/** * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. * SPDX-License-Identifier: Apache-2.0. */ #pragma once #include #include #include #include namespace Aws { namespace Utils { namespace Json { class JsonValue; class JsonView; } // namespace Json } // namespace Utils namespace ACMPCA { namespace Model { /** *

Contains configuration information for a certificate revocation list (CRL). * Your private certificate authority (CA) creates base CRLs. Delta CRLs are not * supported. You can enable CRLs for your new or an existing private CA by setting * the Enabled parameter to true. Your private CA writes CRLs * to an S3 bucket that you specify in the S3BucketName parameter. You can * hide the name of your bucket by specifying a value for the CustomCname * parameter. Your private CA copies the CNAME or the S3 bucket name to the CRL * Distribution Points extension of each certificate it issues. Your S3 bucket * policy must give write permission to Amazon Web Services Private CA.

Amazon Web Services Private CA assets that are stored in Amazon S3 can be * protected with encryption. For more information, see Encrypting * Your CRLs.

Your private CA uses the value in the * ExpirationInDays parameter to calculate the nextUpdate field in * the CRL. The CRL is refreshed prior to a certificate's expiration date or when a * certificate is revoked. When a certificate is revoked, it appears in the CRL * until the certificate expires, and then in one additional CRL after expiration, * and it always appears in the audit report.

A CRL is typically updated * approximately 30 minutes after a certificate is revoked. If for any reason a CRL * update fails, Amazon Web Services Private CA makes further attempts every 15 * minutes.

CRLs contain the following fields:

* Version: The current version number defined in RFC 5280 is V2. The * integer value is 0x1.
Signature Algorithm: The name * of the algorithm used to sign the CRL.
Issuer: The * X.500 distinguished name of your private CA that issued the CRL.
*
Last Update: The issue date and time of this CRL.
* Next Update: The day and time by which the next CRL will be issued.
*
Revoked Certificates: List of revoked certificates. Each * list item contains the following information.
- Serial * Number: The serial number, in hexadecimal format, of the revoked * certificate.
- Revocation Date: Date and time the * certificate was revoked.
- CRL Entry Extensions: * Optional extensions for the CRL entry.
  - X509v3 CRL Reason * Code: Reason the certificate was revoked.
CRL Extensions: Optional extensions for the CRL.
- *
  X509v3 Authority Key Identifier: Identifies the public key associated * with the private key used to sign the certificate.
- X509v3 * CRL Number:: Decimal sequence number for the CRL.
*
Signature Algorithm: Algorithm used by your private CA to sign the * CRL.
Signature Value: Signature computed over the * CRL.

Certificate revocation lists created by Amazon Web * Services Private CA are DER-encoded. You can use the following OpenSSL command * to list a CRL.

openssl crl -inform DER -text -in crl_path * -noout

For more information, see Planning * a certificate revocation list (CRL) in the Amazon Web Services Private * Certificate Authority User Guide

Name of the S3 bucket that contains the CRL. If you do not provide a value * for the CustomCname argument, the name of your S3 bucket is placed into * the CRL Distribution Points extension of the issued certificate. You can * change the name of your bucket by calling the UpdateCertificateAuthority * operation. You must specify a bucket * policy that allows Amazon Web Services Private CA to write the CRL to your * bucket.

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline const Aws::String& GetS3BucketName() const{ return m_s3BucketName; } /** *

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline bool S3BucketNameHasBeenSet() const { return m_s3BucketNameHasBeenSet; } /** *

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline void SetS3BucketName(const Aws::String& value) { m_s3BucketNameHasBeenSet = true; m_s3BucketName = value; } /** *

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline void SetS3BucketName(Aws::String&& value) { m_s3BucketNameHasBeenSet = true; m_s3BucketName = std::move(value); } /** *

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline void SetS3BucketName(const char* value) { m_s3BucketNameHasBeenSet = true; m_s3BucketName.assign(value); } /** *

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline CrlConfiguration& WithS3BucketName(const Aws::String& value) { SetS3BucketName(value); return *this;} /** *

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline CrlConfiguration& WithS3BucketName(Aws::String&& value) { SetS3BucketName(std::move(value)); return *this;} /** *

The S3BucketName parameter must conform to * the S3 * bucket naming rules.

*/ inline CrlConfiguration& WithS3BucketName(const char* value) { SetS3BucketName(value); return *this;} /** *

Determines whether the CRL will be publicly readable or privately held in the * CRL Amazon S3 bucket. If you choose PUBLIC_READ, the CRL will be accessible over * the public internet. If you choose BUCKET_OWNER_FULL_CONTROL, only the owner of * the CRL S3 bucket can access the CRL, and your PKI clients may need an * alternative method of access.