Configure Google Cloud CAS as a subordinate CA provider for Workload Identity Manager¶

In this tutorial, you'll use the gcloud CLI to configure Google Cloud Certificate Authority Service (Google Cloud CAS) as a subordinate CA provider for Workload Identity Manager. You'll create a dedicated subordinate CA pool, a subordinate CA chained to your existing root CA, and a service account that Workload Identity Manager will use to request certificates.

Step 1: Define environment variables¶

Using the following example, define your project's details, resource identities, and target regions as environment variables:

export PROJECT_ID="your-gcp-project-id"
export LOCATION="us-central1"
export SUBORDINATE_POOL_ID="firefly-intermediate-pool"
export SUBORDINATE_CA_ID="firefly-intermediate-ca"
export ROOT_POOL_ID="existing-root-pool"
export ROOT_CA_ID="existing-root-ca"
export ROOT_LOCATION="us-central1"
export SA_NAME="firefly-ca-sa"
export PRODUCT_SA="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

Step 2: Create the subordinate CA pool¶

1. Save the following issuance policy locally as firefly-pool-policy.yaml. This policy forces every certificate issued from the pool to be a subordinate CA certificate that Workload Identity Manager can use.

   firefly-pool-policy.yaml

   baselineValues:
     caOptions:
       isCa: true # (1)!
       maxIssuerPathLength: 0 # (2)!
     keyUsage:
       baseKeyUsage:
         certSign: true # (3)!
         digitalSignature: true
   

   1. Issues each certificate as a CA certificate.
   2. Prevents the CA from issuing certificates to other CAs.
   3. Allows the certificate to sign other certificates and signatures.

2. Create the pool with this issuance policy:

   gcloud privateca pools create $SUBORDINATE_POOL_ID \
     --location=$LOCATION \
     --tier=enterprise \
     --issuance-policy=firefly-pool-policy.yaml \
     --project=$PROJECT_ID
   

Step 3: Create and activate the subordinate CA¶

1. Create a subordinate CA in the pool, chained to your existing root CA:

   Adjust --key-algorithm and --validity based on your compliance guidelines. The subordinate CA's lifetime is determined by --validity and must be shorter than the remaining lifetime of the parent root CA.

   gcloud privateca subordinates create $SUBORDINATE_CA_ID \
     --pool=$SUBORDINATE_POOL_ID \
     --location=$LOCATION \
     --issuer-pool=$ROOT_POOL_ID \
     --issuer-ca=$ROOT_CA_ID \
     --issuer-location=$ROOT_LOCATION \
     --subject="CN=Firefly Intermediate CA, O=Example" \
     --key-algorithm=ec-p256-sha256 \
     --validity="P7D" \
     --project=$PROJECT_ID
   

2. A new subordinate CA starts in a disabled state. Activate it so it can sign incoming requests:

   gcloud privateca subordinates enable $SUBORDINATE_CA_ID \
     --pool=$SUBORDINATE_POOL_ID \
     --location=$LOCATION \
     --project=$PROJECT_ID
   

Step 4: Create a service account for Workload Identity Manager¶

Workload Identity Manager authenticates to Google Cloud CAS with a Google Cloud service account. Create the service account, grant it permission to request certificates from the pool, and download its key.

1. Create the service account:

   gcloud iam service-accounts create $SA_NAME \
     --display-name="Firefly Service Account" \
     --project=$PROJECT_ID
   

2. Grant the Certificate Requester and CA Service Operation Manager roles on the pool:

   gcloud privateca pools add-iam-policy-binding $SUBORDINATE_POOL_ID \
     --location=$LOCATION \
     --member="serviceAccount:$PRODUCT_SA" \
     --role="roles/privateca.certificateRequester" \
     --project=$PROJECT_ID
   
   gcloud privateca pools add-iam-policy-binding $SUBORDINATE_POOL_ID \
     --location=$LOCATION \
     --member="serviceAccount:$PRODUCT_SA" \
     --role="roles/privateca.caManager" \
     --project=$PROJECT_ID
   

3. Grant the Template User role at the project level:

   gcloud projects add-iam-policy-binding $PROJECT_ID \
     --member="serviceAccount:$PRODUCT_SA" \
     --role="roles/privateca.templateUser"
   

4. Generate and download the service account key:

   Protect the key file

   firefly-sa-key.json is a credential that grants access to your CA pool. Store it securely and don't commit it to source control. You'll paste its contents when you create the Google Cloud Certificate Authority Service connector.

   gcloud iam service-accounts keys create firefly-sa-key.json \
     --iam-account=$PRODUCT_SA \
     --project=$PROJECT_ID
   

What's next?¶

Now that Google Cloud CAS is configured, create a Google Cloud CAS connector in Certificate Manager - SaaS using your project, region, CA pool, and the firefly-sa-key.json file you downloaded. Then create a Sub CA Provider that uses the connector.

Related links¶

• Certificate authority accounts
• Sub CA Providers
• Create a CAS connector