConfig',
                 x509_config: 'outputs.CertificateConfigX509Config'):
        """
        :param 'CertificateConfigPublicKeyArgs' public_key: A PublicKey describes a public key.
               Structure is documented below.
        :param 'CertificateConfigSubjectConfigArgs' subject_config: Specifies some of the values in a certificate that are related to the subject.
               Structure is documented below.
        :param 'CertificateConfigX509ConfigArgs' x509_config: Describes how some of the technical X.509 fields in a certificate should be populated.
               Structure is documented below.
        """
        pulumi.set(__self__, "public_key", public_key)
        pulumi.set(__self__, "subject_config", subject_config)
        pulumi.set(__self__, "x509_config", x509_config)

    @property
    @pulumi.getter(name="publicKey")
    def public_key(self) -> 'outputs.CertificateConfigPublicKey':
        """
        A PublicKey describes a public key.
        Structure is documented below.
        """
        return pulumi.get(self, "public_key")

    @property
    @pulumi.getter(name="subjectConfig")
    def subject_config(self) -> 'outputs.CertificateConfigSubjectConfig':
        """
        Specifies some of the values in a certificate that are related to the subject.
        Structure is documented below.
        """
        return pulumi.get(self, "subject_config")

    @property
    @pulumi.getter(name="x509Config")
    def x509_config(self) -> 'outputs.CertificateConfigX509Config':
        """
        Describes how some of the technical X.509 fields in a certificate should be populated.
        Structure is documented below.
        """
        return pulumi.get(self, "x509_config")


@pulumi.output_type
class CertificateConfigPublicKey(dict):
    def __init__(__self__, *,
                 format: str,
                 key: Optional[str] = None):
        """
        :param str format: The format of the public key. Currently, only PEM format is supported.
               Possible values are `KEY_TYPE_UNSPECIFIED` and `PEM`.
        :param str key: Required. A public key. When this is specified in a request, the padding and encoding can be any of the options described by the respective 'KeyType' value. When this is generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key. A base64-encoded string.
        """
        pulumi.set(__self__, "format", format)
        if key is not None:
            pulumi.set(__self__, "key", key)

    @property
    @pulumi.getter
    def format(self) -> str:
        """
        The format of the public key. Currently, only PEM format is supported.
        Possible values are `KEY_TYPE_UNSPECIFIED` and `PEM`.
        """
        return pulumi.get(self, "format")

    @property
    @pulumi.getter
    def key(self) -> Optional[str]:
        """
        Required. A public key. When this is specified in a request, the padding and encoding can be any of the options described by the respective 'KeyType' value. When this is generated by the service, it will always be an RFC 5280 SubjectPublicKeyInfo structure containing an algorithm identifier and a key. A base64-encoded string.
        """
        return pulumi.get(self, "key")


@pulumi.output_type
class CertificateConfigSubjectConfig(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "subjectAltName":
            suggest = "subject_alt_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigSubjectConfig. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigSubjectConfig.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigSubjectConfig.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 subject: 'outputs.CertificateConfigSubjectConfigSubject',
                 subject_alt_name: Optional['outputs.CertificateConfigSubjectConfigSubjectAltName'] = None):
        """
        :param 'CertificateConfigSubjectConfigSubjectArgs' subject: Contains distinguished name fields such as the location and organization.
               Structure is documented below.
        :param 'CertificateConfigSubjectConfigSubjectAltNameArgs' subject_alt_name: The subject alternative name fields.
               Structure is documented below.
        """
        pulumi.set(__self__, "subject", subject)
        if subject_alt_name is not None:
            pulumi.set(__self__, "subject_alt_name", subject_alt_name)

    @property
    @pulumi.getter
    def subject(self) -> 'outputs.CertificateConfigSubjectConfigSubject':
        """
        Contains distinguished name fields such as the location and organization.
        Structure is documented below.
        """
        return pulumi.get(self, "subject")

    @property
    @pulumi.getter(name="subjectAltName")
    def subject_alt_name(self) -> Optional['outputs.CertificateConfigSubjectConfigSubjectAltName']:
        """
        The subject alternative name fields.
        Structure is documented below.
        """
        return pulumi.get(self, "subject_alt_name")


@pulumi.output_type
class CertificateConfigSubjectConfigSubject(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "commonName":
            suggest = "common_name"
        elif key == "countryCode":
            suggest = "country_code"
        elif key == "organizationalUnit":
            suggest = "organizational_unit"
        elif key == "postalCode":
            suggest = "postal_code"
        elif key == "streetAddress":
            suggest = "street_address"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigSubjectConfigSubject. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigSubjectConfigSubject.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigSubjectConfigSubject.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 common_name: str,
                 organization: str,
                 country_code: Optional[str] = None,
                 locality: Optional[str] = None,
                 organizational_unit: Optional[str] = None,
                 postal_code: Optional[str] = None,
                 province: Optional[str] = None,
                 street_address: Optional[str] = None):
        """
        :param str common_name: The common name of the distinguished name.
        :param str organization: The organization of the subject.
        :param str country_code: The country code of the subject.
        :param str locality: The locality or city of the subject.
        :param str organizational_unit: The organizational unit of the subject.
        :param str postal_code: The postal code of the subject.
        :param str province: The province, territory, or regional state of the subject.
        :param str street_address: The street address of the subject.
        """
        pulumi.set(__self__, "common_name", common_name)
        pulumi.set(__self__, "organization", organization)
        if country_code is not None:
            pulumi.set(__self__, "country_code", country_code)
        if locality is not None:
            pulumi.set(__self__, "locality", locality)
        if organizational_unit is not None:
            pulumi.set(__self__, "organizational_unit", organizational_unit)
        if postal_code is not None:
            pulumi.set(__self__, "postal_code", postal_code)
        if province is not None:
            pulumi.set(__self__, "province", province)
        if street_address is not None:
            pulumi.set(__self__, "street_address", street_address)

    @property
    @pulumi.getter(name="commonName")
    def common_name(self) -> str:
        """
        The common name of the distinguished name.
        """
        return pulumi.get(self, "common_name")

    @property
    @pulumi.getter
    def organization(self) -> str:
        """
        The organization of the subject.
        """
        return pulumi.get(self, "organization")

    @property
    @pulumi.getter(name="countryCode")
    def country_code(self) -> Optional[str]:
        """
        The country code of the subject.
        """
        return pulumi.get(self, "country_code")

    @property
    @pulumi.getter
    def locality(self) -> Optional[str]:
        """
        The locality or city of the subject.
        """
        return pulumi.get(self, "locality")

    @property
    @pulumi.getter(name="organizationalUnit")
    def organizational_unit(self) -> Optional[str]:
        """
        The organizational unit of the subject.
        """
        return pulumi.get(self, "organizational_unit")

    @property
    @pulumi.getter(name="postalCode")
    def postal_code(self) -> Optional[str]:
        """
        The postal code of the subject.
        """
        return pulumi.get(self, "postal_code")

    @property
    @pulumi.getter
    def province(self) -> Optional[str]:
        """
        The province, territory, or regional state of the subject.
        """
        return pulumi.get(self, "province")

    @property
    @pulumi.getter(name="streetAddress")
    def street_address(self) -> Optional[str]:
        """
        The street address of the subject.
        """
        return pulumi.get(self, "street_address")


@pulumi.output_type
class CertificateConfigSubjectConfigSubjectAltName(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "dnsNames":
            suggest = "dns_names"
        elif key == "emailAddresses":
            suggest = "email_addresses"
        elif key == "ipAddresses":
            suggest = "ip_addresses"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigSubjectConfigSubjectAltName. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigSubjectConfigSubjectAltName.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigSubjectConfigSubjectAltName.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 dns_names: Optional[Sequence[str]] = None,
                 email_addresses: Optional[Sequence[str]] = None,
                 ip_addresses: Optional[Sequence[str]] = None,
                 uris: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] dns_names: Contains only valid, fully-qualified host names.
        :param Sequence[str] email_addresses: Contains only valid RFC 2822 E-mail addresses.
        :param Sequence[str] ip_addresses: Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
        :param Sequence[str] uris: Contains only valid RFC 3986 URIs.
        """
        if dns_names is not None:
            pulumi.set(__self__, "dns_names", dns_names)
        if email_addresses is not None:
            pulumi.set(__self__, "email_addresses", email_addresses)
        if ip_addresses is not None:
            pulumi.set(__self__, "ip_addresses", ip_addresses)
        if uris is not None:
            pulumi.set(__self__, "uris", uris)

