Use the Google Cloud Certificate Connector

Legacy configuration

If given, the connector will use the legacy protocol for the requests associated with the Pub/Sub subscription ID that is included in this configuration. The available features are limited to those provided in this configuration. A given subscription ID must appear in either the adapter or legacy configuration, but not both.

Adapter configuration

If given, the connector will use the new protocol for requests associated with the Pub/Sub subscription IDs that are included in this configuration and also configure the connector itself with the attributes given in this configuration.

string

This is the name of the subscription ID the connector listens to for requests.

string

This is the name of the topic which the connector sends the issued certificates to.

float

The connector uses this parameter to control the pace it sends its traffic to the CA server. If this value is not found the default value of 2 will be used.

string

The unique identifier that the connector uses so it can be identified with this ID. It should be unique across all connectors in the same project. If not present, the connector generates a random GUID to be identified with.

[]string

The fully qualified subscription names that the connector listens to. The subscriptions must be in the format projects/<projectid>/subscriptions/<id>. All subscriptions in this list must be from the same project.

string

The file name of the key file that the connector uses to authenticate. The key file is expected to be in the same directory as the connector executable file. The connector uses this key file to authenticate Google services used by the new flow—listening to subscriptions given in the request_subscription_ids attribute and invoking the CertificateProvisioningAPI.

string

This attribute describes the proxy mode that the connector uses to route its traffic. Possible modes currently are:

• system: Uses what is configured on the system level. The connector in this mode looks for proxy settings in the following order:
  • The IE settings configured for the user—the user here is the Service Account the connector service is configured to log on as.
  • Machine level settings (winhttp) settings
  • User level registries (ProxyServer, and so on) under HKU\<user-
id>\Software\Microsoft\
Windows\CurrentVersion\
Internet Settings\
• direct: The connector will connect directly disregarding any proxy settings.
• fixed_servers: If given, the connector uses the static values found in proxy_server and proxy_bypass_list for all requests.

If proxy_mode is not given, system is used as the default.

string

It's used in case fixed_servers is used as the proxy_mode. An empty bypass list will be used if omitted.

string

This describes the level of logs that the connector should output. Possible values are: debug, info, warn, error. The connector outputs any event at the given level and higher. If omitted, info is used as the default.

int

The connector can process a limited number of requests simultaneously, defaulting to 100. When this limit is reached, no new requests are accepted until a spot is freed by completing an enrollment or timing out. Unresponsive client devices or CAs block enrollments, occupying spots until resolved. Higher limits increase memory usage.

string

The unique identifier of the configuration. The connector uses this configuration for certificate profiles with matching certificate provisioning profile config reference identifier.

struct

• The fully distinguished name of the subject. It has the following attributes—at least one attribute needs to be provided:
  • common_name: string, optional
  • organization: string, optional
  • organizational_unit: []string, optional
  • locality: string, optional
  • state: string, optional
  • country: string, optional

Required if subject_name is not given.

[]subject_alt_name

This is an object made of two required keys. The first key type can be one of ("USER_PRINCIPLE", "RFC822", "DNS", "URI"). The second key is name and should hold the equivalent string value of the chosen type.

The connector uses this parameter to control the pace it sends its traffic to the CA server. If this value is not found, the default value of 2 is used.

Note: subject_name and subject_alt_names values can be a placeholder that will be replaced with a value based on user and device attributes, if available. The placeholder can be any of the following :

• ${USER_EMAIL}—Full user email.
• ${USER_EMAIL_NAME}—First part of the email before the "@".
• ${USER_ID}—Same as ${USER_EMAIL_NAME}.
• ${USER_EMAIL_DOMAIN}—Second part of the email after the "@".
• ${USER_DOMAIN}—Same as ${USER_EMAIL_DOMAIN}.
• ${DEVICE_SERIAL_NUMBER}—Device serial number.
• ${DEVICE_DIRECTORY_ID}—Device directory ID, same as the Admin console's Directory API ID in the ChromeOS > Devices tab.

[]string

Each usage specifies a single key usage. Possible values are "KEY_ENCIPHERMENT" and "SIGNING".

[]string

Each usage specifies a single key usage. Possible values are "CLIENT_AUTH" and "SERVER_AUTH"

string

The template name to be requested from the CA.

The name given here must match a template name—not display name—in the CA.

string

The signature algorithm that the client device, holding the private key, will be asked to sign the Certificate Signing Request (CSR) with. The value given here should be compatible with the key type selected in the Admin console. Currently, only one signature algorithm is offered per key type. Possible values are "RSA_SHA256", "ECDSA_SHA256"

string

The CA connection type. Only SCEP is supported at the moment.

string

The unique identifier of the configuration. The connector chooses to use this configuration for CA communication when it receives a certificate provisioning process with a matching certificate authority connection configuration identifier.

string

The URL of the CA server which the connector reaches for to request a certificate.

float

The connector uses this parameter to control the pace it sends its traffic to the CA server. If this value is not found the default value of 2 is used.

string

This specifies the file with the static challenge for certificate requests from the CA.

The connector's service account needs read permissions for this file.

Only one of challenge_filename or dynamic_challenge can be configured per CA.

Dynamic challenge configuration

Only one of challenge_filename or dynamic_challenge can be set in a single CA configuration.

string

The URL of the endpoint that the connector uses to request a challenge.

int

The number of fetchers working simultaneously to fetch challenges from the challenge endpoint. This number should always be lower than the number of challenges the endpoint can give out before running out of challenges. The default value is 2.

float

The number of minutes each challenge fetcher waits before retrying to fetch a new challenge after a failed attempt. The value cannot be below 0.016 ~= 1 second. The default value is 1 minute.

int

The number of minutes a challenge is valid for. The default value is 60.

Challenge parser configuration

If not given, default values will be used. The default values are based on the MS AD/CS admin page behavior.

Kerberos configuration

If not given, the connector expects no authentication requirement when accessing the challenge endpoint.

boolean

The flag that indicates whether the HTML retrieved from the challenge endpoint should be converted to UTF-8. The default value is true.

boolean

The flag that indicates whether the password is wrapped in spaces. The default value is true.

string

The XPath expression that points to the challenge in the HTML page returned by the challenge endpoint. The default value is "//*[@id="locPageFont"]/p[4]/b".

string

The XPath to an element that, if found, indicates that the challenge server has run out of enrollment passwords. This element should only appear on that specific error page. The default value is "//*[@id="locPageFont"]/ul/li[3]".

string

The file name of the Kerberos configuration file.

string

The file name of the keytab file.

string

The realm name the connector will use. This should match a realm entry in the Kerberos configuration file.

string

The name of the Windows Service Account (SA) that the connector will use for Kerberos authentication. This must match the SA from which the keytab file is generated.

string

The Service Principal Name (SPN) of the challenge endpoint for which the connector will request a service ticket. If an empty string is given (""), the connector will deduce the SPN from the challenge endpoint URL.

string

The flag that indicates whether the client should use the Flexible Authentication Secure Tunneling (FAST) algorithm. This option needs to be enabled on the server machine first. The default value is false.