PcaConnectorAd ************** Client ====== class PcaConnectorAd.Client A low-level client representing PcaConnectorAd Amazon Web Services Private CA Connector for Active Directory creates a connector between Amazon Web Services Private CA and Active Directory (AD) that enables you to provision security certificates for AD signed by a private CA that you own. For more information, see Amazon Web Services Private CA Connector for Active Directory. import boto3 client = boto3.client('pca-connector-ad') These are the available methods: * can_paginate * close * create_connector * create_directory_registration * create_service_principal_name * create_template * create_template_group_access_control_entry * delete_connector * delete_directory_registration * delete_service_principal_name * delete_template * delete_template_group_access_control_entry * get_connector * get_directory_registration * get_paginator * get_service_principal_name * get_template * get_template_group_access_control_entry * get_waiter * list_connectors * list_directory_registrations * list_service_principal_names * list_tags_for_resource * list_template_group_access_control_entries * list_templates * tag_resource * untag_resource * update_template * update_template_group_access_control_entry Paginators ========== Paginators are available on a client instance via the "get_paginator" method. For more detailed instructions and examples on the usage of paginators, see the paginators user guide. The available paginators are: * ListConnectors * ListDirectoryRegistrations * ListServicePrincipalNames * ListTemplateGroupAccessControlEntries * ListTemplates PcaConnectorAd / Paginator / ListTemplates ListTemplates ************* class PcaConnectorAd.Paginator.ListTemplates paginator = client.get_paginator('list_templates') paginate(**kwargs) Creates an iterator that will paginate through responses from "PcaConnectorAd.Client.list_templates()". See also: AWS API Documentation **Request Syntax** response_iterator = paginator.paginate( ConnectorArn='string', PaginationConfig={ 'MaxItems': 123, 'PageSize': 123, 'StartingToken': 'string' } ) Parameters: * **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **PaginationConfig** (*dict*) -- A dictionary that provides parameters to control pagination. * **MaxItems** *(integer) --* The total number of items to return. If the total number of items available is more than the value specified in max-items then a "NextToken" will be provided in the output that you can use to resume pagination. * **PageSize** *(integer) --* The size of each page. * **StartingToken** *(string) --* A token to specify where to start paginating. This is the "NextToken" from a previous response. Return type: dict Returns: **Response Syntax** { 'Templates': [ { 'Arn': 'string', 'ConnectorArn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'Definition': { 'TemplateV2': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'PrivateKeyAttributes': { 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2003'|'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV3': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV4': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'RequireSameKeyRenewal': True|False, 'StrongKeyProtectionRequired': True|False, 'UseLegacyProvider': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] } }, 'Name': 'string', 'ObjectIdentifier': 'string', 'PolicySchema': 123, 'Revision': { 'MajorRevision': 123, 'MinorRevision': 123 }, 'Status': 'ACTIVE'|'DELETING', 'UpdatedAt': datetime(2015, 1, 1) }, ] } **Response Structure** * *(dict) --* * **Templates** *(list) --* Custom configuration templates used when issuing a certificate. * *(dict) --* An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. * **ConnectorArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CreatedAt** *(datetime) --* The date and time that the template was created. * **Definition** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "TemplateV2", "TemplateV3", "TemplateV4". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **TemplateV2** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of- privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV3** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of- privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PropertyFlags", "PropertyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **StrongKeyProtectionRequired** *(boolean) --* Requirer user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV4** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of- privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PropertyFlags", "PropertyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **RequireSameKeyRenewal** *(boolean) --* Renew certificate using the same private key. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **UseLegacyProvider** *(boolean) --* Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **Name** *(string) --* Name of the template. The template name must be unique. * **ObjectIdentifier** *(string) --* Object identifier of a template. * **PolicySchema** *(integer) --* The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version. * **Revision** *(dict) --* The revision version of the template. Template updates will increment the minor revision. Re- enrolling all certificate holders will increment the major revision. * **MajorRevision** *(integer) --* The revision version of the template. Re-enrolling all certificate holders will increment the major revision. * **MinorRevision** *(integer) --* The revision version of the template. Re-enrolling all certificate holders will increment the major revision. * **Status** *(string) --* Status of the template. Status can be creating, active, deleting, or failed. * **UpdatedAt** *(datetime) --* The date and time that the template was updated. PcaConnectorAd / Paginator / ListTemplateGroupAccessControlEntries ListTemplateGroupAccessControlEntries ************************************* class PcaConnectorAd.Paginator.ListTemplateGroupAccessControlEntries paginator = client.get_paginator('list_template_group_access_control_entries') paginate(**kwargs) Creates an iterator that will paginate through responses from " PcaConnectorAd.Client.list_template_group_access_control_entrie s()". See also: AWS API Documentation **Request Syntax** response_iterator = paginator.paginate( TemplateArn='string', PaginationConfig={ 'MaxItems': 123, 'PageSize': 123, 'StartingToken': 'string' } ) Parameters: * **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. * **PaginationConfig** (*dict*) -- A dictionary that provides parameters to control pagination. * **MaxItems** *(integer) --* The total number of items to return. If the total number of items available is more than the value specified in max-items then a "NextToken" will be provided in the output that you can use to resume pagination. * **PageSize** *(integer) --* The size of each page. * **StartingToken** *(string) --* A token to specify where to start paginating. This is the "NextToken" from a previous response. Return type: dict Returns: **Response Syntax** { 'AccessControlEntries': [ { 'AccessRights': { 'AutoEnroll': 'ALLOW'|'DENY', 'Enroll': 'ALLOW'|'DENY' }, 'CreatedAt': datetime(2015, 1, 1), 'GroupDisplayName': 'string', 'GroupSecurityIdentifier': 'string', 'TemplateArn': 'string', 'UpdatedAt': datetime(2015, 1, 1) }, ], } **Response Structure** * *(dict) --* * **AccessControlEntries** *(list) --* An access control entry grants or denies permission to an Active Directory group to enroll certificates for a template. * *(dict) --* Summary of group access control entries that allow or deny Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autofenrolling with the template. * **AccessRights** *(dict) --* Allow or deny an Active Directory group from enrolling and autoenrolling certificates issued against a template. * **AutoEnroll** *(string) --* Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment * **Enroll** *(string) --* Allow or deny an Active Directory group from enrolling certificates issued against a template. * **CreatedAt** *(datetime) --* The date and time that the Access Control Entry was created. * **GroupDisplayName** *(string) --* Name of the Active Directory group. This name does not need to match the group name in Active Directory. * **GroupSecurityIdentifier** *(string) --* Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". * **TemplateArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. * **UpdatedAt** *(datetime) --* The date and time that the Access Control Entry was updated. PcaConnectorAd / Paginator / ListServicePrincipalNames ListServicePrincipalNames ************************* class PcaConnectorAd.Paginator.ListServicePrincipalNames paginator = client.get_paginator('list_service_principal_names') paginate(**kwargs) Creates an iterator that will paginate through responses from "PcaConnectorAd.Client.list_service_principal_names()". See also: AWS API Documentation **Request Syntax** response_iterator = paginator.paginate( DirectoryRegistrationArn='string', PaginationConfig={ 'MaxItems': 123, 'PageSize': 123, 'StartingToken': 'string' } ) Parameters: * **DirectoryRegistrationArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **PaginationConfig** (*dict*) -- A dictionary that provides parameters to control pagination. * **MaxItems** *(integer) --* The total number of items to return. If the total number of items available is more than the value specified in max-items then a "NextToken" will be provided in the output that you can use to resume pagination. * **PageSize** *(integer) --* The