    @property
    @pulumi.getter(name="dnsNames")
    def dns_names(self) -> Optional[Sequence[str]]:
        """
        Contains only valid, fully-qualified host names.
        """
        return pulumi.get(self, "dns_names")

    @property
    @pulumi.getter(name="emailAddresses")
    def email_addresses(self) -> Optional[Sequence[str]]:
        """
        Contains only valid RFC 2822 E-mail addresses.
        """
        return pulumi.get(self, "email_addresses")

    @property
    @pulumi.getter(name="ipAddresses")
    def ip_addresses(self) -> Optional[Sequence[str]]:
        """
        Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.
        """
        return pulumi.get(self, "ip_addresses")

    @property
    @pulumi.getter
    def uris(self) -> Optional[Sequence[str]]:
        """
        Contains only valid RFC 3986 URIs.
        """
        return pulumi.get(self, "uris")


@pulumi.output_type
class CertificateConfigX509Config(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "keyUsage":
            suggest = "key_usage"
        elif key == "additionalExtensions":
            suggest = "additional_extensions"
        elif key == "aiaOcspServers":
            suggest = "aia_ocsp_servers"
        elif key == "caOptions":
            suggest = "ca_options"
        elif key == "policyIds":
            suggest = "policy_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509Config. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509Config.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509Config.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 key_usage: 'outputs.CertificateConfigX509ConfigKeyUsage',
                 additional_extensions: Optional[Sequence['outputs.CertificateConfigX509ConfigAdditionalExtension']] = None,
                 aia_ocsp_servers: Optional[Sequence[str]] = None,
                 ca_options: Optional['outputs.CertificateConfigX509ConfigCaOptions'] = None,
                 policy_ids: Optional[Sequence['outputs.CertificateConfigX509ConfigPolicyId']] = None):
        """
        :param 'CertificateConfigX509ConfigKeyUsageArgs' key_usage: Indicates the intended use for keys that correspond to a certificate.
               Structure is documented below.
        :param Sequence['CertificateConfigX509ConfigAdditionalExtensionArgs'] additional_extensions: Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
               Structure is documented below.
        :param Sequence[str] aia_ocsp_servers: Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
               "Authority Information Access" extension in the certificate.
        :param 'CertificateConfigX509ConfigCaOptionsArgs' ca_options: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param Sequence['CertificateConfigX509ConfigPolicyIdArgs'] policy_ids: Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
               Structure is documented below.
        """
        pulumi.set(__self__, "key_usage", key_usage)
        if additional_extensions is not None:
            pulumi.set(__self__, "additional_extensions", additional_extensions)
        if aia_ocsp_servers is not None:
            pulumi.set(__self__, "aia_ocsp_servers", aia_ocsp_servers)
        if ca_options is not None:
            pulumi.set(__self__, "ca_options", ca_options)
        if policy_ids is not None:
            pulumi.set(__self__, "policy_ids", policy_ids)

    @property
    @pulumi.getter(name="keyUsage")
    def key_usage(self) -> 'outputs.CertificateConfigX509ConfigKeyUsage':
        """
        Indicates the intended use for keys that correspond to a certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "key_usage")

    @property
    @pulumi.getter(name="additionalExtensions")
    def additional_extensions(self) -> Optional[Sequence['outputs.CertificateConfigX509ConfigAdditionalExtension']]:
        """
        Specifies an X.509 extension, which may be used in different parts of X.509 objects like certificates, CSRs, and CRLs.
        Structure is documented below.
        """
        return pulumi.get(self, "additional_extensions")

    @property
    @pulumi.getter(name="aiaOcspServers")
    def aia_ocsp_servers(self) -> Optional[Sequence[str]]:
        """
        Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the
        "Authority Information Access" extension in the certificate.
        """
        return pulumi.get(self, "aia_ocsp_servers")

    @property
    @pulumi.getter(name="caOptions")
    def ca_options(self) -> Optional['outputs.CertificateConfigX509ConfigCaOptions']:
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "ca_options")

    @property
    @pulumi.getter(name="policyIds")
    def policy_ids(self) -> Optional[Sequence['outputs.CertificateConfigX509ConfigPolicyId']]:
        """
        Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
        Structure is documented below.
        """
        return pulumi.get(self, "policy_ids")


@pulumi.output_type
class CertificateConfigX509ConfigAdditionalExtension(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectId":
            suggest = "object_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigAdditionalExtension. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigAdditionalExtension.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigAdditionalExtension.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 critical: bool,
                 object_id: 'outputs.CertificateConfigX509ConfigAdditionalExtensionObjectId',
                 value: str):
        """
        :param bool critical: Indicates whether or not this extension is critical (i.e., if the client does not know how to
               handle this extension, the client should consider this to be an error).
        :param 'CertificateConfigX509ConfigAdditionalExtensionObjectIdArgs' object_id: Describes values that are relevant in a CA certificate.
               Structure is documented below.
        :param str value: The value of this X.509 extension. A base64-encoded string.
        """
        pulumi.set(__self__, "critical", critical)
        pulumi.set(__self__, "object_id", object_id)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def critical(self) -> bool:
        """
        Indicates whether or not this extension is critical (i.e., if the client does not know how to
        handle this extension, the client should consider this to be an error).
        """
        return pulumi.get(self, "critical")

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> 'outputs.CertificateConfigX509ConfigAdditionalExtensionObjectId':
        """
        Describes values that are relevant in a CA certificate.
        Structure is documented below.
        """
        return pulumi.get(self, "object_id")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value of this X.509 extension. A base64-encoded string.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class CertificateConfigX509ConfigAdditionalExtensionObjectId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigAdditionalExtensionObjectId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigAdditionalExtensionObjectId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigAdditionalExtensionObjectId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateConfigX509ConfigCaOptions(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "isCa":
            suggest = "is_ca"
        elif key == "maxIssuerPathLength":
            suggest = "max_issuer_path_length"
        elif key == "nonCa":
            suggest = "non_ca"
        elif key == "zeroMaxIssuerPathLength":
            suggest = "zero_max_issuer_path_length"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigCaOptions. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigCaOptions.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigCaOptions.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 is_ca: Optional[bool] = None,
                 max_issuer_path_length: Optional[int] = None,
                 non_ca: Optional[bool] = None,
                 zero_max_issuer_path_length: Optional[bool] = None):
        """
        :param bool is_ca: When true, the "CA" in Basic Constraints extension will be set to true.
        :param int max_issuer_path_length: Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
               subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
        :param bool non_ca: When true, the "CA" in Basic Constraints extension will be set to false.
               If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
        :param bool zero_max_issuer_path_length: When true, the "path length constraint" in Basic Constraints extension will be set to 0.
               if both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
               the max path length will be omitted from the CA certificate.
        """
        if is_ca is not None:
            pulumi.set(__self__, "is_ca", is_ca)
        if max_issuer_path_length is not None:
            pulumi.set(__self__, "max_issuer_path_length", max_issuer_path_length)
        if non_ca is not None:
            pulumi.set(__self__, "non_ca", non_ca)
        if zero_max_issuer_path_length is not None:
            pulumi.set(__self__, "zero_max_issuer_path_length", zero_max_issuer_path_length)

    @property
    @pulumi.getter(name="isCa")
    def is_ca(self) -> Optional[bool]:
        """
        When true, the "CA" in Basic Constraints extension will be set to true.
        """
        return pulumi.get(self, "is_ca")

    @property
    @pulumi.getter(name="maxIssuerPathLength")
    def max_issuer_path_length(self) -> Optional[int]:
        """
        Refers to the "path length constraint" in Basic Constraints extension. For a CA certificate, this value describes the depth of
        subordinate CA certificates that are allowed. If this value is less than 0, the request will fail.
        """
        return pulumi.get(self, "max_issuer_path_length")

