This page shows how to get started with the Cloud Client Libraries for the
Certificate Authority Service API. Client libraries make it easier to access
Google Cloud APIs from a supported language. Although you can use
Google Cloud APIs directly by making raw requests to the server, client
libraries provide simplifications that significantly reduce the amount of code
you need to write.

Read more about the Cloud Client Libraries
and the older Google API Client Libraries in
[Client libraries explained](https://docs.cloud.google.com/apis/docs/client-libraries-explained).

## Install the client library

### C++

See [Setting up a C++ development environment](https://docs.cloud.google.com/cpp/docs/setup)
for details about this client library's requirements and install dependencies.

### C#

Install the [Google.Cloud.Security.PrivateCA.V1](https://www.nuget.org/packages/Google.Cloud.Security.PrivateCA.V1/) package from NuGet.

For more information, see [Setting Up a C# Development Environment](https://docs.cloud.google.com/dotnet/docs/setup).

### Go

```
go get cloud.google.com/go/security/privateca/apiv1
```

For more information, see [Setting Up a Go Development Environment](https://docs.cloud.google.com/go/docs/setup).

### Java

If you are using [Maven](https://maven.apache.org/), add
the following to your `pom.xml` file. For more information about
BOMs, see [The Google Cloud Platform Libraries BOM](https://cloud.google.com/java/docs/bom).

    <dependencyManagement>
      <dependencies>
        <dependency>
          <groupId>com.google.cloud</groupId>
          <artifactId>libraries-bom</artifactId>
          <version>26.90.0</version>
          <type>pom</type>
          <scope>import</scope>
        </dependency>
      </dependencies>
    </dependencyManagement>

    <dependencies>
      <dependency>
        <groupId>com.google.cloud</groupId>
        <artifactId>google-cloud-security-private-ca</artifactId>
      </dependency>
    </dependencies>

If you are using [Gradle](https://gradle.org/),
add the following to your dependencies:

    implementation platform('com.google.cloud:libraries-bom:26.90.0')

    implementation 'com.google.cloud:google-cloud-security-private-ca'

If you are using [sbt](https://www.scala-sbt.org/), add
the following to your dependencies:

    libraryDependencies += "com.google.cloud" % "google-cloud-security-private-ca" % "2.103.0"

If you're using Visual Studio Code or IntelliJ, you can add client libraries to your
project using the following IDE plugins:

- [Cloud Code for VS Code](https://docs.cloud.google.com/code/docs/vscode/client-libraries)
- [Cloud Code for IntelliJ](https://docs.cloud.google.com/code/docs/intellij/client-libraries)

The plugins provide additional functionality, such as key management for service accounts. Refer
to each plugin's documentation for details.

For more information, see [Setting Up a Java Development Environment](https://docs.cloud.google.com/java/docs/setup).

### Node.js

```
npm install @google-cloud/security-private-ca
```

For more information, see [Setting Up a Node.js Development Environment](https://docs.cloud.google.com/nodejs/docs/setup).

### PHP

```
composer require google/cloud-security-private-ca
```

For more information, see [Using PHP on Google Cloud](https://docs.cloud.google.com/php/docs).

### Python

```
pip install --upgrade google-cloud-private-ca
```

For more information, see [Setting Up a Python Development Environment](https://docs.cloud.google.com/python/docs/setup).

### Ruby

```
gem install google-cloud-security-private_ca
```

For more information, see [Setting Up a Ruby Development Environment](https://docs.cloud.google.com/ruby/docs/setup).

<br />

## Set up authentication

To authenticate calls to Google Cloud APIs, client libraries support [Application Default Credentials (ADC)](https://docs.cloud.google.com/docs/authentication/application-default-credentials); the libraries look for credentials in a set of defined locations and use those credentials to authenticate requests to the API. With ADC, you can make credentials available to your application in a variety of environments, such as local development or production, without needing to modify your application code.

For production environments, the way you set up ADC depends on the service
and context. For more information, see [Set up Application Default Credentials](https://docs.cloud.google.com/docs/authentication/provide-credentials-adc).

