.TH "GCLOUD_CERTIFICATE\-MANAGER_CERTIFICATES_CREATE" 1



.SH "NAME"
.HP
gcloud certificate\-manager certificates create \- create a certificate



.SH "SYNOPSIS"
.HP
\f5gcloud certificate\-manager certificates create\fR (\fICERTIFICATE\fR\ :\ \fB\-\-location\fR=\fILOCATION\fR) (\fB\-\-certificate\-file\fR=\fIPATH_TO_FILE\fR\ \fB\-\-private\-key\-file\fR=\fIPATH_TO_FILE\fR\ |\ [\fB\-\-domains\fR=[\fIDOMAINS\fR,...]\ :\ \fB\-\-dns\-authorizations\fR=[\fIDNS_AUTHORIZATIONS\fR,...]\ |\ \fB\-\-issuance\-config\fR=\fIISSUANCE_CONFIG\fR]) [\fB\-\-async\fR] [\fB\-\-description\fR=\fIDESCRIPTION\fR] [\fB\-\-labels\fR=[\fIKEY\fR=\fIVALUE\fR,...]] [\fB\-\-scope\fR=\fISCOPE\fR;\ default="DEFAULT"] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

Create a new certificate.

.RS 2m
.IP "\(bu" 2m
Managed certificates can be created by supplying one or more domain names and an
(optional) list of DNS authorizations for those domain names.
.IP "\(bu" 2m
Self\-managed certificates can be created by uploading a certificate and its
corresponding private key (both in PEM format).
.RE
.sp



.SH "EXAMPLES"

To create (upload) a self\-managed certificate called \f5www\-example\-com\fR,
run:

.RS 2m
$ gcloud certificate\-manager certificates create www\-example\-com \e
    \-\-private\-key\-file=key.pem \-\-certificate\-file=cert.pem
.RE

To create a certificate managed by Certificate Manager called
\f5api\-example\-com\fR, run:

.RS 2m
$ gcloud certificate\-manager certificates create api\-example\-com \e
    \-\-domains="api.example.com"
.RE

To create a certificate managed by Certificate Manager called
\f5api\-example\-com\fR, using an existing DNS authorization, run:

.RS 2m
$ gcloud certificate\-manager certificates create api\-example\-com \e
    \-\-dns\-authorizations=api\-example\-com \-\-domains="api.example.com"
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m

Certificate resource \- The name of the certificate to create. The arguments in
this group can be used to specify the attributes of this resource. (NOTE) Some
attributes are not given arguments in this group but can be set in other ways.

To set the \f5project\fR attribute:
.RS 2m
.IP "\(em" 2m
provide the argument \f5certificate\fR on the command line with a fully
specified name;
.IP "\(em" 2m
provide the argument \f5\-\-project\fR on the command line;
.IP "\(em" 2m
set the property \f5core/project\fR.
.RE
.sp

This must be specified.


.RS 2m
.TP 2m
\fICERTIFICATE\fR

ID of the certificate or fully qualified identifier for the certificate.

To set the \f5certificate\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5certificate\fR on the command line.
.RE
.sp

This positional argument must be specified if any of the other arguments in this
group are specified.

.TP 2m
\fB\-\-location\fR=\fILOCATION\fR

Certificate Manager location.

To set the \f5location\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5certificate\fR on the command line with a fully
specified name;
.IP "\(bu" 2m
provide the argument \f5\-\-location\fR on the command line;
.IP "\(bu" 2m
default value of location is [global].
.RE
.sp


.RE
.RE
.sp

.SH "REQUIRED FLAGS"

.RS 2m
.TP 2m

Configuration for creating and uploading certificates to Cloud Certificate
Manager.


Exactly one of these must be specified:


.RS 2m
.TP 2m

Configuration for uploading self\-managed certificates and keys.



.RS 2m
.TP 2m
\fB\-\-certificate\-file\fR=\fIPATH_TO_FILE\fR

Certificate data in PEM\-encoded form. Use a full or relative path to a local
file containing the value of certificate_file.

This flag argument must be specified if any of the other arguments in this group
are specified.

.TP 2m
\fB\-\-private\-key\-file\fR=\fIPATH_TO_FILE\fR

Private key data in PEM\-encoded form. Use a full or relative path to a local
file containing the value of private_key_file.

This flag argument must be specified if any of the other arguments in this group
are specified.

.RE
.sp
.TP 2m

Configuration for creating new managed certificates.



.RS 2m
.TP 2m
\fB\-\-domains\fR=[\fIDOMAINS\fR,...]

Public domain name(s) to create a certificate for.

.RS 2m
.IP "\(em" 2m
If a DNS authorization is provided for the domain, the certificate will be
validated against the DNS record you added as part of the authorization flow.
.IP "\(em" 2m
If no DNS authorization is provided, Certificate Manager will attempt to
validate the domain against the serving endpoint directly.
.RE
.sp

You may list multiple, comma\-separated domain names to include multiple names
as Subject Alternative Names on the issued certificate.

This flag argument must be specified if any of the other arguments in this group
are specified.

.TP 2m

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-dns\-authorizations\fR=[\fIDNS_AUTHORIZATIONS\fR,...]

Name(s) of the DNS authorizations for each listed domain.

Note that each domain requires a matching authorization, and any domain that
fails authorization will prevent issuance and/or renewal of the certificate.

To reference multiple DNS authorizations, provide a list of comma separated DNS
authorization resource names or URLs. For example:

.RS 2m
$ gcloud certificate\-manager certificates create \e
     \-\-dns\-authorizations=api\-example\-com,www\-example\-com
.RE

.TP 2m
\fB\-\-issuance\-config\fR=\fIISSUANCE_CONFIG\fR

Name of the Certificate Issuance Config to use for issuance.


.RE
.RE
.RE
.RE
.sp

.SH "OPTIONAL FLAGS"

.RS 2m
.TP 2m
\fB\-\-async\fR

Return immediately, without waiting for the operation in progress to complete.

.TP 2m
\fB\-\-description\fR=\fIDESCRIPTION\fR

Human\-readable description of the resource.

.TP 2m
\fB\-\-labels\fR=[\fIKEY\fR=\fIVALUE\fR,...]

List of label KEY=VALUE pairs to add.

Keys must start with a lowercase character and contain only hyphens (\f5\-\fR),
underscores (\f5_\fR), lowercase characters, and numbers. Values must contain
only hyphens (\f5\-\fR), underscores (\f5_\fR), lowercase characters, and
numbers.

.TP 2m
\fB\-\-scope\fR=\fISCOPE\fR; default="DEFAULT"

Scope of the managed certificate. This determines which services the certificate
can be attached to/associated with. Defaults to \f5DEFAULT\fR. \fISCOPE\fR must
be one of:

.RS 2m
.TP 2m
\fBall\-regions\fR
Certificates with scope ALL_REGIONS are currently used for Cross\-region
Internal Application Load Balancer only.

.TP 2m
\fBclient\-auth\fR
Certificates with scope CLIENT_AUTH are used for client authentication.

.TP 2m
\fBdefault\fR
Certificates with DEFAULT scope are used for Load Balancing and Cloud CDN.

If unsure, choose this option.

.TP 2m
\fBedge\-cache\fR
Certificates with scope EDGE_CACHE are special\-purposed certificates, scoped
for use with Media Edge services only.

.RE
.sp



.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "API REFERENCE"

This command uses the \fBcertificatemanager/v1\fR API. The full documentation
for this API can be found at: https://cloud.google.com/certificate\-manager



.SH "NOTES"

These variants are also available:

.RS 2m
$ gcloud alpha certificate\-manager certificates create
.RE

.RS 2m
$ gcloud beta certificate\-manager certificates create
.RE