To Configure Google Cloud CAS

1. Define environment variables for the commands that follow.

   export PROJECT_ID="your-gcp-project-id"
   export LOCATION="us-central1"
   export SUBORDINATE_POOL_ID="firefly-intermediate-pool"
   export SUBORDINATE_CA_ID="firefly-intermediate-ca"
   export ROOT_POOL_ID="existing-root-pool"
   export ROOT_CA_ID="existing-root-ca"
   export ROOT_LOCATION="us-central1"
   export SA_NAME="firefly-ca-sa"
   export PRODUCT_SA="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

2. Create the subordinate CA pool with an issuance policy.
   1. Save the following issuance policy locally as firefly-pool-policy.yaml. This policy forces every certificate issued from the pool to be a subordinate CA certificate that Distributed Issuer can use.

      baselineValues:
        caOptions:
          isCa: true                    # Issues each certificate as a CA certificate.
          maxIssuerPathLength: 0        # Prevents the CA from issuing certificates to other CAs.
        keyUsage:
          baseKeyUsage:
            certSign: true              # Allows the certificate to sign other certificates.
            digitalSignature: true

   2. Create the pool.

      gcloud privateca pools create $SUBORDINATE_POOL_ID \
        --location=$LOCATION \
        --tier=enterprise \
        --issuance-policy=firefly-pool-policy.yaml \
        --project=$PROJECT_ID

3. Create and activate the subordinate CA.
   1. Create a subordinate CA in the pool, chained to your existing root CA. Adjust --key-algorithm and --validity to match your compliance guidelines.
      Note: The subordinate CA's lifetime, set by --validity, must be shorter than the remaining lifetime of the parent root CA.

      gcloud privateca subordinates create $SUBORDINATE_CA_ID \
        --pool=$SUBORDINATE_POOL_ID \
        --location=$LOCATION \
        --issuer-pool=$ROOT_POOL_ID \
        --issuer-ca=$ROOT_CA_ID \
        --issuer-location=$ROOT_LOCATION \
        --subject="CN=Firefly Intermediate CA, O=Example" \
        --key-algorithm=ec-p256-sha256 \
        --validity="P7D" \
        --project=$PROJECT_ID

   2. A new subordinate CA starts in a disabled state. Activate it so it can sign incoming requests.

      gcloud privateca subordinates enable $SUBORDINATE_CA_ID \
        --pool=$SUBORDINATE_POOL_ID \
        --location=$LOCATION \
        --project=$PROJECT_ID

4. Create a service account for Distributed Issuer to authenticate to Google Cloud CAS, grant it permission to request certificates, and download its key.
   1. Create the service account.

      gcloud iam service-accounts create $SA_NAME \
        --display-name="Firefly Service Account" \
        --project=$PROJECT_ID

   2. Grant the Certificate Requester and CA Service Operation Manager roles on the pool.

      gcloud privateca pools add-iam-policy-binding $SUBORDINATE_POOL_ID \
        --location=$LOCATION \
        --member="serviceAccount:$PRODUCT_SA" \
        --role="roles/privateca.certificateRequester" \
        --project=$PROJECT_ID
      
      gcloud privateca pools add-iam-policy-binding $SUBORDINATE_POOL_ID \
        --location=$LOCATION \
        --member="serviceAccount:$PRODUCT_SA" \
        --role="roles/privateca.caManager" \
        --project=$PROJECT_ID

   3. Grant the Template User role at the project level.

      gcloud projects add-iam-policy-binding $PROJECT_ID \
        --member="serviceAccount:$PRODUCT_SA" \
        --role="roles/privateca.templateUser"

   4. Generate and download the service account key.

      gcloud iam service-accounts keys create firefly-sa-key.json \
        --iam-account=$PRODUCT_SA \
        --project=$PROJECT_ID

      Warning: firefly-sa-key.json is a credential that grants access to your CA pool. Store it securely and don't commit it to source control. You paste its contents when you create the Google Cloud CAS connector.

What's Next?