    @property
    @pulumi.getter(name="nonCa")
    def non_ca(self) -> Optional[bool]:
        """
        When true, the "CA" in Basic Constraints extension will be set to false.
        If both `is_ca` and `non_ca` are unset, the extension will be omitted from the CA certificate.
        """
        return pulumi.get(self, "non_ca")

    @property
    @pulumi.getter(name="zeroMaxIssuerPathLength")
    def zero_max_issuer_path_length(self) -> Optional[bool]:
        """
        When true, the "path length constraint" in Basic Constraints extension will be set to 0.
        if both `max_issuer_path_length` and `zero_max_issuer_path_length` are unset,
        the max path length will be omitted from the CA certificate.
        """
        return pulumi.get(self, "zero_max_issuer_path_length")


@pulumi.output_type
class CertificateConfigX509ConfigKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "baseKeyUsage":
            suggest = "base_key_usage"
        elif key == "extendedKeyUsage":
            suggest = "extended_key_usage"
        elif key == "unknownExtendedKeyUsages":
            suggest = "unknown_extended_key_usages"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 base_key_usage: 'outputs.CertificateConfigX509ConfigKeyUsageBaseKeyUsage',
                 extended_key_usage: 'outputs.CertificateConfigX509ConfigKeyUsageExtendedKeyUsage',
                 unknown_extended_key_usages: Optional[Sequence['outputs.CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsage']] = None):
        """
        :param 'CertificateConfigX509ConfigKeyUsageBaseKeyUsageArgs' base_key_usage: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param 'CertificateConfigX509ConfigKeyUsageExtendedKeyUsageArgs' extended_key_usage: Describes high-level ways in which a key may be used.
               Structure is documented below.
        :param Sequence['CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsageArgs'] unknown_extended_key_usages: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
               Structure is documented below.
        """
        pulumi.set(__self__, "base_key_usage", base_key_usage)
        pulumi.set(__self__, "extended_key_usage", extended_key_usage)
        if unknown_extended_key_usages is not None:
            pulumi.set(__self__, "unknown_extended_key_usages", unknown_extended_key_usages)

    @property
    @pulumi.getter(name="baseKeyUsage")
    def base_key_usage(self) -> 'outputs.CertificateConfigX509ConfigKeyUsageBaseKeyUsage':
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "base_key_usage")

    @property
    @pulumi.getter(name="extendedKeyUsage")
    def extended_key_usage(self) -> 'outputs.CertificateConfigX509ConfigKeyUsageExtendedKeyUsage':
        """
        Describes high-level ways in which a key may be used.
        Structure is documented below.
        """
        return pulumi.get(self, "extended_key_usage")

    @property
    @pulumi.getter(name="unknownExtendedKeyUsages")
    def unknown_extended_key_usages(self) -> Optional[Sequence['outputs.CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsage']]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        Structure is documented below.
        """
        return pulumi.get(self, "unknown_extended_key_usages")


@pulumi.output_type
class CertificateConfigX509ConfigKeyUsageBaseKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certSign":
            suggest = "cert_sign"
        elif key == "contentCommitment":
            suggest = "content_commitment"
        elif key == "crlSign":
            suggest = "crl_sign"
        elif key == "dataEncipherment":
            suggest = "data_encipherment"
        elif key == "decipherOnly":
            suggest = "decipher_only"
        elif key == "digitalSignature":
            suggest = "digital_signature"
        elif key == "encipherOnly":
            suggest = "encipher_only"
        elif key == "keyAgreement":
            suggest = "key_agreement"
        elif key == "keyEncipherment":
            suggest = "key_encipherment"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigKeyUsageBaseKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigKeyUsageBaseKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigKeyUsageBaseKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 cert_sign: Optional[bool] = None,
                 content_commitment: Optional[bool] = None,
                 crl_sign: Optional[bool] = None,
                 data_encipherment: Optional[bool] = None,
                 decipher_only: Optional[bool] = None,
                 digital_signature: Optional[bool] = None,
                 encipher_only: Optional[bool] = None,
                 key_agreement: Optional[bool] = None,
                 key_encipherment: Optional[bool] = None):
        """
        :param bool cert_sign: The key may be used to sign certificates.
        :param bool content_commitment: The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        :param bool crl_sign: The key may be used sign certificate revocation lists.
        :param bool data_encipherment: The key may be used to encipher data.
        :param bool decipher_only: The key may be used to decipher only.
        :param bool digital_signature: The key may be used for digital signatures.
        :param bool encipher_only: The key may be used to encipher only.
        :param bool key_agreement: The key may be used in a key agreement protocol.
        :param bool key_encipherment: The key may be used to encipher other keys.
        """
        if cert_sign is not None:
            pulumi.set(__self__, "cert_sign", cert_sign)
        if content_commitment is not None:
            pulumi.set(__self__, "content_commitment", content_commitment)
        if crl_sign is not None:
            pulumi.set(__self__, "crl_sign", crl_sign)
        if data_encipherment is not None:
            pulumi.set(__self__, "data_encipherment", data_encipherment)
        if decipher_only is not None:
            pulumi.set(__self__, "decipher_only", decipher_only)
        if digital_signature is not None:
            pulumi.set(__self__, "digital_signature", digital_signature)
        if encipher_only is not None:
            pulumi.set(__self__, "encipher_only", encipher_only)
        if key_agreement is not None:
            pulumi.set(__self__, "key_agreement", key_agreement)
        if key_encipherment is not None:
            pulumi.set(__self__, "key_encipherment", key_encipherment)

    @property
    @pulumi.getter(name="certSign")
    def cert_sign(self) -> Optional[bool]:
        """
        The key may be used to sign certificates.
        """
        return pulumi.get(self, "cert_sign")

    @property
    @pulumi.getter(name="contentCommitment")
    def content_commitment(self) -> Optional[bool]:
        """
        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        """
        return pulumi.get(self, "content_commitment")

    @property
    @pulumi.getter(name="crlSign")
    def crl_sign(self) -> Optional[bool]:
        """
        The key may be used sign certificate revocation lists.
        """
        return pulumi.get(self, "crl_sign")

    @property
    @pulumi.getter(name="dataEncipherment")
    def data_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher data.
        """
        return pulumi.get(self, "data_encipherment")

    @property
    @pulumi.getter(name="decipherOnly")
    def decipher_only(self) -> Optional[bool]:
        """
        The key may be used to decipher only.
        """
        return pulumi.get(self, "decipher_only")

    @property
    @pulumi.getter(name="digitalSignature")
    def digital_signature(self) -> Optional[bool]:
        """
        The key may be used for digital signatures.
        """
        return pulumi.get(self, "digital_signature")

    @property
    @pulumi.getter(name="encipherOnly")
    def encipher_only(self) -> Optional[bool]:
        """
        The key may be used to encipher only.
        """
        return pulumi.get(self, "encipher_only")

    @property
    @pulumi.getter(name="keyAgreement")
    def key_agreement(self) -> Optional[bool]:
        """
        The key may be used in a key agreement protocol.
        """
        return pulumi.get(self, "key_agreement")

    @property
    @pulumi.getter(name="keyEncipherment")
    def key_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher other keys.
        """
        return pulumi.get(self, "key_encipherment")


@pulumi.output_type
class CertificateConfigX509ConfigKeyUsageExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "clientAuth":
            suggest = "client_auth"
        elif key == "codeSigning":
            suggest = "code_signing"
        elif key == "emailProtection":
            suggest = "email_protection"
        elif key == "ocspSigning":
            suggest = "ocsp_signing"
        elif key == "serverAuth":
            suggest = "server_auth"
        elif key == "timeStamping":
            suggest = "time_stamping"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigKeyUsageExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 client_auth: Optional[bool] = None,
                 code_signing: Optional[bool] = None,
                 email_protection: Optional[bool] = None,
                 ocsp_signing: Optional[bool] = None,
                 server_auth: Optional[bool] = None,
                 time_stamping: Optional[bool] = None):
        """
        :param bool client_auth: Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        :param bool code_signing: Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        :param bool email_protection: Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        :param bool ocsp_signing: Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        :param bool server_auth: Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        :param bool time_stamping: Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        if client_auth is not None:
            pulumi.set(__self__, "client_auth", client_auth)
        if code_signing is not None:
            pulumi.set(__self__, "code_signing", code_signing)
        if email_protection is not None:
            pulumi.set(__self__, "email_protection", email_protection)
        if ocsp_signing is not None:
            pulumi.set(__self__, "ocsp_signing", ocsp_signing)
        if server_auth is not None:
            pulumi.set(__self__, "server_auth", server_auth)
        if time_stamping is not None:
            pulumi.set(__self__, "time_stamping", time_stamping)