For a local development environment, you can set up ADC with the credentials
that are associated with your Google Account:

1.
   [Install](https://docs.cloud.google.com/sdk/docs/install) the Google Cloud CLI.

   After installation,
   [initialize](https://docs.cloud.google.com/sdk/docs/initializing) the Google Cloud CLI by running the following command:

   ```bash
   gcloud init
   ```


   If you're using an external identity provider (IdP), you must first
   [sign in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud).
2.

   If you're using a local shell, then create local authentication credentials for your user
   account:

   ```bash
   gcloud auth application-default login
   ```

   You don't need to do this if you're using Cloud Shell.


   If an authentication error is returned, and you are using an external identity provider
   (IdP), confirm that you have
   [signed in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud).


   A sign-in screen appears. After you sign in, your credentials are stored in the
   [local credential file used by ADC](https://docs.cloud.google.com/docs/authentication/application-default-credentials#personal).

## Use the client library


The following example shows how to use the client library.

### C++


    #include "google/cloud/privateca/v1/certificate_authority_client.h"
    #include "google/cloud/location.h"
    #include <iostream>

    int main(int argc, char* argv[]) try {
      if (argc != 3) {
        std::cerr << "Usage: " << argv[0] << " project-id location-id\n";
        return 1;
      }

      auto const location = google::cloud::Location(argv[1], argv[2]);

      namespace privateca = ::google::cloud::privateca_v1;
      auto client = privateca::CertificateAuthorityServiceClient(
          privateca::MakeCertificateAuthorityServiceConnection());

      for (auto ca_pool : client.ListCaPools(location.FullName())) {
        if (!ca_pool) throw std::move(ca_pool).status();
        std::cout << ca_pool->DebugString() << "\n";
      }

      return 0;
    } catch (google::cloud::Status const& status) {
      std::cerr << "google::cloud::Status thrown: " << status << "\n";
      return 1;
    }

### Go

    import (
    	"context"
    	"fmt"
    	"io"

    	privateca "cloud.google.com/go/security/privateca/apiv1"
    	"cloud.google.com/go/security/privateca/apiv1/privatecapb"
    	"google.golang.org/protobuf/types/known/durationpb"
    )

    // Create Certificate Authority which is the root CA in the given CA Pool. This CA will be
    // responsible for signing certificates within this pool.
    func createCa(
    	w io.Writer,
    	projectId string,
    	location string,
    	caPoolId string,
    	caId string,
    	caCommonName string,
    	org string,
    	caDuration int64) error {
    	// projectId := "your_project_id"
    	// location := "us-central1"		// For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
    	// caPoolId := "ca-pool-id"			// The CA Pool id under which the CA should be created.
    	// caId := "ca-id"					// A unique id/name for the ca.
    	// caCommonName := "ca-name"		// A common name for your certificate authority.
    	// org := "ca-org"					// The name of your company for your certificate authority.
    	// ca_duration := int64(31536000)	// The validity of the certificate authority in seconds.

    	ctx := context.Background()
    	caClient, err := privateca.https://docs.cloud.google.com/go/docs/reference/cloud.google.com/go/security/latest/privateca/apiv1.html#cloud_google_com_go_security_privateca_apiv1_CertificateAuthorityClient_NewCertificateAuthorityClient(ctx)
    	if err != nil {
    		return fmt.Errorf("NewCertificateAuthorityClient creation failed: %w", err)
    	}
    	defer caClient.https://docs.cloud.google.com/go/docs/reference/cloud.google.com/go/security/latest/privateca/apiv1.html#cloud_google_com_go_security_privateca_apiv1_CertificateAuthorityClient_Close()