size of each page. * **StartingToken** *(string) --* A token to specify where to start paginating. This is the "NextToken" from a previous response. Return type: dict Returns: **Response Syntax** { 'ServicePrincipalNames': [ { 'ConnectorArn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryRegistrationArn': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'DIRECTORY_ACCESS_DENIED'|'DIRECTORY_NOT_REACHABLE'|'DIRECTORY_RESOURCE_NOT_FOUND'|'SPN_EXISTS_ON_DIFFERENT_AD_OBJECT'|'SPN_LIMIT_EXCEEDED'|'INTERNAL_FAILURE', 'UpdatedAt': datetime(2015, 1, 1) }, ] } **Response Structure** * *(dict) --* * **ServicePrincipalNames** *(list) --* The service principal name, if any, that the connector uses to authenticate with Active Directory. * *(dict) --* The service principal name that the connector uses to authenticate with Active Directory. * **ConnectorArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CreatedAt** *(datetime) --* The date and time that the service principal name was created. * **DirectoryRegistrationArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **Status** *(string) --* The status of a service principal name. * **StatusReason** *(string) --* Additional information for the status of a service principal name if the status is failed. * **UpdatedAt** *(datetime) --* Time when the service principal name was updated. PcaConnectorAd / Paginator / ListDirectoryRegistrations ListDirectoryRegistrations ************************** class PcaConnectorAd.Paginator.ListDirectoryRegistrations paginator = client.get_paginator('list_directory_registrations') paginate(**kwargs) Creates an iterator that will paginate through responses from "PcaConnectorAd.Client.list_directory_registrations()". See also: AWS API Documentation **Request Syntax** response_iterator = paginator.paginate( PaginationConfig={ 'MaxItems': 123, 'PageSize': 123, 'StartingToken': 'string' } ) Parameters: **PaginationConfig** (*dict*) -- A dictionary that provides parameters to control pagination. * **MaxItems** *(integer) --* The total number of items to return. If the total number of items available is more than the value specified in max- items then a "NextToken" will be provided in the output that you can use to resume pagination. * **PageSize** *(integer) --* The size of each page. * **StartingToken** *(string) --* A token to specify where to start paginating. This is the "NextToken" from a previous response. Return type: dict Returns: **Response Syntax** { 'DirectoryRegistrations': [ { 'Arn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryId': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'DIRECTORY_ACCESS_DENIED'|'DIRECTORY_RESOURCE_NOT_FOUND'|'DIRECTORY_NOT_ACTIVE'|'DIRECTORY_NOT_REACHABLE'|'DIRECTORY_TYPE_NOT_SUPPORTED'|'INTERNAL_FAILURE', 'UpdatedAt': datetime(2015, 1, 1) }, ], } **Response Structure** * *(dict) --* * **DirectoryRegistrations** *(list) --* Summary information about each directory registration you have created. * *(dict) --* The directory registration represents the authorization of the connector service with the Active Directory. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **CreatedAt** *(datetime) --* The date and time that the directory registration was created. * **DirectoryId** *(string) --* The identifier of the Active Directory. * **Status** *(string) --* Status of the directory registration. * **StatusReason** *(string) --* Additional information about the directory registration status if the status is failed. * **UpdatedAt** *(datetime) --* The date and time that the directory registration was updated. PcaConnectorAd / Paginator / ListConnectors ListConnectors ************** class PcaConnectorAd.Paginator.ListConnectors paginator = client.get_paginator('list_connectors') paginate(**kwargs) Creates an iterator that will paginate through responses from "PcaConnectorAd.Client.list_connectors()". See also: AWS API Documentation **Request Syntax** response_iterator = paginator.paginate( PaginationConfig={ 'MaxItems': 123, 'PageSize': 123, 'StartingToken': 'string' } ) Parameters: **PaginationConfig** (*dict*) -- A dictionary that provides parameters to control pagination. * **MaxItems** *(integer) --* The total number of items to return. If the total number of items available is more than the value specified in max- items then a "NextToken" will be provided in the output that you can use to resume pagination. * **PageSize** *(integer) --* The size of each page. * **StartingToken** *(string) --* A token to specify where to start paginating. This is the "NextToken" from a previous response. Return type: dict Returns: **Response Syntax** { 'Connectors': [ { 'Arn': 'string', 'CertificateAuthorityArn': 'string', 'CertificateEnrollmentPolicyServerEndpoint': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryId': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'CA_CERTIFICATE_REGISTRATION_FAILED'|'DIRECTORY_ACCESS_DENIED'|'INTERNAL_FAILURE'|'INSUFFICIENT_FREE_ADDRESSES'|'INVALID_SUBNET_IP_PROTOCOL'|'PRIVATECA_ACCESS_DENIED'|'PRIVATECA_RESOURCE_NOT_FOUND'|'SECURITY_GROUP_NOT_IN_VPC'|'VPC_ACCESS_DENIED'|'VPC_ENDPOINT_LIMIT_EXCEEDED'|'VPC_RESOURCE_NOT_FOUND', 'UpdatedAt': datetime(2015, 1, 1), 'VpcInformation': { 'IpAddressType': 'IPV4'|'DUALSTACK', 'SecurityGroupIds': [ 'string', ] } }, ], } **Response Structure** * *(dict) --* * **Connectors** *(list) --* Summary information about each connector you have created. * *(dict) --* Summary description of the Amazon Web Services Private CA AD connectors belonging to an Amazon Web Services account. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CertificateAuthorityArn** *(string) --* The Amazon Resource Name (ARN) of the certificate authority being used. * **CertificateEnrollmentPolicyServerEndpoint** *(string) --* Certificate enrollment endpoint for Active Directory domain-joined objects to request certificates. * **CreatedAt** *(datetime) --* The date and time that the connector was created. * **DirectoryId** *(string) --* The identifier of the Active Directory. * **Status** *(string) --* Status of the connector. Status can be creating, active, deleting, or failed. * **StatusReason** *(string) --* Additional information about the connector status if the status is failed. * **UpdatedAt** *(datetime) --* The date and time that the connector was updated. * **VpcInformation** *(dict) --* Information of the VPC and security group(s) used with the connector. * **IpAddressType** *(string) --* The VPC IP address type. * **SecurityGroupIds** *(list) --* The security groups used with the connector. You can use a maximum of 4 security groups with a connector. * *(string) --* PcaConnectorAd / Client / get_paginator get_paginator ************* PcaConnectorAd.Client.get_paginator(operation_name) Create a paginator for an operation. Parameters: **operation_name** (*string*) -- The operation name. This is the same name as the method name on the client. For example, if the method name is "create_foo", and you'd normally invoke the operation as "client.create_foo(**kwargs)", if the "create_foo" operation can be paginated, you can use the call "client.get_paginator("create_foo")". Raises: **OperationNotPageableError** -- Raised if the operation is not pageable. You can use the "client.can_paginate" method to check if an operation is pageable. Return type: "botocore.paginate.Paginator" Returns: A paginator object. PcaConnectorAd / Client / delete_template delete_template *************** PcaConnectorAd.Client.delete_template(**kwargs) Deletes a template. Certificates issued using the template are still valid until they are revoked or expired. See also: AWS API Documentation **Request Syntax** response = client.delete_template( TemplateArn='string' ) Parameters: **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / create_directory_registration create_directory_registration ***************************** PcaConnectorAd.Client.create_directory_registration(**kwargs) Creates a directory registration that authorizes communication between Amazon Web Services Private CA and an Active Directory See also: AWS API Documentation **Request Syntax** response = client.create_directory_registration( ClientToken='string', DirectoryId='string', Tags={ 'string': 'string' } ) Parameters: * **ClientToken** (*string*) -- Idempotency token. This field is autopopulated if not provided. * **DirectoryId** (*string*) -- **[REQUIRED]** The identifier of the Active Directory. * **Tags** (*dict*) -- Metadata assigned to a directory registration consisting of a key-value pair. * *(string) --* * *(string) --* Return type: dict Returns: **Response Syntax** { 'DirectoryRegistrationArn': 'string' } **Response Structure** * *(dict) --* * **DirectoryRegistrationArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / can_paginate can_paginate ************ PcaConnectorAd.Client.can_paginate(operation_name) Check if an operation can be paginated. Parameters: **operation_name** (*string*) -- The operation name. This is the same name as the method name on the client. For example, if the method name is "create_foo", and you'd normally invoke the operation as "client.create_foo(**kwargs)", if the "create_foo" operation can be paginated, you can use the call "client.get_paginator("create_foo")". Returns: "True" if the operation can be paginated, "False" otherwise. PcaConnectorAd / Client / delete_template_group_access_control_entry delete_template_group_access_control_entry ****************************************** PcaConnectorAd.Client.delete_template_group_access_control_entry(**kwargs) Deletes a group access