    @property
    @pulumi.getter(name="clientAuth")
    def client_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "client_auth")

    @property
    @pulumi.getter(name="codeSigning")
    def code_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        """
        return pulumi.get(self, "code_signing")

    @property
    @pulumi.getter(name="emailProtection")
    def email_protection(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        """
        return pulumi.get(self, "email_protection")

    @property
    @pulumi.getter(name="ocspSigning")
    def ocsp_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        """
        return pulumi.get(self, "ocsp_signing")

    @property
    @pulumi.getter(name="serverAuth")
    def server_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "server_auth")

    @property
    @pulumi.getter(name="timeStamping")
    def time_stamping(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        return pulumi.get(self, "time_stamping")


@pulumi.output_type
class CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateConfigX509ConfigPolicyId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateConfigX509ConfigPolicyId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateConfigX509ConfigPolicyId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateConfigX509ConfigPolicyId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateRevocationDetail(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "revocationState":
            suggest = "revocation_state"
        elif key == "revocationTime":
            suggest = "revocation_time"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateRevocationDetail. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateRevocationDetail.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateRevocationDetail.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 revocation_state: Optional[str] = None,
                 revocation_time: Optional[str] = None):
        """
        :param str revocation_state: Indicates why a Certificate was revoked.
        :param str revocation_time: The time at which this Certificate was revoked.
        """
        if revocation_state is not None:
            pulumi.set(__self__, "revocation_state", revocation_state)
        if revocation_time is not None:
            pulumi.set(__self__, "revocation_time", revocation_time)

    @property
    @pulumi.getter(name="revocationState")
    def revocation_state(self) -> Optional[str]:
        """
        Indicates why a Certificate was revoked.
        """
        return pulumi.get(self, "revocation_state")

    @property
    @pulumi.getter(name="revocationTime")
    def revocation_time(self) -> Optional[str]:
        """
        The time at which this Certificate was revoked.
        """
        return pulumi.get(self, "revocation_time")


@pulumi.output_type
class CertificateTemplateIamBindingCondition(dict):
    def __init__(__self__, *,
                 expression: str,
                 title: str,
                 description: Optional[str] = None):
        """
        :param str expression: Textual representation of an expression in Common Expression Language syntax.
        :param str title: A title for the expression, i.e. a short string describing its purpose.
        :param str description: An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        pulumi.set(__self__, "expression", expression)
        pulumi.set(__self__, "title", title)
        if description is not None:
            pulumi.set(__self__, "description", description)

    @property
    @pulumi.getter
    def expression(self) -> str:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def title(self) -> str:
        """
        A title for the expression, i.e. a short string describing its purpose.
        """
        return pulumi.get(self, "title")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")


@pulumi.output_type
class CertificateTemplateIamMemberCondition(dict):
    def __init__(__self__, *,
                 expression: str,
                 title: str,
                 description: Optional[str] = None):
        """
        :param str expression: Textual representation of an expression in Common Expression Language syntax.
        :param str title: A title for the expression, i.e. a short string describing its purpose.
        :param str description: An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        pulumi.set(__self__, "expression", expression)
        pulumi.set(__self__, "title", title)
        if description is not None:
            pulumi.set(__self__, "description", description)

    @property
    @pulumi.getter
    def expression(self) -> str:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def title(self) -> str:
        """
        A title for the expression, i.e. a short string describing its purpose.
        """
        return pulumi.get(self, "title")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")


@pulumi.output_type
class CertificateTemplateIdentityConstraints(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "allowSubjectAltNamesPassthrough":
            suggest = "allow_subject_alt_names_passthrough"
        elif key == "allowSubjectPassthrough":
            suggest = "allow_subject_passthrough"
        elif key == "celExpression":
            suggest = "cel_expression"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplateIdentityConstraints. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplateIdentityConstraints.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplateIdentityConstraints.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 allow_subject_alt_names_passthrough: bool,
                 allow_subject_passthrough: bool,
                 cel_expression: Optional['outputs.CertificateTemplateIdentityConstraintsCelExpression'] = None):
        """
        :param bool allow_subject_alt_names_passthrough: Required. If this is true, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.
        :param bool allow_subject_passthrough: Required. If this is true, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.
        :param 'CertificateTemplateIdentityConstraintsCelExpressionArgs' cel_expression: Optional. A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/using-cel
        """
        pulumi.set(__self__, "allow_subject_alt_names_passthrough", allow_subject_alt_names_passthrough)
        pulumi.set(__self__, "allow_subject_passthrough", allow_subject_passthrough)
        if cel_expression is not None:
            pulumi.set(__self__, "cel_expression", cel_expression)

    @property
    @pulumi.getter(name="allowSubjectAltNamesPassthrough")
    def allow_subject_alt_names_passthrough(self) -> bool:
        """
        Required. If this is true, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.
        """
        return pulumi.get(self, "allow_subject_alt_names_passthrough")

    @property
    @pulumi.getter(name="allowSubjectPassthrough")
    def allow_subject_passthrough(self) -> bool:
        """
        Required. If this is true, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.
        """
        return pulumi.get(self, "allow_subject_passthrough")

    @property
    @pulumi.getter(name="celExpression")
    def cel_expression(self) -> Optional['outputs.CertificateTemplateIdentityConstraintsCelExpression']:
        """
        Optional. A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/using-cel
        """
        return pulumi.get(self, "cel_expression")


@pulumi.output_type
class CertificateTemplateIdentityConstraintsCelExpression(dict):
    def __init__(__self__, *,
                 description: Optional[str] = None,
                 expression: Optional[str] = None,
                 location: Optional[str] = None,
                 title: Optional[str] = None):
        """
        :param str description: Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        :param str expression: Textual representation of an expression in Common Expression Language syntax.
        :param str location: Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
        :param str title: Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
        """
        if description is not None:
            pulumi.set(__self__, "description", description)
        if expression is not None:
            pulumi.set(__self__, "expression", expression)
        if location is not None:
            pulumi.set(__self__, "location", location)
        if title is not None:
            pulumi.set(__self__, "title", title)

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def expression(self) -> Optional[str]:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def location(self) -> Optional[str]:
        """
        Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
        """
        return pulumi.get(self, "location")

    @property
    @pulumi.getter
    def title(self) -> Optional[str]:
        """
        Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
        """
        return pulumi.get(self, "title")


@pulumi.output_type
class CertificateTemplatePassthroughExtensions(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "additionalExtensions":
            suggest = "additional_extensions"
        elif key == "knownExtensions":
            suggest = "known_extensions"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePassthroughExtensions. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePassthroughExtensions.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePassthroughExtensions.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 additional_extensions: Optional[Sequence['outputs.CertificateTemplatePassthroughExtensionsAdditionalExtension']] = None,
                 known_extensions: Optional[Sequence[str]] = None):
        """
        :param Sequence['CertificateTemplatePassthroughExtensionsAdditionalExtensionArgs'] additional_extensions: Optional. A set of ObjectIds identifying custom X.509 extensions. Will be combined with known_extensions to determine the full set of X.509 extensions.
        :param Sequence[str] known_extensions: Optional. A set of named X.509 extensions. Will be combined with additional_extensions to determine the full set of X.509 extensions.
        """
        if additional_extensions is not None:
            pulumi.set(__self__, "additional_extensions", additional_extensions)
        if known_extensions is not None:
            pulumi.set(__self__, "known_extensions", known_extensions)