    	// Set the types of Algorithm used to create a cloud KMS key.
    	keySpec := &privatecapb.CertificateAuthority_KeyVersionSpec{
    		KeyVersion: &privatecapb.CertificateAuthority_KeyVersionSpec_Algorithm{
    			Algorithm: privatecapb.https://docs.cloud.google.com/go/docs/reference/cloud.google.com/go/security/latest/privateca/apiv1/privatecapb.html#cloud_google_com_go_security_privateca_apiv1_privatecapb_CertificateAuthority_SIGN_HASH_ALGORITHM_UNSPECIFIED_CertificateAuthority_RSA_PSS_2048_SHA256_CertificateAuthority_RSA_PSS_3072_SHA256_CertificateAuthority_RSA_PSS_4096_SHA256_CertificateAuthority_RSA_PKCS1_2048_SHA256_CertificateAuthority_RSA_PKCS1_3072_SHA256_CertificateAuthority_RSA_PKCS1_4096_SHA256_CertificateAuthority_EC_P256_SHA256_CertificateAuthority_EC_P384_SHA384,
    		},
    	}

    	// Set CA subject config.
    	subjectConfig := &privatecapb.CertificateConfig_SubjectConfig{
    		Subject: &privatecapb.Subject{
    			CommonName:   caCommonName,
    			Organization: org,
    		},
    	}

    	// Set the key usage options for X.509 fields.
    	isCa := true
    	x509Parameters := &privatecapb.X509Parameters{
    		KeyUsage: &privatecapb.KeyUsage{
    			BaseKeyUsage: &privatecapb.KeyUsage_KeyUsageOptions{
    				CrlSign:  true,
    				CertSign: true,
    			},
    		},
    		CaOptions: &privatecapb.X509Parameters_CaOptions{
    			IsCa: &isCa,
    		},
    	}

    	// Set certificate authority settings.
    	// Type: SELF_SIGNED denotes that this CA is a root CA.
    	ca := &privatecapb.CertificateAuthority{
    		Type:    privatecapb.https://docs.cloud.google.com/go/docs/reference/cloud.google.com/go/security/latest/privateca/apiv1/privatecapb.html#cloud_google_com_go_security_privateca_apiv1_privatecapb_CertificateAuthority_TYPE_UNSPECIFIED_CertificateAuthority_SELF_SIGNED_CertificateAuthority_SUBORDINATE,
    		KeySpec: keySpec,
    		Config: &privatecapb.CertificateConfig{
    			SubjectConfig: subjectConfig,
    			X509Config:    x509Parameters,
    		},
    		Lifetime: &durationpb.Duration{
    			Seconds: caDuration,
    		},
    	}

    	fullCaPoolName := fmt.Sprintf("projects/%s/locations/%s/caPools/%s", projectId, location, caPoolId)

    	// Create the CreateCertificateAuthorityRequest.
    	// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#CreateCertificateAuthorityRequest.
    	req := &privatecapb.CreateCertificateAuthorityRequest{
    		Parent:                 fullCaPoolName,
    		CertificateAuthorityId: caId,
    		CertificateAuthority:   ca,
    	}

    	op, err := caClient.CreateCertificateAuthority(ctx, req)
    	if err != nil {
    		return fmt.Errorf("CreateCertificateAuthority failed: %w", err)
    	}

    	if _, err = op.Wait(ctx); err != nil {
    		return fmt.Errorf("CreateCertificateAuthority failed during wait: %w", err)
    	}

    	fmt.Fprintf(w, "CA %s created", caId)

    	return nil
    }

### Java


    import com.google.api.core.https://docs.cloud.google.com/java/docs/reference/api-common/latest/com.google.api.core.ApiFuture.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CaPoolName.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.html.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.KeyVersionSpec.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.html.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.SignHashAlgorithm.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.html.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.SubjectConfig.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CreateCertificateAuthorityRequest.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.html.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.Subject.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.html;
    import com.google.cloud.security.privateca.v1.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.html.https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.CaOptions.html;
    import com.google.longrunning.https://docs.cloud.google.com/java/docs/reference/proto-google-common-protos/latest/com.google.longrunning.Operation.html;
    import com.google.protobuf.https://docs.cloud.google.com/java/docs/reference/protobuf/latest/com.google.protobuf.Duration.html;
    import java.io.IOException;
    import java.util.concurrent.ExecutionException;