control entry. See also: AWS API Documentation **Request Syntax** response = client.delete_template_group_access_control_entry( GroupSecurityIdentifier='string', TemplateArn='string' ) Parameters: * **GroupSecurityIdentifier** (*string*) -- **[REQUIRED]** Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". * **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / delete_directory_registration delete_directory_registration ***************************** PcaConnectorAd.Client.delete_directory_registration(**kwargs) Deletes a directory registration. Deleting a directory registration deauthorizes Amazon Web Services Private CA with the directory. See also: AWS API Documentation **Request Syntax** response = client.delete_directory_registration( DirectoryRegistrationArn='string' ) Parameters: **DirectoryRegistrationArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / create_service_principal_name create_service_principal_name ***************************** PcaConnectorAd.Client.create_service_principal_name(**kwargs) Creates a service principal name (SPN) for the service account in Active Directory. Kerberos authentication uses SPNs to associate a service instance with a service sign-in account. See also: AWS API Documentation **Request Syntax** response = client.create_service_principal_name( ClientToken='string', ConnectorArn='string', DirectoryRegistrationArn='string' ) Parameters: * **ClientToken** (*string*) -- Idempotency token. This field is autopopulated if not provided. * **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **DirectoryRegistrationArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / get_connector get_connector ************* PcaConnectorAd.Client.get_connector(**kwargs) Lists information about your connector. You specify the connector on input by its ARN (Amazon Resource Name). See also: AWS API Documentation **Request Syntax** response = client.get_connector( ConnectorArn='string' ) Parameters: **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. Return type: dict Returns: **Response Syntax** { 'Connector': { 'Arn': 'string', 'CertificateAuthorityArn': 'string', 'CertificateEnrollmentPolicyServerEndpoint': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryId': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'CA_CERTIFICATE_REGISTRATION_FAILED'|'DIRECTORY_ACCESS_DENIED'|'INTERNAL_FAILURE'|'INSUFFICIENT_FREE_ADDRESSES'|'INVALID_SUBNET_IP_PROTOCOL'|'PRIVATECA_ACCESS_DENIED'|'PRIVATECA_RESOURCE_NOT_FOUND'|'SECURITY_GROUP_NOT_IN_VPC'|'VPC_ACCESS_DENIED'|'VPC_ENDPOINT_LIMIT_EXCEEDED'|'VPC_RESOURCE_NOT_FOUND', 'UpdatedAt': datetime(2015, 1, 1), 'VpcInformation': { 'IpAddressType': 'IPV4'|'DUALSTACK', 'SecurityGroupIds': [ 'string', ] } } } **Response Structure** * *(dict) --* * **Connector** *(dict) --* A structure that contains information about your connector. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CertificateAuthorityArn** *(string) --* The Amazon Resource Name (ARN) of the certificate authority being used. * **CertificateEnrollmentPolicyServerEndpoint** *(string) --* Certificate enrollment endpoint for Active Directory domain-joined objects reach out to when requesting certificates. * **CreatedAt** *(datetime) --* The date and time that the connector was created. * **DirectoryId** *(string) --* The identifier of the Active Directory. * **Status** *(string) --* Status of the connector. Status can be creating, active, deleting, or failed. * **StatusReason** *(string) --* Additional information about the connector status if the status is failed. * **UpdatedAt** *(datetime) --* The date and time that the connector was updated. * **VpcInformation** *(dict) --* Information of the VPC and security group(s) used with the connector. * **IpAddressType** *(string) --* The VPC IP address type. * **SecurityGroupIds** *(list) --* The security groups used with the connector. You can use a maximum of 4 security groups with a connector. * *(string) --* **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / list_directory_registrations list_directory_registrations **************************** PcaConnectorAd.Client.list_directory_registrations(**kwargs) Lists the directory registrations that you created by using the https://docs.aws.amazon.com/pca-connector- ad/latest/APIReference/API_CreateDirectoryRegistration action. See also: AWS API Documentation **Request Syntax** response = client.list_directory_registrations( MaxResults=123, NextToken='string' ) Parameters: * **MaxResults** (*integer*) -- Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the "NextToken" element is sent in the response. Use this "NextToken" value in a subsequent request to retrieve additional items. * **NextToken** (*string*) -- Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. Return type: dict Returns: **Response Syntax** { 'DirectoryRegistrations': [ { 'Arn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryId': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'DIRECTORY_ACCESS_DENIED'|'DIRECTORY_RESOURCE_NOT_FOUND'|'DIRECTORY_NOT_ACTIVE'|'DIRECTORY_NOT_REACHABLE'|'DIRECTORY_TYPE_NOT_SUPPORTED'|'INTERNAL_FAILURE', 'UpdatedAt': datetime(2015, 1, 1) }, ], 'NextToken': 'string' } **Response Structure** * *(dict) --* * **DirectoryRegistrations** *(list) --* Summary information about each directory registration you have created. * *(dict) --* The directory registration represents the authorization of the connector service with the Active Directory. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **CreatedAt** *(datetime) --* The date and time that the directory registration was created. * **DirectoryId** *(string) --* The identifier of the Active Directory. * **Status** *(string) --* Status of the directory registration. * **StatusReason** *(string) --* Additional information about the directory registration status if the status is failed. * **UpdatedAt** *(datetime) --* The date and time that the directory registration was updated. * **NextToken** *(string) --* Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / get_template_group_access_control_entry get_template_group_access_control_entry *************************************** PcaConnectorAd.Client.get_template_group_access_control_entry(**kwargs) Retrieves the group access control entries for a template. See also: AWS API Documentation **Request Syntax** response = client.get_template_group_access_control_entry( GroupSecurityIdentifier='string', TemplateArn='string' ) Parameters: * **GroupSecurityIdentifier** (*string*) -- **[REQUIRED]** Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". * **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Return type: dict Returns: **Response Syntax** { 'AccessControlEntry': { 'AccessRights': { 'AutoEnroll': 'ALLOW'|'DENY', 'Enroll': 'ALLOW'|'DENY' }, 'CreatedAt': datetime(2015, 1, 1), 'GroupDisplayName': 'string', 'GroupSecurityIdentifier': 'string', 'TemplateArn': 'string', 'UpdatedAt': datetime(2015, 1, 1) } } **Response Structure** * *(dict) --* * **AccessControlEntry** *(dict) --* An access control entry allows or denies an Active Directory group from enrolling and/or autoenrolling with a template. * **AccessRights** *(dict) --* Permissions to allow or deny an Active Directory group to enroll or autoenroll certificates issued against a template. * **AutoEnroll** *(string) --* Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment * **Enroll** *(string) --* Allow or deny an Active Directory group from enrolling certificates issued against a template. * **CreatedAt** *(datetime) --* The date and time that the Access Control Entry was created. * **GroupDisplayName** *(string) --* Name of the Active Directory group. This name does not need to match the group name in Active Directory. * **GroupSecurityIdentifier** *(string) --* Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". * **TemplateArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. * **UpdatedAt** *(datetime) --* The date and time that the Access Control Entry was updated. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / list_tags_for_resource list_tags_for_resource ********************** PcaConnectorAd.Client.list_tags_for_resource(**kwargs) Lists the tags, if any, that are associated with your resource. See also: AWS API Documentation **Request Syntax** response = client.list_tags_for_resource( ResourceArn='string' ) Parameters: **ResourceArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you created the resource. Return type: dict Returns: **Response Syntax** { 'Tags': { 'string': 'string' } } **Response Structure** * *(dict) --* * **Tags** *(dict) --* The tags, if any, that are associated with your resource. * *(string) --* * *(string) --* **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / untag_resource untag_resource ************** PcaConnectorAd.Client.untag_resource(**kwargs) Removes one or more tags from your resource. See also: AWS API Documentation **Request Syntax** response = client.untag_resource( ResourceArn='string', TagKeys=[ 'string', ] ) Parameters: * **ResourceArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you created the resource. * **TagKeys** (*list*) -- **[REQUIRED]** Specifies a list of tag keys that you want to remove from the specified resources. * *(string) --* Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / delete_service_principal_name delete_service_principal_name ***************************** PcaConnectorAd.Client.delete_service_principal_name(**kwargs) Deletes the service principal name (SPN) used by a connector to authenticate with your Active Directory. See also: AWS API Documentation **Request Syntax** response = client.delete_service_principal_name( ConnectorArn='string', DirectoryRegistrationArn='string' ) Parameters: * **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **DirectoryRegistrationArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / get_waiter get_waiter ********** PcaConnectorAd.Client.get_waiter(waiter_name) Returns an object that can wait for some condition. Parameters: **waiter_name** (*str*) -- The name of the waiter to get. See the waiters section of the service docs for a list of available waiters. Returns: The specified waiter object. Return type: "botocore.waiter.Waiter" PcaConnectorAd / Client / get_template get_template ************ PcaConnectorAd.Client.get_template(**kwargs) Retrieves a certificate template that the connector uses to issue certificates from a private CA. See also: AWS API Documentation **Request Syntax** response = client.get_template( TemplateArn='string' ) Parameters: **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Return type: dict Returns: **Response Syntax** { 'Template': { 'Arn': 'string', 'ConnectorArn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'Definition': { 'TemplateV2': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'PrivateKeyAttributes': { 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2003'|'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV3': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV4': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'RequireSameKeyRenewal': True|False, 'StrongKeyProtectionRequired': True|False, 'UseLegacyProvider': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] } }, 'Name': 'string', 'ObjectIdentifier': 'string', 'PolicySchema': 123, 'Revision': { 'MajorRevision': 123, 'MinorRevision': 123 }, 'Status': 'ACTIVE'|'DELETING', 'UpdatedAt': datetime(2015, 1, 1) } } **Response Structure** * *(dict) --* * **Template** *(dict) --* A certificate template that the connector uses to issue certificates from a private CA. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. * **ConnectorArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CreatedAt** *(datetime) --* The date and time that the template was created. * **Definition** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "TemplateV2", "TemplateV3", "TemplateV4". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **TemplateV2** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS- WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV3** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS- WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PropertyFlags", "PropertyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **StrongKeyProtectionRequired** *(boolean) --* Requirer user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV4** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS- WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PropertyFlags", "PropertyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **RequireSameKeyRenewal** *(boolean) --* Renew certificate using the same private key. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **UseLegacyProvider** *(boolean) --* Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **Name** *(string) --* Name of the templates. Template names must be unique. * **ObjectIdentifier** *(string) --* Object identifier of a template. * **PolicySchema** *(integer) --* The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version. * **Revision** *(dict) --* The version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision. * **MajorRevision** *(integer) --* The revision version of the template. Re-enrolling all certificate holders will increment the major revision. * **MinorRevision** *(integer) --* The revision version of the template. Re-enrolling all certificate holders will increment the major revision. * **Status** *(string) --* Status of the template. Status can be creating, active, deleting, or failed. * **UpdatedAt** *(datetime) --* The date and time that the template was updated. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / create_template_group_access_control_entry create_template_group_access_control_entry ****************************************** PcaConnectorAd.Client.create_template_group_access_control_entry(**kwargs) Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling with the template based on the group security identifiers (SIDs). See also: AWS API Documentation **Request Syntax** response = client.create_template_group_access_control_entry( AccessRights={ 'AutoEnroll': 'ALLOW'|'DENY', 'Enroll': 'ALLOW'|'DENY' }, ClientToken='string', GroupDisplayName='string', GroupSecurityIdentifier='string', TemplateArn='string' ) Parameters: * **AccessRights** (*dict*) -- **[REQUIRED]** Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template. * **AutoEnroll** *(string) --* Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment * **Enroll** *(string) --* Allow or deny an Active Directory group from enrolling certificates issued against a template. * **ClientToken** (*string*) -- Idempotency token. This field is autopopulated if not provided. * **GroupDisplayName** (*string*) -- **[REQUIRED]** Name of the Active Directory group. This name does not need to match the group name in Active Directory. * **GroupSecurityIdentifier** (*string*) -- **[REQUIRED]** Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". * **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.ServiceQuotaExceededException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / create_template create_template *************** PcaConnectorAd.Client.create_template(**kwargs) Creates an Active Directory compatible certificate template. The connectors issues certificates using these templates based on the requester’s Active Directory group membership. See also: AWS API Documentation **Request Syntax** response = client.create_template( ClientToken='string', ConnectorArn='string', Definition={ 'TemplateV2': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'PrivateKeyAttributes': { 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2003'|'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV3': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV4': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'RequireSameKeyRenewal': True|False, 'StrongKeyProtectionRequired': True|False, 'UseLegacyProvider': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] } }, Name='string', Tags={ 'string': 'string' } ) Parameters: * **ClientToken** (*string*) -- Idempotency token. This field is autopopulated if not provided. * **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **Definition** (*dict*) -- **[REQUIRED]** Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "TemplateV2", "TemplateV3", "TemplateV4". * **TemplateV2** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* **[REQUIRED]** Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* **[REQUIRED]** Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* **[REQUIRED]** Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* **[REQUIRED]** Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* **[REQUIRED]** Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* **[REQUIRED]** Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PolicyObjectIdentifier", "PolicyType". * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* **[REQUIRED]** The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* **[REQUIRED]** The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* **[REQUIRED]** General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users. * **PrivateKeyAttributes** *(dict) --* **[REQUIRED]** Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* **[REQUIRED]** Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **MinimalKeyLength** *(integer) --* **[REQUIRED]** Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* **[REQUIRED]** Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key. * **ClientVersion** *(string) --* **[REQUIRED]** Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* **[REQUIRED]** Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV3** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* **[REQUIRED]** Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* **[REQUIRED]** Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* **[REQUIRED]** Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* **[REQUIRED]** Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* **[REQUIRED]** Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* **[REQUIRED]** Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PolicyObjectIdentifier", "PolicyType". * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* **[REQUIRED]** The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* **[REQUIRED]** The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* **[REQUIRED]** General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* **[REQUIRED]** Specifies the hash algorithm used to hash the private key. * **PrivateKeyAttributes** *(dict) --* **[REQUIRED]** Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers. * **Algorithm** *(string) --* **[REQUIRED]** Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* **[REQUIRED]** Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* **[REQUIRED]** The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PropertyFlags", "PropertyType". * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* **[REQUIRED]** Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* **[REQUIRED]** Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used. * **ClientVersion** *(string) --* **[REQUIRED]** Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **StrongKeyProtectionRequired** *(boolean) --* Requirer