    @property
    @pulumi.getter(name="additionalExtensions")
    def additional_extensions(self) -> Optional[Sequence['outputs.CertificateTemplatePassthroughExtensionsAdditionalExtension']]:
        """
        Optional. A set of ObjectIds identifying custom X.509 extensions. Will be combined with known_extensions to determine the full set of X.509 extensions.
        """
        return pulumi.get(self, "additional_extensions")

    @property
    @pulumi.getter(name="knownExtensions")
    def known_extensions(self) -> Optional[Sequence[str]]:
        """
        Optional. A set of named X.509 extensions. Will be combined with additional_extensions to determine the full set of X.509 extensions.
        """
        return pulumi.get(self, "known_extensions")


@pulumi.output_type
class CertificateTemplatePassthroughExtensionsAdditionalExtension(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePassthroughExtensionsAdditionalExtension. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePassthroughExtensionsAdditionalExtension.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePassthroughExtensionsAdditionalExtension.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: Required. The parts of an OID path. The most significant parts of the path come first.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        Required. The parts of an OID path. The most significant parts of the path come first.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateTemplatePredefinedValues(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "additionalExtensions":
            suggest = "additional_extensions"
        elif key == "aiaOcspServers":
            suggest = "aia_ocsp_servers"
        elif key == "caOptions":
            suggest = "ca_options"
        elif key == "keyUsage":
            suggest = "key_usage"
        elif key == "policyIds":
            suggest = "policy_ids"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValues. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValues.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValues.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 additional_extensions: Optional[Sequence['outputs.CertificateTemplatePredefinedValuesAdditionalExtension']] = None,
                 aia_ocsp_servers: Optional[Sequence[str]] = None,
                 ca_options: Optional['outputs.CertificateTemplatePredefinedValuesCaOptions'] = None,
                 key_usage: Optional['outputs.CertificateTemplatePredefinedValuesKeyUsage'] = None,
                 policy_ids: Optional[Sequence['outputs.CertificateTemplatePredefinedValuesPolicyId']] = None):
        """
        :param Sequence['CertificateTemplatePredefinedValuesAdditionalExtensionArgs'] additional_extensions: Optional. Describes custom X.509 extensions.
        :param Sequence[str] aia_ocsp_servers: Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
        :param 'CertificateTemplatePredefinedValuesCaOptionsArgs' ca_options: Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
        :param 'CertificateTemplatePredefinedValuesKeyUsageArgs' key_usage: Optional. Indicates the intended use for keys that correspond to a certificate.
        :param Sequence['CertificateTemplatePredefinedValuesPolicyIdArgs'] policy_ids: Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
        """
        if additional_extensions is not None:
            pulumi.set(__self__, "additional_extensions", additional_extensions)
        if aia_ocsp_servers is not None:
            pulumi.set(__self__, "aia_ocsp_servers", aia_ocsp_servers)
        if ca_options is not None:
            pulumi.set(__self__, "ca_options", ca_options)
        if key_usage is not None:
            pulumi.set(__self__, "key_usage", key_usage)
        if policy_ids is not None:
            pulumi.set(__self__, "policy_ids", policy_ids)

    @property
    @pulumi.getter(name="additionalExtensions")
    def additional_extensions(self) -> Optional[Sequence['outputs.CertificateTemplatePredefinedValuesAdditionalExtension']]:
        """
        Optional. Describes custom X.509 extensions.
        """
        return pulumi.get(self, "additional_extensions")

    @property
    @pulumi.getter(name="aiaOcspServers")
    def aia_ocsp_servers(self) -> Optional[Sequence[str]]:
        """
        Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.
        """
        return pulumi.get(self, "aia_ocsp_servers")

    @property
    @pulumi.getter(name="caOptions")
    def ca_options(self) -> Optional['outputs.CertificateTemplatePredefinedValuesCaOptions']:
        """
        Optional. Describes options in this X509Parameters that are relevant in a CA certificate.
        """
        return pulumi.get(self, "ca_options")

    @property
    @pulumi.getter(name="keyUsage")
    def key_usage(self) -> Optional['outputs.CertificateTemplatePredefinedValuesKeyUsage']:
        """
        Optional. Indicates the intended use for keys that correspond to a certificate.
        """
        return pulumi.get(self, "key_usage")

    @property
    @pulumi.getter(name="policyIds")
    def policy_ids(self) -> Optional[Sequence['outputs.CertificateTemplatePredefinedValuesPolicyId']]:
        """
        Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.
        """
        return pulumi.get(self, "policy_ids")


@pulumi.output_type
class CertificateTemplatePredefinedValuesAdditionalExtension(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectId":
            suggest = "object_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesAdditionalExtension. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesAdditionalExtension.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesAdditionalExtension.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id: 'outputs.CertificateTemplatePredefinedValuesAdditionalExtensionObjectId',
                 value: str,
                 critical: Optional[bool] = None):
        """
        :param 'CertificateTemplatePredefinedValuesAdditionalExtensionObjectIdArgs' object_id: Required. The OID for this X.509 extension.
        :param str value: Required. The value of this X.509 extension.
        :param bool critical: Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
        """
        pulumi.set(__self__, "object_id", object_id)
        pulumi.set(__self__, "value", value)
        if critical is not None:
            pulumi.set(__self__, "critical", critical)

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> 'outputs.CertificateTemplatePredefinedValuesAdditionalExtensionObjectId':
        """
        Required. The OID for this X.509 extension.
        """
        return pulumi.get(self, "object_id")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        Required. The value of this X.509 extension.
        """
        return pulumi.get(self, "value")

    @property
    @pulumi.getter
    def critical(self) -> Optional[bool]:
        """
        Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).
        """
        return pulumi.get(self, "critical")


@pulumi.output_type
class CertificateTemplatePredefinedValuesAdditionalExtensionObjectId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesAdditionalExtensionObjectId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesAdditionalExtensionObjectId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesAdditionalExtensionObjectId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: Required. The parts of an OID path. The most significant parts of the path come first.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        Required. The parts of an OID path. The most significant parts of the path come first.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateTemplatePredefinedValuesCaOptions(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "isCa":
            suggest = "is_ca"
        elif key == "maxIssuerPathLength":
            suggest = "max_issuer_path_length"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesCaOptions. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesCaOptions.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesCaOptions.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 is_ca: Optional[bool] = None,
                 max_issuer_path_length: Optional[int] = None):
        """
        :param bool is_ca: Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
        :param int max_issuer_path_length: Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
        """
        if is_ca is not None:
            pulumi.set(__self__, "is_ca", is_ca)
        if max_issuer_path_length is not None:
            pulumi.set(__self__, "max_issuer_path_length", max_issuer_path_length)

    @property
    @pulumi.getter(name="isCa")
    def is_ca(self) -> Optional[bool]:
        """
        Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.
        """
        return pulumi.get(self, "is_ca")

    @property
    @pulumi.getter(name="maxIssuerPathLength")
    def max_issuer_path_length(self) -> Optional[int]:
        """
        Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.
        """
        return pulumi.get(self, "max_issuer_path_length")


@pulumi.output_type
class CertificateTemplatePredefinedValuesKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "baseKeyUsage":
            suggest = "base_key_usage"
        elif key == "extendedKeyUsage":
            suggest = "extended_key_usage"
        elif key == "unknownExtendedKeyUsages":
            suggest = "unknown_extended_key_usages"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 base_key_usage: Optional['outputs.CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage'] = None,
                 extended_key_usage: Optional['outputs.CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage'] = None,
                 unknown_extended_key_usages: Optional[Sequence['outputs.CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsage']] = None):
        """
        :param 'CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageArgs' base_key_usage: Describes high-level ways in which a key may be used.
        :param 'CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageArgs' extended_key_usage: Detailed scenarios in which a key may be used.
        :param Sequence['CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsageArgs'] unknown_extended_key_usages: Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
        """
        if base_key_usage is not None:
            pulumi.set(__self__, "base_key_usage", base_key_usage)
        if extended_key_usage is not None:
            pulumi.set(__self__, "extended_key_usage", extended_key_usage)
        if unknown_extended_key_usages is not None:
            pulumi.set(__self__, "unknown_extended_key_usages", unknown_extended_key_usages)