    public class CreateCertificateAuthority {

      public static void main(String[] args)
          throws InterruptedException, ExecutionException, IOException {
        // TODO(developer): Replace these variables before running the sample.
        // location: For a list of locations, see:
        // https://cloud.google.com/certificate-authority-service/docs/locations
        // poolId: Set it to the CA Pool under which the CA should be created.
        // certificateAuthorityName: Unique name for the CA.
        String project = "your-project-id";
        String location = "ca-location";
        String poolId = "ca-pool-id";
        String certificateAuthorityName = "certificate-authority-name";
        createCertificateAuthority(project, location, poolId, certificateAuthorityName);
      }

      // Create Certificate Authority which is the root CA in the given CA Pool.
      public static void createCertificateAuthority(
          String project, String location, String poolId, String certificateAuthorityName)
          throws InterruptedException, ExecutionException, IOException {
        // Initialize client that will be used to send requests. This client only needs to be created
        // once, and can be reused for multiple requests. After completing all of your requests, call
        // the `certificateAuthorityServiceClient.close()` method on the client to safely
        // clean up any remaining background resources.
        try (https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient.html certificateAuthorityServiceClient =
            https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient.html.create()) {

          String commonName = "common-name";
          String orgName = "org-name";
          int caDuration = 100000; // Validity of this CA in seconds.

          // Set the type of Algorithm.
          https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.KeyVersionSpec.html keyVersionSpec =
              https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.KeyVersionSpec.html.newBuilder().https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.KeyVersionSpec.Builder.html#com_google_cloud_security_privateca_v1_CertificateAuthority_KeyVersionSpec_Builder_setAlgorithm_com_google_cloud_security_privateca_v1_CertificateAuthority_SignHashAlgorithm_(https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.SignHashAlgorithm.html.RSA_PKCS1_4096_SHA256).build();

          // Set CA subject config.
          https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.SubjectConfig.html subjectConfig =
              https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.SubjectConfig.html.newBuilder()
                  .setSubject(
                      https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.Subject.html.newBuilder().https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.Subject.Builder.html#com_google_cloud_security_privateca_v1_Subject_Builder_setCommonName_java_lang_String_(commonName).https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.Subject.Builder.html#com_google_cloud_security_privateca_v1_Subject_Builder_setOrganization_java_lang_String_(orgName).build())
                  .build();

          //  Set the key usage options for X.509 fields.
          https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.html x509Parameters =
              https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.html.newBuilder()
                  .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.Builder.html#com_google_cloud_security_privateca_v1_X509Parameters_Builder_setKeyUsage_com_google_cloud_security_privateca_v1_KeyUsage_(
                      https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.html.newBuilder()
                          .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.Builder.html#com_google_cloud_security_privateca_v1_KeyUsage_Builder_setBaseKeyUsage_com_google_cloud_security_privateca_v1_KeyUsage_KeyUsageOptions_(
                              https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions.html.newBuilder().https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions.Builder.html#com_google_cloud_security_privateca_v1_KeyUsage_KeyUsageOptions_Builder_setCrlSign_boolean_(true).https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.KeyUsage.KeyUsageOptions.Builder.html#com_google_cloud_security_privateca_v1_KeyUsage_KeyUsageOptions_Builder_setCertSign_boolean_(true).build())
                          .build())
                  .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.Builder.html#com_google_cloud_security_privateca_v1_X509Parameters_Builder_setCaOptions_com_google_cloud_security_privateca_v1_X509Parameters_CaOptions_(https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.CaOptions.html.newBuilder().https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.X509Parameters.CaOptions.Builder.html#com_google_cloud_security_privateca_v1_X509Parameters_CaOptions_Builder_setIsCa_boolean_(true).build())
                  .build();

