Google Certificate Authority API

Name: Certificate Authority API
Brand: Certificate Authority API
Availability: InStock

✓ Official Vendor SpecSecuritySecrets Managementoauth225 Endpoints

Install Jentic One Beta

Connect the Certificate Authority API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Certificate Authority API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Certificate Authority API.

Create CA pools and provision root or subordinate certificate authorities under a Google Cloud project

Issue private X.509 certificates against a CA pool using configurable certificate templates

Revoke previously issued certificates and fetch the resulting certificate revocation lists

GET STARTED

Start building with Certificate Authority API

Explore with Jentic

View OpenAPI Document

For Agents

Issue, revoke, and manage X.509 certificates from private certificate authorities on Google Cloud, including CA pool and template lifecycle operations.

Use for: I need to issue a private TLS certificate from a Google Cloud CA pool, Revoke a compromised certificate from our internal certificate authority, List all certificates issued by a specific CA pool in the last 30 days, Create a new subordinate certificate authority under an existing root CA

Not supported: Does not handle public browser-trusted certificate issuance, ACME account binding, or key generation in HSMs - use for Google Cloud private certificate authority operations only.

Use Cases

Patterns agents use Certificate Authority API for, with concrete tasks.

★ Internal Service mTLS

Issue short-lived X.509 certificates for mutual TLS between microservices on Google Cloud without operating bespoke CA software. Certificate Authority Service handles key protection, audit logging, and CRL publication while certificate templates pin key usages and SANs to internal naming conventions.

Create a CA pool in DevOps tier, then issue a 90-day certificate for service.internal.example.com using a template that enforces serverAuth and clientAuth extended key usages.

Device and IoT PKI

Provision unique device certificates for fleets of IoT or edge devices using a private CA hierarchy hosted on Google Cloud. The API supports template-based issuance and revocation so devices can be rotated, retired, or quarantined without rebuilding the trust chain.

Issue a certificate with a device serial number embedded as the subject CN, then later revoke it with reason key_compromise when the device is decommissioned.

Compliance and Audit Reporting

Generate periodic compliance reports on certificate issuance, expiry, and revocation across all CA pools in an organization. The API exposes structured certificate metadata and CA state so audit pipelines can verify issuance policy enforcement and detect drift.

List all certificates issued by ca-pool projects/p/locations/us-central1/caPools/prod where state is ENABLED, then export issuer, subject, and notAfter fields for the audit team.

Agent-Driven CA Lifecycle Management

An AI operations agent uses Jentic to discover and call Certificate Authority Service operations on behalf of platform engineers - provisioning new CAs, rotating subordinate CAs, and revoking certificates in response to security alerts without needing direct console access.

Search Jentic for revoke a certificate, load the schema for projects.locations.caPools.certificates.revoke, and call it for the certificate referenced in a SOC alert.

Key Endpoints

25 endpoints — the google cloud certificate authority service api lets you provision, manage, and operate private certificate authorities (cas) at scale on google cloud.

METHOD

PATH

DESCRIPTION

POST

/v1/{+caPool}:fetchCaCerts

Fetch CA chain certificates for a CA pool

POST

/v1/{+name}:activate

Activate a subordinate certificate authority

POST

/v1/{+name}:disable

Disable a certificate authority

POST

/v1/{+name}:enable

Enable a certificate authority

POST

/v1/{+name}:revoke

Revoke a previously issued certificate

POST

/v1/{+name}:undelete

Undelete a certificate authority within its retention window

POST

/v1/{+caPool}:fetchCaCerts

Fetch CA chain certificates for a CA pool

POST

/v1/{+name}:activate

Activate a subordinate certificate authority

POST

/v1/{+name}:disable

Disable a certificate authority

POST

/v1/{+name}:enable

Enable a certificate authority

POST

/v1/{+name}:revoke

Revoke a previously issued certificate

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Google OAuth credential is stored once, encrypted, by your own Jentic One instance and a scoped access token is injected at execution time. The credential never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'issue a certificate' or 'revoke a certificate from a CA pool', and Jentic returns the matching Certificate Authority API operation with its input schema so the agent calls the right endpoint without browsing the Google Cloud reference docs.

Time to first call

FAQs

Specific to using Certificate Authority API through Jentic.

What authentication does the Certificate Authority API use?

The API uses Google OAuth 2.0 with the cloud-platform scope, sent as a Bearer token in the Authorization header. Through Jentic the OAuth credentials are stored in the vault and short-lived access tokens are injected at call time, so the raw refresh token never enters the agent context.

Can I issue certificates for arbitrary domains with this API?

No, this API issues certificates from your own private CAs, so issuance is constrained by the CA pool issuance policy and any certificate template attached to the call. It is not a public CA and the certificates it issues are not trusted by browsers by default.

What are the rate limits for the Certificate Authority API?

Quotas are enforced per Google Cloud project and are configurable in the Cloud console under IAM and admin quotas. Default per-minute write quotas apply to certificate issuance and CA mutation operations, and bulk issuance should batch requests rather than fire them in tight loops.

How do I revoke a certificate through Jentic?

Search Jentic for revoke a certificate, load the schema for the projects.locations.caPools.certificates.revoke operation which maps to POST /v1/{+name}:revoke, then execute it with the full certificate resource name and a reason such as KEY_COMPROMISE.

Is the Certificate Authority API free?

No, Certificate Authority Service is billed per CA per month based on tier (DevOps or Enterprise) plus a per-certificate issuance fee. Pricing is published on the Google Cloud pricing page and applies whether the API is called directly or via Jentic.

How do I fetch the trust chain CA certificates for a CA pool?

Call POST /v1/{+caPool}:fetchCaCerts with the full CA pool resource name. The response contains the PEM-encoded CA certificates that relying parties need to trust certificates issued by the pool.

Can I limit what my agent is allowed to do with the Certificate Authority API?

Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use, and the API puts the resource name in the URL path (/v1/{+name} and /v1/{+caPool}), so you can pin the agent to a single CA pool or certificate authority. You also choose which operations it may call, so read-only work like fetching CA chain certificates can be allowed while state-changing calls such as revoking a certificate, disabling a CA, or activating a subordinate CA stay off unless you add them. The scoped access token is injected only at execution time, so the agent can act on exactly the resources and operations you permit and nothing more.

Google Certificate Authority API

Connect the Certificate Authority API to your agent

Capabilities

Start building with Certificate Authority API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs