{"id":22292624,"url":"https://github.com/ericnorris/google-kms-x509","last_synced_at":"2025-07-28T23:33:36.339Z","repository":{"id":47707904,"uuid":"237682125","full_name":"ericnorris/google-kms-x509","owner":"ericnorris","description":"Generate certificates with Google Cloud's KMS product.","archived":false,"fork":false,"pushed_at":"2021-08-17T09:17:22.000Z","size":61,"stargazers_count":9,"open_issues_count":1,"forks_count":8,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-05-31T17:42:11.346Z","etag":null,"topics":["certificate-authority","certificates","cloudkms","csr","google","x509"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ericnorris.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-02-01T21:44:09.000Z","updated_at":"2022-10-20T00:44:54.000Z","dependencies_parsed_at":"2022-08-22T15:50:45.713Z","dependency_job_id":null,"html_url":"https://github.com/ericnorris/google-kms-x509","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/ericnorris/google-kms-x509","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgoogle-kms-x509","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgoogle-kms-x509/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgoogle-kms-x509/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgoogle-kms-x509/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ericnorris","download_url":"https://codeload.github.com/ericnorris/google-kms-x509/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgoogle-kms-x509/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267604324,"owners_count":24114522,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-28T02:00:09.689Z","response_time":68,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate-authority","certificates","cloudkms","csr","google","x509"],"created_at":"2024-12-03T17:23:12.057Z","updated_at":"2025-07-28T23:33:35.994Z","avatar_url":"https://github.com/ericnorris.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# google-kms-x509\n\nKind of like `openssl x509`, but with [Google Cloud KMS](https://cloud.google.com/kms) as the backend.\n\n- [Features](#features)\n- [Authentication](#authentication)\n- [Supported KMS algorithms](#supported-kms-algorithms)\n- [Usage](#usage)\n  - [Generate a root CA](#generate-a-root-ca)\n  - [Generate a CSR](#generate-a-csr)\n  - [Sign an intermediate CA](#sign-an-intermediate-ca)\n  - [Sign a leaf certificate](#sign-a-leaf-certificate)\n\n## Features\n- generate self-signed root certificate authorities (CAs)\n- generate certificate signing requests (CSRs)\n- sign intermediate CAs with [x509 name constraints](https://tools.ietf.org/html/rfc5280#section-4.2.1.10)\n- sign leaf certificates\n- no private keys, all operations are backed by Cloud KMS\n\n## Authentication\n\nCalls to Cloud KMS are authenticated using [Application Default Credentials](https://cloud.google.com/docs/authentication/production).\n\n## Supported KMS algorithms\n\nElliptic Curve signing algorithms:\n\n- EC_SIGN_P256_SHA256\n- EC_SIGN_P384_SHA384\n\nRSA signing algorithms:\n\n- RSA_SIGN_PKCS1_2048_SHA256\n- RSA_SIGN_PKCS1_3072_SHA256\n- RSA_SIGN_PKCS1_4096_SHA256\n- RSA_SIGN_PKCS1_4096_SHA512\n- RSA_SIGN_PSS_2048_SHA256\n- RSA_SIGN_PSS_3072_SHA256\n- RSA_SIGN_PSS_4096_SHA256\n- RSA_SIGN_PSS_4096_SHA512\n\n\n## Usage\n\nAll of the commands take a `--kms-key` argument in the form of a [Key version resource ID](https://cloud.google.com/kms/docs/object-hierarchy#key_version_resource_id), which is the fully qualified path to the _version_ of the KMS key.\n\n### Generate a root CA\n\n```\nUsage:\n  google-kms-x509 generate root-ca [flags]\n\nFlags:\n      --common-name string          x509 Distinguished Name (DN) field\n      --country string              x509 Distinguished Name (DN) field\n      --days int                    days until expiration\n      --emailAddress string         x509 Distinguished Name (DN) field\n      --generate-comment            generate an x509 comment showing the Google KMS key resource ID used (default true)\n  -h, --help                        help for root-ca\n  -k, --kms-key string              Google KMS key resource ID\n      --locality string             x509 Distinguished Name (DN) field\n      --organization string         x509 Distinguished Name (DN) field\n      --organizationalUnit string   x509 Distinguished Name (DN) field\n  -o, --out string                  output file path, '-' for stdout (default \"-\")\n      --province string             x509 Distinguished Name (DN) field\n```\n\n### Generate a CSR\n\n```\nUsage:\n  google-kms-x509 generate csr [flags]\n\nFlags:\n      --common-name string          x509 Distinguished Name (DN) field\n      --country string              x509 Distinguished Name (DN) field\n      --emailAddress string         x509 Distinguished Name (DN) field\n      --generate-comment            generate an x509 comment showing the Google KMS key resource ID used (default true)\n  -h, --help                        help for csr\n  -k, --kms-key string              Google KMS key resource ID\n      --locality string             x509 Distinguished Name (DN) field\n      --organization string         x509 Distinguished Name (DN) field\n      --organizationalUnit string   x509 Distinguished Name (DN) field\n  -o, --out string                  output file path, '-' for stdout (default \"-\")\n      --province string             x509 Distinguished Name (DN) field\n```\n \n### Sign an intermediate CA\n \nNote: You must first generate a CSR. Distinguished Name fields are taken from the command line, not the CSR.\n \n```\nUsage:\n  google-kms-x509 sign intermediate-ca [flags]\n\nFlags:\n      --child-csr string                child CSR path\n      --common-name string              x509 Distinguished Name (DN) field\n      --country string                  x509 Distinguished Name (DN) field\n      --days int                        days until expiration\n      --emailAddress string             x509 Distinguished Name (DN) field\n      --generate-comment                generate an x509 comment showing the Google KMS key resource ID used (default true)\n  -h, --help                            help for intermediate-ca\n  -k, --kms-key string                  Google KMS key resource ID\n      --locality string                 x509 Distinguished Name (DN) field\n      --organization string             x509 Distinguished Name (DN) field\n      --organizationalUnit string       x509 Distinguished Name (DN) field\n  -o, --out string                      output file path, '-' for stdout (default \"-\")\n      --parent-cert string              parent certificate path\n      --path-len int                    number of intermediate CAs allowed under this CA\n      --permitted-dns-domains strings   permitted DNS names for x509 Name Constraints extension\n      --province string                 x509 Distinguished Name (DN) field\n```\n \n### Sign a leaf certificate\n \nNote: You must first generate a CSR. Distinguished Name fields are taken from the command line, not the CSR.\n \n```\nUsage:\n  google-kms-x509 sign leaf [flags]\n\nFlags:\n      --child-csr string            child CSR path\n      --client                      sign as a client certificate\n      --common-name string          x509 Distinguished Name (DN) field\n      --country string              x509 Distinguished Name (DN) field\n      --days int                    days until expiration\n      --dns-names strings           DNS names for x509 Subject Alternative Names extension\n      --emailAddress string         x509 Distinguished Name (DN) field\n      --generate-comment            generate an x509 comment showing the Google KMS key resource ID used (default true)\n  -h, --help                        help for leaf\n      --ip-addresses ipSlice        IP addresses for x509 Subject Alternative Names extension (default [])\n  -k, --kms-key string              Google KMS key resource ID\n      --locality string             x509 Distinguished Name (DN) field\n      --organization string         x509 Distinguished Name (DN) field\n      --organizationalUnit string   x509 Distinguished Name (DN) field\n  -o, --out string                  output file path, '-' for stdout (default \"-\")\n      --parent-cert string          parent certificate path\n      --province string             x509 Distinguished Name (DN) field\n      --server                      sign as a server cert\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fericnorris%2Fgoogle-kms-x509","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fericnorris%2Fgoogle-kms-x509","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fericnorris%2Fgoogle-kms-x509/lists"}