# Google Certificate Authority Service V1 Client - Class IssuancePolicy (2.4.0)

2.4.0 (latest) 2.3.0 2.2.2 2.1.1 2.0.3 1.7.3 1.5.0 1.4.2 1.3.1 1.2.2 1.1.0 1.0.3 Reference documentation and code samples for the Google Certificate Authority Service V1 Client class IssuancePolicy.

Defines controls over all certificate issuance within a
[CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool).

Generated from protobuf message `google.cloud.security.privateca.v1.CaPool.IssuancePolicy`

## Namespace

Google \\ Cloud \\ Security \\ PrivateCA \\ V1 \\ CaPool

## Methods

### __construct

Constructor.

| **Parameters** ||
|---|---|
| **Name** | **Description** |
| `data` | `array` Optional. Data for populating the Message object. |
| `↳ allowed_key_types` | `array<https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.AllowedKeyType>` Optional. If any [AllowedKeyType](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.AllowedKeyType) is specified, then the certificate request's public key must match one of the key types listed here. Otherwise, any key may be used. |
| `↳ backdate_duration` | `https://protobuf.dev/reference/php/api-docs/Google/Protobuf/Duration` Optional. If set, all certificates issued from this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool) will be backdated by this duration. The 'not_before_time' will be the issuance time minus this [backdate_duration](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBackdateDuration__), and the 'not_after_time' will be adjusted to preserve the requested lifetime. The maximum duration that a certificate can be backdated with these options is 48 hours in the past. This option cannot be set if [allow_requester_specified_not_before_time](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getAllowRequesterSpecifiedNotBeforeTime__) is set. |
| `↳ allow_requester_specified_not_before_time` | `bool` Optional. If set to true, allows requesters to specify the [requested_not_before_time](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate#_Google_Cloud_Security_PrivateCA_V1_Certificate__getRequestedNotBeforeTime__) field when creating a [Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate). Certificates requested with this option enabled will have a 'not_before_time' equal to the value specified in the request. The 'not_after_time' will be adjusted to preserve the requested lifetime. The maximum time that a certificate can be backdated with these options is 48 hours in the past. This option cannot be set if [backdate_duration](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBackdateDuration__) is set. |
| `↳ maximum_lifetime` | `https://protobuf.dev/reference/php/api-docs/Google/Protobuf/Duration` Optional. The maximum lifetime allowed for issued [Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate). Note that if the issuing [CertificateAuthority](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateAuthority) expires before a [Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) resource's requested maximum_lifetime, the effective lifetime will be explicitly truncated to match it. |
| `↳ allowed_issuance_modes` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.IssuanceModes` Optional. If specified, then only methods allowed in the [IssuanceModes](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.IssuanceModes) may be used to issue [Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate). |
| `↳ baseline_values` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.X509Parameters` Optional. A set of X.509 values that will be applied to all certificates issued through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool). If a certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If a certificate request uses a [CertificateTemplate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate) that defines conflicting [predefined_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate#_Google_Cloud_Security_PrivateCA_V1_CertificateTemplate__getPredefinedValues__) for the same properties, the certificate issuance request will fail. |
| `↳ identity_constraints` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateIdentityConstraints` Optional. Describes constraints on identities that may appear in [Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) issued through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool). If this is omitted, then this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool) will not add restrictions on a certificate's identity. |
| `↳ passthrough_extensions` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateExtensionConstraints` Optional. Describes the set of X.509 extensions that may appear in a [Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) issued through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool). If a certificate request sets extensions that don't appear in the [passthrough_extensions](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getPassthroughExtensions__), those extensions will be dropped. If a certificate request uses a [CertificateTemplate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate) with [predefined_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate#_Google_Cloud_Security_PrivateCA_V1_CertificateTemplate__getPredefinedValues__) that don't appear here, the certificate issuance request will fail. If this is omitted, then this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool) will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool)'s [baseline_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBaselineValues__). |

### getAllowedKeyTypes

Optional. If any
[AllowedKeyType](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.AllowedKeyType)
is specified, then the certificate request's public key must match one of
the key types listed here. Otherwise, any key may be used.

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `https://protobuf.dev/reference/php/api-docs/Google/Protobuf/RepeatedField<https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.AllowedKeyType>` |   |

### setAllowedKeyTypes

Optional. If any
[AllowedKeyType](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.AllowedKeyType)
is specified, then the certificate request's public key must match one of
the key types listed here. Otherwise, any key may be used.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `array<https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.AllowedKeyType>` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |

### getBackdateDuration

Optional. If set, all certificates issued from this
[CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool) will be backdated by
this duration. The 'not_before_time' will be the issuance time minus this
[backdate_duration](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBackdateDuration__),
and the 'not_after_time' will be adjusted to preserve the requested
lifetime. The maximum duration that a certificate can be backdated with
these options is 48 hours in the past.

This option cannot be set if
[allow_requester_specified_not_before_time](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getAllowRequesterSpecifiedNotBeforeTime__)
is set.

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `https://protobuf.dev/reference/php/api-docs/Google/Protobuf/Duration|null` |   |

### hasBackdateDuration

### clearBackdateDuration

### setBackdateDuration

Optional. If set, all certificates issued from this
[CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool) will be backdated by
this duration. The 'not_before_time' will be the issuance time minus this
[backdate_duration](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBackdateDuration__),
and the 'not_after_time' will be adjusted to preserve the requested
lifetime. The maximum duration that a certificate can be backdated with
these options is 48 hours in the past.

This option cannot be set if
[allow_requester_specified_not_before_time](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getAllowRequesterSpecifiedNotBeforeTime__)
is set.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `https://protobuf.dev/reference/php/api-docs/Google/Protobuf/Duration` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |

### getAllowRequesterSpecifiedNotBeforeTime

Optional. If set to true, allows requesters to specify the
[requested_not_before_time](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate#_Google_Cloud_Security_PrivateCA_V1_Certificate__getRequestedNotBeforeTime__)
field when creating a
[Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate).

