{
  "slug": "gcloud-privateca-certificates-create-key-algorithm-8a74fa97dc36",
  "title": "gcloud privateca certificates create --key-algorithm",
  "tools": [
    "gcloud"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-06T00:00:00.000Z",
  "announced_at": "2026-10-06T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating a certificate with a generated key, set `--key-algorithm` to choose the client-side key algorithm. The documented values are `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256`, and `ec-p384`.",
    "examples": [
      "gcloud privateca certificates create <certificate-id> --issuer-pool=<pool> --issuer-location=<location> --generate-key --key-output-file=<key.pem> --key-algorithm=ec-p256 --cert-output-file=<cert.pem> --dns-san=<domain> --use-preset-profile=leaf_server_tls"
    ],
    "gotchas": [
      "--generate-key (required): Generate a new private key on the client machine.",
      "--key-output-file (required): Path for the generated PEM private key.",
      "--key-algorithm: Algorithm for the client-side private key; defaults to `rsa-2048`. Allowed values: `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256`, `ec-p384`.",
      "--issuer-pool (required): Parent CA pool for the certificate.",
      "--issuer-location (required): Location of the certificate.",
      "--cert-output-file (required): Path to write the PEM-encoded certificate chain; the command requires this or `--validate-only`.",
      "--dns-san (required): One or more DNS Subject Alternative Names; the command requires at least one subject name option when describing the certificate.",
      "--use-preset-profile (required): Name of an existing preset X.509 profile; the command permits this or X.509 parameter flags.",
      "This applies when creating certificates with `--generate-key`.",
      "The supported key algorithm values are not stated."
    ]
  },
  "why_it_matters": "Create a certificate with a generated key using a custom public key algorithm.",
  "sources": [
    "https://docs.cloud.google.com/sdk/docs/release-notes#58800_2026-10-06",
    "https://docs.cloud.google.com/sdk/gcloud/reference/privateca/certificates/create"
  ],
  "rank": 0.93023,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "cloud-20261008",
    "verdict_id": "cloud-20261008:cloud-20261008-8318f02d757eb207-3:gate",
    "evidence_hash": "536626311e01c553b22b75810082021e80d5624a0b45d36fefe7f1b808c10702"
  },
  "review": {
    "draft_hash": "1af32915954961b52bee0f219b38a5a4e8862dfed2b5b5eb9085aa8219fe6207",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "cloud-20261008:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.61 (>= 0.6 needed)."
  }
}