    @property
    @pulumi.getter(name="baseKeyUsage")
    def base_key_usage(self) -> Optional['outputs.CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage']:
        """
        Describes high-level ways in which a key may be used.
        """
        return pulumi.get(self, "base_key_usage")

    @property
    @pulumi.getter(name="extendedKeyUsage")
    def extended_key_usage(self) -> Optional['outputs.CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage']:
        """
        Detailed scenarios in which a key may be used.
        """
        return pulumi.get(self, "extended_key_usage")

    @property
    @pulumi.getter(name="unknownExtendedKeyUsages")
    def unknown_extended_key_usages(self) -> Optional[Sequence['outputs.CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsage']]:
        """
        Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.
        """
        return pulumi.get(self, "unknown_extended_key_usages")


@pulumi.output_type
class CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "certSign":
            suggest = "cert_sign"
        elif key == "contentCommitment":
            suggest = "content_commitment"
        elif key == "crlSign":
            suggest = "crl_sign"
        elif key == "dataEncipherment":
            suggest = "data_encipherment"
        elif key == "decipherOnly":
            suggest = "decipher_only"
        elif key == "digitalSignature":
            suggest = "digital_signature"
        elif key == "encipherOnly":
            suggest = "encipher_only"
        elif key == "keyAgreement":
            suggest = "key_agreement"
        elif key == "keyEncipherment":
            suggest = "key_encipherment"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 cert_sign: Optional[bool] = None,
                 content_commitment: Optional[bool] = None,
                 crl_sign: Optional[bool] = None,
                 data_encipherment: Optional[bool] = None,
                 decipher_only: Optional[bool] = None,
                 digital_signature: Optional[bool] = None,
                 encipher_only: Optional[bool] = None,
                 key_agreement: Optional[bool] = None,
                 key_encipherment: Optional[bool] = None):
        """
        :param bool cert_sign: The key may be used to sign certificates.
        :param bool content_commitment: The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        :param bool crl_sign: The key may be used sign certificate revocation lists.
        :param bool data_encipherment: The key may be used to encipher data.
        :param bool decipher_only: The key may be used to decipher only.
        :param bool digital_signature: The key may be used for digital signatures.
        :param bool encipher_only: The key may be used to encipher only.
        :param bool key_agreement: The key may be used in a key agreement protocol.
        :param bool key_encipherment: The key may be used to encipher other keys.
        """
        if cert_sign is not None:
            pulumi.set(__self__, "cert_sign", cert_sign)
        if content_commitment is not None:
            pulumi.set(__self__, "content_commitment", content_commitment)
        if crl_sign is not None:
            pulumi.set(__self__, "crl_sign", crl_sign)
        if data_encipherment is not None:
            pulumi.set(__self__, "data_encipherment", data_encipherment)
        if decipher_only is not None:
            pulumi.set(__self__, "decipher_only", decipher_only)
        if digital_signature is not None:
            pulumi.set(__self__, "digital_signature", digital_signature)
        if encipher_only is not None:
            pulumi.set(__self__, "encipher_only", encipher_only)
        if key_agreement is not None:
            pulumi.set(__self__, "key_agreement", key_agreement)
        if key_encipherment is not None:
            pulumi.set(__self__, "key_encipherment", key_encipherment)

    @property
    @pulumi.getter(name="certSign")
    def cert_sign(self) -> Optional[bool]:
        """
        The key may be used to sign certificates.
        """
        return pulumi.get(self, "cert_sign")

    @property
    @pulumi.getter(name="contentCommitment")
    def content_commitment(self) -> Optional[bool]:
        """
        The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
        """
        return pulumi.get(self, "content_commitment")

    @property
    @pulumi.getter(name="crlSign")
    def crl_sign(self) -> Optional[bool]:
        """
        The key may be used sign certificate revocation lists.
        """
        return pulumi.get(self, "crl_sign")

    @property
    @pulumi.getter(name="dataEncipherment")
    def data_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher data.
        """
        return pulumi.get(self, "data_encipherment")

    @property
    @pulumi.getter(name="decipherOnly")
    def decipher_only(self) -> Optional[bool]:
        """
        The key may be used to decipher only.
        """
        return pulumi.get(self, "decipher_only")

    @property
    @pulumi.getter(name="digitalSignature")
    def digital_signature(self) -> Optional[bool]:
        """
        The key may be used for digital signatures.
        """
        return pulumi.get(self, "digital_signature")

    @property
    @pulumi.getter(name="encipherOnly")
    def encipher_only(self) -> Optional[bool]:
        """
        The key may be used to encipher only.
        """
        return pulumi.get(self, "encipher_only")

    @property
    @pulumi.getter(name="keyAgreement")
    def key_agreement(self) -> Optional[bool]:
        """
        The key may be used in a key agreement protocol.
        """
        return pulumi.get(self, "key_agreement")

    @property
    @pulumi.getter(name="keyEncipherment")
    def key_encipherment(self) -> Optional[bool]:
        """
        The key may be used to encipher other keys.
        """
        return pulumi.get(self, "key_encipherment")


@pulumi.output_type
class CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "clientAuth":
            suggest = "client_auth"
        elif key == "codeSigning":
            suggest = "code_signing"
        elif key == "emailProtection":
            suggest = "email_protection"
        elif key == "ocspSigning":
            suggest = "ocsp_signing"
        elif key == "serverAuth":
            suggest = "server_auth"
        elif key == "timeStamping":
            suggest = "time_stamping"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 client_auth: Optional[bool] = None,
                 code_signing: Optional[bool] = None,
                 email_protection: Optional[bool] = None,
                 ocsp_signing: Optional[bool] = None,
                 server_auth: Optional[bool] = None,
                 time_stamping: Optional[bool] = None):
        """
        :param bool client_auth: Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        :param bool code_signing: Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        :param bool email_protection: Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        :param bool ocsp_signing: Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        :param bool server_auth: Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        :param bool time_stamping: Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        if client_auth is not None:
            pulumi.set(__self__, "client_auth", client_auth)
        if code_signing is not None:
            pulumi.set(__self__, "code_signing", code_signing)
        if email_protection is not None:
            pulumi.set(__self__, "email_protection", email_protection)
        if ocsp_signing is not None:
            pulumi.set(__self__, "ocsp_signing", ocsp_signing)
        if server_auth is not None:
            pulumi.set(__self__, "server_auth", server_auth)
        if time_stamping is not None:
            pulumi.set(__self__, "time_stamping", time_stamping)

    @property
    @pulumi.getter(name="clientAuth")
    def client_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "client_auth")

    @property
    @pulumi.getter(name="codeSigning")
    def code_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
        """
        return pulumi.get(self, "code_signing")

    @property
    @pulumi.getter(name="emailProtection")
    def email_protection(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
        """
        return pulumi.get(self, "email_protection")

    @property
    @pulumi.getter(name="ocspSigning")
    def ocsp_signing(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
        """
        return pulumi.get(self, "ocsp_signing")

    @property
    @pulumi.getter(name="serverAuth")
    def server_auth(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
        """
        return pulumi.get(self, "server_auth")

    @property
    @pulumi.getter(name="timeStamping")
    def time_stamping(self) -> Optional[bool]:
        """
        Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
        """
        return pulumi.get(self, "time_stamping")


@pulumi.output_type
class CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: Required. The parts of an OID path. The most significant parts of the path come first.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        Required. The parts of an OID path. The most significant parts of the path come first.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class CertificateTemplatePredefinedValuesPolicyId(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "objectIdPaths":
            suggest = "object_id_paths"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in CertificateTemplatePredefinedValuesPolicyId. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        CertificateTemplatePredefinedValuesPolicyId.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        CertificateTemplatePredefinedValuesPolicyId.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        """
        :param Sequence[int] object_id_paths: Required. The parts of an OID path. The most significant parts of the path come first.
        """
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        """
        Required. The parts of an OID path. The most significant parts of the path come first.
        """
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class GetAuthorityAccessUrlResult(dict):
    def __init__(__self__, *,
                 ca_certificate_access_url: str,
                 crl_access_urls: Sequence[str]):
        pulumi.set(__self__, "ca_certificate_access_url", ca_certificate_access_url)
        pulumi.set(__self__, "crl_access_urls", crl_access_urls)

