gcloud privateca certificates create --key-algorithm
Introduced 2026-10-06 · score 0.93
HOW TO USE IT
When creating a certificate with a generated key, set `--key-algorithm` to choose the client-side key algorithm. The documented values are `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256`, and `ec-p384`.
gcloud privateca certificates create <certificate-id> --issuer-pool=<pool> --issuer-location=<location> --generate-key --key-output-file=<key.pem> --key-algorithm=ec-p256 --cert-output-file=<cert.pem> --dns-san=<domain> --use-preset-profile=leaf_server_tlsWHY THIS HELPS
Create a certificate with a generated key using a custom public key algorithm.
REQUIREMENTS AND LIMITATIONS
- --generate-key (required): Generate a new private key on the client machine.
- --key-output-file (required): Path for the generated PEM private key.
- --key-algorithm: Algorithm for the client-side private key; defaults to `rsa-2048`. Allowed values: `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256`, `ec-p384`.
- --issuer-pool (required): Parent CA pool for the certificate.
- --issuer-location (required): Location of the certificate.
- --cert-output-file (required): Path to write the PEM-encoded certificate chain; the command requires this or `--validate-only`.
- --dns-san (required): One or more DNS Subject Alternative Names; the command requires at least one subject name option when describing the certificate.
- --use-preset-profile (required): Name of an existing preset X.509 profile; the command permits this or X.509 parameter flags.
- This applies when creating certificates with `--generate-key`.
- The supported key algorithm values are not stated.
FIRST-PARTY EVIDENCE
- https://docs.cloud.google.com/sdk/docs/release-notes#58800_2026-10-06
- https://docs.cloud.google.com/sdk/gcloud/reference/privateca/certificates/create
Check the installed version and the source before using it. Entry JSON