user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* **[REQUIRED]** Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV4** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* **[REQUIRED]** Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* **[REQUIRED]** Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* **[REQUIRED]** Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* **[REQUIRED]** Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* **[REQUIRED]** Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* **[REQUIRED]** Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PolicyObjectIdentifier", "PolicyType". * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* **[REQUIRED]** The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* **[REQUIRED]** The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* **[REQUIRED]** General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers. * **PrivateKeyAttributes** *(dict) --* **[REQUIRED]** Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* **[REQUIRED]** Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PropertyFlags", "PropertyType". * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* **[REQUIRED]** Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* **[REQUIRED]** Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key. * **ClientVersion** *(string) --* **[REQUIRED]** Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **RequireSameKeyRenewal** *(boolean) --* Renew certificate using the same private key. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **UseLegacyProvider** *(boolean) --* Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers. * **SubjectNameFlags** *(dict) --* **[REQUIRED]** Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **Name** (*string*) -- **[REQUIRED]** Name of the template. The template name must be unique. * **Tags** (*dict*) -- Metadata assigned to a template consisting of a key-value pair. * *(string) --* * *(string) --* Return type: dict Returns: **Response Syntax** { 'TemplateArn': 'string' } **Response Structure** * *(dict) --* * **TemplateArn** *(string) --* If successful, the Amazon Resource Name (ARN) of the template. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.ServiceQuotaExceededException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / create_connector create_connector **************** PcaConnectorAd.Client.create_connector(**kwargs) Creates a connector between Amazon Web Services Private CA and an Active Directory. You must specify the private CA, directory ID, and security groups. See also: AWS API Documentation **Request Syntax** response = client.create_connector( CertificateAuthorityArn='string', ClientToken='string', DirectoryId='string', Tags={ 'string': 'string' }, VpcInformation={ 'IpAddressType': 'IPV4'|'DUALSTACK', 'SecurityGroupIds': [ 'string', ] } ) Parameters: * **CertificateAuthorityArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) of the certificate authority being used. * **ClientToken** (*string*) -- Idempotency token. This field is autopopulated if not provided. * **DirectoryId** (*string*) -- **[REQUIRED]** The identifier of the Active Directory. * **Tags** (*dict*) -- Metadata assigned to a connector consisting of a key-value pair. * *(string) --* * *(string) --* * **VpcInformation** (*dict*) -- **[REQUIRED]** Information about your VPC and security groups used with the connector. * **IpAddressType** *(string) --* The VPC IP address type. * **SecurityGroupIds** *(list) --* **[REQUIRED]** The security groups used with the connector. You can use a maximum of 4 security groups with a connector. * *(string) --* Return type: dict Returns: **Response Syntax** { 'ConnectorArn': 'string' } **Response Structure** * *(dict) --* * **ConnectorArn** *(string) --* If successful, the Amazon Resource Name (ARN) of the connector for Active Directory. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.ServiceQuotaExceededException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / close close ***** PcaConnectorAd.Client.close() Closes underlying endpoint connections. PcaConnectorAd / Client / update_template update_template *************** PcaConnectorAd.Client.update_template(**kwargs) Update template configuration to define the information included in certificates. See also: AWS API Documentation **Request Syntax** response = client.update_template( Definition={ 'TemplateV2': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'PrivateKeyAttributes': { 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2003'|'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV3': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV4': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'RequireSameKeyRenewal': True|False, 'StrongKeyProtectionRequired': True|False, 'UseLegacyProvider': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] } }, ReenrollAllCertificateHolders=True|False, TemplateArn='string' ) Parameters: * **Definition** (*dict*) -- Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "TemplateV2", "TemplateV3", "TemplateV4". * **TemplateV2** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* **[REQUIRED]** Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* **[REQUIRED]** Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* **[REQUIRED]** Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* **[REQUIRED]** Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* **[REQUIRED]** Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* **[REQUIRED]** Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PolicyObjectIdentifier", "PolicyType". * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* **[REQUIRED]** The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* **[REQUIRED]** The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* **[REQUIRED]** General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users. * **PrivateKeyAttributes** *(dict) --* **[REQUIRED]** Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* **[REQUIRED]** Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **MinimalKeyLength** *(integer) --* **[REQUIRED]** Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* **[REQUIRED]** Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key. * **ClientVersion** *(string) --* **[REQUIRED]** Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* **[REQUIRED]** Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV3** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* **[REQUIRED]** Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* **[REQUIRED]** Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* **[REQUIRED]** Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* **[REQUIRED]** Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* **[REQUIRED]** Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* **[REQUIRED]** Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PolicyObjectIdentifier", "PolicyType". * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* **[REQUIRED]** The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* **[REQUIRED]** The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* **[REQUIRED]** General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* **[REQUIRED]** Specifies the hash algorithm used to hash the private key. * **PrivateKeyAttributes** *(dict) --* **[REQUIRED]** Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers. * **Algorithm** *(string) --* **[REQUIRED]** Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* **[REQUIRED]** Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* **[REQUIRED]** The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PropertyFlags", "PropertyType". * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* **[REQUIRED]** Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* **[REQUIRED]** Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used. * **ClientVersion** *(string) --* **[REQUIRED]** Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **StrongKeyProtectionRequired** *(boolean) --* Requirer user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* **[REQUIRED]** Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV4** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* **[REQUIRED]** Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* **[REQUIRED]** Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* **[REQUIRED]** Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* **[REQUIRED]** The numeric value for the validity period. * **PeriodType** *(string) --* **[REQUIRED]** The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* **[REQUIRED]** Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* **[REQUIRED]** Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* **[REQUIRED]** Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PolicyObjectIdentifier", "PolicyType". * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* **[REQUIRED]** The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* **[REQUIRED]** The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* **[REQUIRED]** General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers. * **PrivateKeyAttributes** *(dict) --* **[REQUIRED]** Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* **[REQUIRED]** Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys can be set: "PropertyFlags", "PropertyType". * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* **[REQUIRED]** Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* **[REQUIRED]** Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key. * **ClientVersion** *(string) --* **[REQUIRED]** Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **RequireSameKeyRenewal** *(boolean) --* Renew certificate using the same private key. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **UseLegacyProvider** *(boolean) --* Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers. * **SubjectNameFlags** *(dict) --* **[REQUIRED]** Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **ReenrollAllCertificateHolders** (*boolean*) -- This setting allows the major version of a template to be increased automatically. All members of Active Directory groups that are allowed to enroll with a template will receive a new certificate issued using that template. * **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / get_directory_registration get_directory_registration ************************** PcaConnectorAd.Client.get_directory_registration(**kwargs) A structure that contains information about your directory registration. See also: AWS API Documentation **Request Syntax** response = client.get_directory_registration( DirectoryRegistrationArn='string' ) Parameters: **DirectoryRegistrationArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. Return type: dict Returns: **Response Syntax** { 'DirectoryRegistration': { 'Arn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryId': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'DIRECTORY_ACCESS_DENIED'|'DIRECTORY_RESOURCE_NOT_FOUND'|'DIRECTORY_NOT_ACTIVE'|'DIRECTORY_NOT_REACHABLE'|'DIRECTORY_TYPE_NOT_SUPPORTED'|'INTERNAL_FAILURE', 'UpdatedAt': datetime(2015, 1, 1) } } **Response Structure** * *(dict) --* * **DirectoryRegistration** *(dict) --* The directory registration represents the authorization of the connector service with a directory. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **CreatedAt** *(datetime) --* The date and time that the directory registration was created. * **DirectoryId** *(string) --* The identifier of the Active Directory. * **Status** *(string) --* Status of the directory registration. * **StatusReason** *(string) --* Additional information about the directory registration status if the status is failed. * **UpdatedAt** *(datetime) --* The date and time that the directory registration was updated. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / list_service_principal_names list_service_principal_names **************************** PcaConnectorAd.Client.list_service_principal_names(**kwargs) Lists the service principal names that the connector uses to authenticate with Active Directory. See also: AWS API Documentation **Request Syntax** response = client.list_service_principal_names( DirectoryRegistrationArn='string', MaxResults=123, NextToken='string' ) Parameters: * **DirectoryRegistrationArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **MaxResults** (*integer*) -- Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the "NextToken" element is sent in the response. Use this "NextToken" value in a subsequent request to retrieve additional items. * **NextToken** (*string*) -- Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. Return type: dict Returns: **Response Syntax** { 'NextToken': 'string', 'ServicePrincipalNames': [ { 'ConnectorArn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryRegistrationArn': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'DIRECTORY_ACCESS_DENIED'|'DIRECTORY_NOT_REACHABLE'|'DIRECTORY_RESOURCE_NOT_FOUND'|'SPN_EXISTS_ON_DIFFERENT_AD_OBJECT'|'SPN_LIMIT_EXCEEDED'|'INTERNAL_FAILURE', 'UpdatedAt': datetime(2015, 1, 1) }, ] } **Response Structure** * *(dict) --* * **NextToken** *(string) --* Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. * **ServicePrincipalNames** *(list) --* The service principal name, if any, that the connector uses to authenticate with Active Directory. * *(dict) --* The service principal name that the connector uses to authenticate with Active Directory. * **ConnectorArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CreatedAt** *(datetime) --* The date and time that the service principal name was created. * **DirectoryRegistrationArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **Status** *(string) --* The status of a service principal name. * **StatusReason** *(string) --* Additional information for the status of a service principal name if the status is failed. * **UpdatedAt** *(datetime) --* Time when the service principal name was updated. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / list_template_group_access_control_entries list_template_group_access_control_entries ****************************************** PcaConnectorAd.Client.list_template_group_access_control_entries(**kwargs) Lists group access control entries you created. See also: AWS API Documentation **Request Syntax** response = client.list_template_group_access_control_entries( MaxResults=123, NextToken='string', TemplateArn='string' ) Parameters: * **MaxResults** (*integer*) -- Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the "NextToken" element is sent in the response. Use this "NextToken" value in a subsequent request to retrieve additional items. * **NextToken** (*string*) -- Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. * **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Return type: dict Returns: **Response Syntax** { 'AccessControlEntries': [ { 'AccessRights': { 'AutoEnroll': 'ALLOW'|'DENY', 'Enroll': 'ALLOW'|'DENY' }, 'CreatedAt': datetime(2015, 1, 1), 'GroupDisplayName': 'string', 'GroupSecurityIdentifier': 'string', 'TemplateArn': 'string', 'UpdatedAt': datetime(2015, 1, 1) }, ], 'NextToken': 'string' } **Response Structure** * *(dict) --* * **AccessControlEntries** *(list) --* An access control entry grants or denies permission to an Active Directory group to enroll certificates for a template. * *(dict) --* Summary of group access control entries that allow or deny Active Directory groups based on their security identifiers (SIDs) from enrolling and/or autofenrolling with the template. * **AccessRights** *(dict) --* Allow or deny an Active Directory group from enrolling and autoenrolling certificates issued against a template. * **AutoEnroll** *(string) --* Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment * **Enroll** *(string) --* Allow or deny an Active Directory group from enrolling certificates issued against a template. * **CreatedAt** *(datetime) --* The date and time that the Access Control Entry was created. * **GroupDisplayName** *(string) --* Name of the Active Directory group. This name does not need to match the group name in Active Directory. * **GroupSecurityIdentifier** *(string) --* Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". * **TemplateArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. * **UpdatedAt** *(datetime) --* The date and time that the Access Control Entry was updated. * **NextToken** *(string) --* Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / tag_resource tag_resource ************ PcaConnectorAd.Client.tag_resource(**kwargs) Adds one or more tags to your resource. See also: AWS API Documentation **Request Syntax** response = client.tag_resource( ResourceArn='string', Tags={ 'string': 'string' } ) Parameters: * **ResourceArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you created the resource. * **Tags** (*dict*) -- **[REQUIRED]** Metadata assigned to a directory registration consisting of a key-value pair. * *(string) --* * *(string) --* Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / delete_connector delete_connector **************** PcaConnectorAd.Client.delete_connector(**kwargs) Deletes a connector for Active Directory. You must provide the Amazon Resource Name (ARN) of the connector that you want to delete. You can find the ARN by calling the https://docs.aws.amazon.com/pca-connector- ad/latest/APIReference/API_ListConnectors action. Deleting a connector does not deregister your directory with Amazon Web Services Private CA. You can deregister your directory by calling the https://docs.aws.amazon.com/pca-connector- ad/latest/APIReference/API_DeleteDirectoryRegistration action. See also: AWS API Documentation **Request Syntax** response = client.delete_connector( ConnectorArn='string' ) Parameters: **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / update_template_group_access_control_entry update_template_group_access_control_entry ****************************************** PcaConnectorAd.Client.update_template_group_access_control_entry(**kwargs) Update a group access control entry you created using CreateTemplateGroupAccessControlEntry. See also: AWS API Documentation **Request Syntax** response = client.update_template_group_access_control_entry( AccessRights={ 'AutoEnroll': 'ALLOW'|'DENY', 'Enroll': 'ALLOW'|'DENY' }, GroupDisplayName='string', GroupSecurityIdentifier='string', TemplateArn='string' ) Parameters: * **AccessRights** (*dict*) -- Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template. * **AutoEnroll** *(string) --* Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment * **Enroll** *(string) --* Allow or deny an Active Directory group from enrolling certificates issued against a template. * **GroupDisplayName** (*string*) -- Name of the Active Directory group. This name does not need to match the group name in Active Directory. * **GroupSecurityIdentifier** (*string*) -- **[REQUIRED]** Security identifier (SID) of the group object from Active Directory. The SID starts with "S-". * **TemplateArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. Returns: None **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" * "PcaConnectorAd.Client.exceptions.ConflictException" PcaConnectorAd / Client / list_templates list_templates ************** PcaConnectorAd.Client.list_templates(**kwargs) Lists the templates, if any, that are associated with a connector. See also: AWS API Documentation **Request Syntax** response = client.list_templates( ConnectorArn='string', MaxResults=123, NextToken='string' ) Parameters: * **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **MaxResults** (*integer*) -- Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the "NextToken" element is sent in the response. Use this "NextToken" value in a subsequent request to retrieve additional items. * **NextToken** (*string*) -- Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. Return type: dict Returns: **Response Syntax** { 'NextToken': 'string', 'Templates': [ { 'Arn': 'string', 'ConnectorArn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'Definition': { 'TemplateV2': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'PrivateKeyAttributes': { 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2003'|'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV3': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2008'|'WINDOWS_SERVER_2008_R2'|'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'StrongKeyProtectionRequired': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] }, 'TemplateV4': { 'CertificateValidity': { 'RenewalPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' }, 'ValidityPeriod': { 'Period': 123, 'PeriodType': 'HOURS'|'DAYS'|'WEEKS'|'MONTHS'|'YEARS' } }, 'EnrollmentFlags': { 'EnableKeyReuseOnNtTokenKeysetStorageFull': True|False, 'IncludeSymmetricAlgorithms': True|False, 'NoSecurityExtension': True|False, 'RemoveInvalidCertificateFromPersonalStore': True|False, 'UserInteractionRequired': True|False }, 'Extensions': { 'ApplicationPolicies': { 'Critical': True|False, 'Policies': [ { 'PolicyObjectIdentifier': 'string', 'PolicyType': 'ALL_APPLICATION_POLICIES'|'ANY_PURPOSE'|'ATTESTATION_IDENTITY_KEY_CERTIFICATE'|'CERTIFICATE_REQUEST_AGENT'|'CLIENT_AUTHENTICATION'|'CODE_SIGNING'|'CTL_USAGE'|'DIGITAL_RIGHTS'|'DIRECTORY_SERVICE_EMAIL_REPLICATION'|'DISALLOWED_LIST'|'DNS_SERVER_TRUST'|'DOCUMENT_ENCRYPTION'|'DOCUMENT_SIGNING'|'DYNAMIC_CODE_GENERATOR'|'EARLY_LAUNCH_ANTIMALWARE_DRIVER'|'EMBEDDED_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'ENCLAVE'|'ENCRYPTING_FILE_SYSTEM'|'ENDORSEMENT_KEY_CERTIFICATE'|'FILE_RECOVERY'|'HAL_EXTENSION'|'IP_SECURITY_END_SYSTEM'|'IP_SECURITY_IKE_INTERMEDIATE'|'IP_SECURITY_TUNNEL_TERMINATION'|'IP_SECURITY_USER'|'ISOLATED_USER_MODE'|'KDC_AUTHENTICATION'|'KERNEL_MODE_CODE_SIGNING'|'KEY_PACK_LICENSES'|'KEY_RECOVERY'|'KEY_RECOVERY_AGENT'|'LICENSE_SERVER_VERIFICATION'|'LIFETIME_SIGNING'|'MICROSOFT_PUBLISHER'|'MICROSOFT_TIME_STAMPING'|'MICROSOFT_TRUST_LIST_SIGNING'|'OCSP_SIGNING'|'OEM_WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'PLATFORM_CERTIFICATE'|'PREVIEW_BUILD_SIGNING'|'PRIVATE_KEY_ARCHIVAL'|'PROTECTED_PROCESS_LIGHT_VERIFICATION'|'PROTECTED_PROCESS_VERIFICATION'|'QUALIFIED_SUBORDINATION'|'REVOKED_LIST_SIGNER'|'ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION'|'ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION'|'ROOT_PROGRAM_NO_OSCP_FAILOVER_TO_CRL'|'ROOT_LIST_SIGNER'|'SECURE_EMAIL'|'SERVER_AUTHENTICATION'|'SMART_CARD_LOGIN'|'SPC_ENCRYPTED_DIGEST_RETRY_COUNT'|'SPC_RELAXED_PE_MARKER_CHECK'|'TIME_STAMPING'|'WINDOWS_HARDWARE_DRIVER_ATTESTED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_EXTENDED_VERIFICATION'|'WINDOWS_HARDWARE_DRIVER_VERIFICATION'|'WINDOWS_HELLO_RECOVERY_KEY_ENCRYPTION'|'WINDOWS_KITS_COMPONENT'|'WINDOWS_RT_VERIFICATION'|'WINDOWS_SOFTWARE_EXTENSION_VERIFICATION'|'WINDOWS_STORE'|'WINDOWS_SYSTEM_COMPONENT_VERIFICATION'|'WINDOWS_TCB_COMPONENT'|'WINDOWS_THIRD_PARTY_APPLICATION_COMPONENT'|'WINDOWS_UPDATE' }, ] }, 'KeyUsage': { 'Critical': True|False, 'UsageFlags': { 'DataEncipherment': True|False, 'DigitalSignature': True|False, 'KeyAgreement': True|False, 'KeyEncipherment': True|False, 'NonRepudiation': True|False } } }, 'GeneralFlags': { 'AutoEnrollment': True|False, 'MachineType': True|False }, 'HashAlgorithm': 'SHA256'|'SHA384'|'SHA512', 'PrivateKeyAttributes': { 'Algorithm': 'RSA'|'ECDH_P256'|'ECDH_P384'|'ECDH_P521', 'CryptoProviders': [ 'string', ], 'KeySpec': 'KEY_EXCHANGE'|'SIGNATURE', 'KeyUsageProperty': { 'PropertyFlags': { 'Decrypt': True|False, 'KeyAgreement': True|False, 'Sign': True|False }, 'PropertyType': 'ALL' }, 'MinimalKeyLength': 123 }, 'PrivateKeyFlags': { 'ClientVersion': 'WINDOWS_SERVER_2012'|'WINDOWS_SERVER_2012_R2'|'WINDOWS_SERVER_2016', 'ExportableKey': True|False, 'RequireAlternateSignatureAlgorithm': True|False, 'RequireSameKeyRenewal': True|False, 'StrongKeyProtectionRequired': True|False, 'UseLegacyProvider': True|False }, 'SubjectNameFlags': { 'RequireCommonName': True|False, 'RequireDirectoryPath': True|False, 'RequireDnsAsCn': True|False, 'RequireEmail': True|False, 'SanRequireDirectoryGuid': True|False, 'SanRequireDns': True|False, 'SanRequireDomainDns': True|False, 'SanRequireEmail': True|False, 'SanRequireSpn': True|False, 'SanRequireUpn': True|False }, 'SupersededTemplates': [ 'string', ] } }, 'Name': 'string', 'ObjectIdentifier': 'string', 'PolicySchema': 123, 'Revision': { 'MajorRevision': 123, 'MinorRevision': 123 }, 'Status': 'ACTIVE'|'DELETING', 'UpdatedAt': datetime(2015, 1, 1) }, ] } **Response Structure** * *(dict) --* * **NextToken** *(string) --* Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. * **Templates** *(list) --* Custom configuration templates used when issuing a certificate. * *(dict) --* An Active Directory compatible certificate template. Connectors issue certificates against these templates based on the requestor's Active Directory group membership. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateTemplate. * **ConnectorArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CreatedAt** *(datetime) --* The date and time that the template was created. * **Definition** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "TemplateV2", "TemplateV3", "TemplateV4". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **TemplateV2** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS- WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV3** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS- WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PropertyFlags", "PropertyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **StrongKeyProtectionRequired** *(boolean) --* Requirer user input when using the private key for enrollment. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **TemplateV4** *(dict) --* Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. * **CertificateValidity** *(dict) --* Certificate validity describes the validity and renewal periods of a certificate. * **RenewalPeriod** *(dict) --* Renewal period is the period of time before certificate expiration when a new certificate will be requested. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **ValidityPeriod** *(dict) --* Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. * **Period** *(integer) --* The numeric value for the validity period. * **PeriodType** *(string) --* The unit of time. You can select hours, days, weeks, months, and years. * **EnrollmentFlags** *(dict) --* Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates. * **EnableKeyReuseOnNtTokenKeysetStorageFull** *(boolean) --* Allow renewal using the same key. * **IncludeSymmetricAlgorithms** *(boolean) --* Include symmetric algorithms allowed by the subject. * **NoSecurityExtension** *(boolean) --* This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS- WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. * **RemoveInvalidCertificateFromPersonalStore** *(boolean) --* Delete expired or revoked certificates instead of archiving them. * **UserInteractionRequired** *(boolean) --* Require user interaction when the subject is enrolled and the private key associated with the certificate is used. * **Extensions** *(dict) --* Extensions describe the key usage extensions and application policies for a template. * **ApplicationPolicies** *(dict) --* Application policies specify what the certificate is used for and its purpose. * **Critical** *(boolean) --* Marks the application policy extension as critical. * **Policies** *(list) --* Application policies describe what the certificate can be used for. * *(dict) --* Application policies describe what the certificate can be used for. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PolicyObjectIdentifier", "PolicyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PolicyObjectIdentifier** *(string) --* The object identifier (OID) of an application policy. * **PolicyType** *(string) --* The type of application policy * **KeyUsage** *(dict) --* The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **Critical** *(boolean) --* Sets the key usage extension to critical. * **UsageFlags** *(dict) --* The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. * **DataEncipherment** *(boolean) --* DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. * **DigitalSignature** *(boolean) --* The digitalSignature is asserted when the subject public key is used for verifying digital signatures. * **KeyAgreement** *(boolean) --* KeyAgreement is asserted when the subject public key is used for key agreement. * **KeyEncipherment** *(boolean) --* KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. * **NonRepudiation** *(boolean) --* NonRepudiation is asserted when the subject public key is used to verify digital signatures. * **GeneralFlags** *(dict) --* General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. * **AutoEnrollment** *(boolean) --* Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. * **MachineType** *(boolean) --* Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users * **HashAlgorithm** *(string) --* Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers. * **PrivateKeyAttributes** *(dict) --* Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags. * **Algorithm** *(string) --* Defines the algorithm used to generate the private key. * **CryptoProviders** *(list) --* Defines the cryptographic providers used to generate the private key. * *(string) --* * **KeySpec** *(string) --* Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. * **KeyUsageProperty** *(dict) --* The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. Note: This is a Tagged Union structure. Only one of the following top level keys will be set: "PropertyFlags", "PropertyType". If a client receives an unknown member it will set "SDK_UNKNOWN_MEMBER" as the top level key, which maps to the name or tag of the unknown member. The structure of "SDK_UNKNOWN_MEMBER" is as follows: 'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'} * **PropertyFlags** *(dict) --* You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. * **Decrypt** *(boolean) --* Allows key for encryption and decryption. * **KeyAgreement** *(boolean) --* Allows key exchange without encryption. * **Sign** *(boolean) --* Allow key use for digital signature. * **PropertyType** *(string) --* You can specify all key usages using property type ALL. You can use property type or property flags but not both. * **MinimalKeyLength** *(integer) --* Set the minimum key length of the private key. * **PrivateKeyFlags** *(dict) --* Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key. * **ClientVersion** *(string) --* Defines the minimum client compatibility. * **ExportableKey** *(boolean) --* Allows the private key to be exported. * **RequireAlternateSignatureAlgorithm** *(boolean) --* Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. * **RequireSameKeyRenewal** *(boolean) --* Renew certificate using the same private key. * **StrongKeyProtectionRequired** *(boolean) --* Require user input when using the private key for enrollment. * **UseLegacyProvider** *(boolean) --* Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers. * **SubjectNameFlags** *(dict) --* Subject name flags describe the subject name and subject alternate name that is included in a certificate. * **RequireCommonName** *(boolean) --* Include the common name in the subject name. * **RequireDirectoryPath** *(boolean) --* Include the directory path in the subject name. * **RequireDnsAsCn** *(boolean) --* Include the DNS as common name in the subject name. * **RequireEmail** *(boolean) --* Include the subject's email in the subject name. * **SanRequireDirectoryGuid** *(boolean) --* Include the globally unique identifier (GUID) in the subject alternate name. * **SanRequireDns** *(boolean) --* Include the DNS in the subject alternate name. * **SanRequireDomainDns** *(boolean) --* Include the domain DNS in the subject alternate name. * **SanRequireEmail** *(boolean) --* Include the subject's email in the subject alternate name. * **SanRequireSpn** *(boolean) --* Include the service principal name (SPN) in the subject alternate name. * **SanRequireUpn** *(boolean) --* Include the user principal name (UPN) in the subject alternate name. * **SupersededTemplates** *(list) --* List of templates in Active Directory that are superseded by this template. * *(string) --* * **Name** *(string) --* Name of the template. The template name must be unique. * **ObjectIdentifier** *(string) --* Object identifier of a template. * **PolicySchema** *(integer) --* The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version. * **Revision** *(dict) --* The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision. * **MajorRevision** *(integer) --* The revision version of the template. Re-enrolling all certificate holders will increment the major revision. * **MinorRevision** *(integer) --* The revision version of the template. Re-enrolling all certificate holders will increment the major revision. * **Status** *(string) --* Status of the template. Status can be creating, active, deleting, or failed. * **UpdatedAt** *(datetime) --* The date and time that the template was updated. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / get_service_principal_name get_service_principal_name ************************** PcaConnectorAd.Client.get_service_principal_name(**kwargs) Lists the service principal name that the connector uses to authenticate with Active Directory. See also: AWS API Documentation **Request Syntax** response = client.get_service_principal_name( ConnectorArn='string', DirectoryRegistrationArn='string' ) Parameters: * **ConnectorArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **DirectoryRegistrationArn** (*string*) -- **[REQUIRED]** The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. Return type: dict Returns: **Response Syntax** { 'ServicePrincipalName': { 'ConnectorArn': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryRegistrationArn': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'DIRECTORY_ACCESS_DENIED'|'DIRECTORY_NOT_REACHABLE'|'DIRECTORY_RESOURCE_NOT_FOUND'|'SPN_EXISTS_ON_DIFFERENT_AD_OBJECT'|'SPN_LIMIT_EXCEEDED'|'INTERNAL_FAILURE', 'UpdatedAt': datetime(2015, 1, 1) } } **Response Structure** * *(dict) --* * **ServicePrincipalName** *(dict) --* The service principal name that the connector uses to authenticate with Active Directory. * **ConnectorArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector.html. * **CreatedAt** *(datetime) --* The date and time that the service principal name was created. * **DirectoryRegistrationArn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateDirectoryRegistration. * **Status** *(string) --* The status of a service principal name. * **StatusReason** *(string) --* Additional information for the status of a service principal name if the status is failed. * **UpdatedAt** *(datetime) --* The date and time that the service principal name was updated. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ResourceNotFoundException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException" PcaConnectorAd / Client / list_connectors list_connectors *************** PcaConnectorAd.Client.list_connectors(**kwargs) Lists the connectors that you created by using the https://docs.aws.amazon.com/pca-connector- ad/latest/APIReference/API_CreateConnector action. See also: AWS API Documentation **Request Syntax** response = client.list_connectors( MaxResults=123, NextToken='string' ) Parameters: * **MaxResults** (*integer*) -- Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the "NextToken" element is sent in the response. Use this "NextToken" value in a subsequent request to retrieve additional items. * **NextToken** (*string*) -- Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the "NextToken" parameter from the response you just received. Return type: dict Returns: **Response Syntax** { 'Connectors': [ { 'Arn': 'string', 'CertificateAuthorityArn': 'string', 'CertificateEnrollmentPolicyServerEndpoint': 'string', 'CreatedAt': datetime(2015, 1, 1), 'DirectoryId': 'string', 'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED', 'StatusReason': 'CA_CERTIFICATE_REGISTRATION_FAILED'|'DIRECTORY_ACCESS_DENIED'|'INTERNAL_FAILURE'|'INSUFFICIENT_FREE_ADDRESSES'|'INVALID_SUBNET_IP_PROTOCOL'|'PRIVATECA_ACCESS_DENIED'|'PRIVATECA_RESOURCE_NOT_FOUND'|'SECURITY_GROUP_NOT_IN_VPC'|'VPC_ACCESS_DENIED'|'VPC_ENDPOINT_LIMIT_EXCEEDED'|'VPC_RESOURCE_NOT_FOUND', 'UpdatedAt': datetime(2015, 1, 1), 'VpcInformation': { 'IpAddressType': 'IPV4'|'DUALSTACK', 'SecurityGroupIds': [ 'string', ] } }, ], 'NextToken': 'string' } **Response Structure** * *(dict) --* * **Connectors** *(list) --* Summary information about each connector you have created. * *(dict) --* Summary description of the Amazon Web Services Private CA AD connectors belonging to an Amazon Web Services account. * **Arn** *(string) --* The Amazon Resource Name (ARN) that was returned when you called CreateConnector. * **CertificateAuthorityArn** *(string) --* The Amazon Resource Name (ARN) of the certificate authority being used. * **CertificateEnrollmentPolicyServerEndpoint** *(string) --* Certificate enrollment endpoint for Active Directory domain-joined objects to request certificates. * **CreatedAt** *(datetime) --* The date and time that the connector was created. * **DirectoryId** *(string) --* The identifier of the Active Directory. * **Status** *(string) --* Status of the connector. Status can be creating, active, deleting, or failed. * **StatusReason** *(string) --* Additional information about the connector status if the status is failed. * **UpdatedAt** *(datetime) --* The date and time that the connector was updated. * **VpcInformation** *(dict) --* Information of the VPC and security group(s) used with the connector. * **IpAddressType** *(string) --* The VPC IP address type. * **SecurityGroupIds** *(list) --* The security groups used with the connector. You can use a maximum of 4 security groups with a connector. * *(string) --* * **NextToken** *(string) --* Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received. **Exceptions** * "PcaConnectorAd.Client.exceptions.AccessDeniedException" * "PcaConnectorAd.Client.exceptions.ValidationException" * "PcaConnectorAd.Client.exceptions.ThrottlingException" * "PcaConnectorAd.Client.exceptions.InternalServerException"