    @property
    @pulumi.getter(name="caCertificateAccessUrl")
    def ca_certificate_access_url(self) -> str:
        return pulumi.get(self, "ca_certificate_access_url")

    @property
    @pulumi.getter(name="crlAccessUrls")
    def crl_access_urls(self) -> Sequence[str]:
        return pulumi.get(self, "crl_access_urls")


@pulumi.output_type
class GetAuthorityConfigResult(dict):
    def __init__(__self__, *,
                 subject_configs: Sequence['outputs.GetAuthorityConfigSubjectConfigResult'],
                 x509_configs: Sequence['outputs.GetAuthorityConfigX509ConfigResult']):
        pulumi.set(__self__, "subject_configs", subject_configs)
        pulumi.set(__self__, "x509_configs", x509_configs)

    @property
    @pulumi.getter(name="subjectConfigs")
    def subject_configs(self) -> Sequence['outputs.GetAuthorityConfigSubjectConfigResult']:
        return pulumi.get(self, "subject_configs")

    @property
    @pulumi.getter(name="x509Configs")
    def x509_configs(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigResult']:
        return pulumi.get(self, "x509_configs")


@pulumi.output_type
class GetAuthorityConfigSubjectConfigResult(dict):
    def __init__(__self__, *,
                 subject_alt_names: Sequence['outputs.GetAuthorityConfigSubjectConfigSubjectAltNameResult'],
                 subjects: Sequence['outputs.GetAuthorityConfigSubjectConfigSubjectResult']):
        pulumi.set(__self__, "subject_alt_names", subject_alt_names)
        pulumi.set(__self__, "subjects", subjects)

    @property
    @pulumi.getter(name="subjectAltNames")
    def subject_alt_names(self) -> Sequence['outputs.GetAuthorityConfigSubjectConfigSubjectAltNameResult']:
        return pulumi.get(self, "subject_alt_names")

    @property
    @pulumi.getter
    def subjects(self) -> Sequence['outputs.GetAuthorityConfigSubjectConfigSubjectResult']:
        return pulumi.get(self, "subjects")


@pulumi.output_type
class GetAuthorityConfigSubjectConfigSubjectResult(dict):
    def __init__(__self__, *,
                 common_name: str,
                 country_code: str,
                 locality: str,
                 organization: str,
                 organizational_unit: str,
                 postal_code: str,
                 province: str,
                 street_address: str):
        pulumi.set(__self__, "common_name", common_name)
        pulumi.set(__self__, "country_code", country_code)
        pulumi.set(__self__, "locality", locality)
        pulumi.set(__self__, "organization", organization)
        pulumi.set(__self__, "organizational_unit", organizational_unit)
        pulumi.set(__self__, "postal_code", postal_code)
        pulumi.set(__self__, "province", province)
        pulumi.set(__self__, "street_address", street_address)

    @property
    @pulumi.getter(name="commonName")
    def common_name(self) -> str:
        return pulumi.get(self, "common_name")

    @property
    @pulumi.getter(name="countryCode")
    def country_code(self) -> str:
        return pulumi.get(self, "country_code")

    @property
    @pulumi.getter
    def locality(self) -> str:
        return pulumi.get(self, "locality")

    @property
    @pulumi.getter
    def organization(self) -> str:
        return pulumi.get(self, "organization")

    @property
    @pulumi.getter(name="organizationalUnit")
    def organizational_unit(self) -> str:
        return pulumi.get(self, "organizational_unit")

    @property
    @pulumi.getter(name="postalCode")
    def postal_code(self) -> str:
        return pulumi.get(self, "postal_code")

    @property
    @pulumi.getter
    def province(self) -> str:
        return pulumi.get(self, "province")

    @property
    @pulumi.getter(name="streetAddress")
    def street_address(self) -> str:
        return pulumi.get(self, "street_address")


@pulumi.output_type
class GetAuthorityConfigSubjectConfigSubjectAltNameResult(dict):
    def __init__(__self__, *,
                 dns_names: Sequence[str],
                 email_addresses: Sequence[str],
                 ip_addresses: Sequence[str],
                 uris: Sequence[str]):
        pulumi.set(__self__, "dns_names", dns_names)
        pulumi.set(__self__, "email_addresses", email_addresses)
        pulumi.set(__self__, "ip_addresses", ip_addresses)
        pulumi.set(__self__, "uris", uris)

    @property
    @pulumi.getter(name="dnsNames")
    def dns_names(self) -> Sequence[str]:
        return pulumi.get(self, "dns_names")

    @property
    @pulumi.getter(name="emailAddresses")
    def email_addresses(self) -> Sequence[str]:
        return pulumi.get(self, "email_addresses")

    @property
    @pulumi.getter(name="ipAddresses")
    def ip_addresses(self) -> Sequence[str]:
        return pulumi.get(self, "ip_addresses")

    @property
    @pulumi.getter
    def uris(self) -> Sequence[str]:
        return pulumi.get(self, "uris")


@pulumi.output_type
class GetAuthorityConfigX509ConfigResult(dict):
    def __init__(__self__, *,
                 additional_extensions: Sequence['outputs.GetAuthorityConfigX509ConfigAdditionalExtensionResult'],
                 aia_ocsp_servers: Sequence[str],
                 ca_options: Sequence['outputs.GetAuthorityConfigX509ConfigCaOptionResult'],
                 key_usages: Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageResult'],
                 policy_ids: Sequence['outputs.GetAuthorityConfigX509ConfigPolicyIdResult']):
        pulumi.set(__self__, "additional_extensions", additional_extensions)
        pulumi.set(__self__, "aia_ocsp_servers", aia_ocsp_servers)
        pulumi.set(__self__, "ca_options", ca_options)
        pulumi.set(__self__, "key_usages", key_usages)
        pulumi.set(__self__, "policy_ids", policy_ids)

    @property
    @pulumi.getter(name="additionalExtensions")
    def additional_extensions(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigAdditionalExtensionResult']:
        return pulumi.get(self, "additional_extensions")

    @property
    @pulumi.getter(name="aiaOcspServers")
    def aia_ocsp_servers(self) -> Sequence[str]:
        return pulumi.get(self, "aia_ocsp_servers")

    @property
    @pulumi.getter(name="caOptions")
    def ca_options(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigCaOptionResult']:
        return pulumi.get(self, "ca_options")

    @property
    @pulumi.getter(name="keyUsages")
    def key_usages(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageResult']:
        return pulumi.get(self, "key_usages")

    @property
    @pulumi.getter(name="policyIds")
    def policy_ids(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigPolicyIdResult']:
        return pulumi.get(self, "policy_ids")


@pulumi.output_type
class GetAuthorityConfigX509ConfigAdditionalExtensionResult(dict):
    def __init__(__self__, *,
                 critical: bool,
                 object_ids: Sequence['outputs.GetAuthorityConfigX509ConfigAdditionalExtensionObjectIdResult'],
                 value: str):
        pulumi.set(__self__, "critical", critical)
        pulumi.set(__self__, "object_ids", object_ids)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def critical(self) -> bool:
        return pulumi.get(self, "critical")

    @property
    @pulumi.getter(name="objectIds")
    def object_ids(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigAdditionalExtensionObjectIdResult']:
        return pulumi.get(self, "object_ids")

    @property
    @pulumi.getter
    def value(self) -> str:
        return pulumi.get(self, "value")


@pulumi.output_type
class GetAuthorityConfigX509ConfigAdditionalExtensionObjectIdResult(dict):
    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class GetAuthorityConfigX509ConfigCaOptionResult(dict):
    def __init__(__self__, *,
                 is_ca: bool,
                 max_issuer_path_length: int,
                 non_ca: bool,
                 zero_max_issuer_path_length: bool):
        pulumi.set(__self__, "is_ca", is_ca)
        pulumi.set(__self__, "max_issuer_path_length", max_issuer_path_length)
        pulumi.set(__self__, "non_ca", non_ca)
        pulumi.set(__self__, "zero_max_issuer_path_length", zero_max_issuer_path_length)