Certificates requested with this option enabled will have a
'not_before_time' equal to the value specified in the request. The
'not_after_time' will be adjusted to preserve the requested lifetime. The
maximum time that a certificate can be backdated with these options is 48
hours in the past. This option cannot be set if
[backdate_duration](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBackdateDuration__)
is set.

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `bool` |   |

### setAllowRequesterSpecifiedNotBeforeTime

Optional. If set to true, allows requesters to specify the
[requested_not_before_time](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate#_Google_Cloud_Security_PrivateCA_V1_Certificate__getRequestedNotBeforeTime__)
field when creating a
[Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate).

Certificates requested with this option enabled will have a
'not_before_time' equal to the value specified in the request. The
'not_after_time' will be adjusted to preserve the requested lifetime. The
maximum time that a certificate can be backdated with these options is 48
hours in the past. This option cannot be set if
[backdate_duration](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBackdateDuration__)
is set.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `bool` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |

### getMaximumLifetime

Optional. The maximum lifetime allowed for issued
[Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate). Note that
if the issuing
[CertificateAuthority](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateAuthority)
expires before a
[Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) resource's
requested maximum_lifetime, the effective lifetime will be explicitly
truncated to match it.

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `https://protobuf.dev/reference/php/api-docs/Google/Protobuf/Duration|null` |   |

### hasMaximumLifetime

### clearMaximumLifetime

### setMaximumLifetime

Optional. The maximum lifetime allowed for issued
[Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate). Note that
if the issuing
[CertificateAuthority](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateAuthority)
expires before a
[Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) resource's
requested maximum_lifetime, the effective lifetime will be explicitly
truncated to match it.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `https://protobuf.dev/reference/php/api-docs/Google/Protobuf/Duration` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |

### getAllowedIssuanceModes

Optional. If specified, then only methods allowed in the
[IssuanceModes](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.IssuanceModes)
may be used to issue
[Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate).

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.IssuanceModes|null` |   |

### hasAllowedIssuanceModes

### clearAllowedIssuanceModes

### setAllowedIssuanceModes

Optional. If specified, then only methods allowed in the
[IssuanceModes](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.IssuanceModes)
may be used to issue
[Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate).

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy.IssuanceModes` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |

### getBaselineValues

Optional. A set of X.509 values that will be applied to all certificates
issued through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool).

If a certificate request includes conflicting values for the same
properties, they will be overwritten by the values defined here. If a
certificate request uses a
[CertificateTemplate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate)
that defines conflicting
[predefined_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate#_Google_Cloud_Security_PrivateCA_V1_CertificateTemplate__getPredefinedValues__)
for the same properties, the certificate issuance request will fail.

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.X509Parameters|null` |   |

### hasBaselineValues

### clearBaselineValues

### setBaselineValues

Optional. A set of X.509 values that will be applied to all certificates
issued through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool).

If a certificate request includes conflicting values for the same
properties, they will be overwritten by the values defined here. If a
certificate request uses a
[CertificateTemplate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate)
that defines conflicting
[predefined_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate#_Google_Cloud_Security_PrivateCA_V1_CertificateTemplate__getPredefinedValues__)
for the same properties, the certificate issuance request will fail.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.X509Parameters` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |

### getIdentityConstraints

Optional. Describes constraints on identities that may appear in
[Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) issued
through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool). If this
is omitted, then this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool)
will not add restrictions on a certificate's identity.

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateIdentityConstraints|null` |   |

### hasIdentityConstraints

### clearIdentityConstraints

### setIdentityConstraints

Optional. Describes constraints on identities that may appear in
[Certificates](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) issued
through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool). If this
is omitted, then this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool)
will not add restrictions on a certificate's identity.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateIdentityConstraints` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |

### getPassthroughExtensions

Optional. Describes the set of X.509 extensions that may appear in a
[Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) issued
through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool). If a
certificate request sets extensions that don't appear in the
[passthrough_extensions](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getPassthroughExtensions__),
those extensions will be dropped. If a certificate request uses a
[CertificateTemplate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate)
with
[predefined_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate#_Google_Cloud_Security_PrivateCA_V1_CertificateTemplate__getPredefinedValues__)
that don't appear here, the certificate issuance request will fail. If
this is omitted, then this
[CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool) will not add
restrictions on a certificate's X.509 extensions. These constraints do
not apply to X.509 extensions set in this
[CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool)'s
[baseline_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBaselineValues__).

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateExtensionConstraints|null` |   |

### hasPassthroughExtensions

### clearPassthroughExtensions

### setPassthroughExtensions

Optional. Describes the set of X.509 extensions that may appear in a
[Certificate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.Certificate) issued
through this [CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool). If a
certificate request sets extensions that don't appear in the
[passthrough_extensions](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getPassthroughExtensions__),
those extensions will be dropped. If a certificate request uses a
[CertificateTemplate](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate)
with
[predefined_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateTemplate#_Google_Cloud_Security_PrivateCA_V1_CertificateTemplate__getPredefinedValues__)
that don't appear here, the certificate issuance request will fail. If
this is omitted, then this
[CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool) will not add
restrictions on a certificate's X.509 extensions. These constraints do
not apply to X.509 extensions set in this
[CaPool](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool)'s
[baseline_values](https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CaPool.IssuancePolicy#_Google_Cloud_Security_PrivateCA_V1_CaPool_IssuancePolicy__getBaselineValues__).

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `var` | `https://docs.cloud.google.com/php/docs/reference/cloud-security-private-ca/latest/V1.CertificateExtensionConstraints` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `$this` |   |