          // Set certificate authority settings.
          https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.html certificateAuthority =
              https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.html.newBuilder()
                  // CertificateAuthority.Type.SELF_SIGNED denotes that this CA is a root CA.
                  .setType(https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.html.Type.SELF_SIGNED)
                  .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthority.Builder.html#com_google_cloud_security_privateca_v1_CertificateAuthority_Builder_setKeySpec_com_google_cloud_security_privateca_v1_CertificateAuthority_KeyVersionSpec_(keyVersionSpec)
                  .setConfig(
                      https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.html.newBuilder()
                          .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.Builder.html#com_google_cloud_security_privateca_v1_CertificateConfig_Builder_setSubjectConfig_com_google_cloud_security_privateca_v1_CertificateConfig_SubjectConfig_(subjectConfig)
                          .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateConfig.Builder.html#com_google_cloud_security_privateca_v1_CertificateConfig_Builder_setX509Config_com_google_cloud_security_privateca_v1_X509Parameters_(x509Parameters)
                          .build())
                  // Set the CA validity duration.
                  .setLifetime(https://docs.cloud.google.com/java/docs/reference/protobuf/latest/com.google.protobuf.Duration.html.newBuilder().setSeconds(caDuration).build())
                  .build();

          // Create the CertificateAuthorityRequest.
          https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CreateCertificateAuthorityRequest.html certificateAuthorityRequest =
              https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CreateCertificateAuthorityRequest.html.newBuilder()
                  .setParent(https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CaPoolName.html.of(project, location, poolId).toString())
                  .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CreateCertificateAuthorityRequest.Builder.html#com_google_cloud_security_privateca_v1_CreateCertificateAuthorityRequest_Builder_setCertificateAuthorityId_java_lang_String_(certificateAuthorityName)
                  .setCertificateAuthority(certificateAuthority)
                  .build();

          // Create Certificate Authority.
          ApiFuture<Operation> futureCall =
              certificateAuthorityServiceClient
                  .https://docs.cloud.google.com/java/docs/reference/google-cloud-security-private-ca/latest/com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient.html#com_google_cloud_security_privateca_v1_CertificateAuthorityServiceClient_createCertificateAuthorityCallable__()
                  .futureCall(certificateAuthorityRequest);
          https://docs.cloud.google.com/java/docs/reference/proto-google-common-protos/latest/com.google.longrunning.Operation.html response = futureCall.get();

          if (response.https://docs.cloud.google.com/java/docs/reference/proto-google-common-protos/latest/com.google.longrunning.Operation.html#com_google_longrunning_Operation_hasError__()) {
            System.out.println("Error while creating CA !" + response.https://docs.cloud.google.com/java/docs/reference/proto-google-common-protos/latest/com.google.longrunning.Operation.html#com_google_longrunning_Operation_getError__());
            return;
          }

          System.out.println(
              "Certificate Authority created successfully : " + certificateAuthorityName);
        }
      }
    }

### Python

    import google.cloud.security.privateca_v1 as privateca_v1
    from google.protobuf import duration_pb2


    def create_certificate_authority(
        project_id: str,
        location: str,
        ca_pool_name: str,
        ca_name: str,
        common_name: str,
        organization: str,
        ca_duration: int,
    ) -> None:
        """
        Create Certificate Authority which is the root CA in the given CA Pool. This CA will be
        responsible for signing certificates within this pool.

        Args:
            project_id: project ID or project number of the Cloud project you want to use.
            location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.
            ca_pool_name: set it to the CA Pool under which the CA should be created.
            ca_name: unique name for the CA.
            common_name: a title for your certificate authority.
            organization: the name of your company for your certificate authority.
            ca_duration: the validity of the certificate authority in seconds.
        """

        caServiceClient = privateca_v1.CertificateAuthorityServiceClient()

        # Set the types of Algorithm used to create a cloud KMS key.
        key_version_spec = privateca_v1.CertificateAuthority.KeyVersionSpec(
            algorithm=privateca_v1.CertificateAuthority.SignHashAlgorithm.RSA_PKCS1_4096_SHA256
        )

        # Set CA subject config.
        subject_config = privateca_v1.CertificateConfig.SubjectConfig(
            subject=privateca_v1.Subject(common_name=common_name, organization=organization)
        )