    @property
    @pulumi.getter(name="isCa")
    def is_ca(self) -> bool:
        return pulumi.get(self, "is_ca")

    @property
    @pulumi.getter(name="maxIssuerPathLength")
    def max_issuer_path_length(self) -> int:
        return pulumi.get(self, "max_issuer_path_length")

    @property
    @pulumi.getter(name="nonCa")
    def non_ca(self) -> bool:
        return pulumi.get(self, "non_ca")

    @property
    @pulumi.getter(name="zeroMaxIssuerPathLength")
    def zero_max_issuer_path_length(self) -> bool:
        return pulumi.get(self, "zero_max_issuer_path_length")


@pulumi.output_type
class GetAuthorityConfigX509ConfigKeyUsageResult(dict):
    def __init__(__self__, *,
                 base_key_usages: Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageBaseKeyUsageResult'],
                 extended_key_usages: Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageExtendedKeyUsageResult'],
                 unknown_extended_key_usages: Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageResult']):
        pulumi.set(__self__, "base_key_usages", base_key_usages)
        pulumi.set(__self__, "extended_key_usages", extended_key_usages)
        pulumi.set(__self__, "unknown_extended_key_usages", unknown_extended_key_usages)

    @property
    @pulumi.getter(name="baseKeyUsages")
    def base_key_usages(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageBaseKeyUsageResult']:
        return pulumi.get(self, "base_key_usages")

    @property
    @pulumi.getter(name="extendedKeyUsages")
    def extended_key_usages(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageExtendedKeyUsageResult']:
        return pulumi.get(self, "extended_key_usages")

    @property
    @pulumi.getter(name="unknownExtendedKeyUsages")
    def unknown_extended_key_usages(self) -> Sequence['outputs.GetAuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageResult']:
        return pulumi.get(self, "unknown_extended_key_usages")


@pulumi.output_type
class GetAuthorityConfigX509ConfigKeyUsageBaseKeyUsageResult(dict):
    def __init__(__self__, *,
                 cert_sign: bool,
                 content_commitment: bool,
                 crl_sign: bool,
                 data_encipherment: bool,
                 decipher_only: bool,
                 digital_signature: bool,
                 encipher_only: bool,
                 key_agreement: bool,
                 key_encipherment: bool):
        pulumi.set(__self__, "cert_sign", cert_sign)
        pulumi.set(__self__, "content_commitment", content_commitment)
        pulumi.set(__self__, "crl_sign", crl_sign)
        pulumi.set(__self__, "data_encipherment", data_encipherment)
        pulumi.set(__self__, "decipher_only", decipher_only)
        pulumi.set(__self__, "digital_signature", digital_signature)
        pulumi.set(__self__, "encipher_only", encipher_only)
        pulumi.set(__self__, "key_agreement", key_agreement)
        pulumi.set(__self__, "key_encipherment", key_encipherment)

    @property
    @pulumi.getter(name="certSign")
    def cert_sign(self) -> bool:
        return pulumi.get(self, "cert_sign")

    @property
    @pulumi.getter(name="contentCommitment")
    def content_commitment(self) -> bool:
        return pulumi.get(self, "content_commitment")

    @property
    @pulumi.getter(name="crlSign")
    def crl_sign(self) -> bool:
        return pulumi.get(self, "crl_sign")

    @property
    @pulumi.getter(name="dataEncipherment")
    def data_encipherment(self) -> bool:
        return pulumi.get(self, "data_encipherment")

    @property
    @pulumi.getter(name="decipherOnly")
    def decipher_only(self) -> bool:
        return pulumi.get(self, "decipher_only")

    @property
    @pulumi.getter(name="digitalSignature")
    def digital_signature(self) -> bool:
        return pulumi.get(self, "digital_signature")

    @property
    @pulumi.getter(name="encipherOnly")
    def encipher_only(self) -> bool:
        return pulumi.get(self, "encipher_only")

    @property
    @pulumi.getter(name="keyAgreement")
    def key_agreement(self) -> bool:
        return pulumi.get(self, "key_agreement")

    @property
    @pulumi.getter(name="keyEncipherment")
    def key_encipherment(self) -> bool:
        return pulumi.get(self, "key_encipherment")


@pulumi.output_type
class GetAuthorityConfigX509ConfigKeyUsageExtendedKeyUsageResult(dict):
    def __init__(__self__, *,
                 client_auth: bool,
                 code_signing: bool,
                 email_protection: bool,
                 ocsp_signing: bool,
                 server_auth: bool,
                 time_stamping: bool):
        pulumi.set(__self__, "client_auth", client_auth)
        pulumi.set(__self__, "code_signing", code_signing)
        pulumi.set(__self__, "email_protection", email_protection)
        pulumi.set(__self__, "ocsp_signing", ocsp_signing)
        pulumi.set(__self__, "server_auth", server_auth)
        pulumi.set(__self__, "time_stamping", time_stamping)

    @property
    @pulumi.getter(name="clientAuth")
    def client_auth(self) -> bool:
        return pulumi.get(self, "client_auth")

    @property
    @pulumi.getter(name="codeSigning")
    def code_signing(self) -> bool:
        return pulumi.get(self, "code_signing")

    @property
    @pulumi.getter(name="emailProtection")
    def email_protection(self) -> bool:
        return pulumi.get(self, "email_protection")

    @property
    @pulumi.getter(name="ocspSigning")
    def ocsp_signing(self) -> bool:
        return pulumi.get(self, "ocsp_signing")

    @property
    @pulumi.getter(name="serverAuth")
    def server_auth(self) -> bool:
        return pulumi.get(self, "server_auth")

    @property
    @pulumi.getter(name="timeStamping")
    def time_stamping(self) -> bool:
        return pulumi.get(self, "time_stamping")


@pulumi.output_type
class GetAuthorityConfigX509ConfigKeyUsageUnknownExtendedKeyUsageResult(dict):
    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class GetAuthorityConfigX509ConfigPolicyIdResult(dict):
    def __init__(__self__, *,
                 object_id_paths: Sequence[int]):
        pulumi.set(__self__, "object_id_paths", object_id_paths)

    @property
    @pulumi.getter(name="objectIdPaths")
    def object_id_paths(self) -> Sequence[int]:
        return pulumi.get(self, "object_id_paths")


@pulumi.output_type
class GetAuthorityKeySpecResult(dict):
    def __init__(__self__, *,
                 algorithm: str,
                 cloud_kms_key_version: str):
        pulumi.set(__self__, "algorithm", algorithm)
        pulumi.set(__self__, "cloud_kms_key_version", cloud_kms_key_version)

    @property
    @pulumi.getter
    def algorithm(self) -> str:
        return pulumi.get(self, "algorithm")

    @property
    @pulumi.getter(name="cloudKmsKeyVersion")
    def cloud_kms_key_version(self) -> str:
        return pulumi.get(self, "cloud_kms_key_version")


@pulumi.output_type
class GetAuthoritySubordinateConfigResult(dict):
    def __init__(__self__, *,
                 certificate_authority: str,
                 pem_issuer_chains: Sequence['outputs.GetAuthoritySubordinateConfigPemIssuerChainResult']):
        pulumi.set(__self__, "certificate_authority", certificate_authority)
        pulumi.set(__self__, "pem_issuer_chains", pem_issuer_chains)

    @property
    @pulumi.getter(name="certificateAuthority")
    def certificate_authority(self) -> str:
        return pulumi.get(self, "certificate_authority")

    @property
    @pulumi.getter(name="pemIssuerChains")
    def pem_issuer_chains(self) -> Sequence['outputs.GetAuthoritySubordinateConfigPemIssuerChainResult']:
        return pulumi.get(self, "pem_issuer_chains")


@pulumi.output_type
class GetAuthoritySubordinateConfigPemIssuerChainResult(dict):
    def __init__(__self__, *,
                 pem_certificates: Sequence[str]):
        pulumi.set(__self__, "pem_certificates", pem_certificates)

    @property
    @pulumi.getter(name="pemCertificates")
    def pem_certificates(self) -> Sequence[str]:
        return pulumi.get(self, "pem_certificates")