        # Set the key usage options for X.509 fields.
        x509_parameters = privateca_v1.X509Parameters(
            key_usage=privateca_v1.KeyUsage(
                base_key_usage=privateca_v1.KeyUsage.KeyUsageOptions(
                    crl_sign=True,
                    cert_sign=True,
                )
            ),
            ca_options=privateca_v1.X509Parameters.CaOptions(
                is_ca=True,
            ),
        )

        # Set certificate authority settings.
        certificate_authority = privateca_v1.CertificateAuthority(
            # CertificateAuthority.Type.SELF_SIGNED denotes that this CA is a root CA.
            type_=privateca_v1.CertificateAuthority.Type.SELF_SIGNED,
            key_spec=key_version_spec,
            config=privateca_v1.CertificateConfig(
                subject_config=subject_config,
                x509_config=x509_parameters,
            ),
            lifetime=duration_pb2.Duration(seconds=ca_duration),
        )

        ca_pool_path = caServiceClient.ca_pool_path(project_id, location, ca_pool_name)

        # Create the CertificateAuthorityRequest.
        request = privateca_v1.CreateCertificateAuthorityRequest(
            parent=ca_pool_path,
            certificate_authority_id=ca_name,
            certificate_authority=certificate_authority,
        )

        operation = caServiceClient.create_certificate_authority(request=request)
        result = operation.result()

        print("Operation result:", result)

<br />

## Additional resources

### C++

The following list contains links to more resources related to the
client library for C++:

- [API reference](https://docs.cloud.google.com/cpp/docs/reference/privateca/latest)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/google-cloud-cpp/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D%5Bc%2B%2B%5D)
- [Source code](https://github.com/googleapis/google-cloud-cpp)

### C#

The following list contains links to more resources related to the
client library for C#:

- [API reference](https://docs.cloud.google.com/dotnet/docs/reference)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/google-cloud-dotnet/tree/main/apis/Google.Cloud.Security.PrivateCA.V1/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D+%5Bc%23%5D)
- [Source code](https://github.com/googleapis/google-cloud-dotnet/tree/main/apis/Google.Cloud.Security.PrivateCA.V1)

### Go

The following list contains links to more resources related to the
client library for Go:

- [API reference](https://docs.cloud.google.com/go/docs/reference/cloud.google.com/go/security/latest/privateca/apiv1)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/google-cloud-go/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D+%5Bgo%5D)
- [Source code](https://github.com/googleapis/google-cloud-go)

### Java

The following list contains links to more resources related to the
client library for Java:

- [API reference](https://docs.cloud.google.com/java/docs/reference)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/java-security-private-ca/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D+%5Bjava%5D)
- [Source code](https://github.com/googleapis/java-security-private-ca)

### Node.js

The following list contains links to more resources related to the
client library for Node.js:

- [API reference](https://docs.cloud.google.com/nodejs/docs/reference)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/nodejs-security-private-ca/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D+%5Bnode.js%5D)
- [Source code](https://github.com/googleapis/nodejs-security-private-ca)

### PHP

The following list contains links to more resources related to the
client library for PHP:

- [API reference](https://docs.cloud.google.com/php/docs/reference)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/google-cloud-php-security-private-ca/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D+%5Bphp%5D)
- [Source code](https://github.com/googleapis/google-cloud-php-security-private-ca)

### Python

The following list contains links to more resources related to the
client library for Python:

- [API reference](https://docs.cloud.google.com/python/docs/reference)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/python-security-private-ca/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D+%5Bpython%5D)
- [Source code](https://github.com/googleapis/python-security-private-ca)

### Ruby

The following list contains links to more resources related to the
client library for Ruby:

- [API reference](https://docs.cloud.google.com/ruby/docs/reference)
- [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices)
- [Issue tracker](https://github.com/googleapis/google-cloud-ruby/issues)
- [`ca-service` on Stack Overflow](https://stackoverflow.com/search?q=%5Bca-service%5D+%5Bruby%5D)
- [Source code](https://github.com/googleapis/google-cloud-ruby)

<br />