export interface ASN1Subject {
    /** Two-digit code that specifies the country in which the certificate subject located. */
    Country?: string;
    /** Legal name of the organization with which the certificate subject is affiliated. */
    Organization?: string;
    /** A subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated. */
    OrganizationalUnit?: string;
    /** Disambiguating information for the certificate subject. */
    DistinguishedNameQualifier?: string;
    /** State in which the subject of the certificate is located. */
    State?: string;
    /** For CA and end-entity certificates in a private PKI, the common name (CN) can be any string within the length limit. Note: In publicly trusted certificates, the common name must be a fully qualified d */
    CommonName?: string;
    /** The certificate serial number. */
    SerialNumber?: string;
    /** The locality (such as a city or town) in which the certificate subject is located. */
    Locality?: string;
    /** A title such as Mr. or Ms., which is pre-pended to the name to refer formally to the certificate subject. */
    Title?: string;
    /** Family name. In the US and the UK, for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first. */
    Surname?: string;
    /** First name. */
    GivenName?: string;
    /** Concatenation that typically contains the first letter of the GivenName, the first letter of the middle name if one exists, and the first letter of the Surname. */
    Initials?: string;
    /** Typically a shortened version of a longer GivenName. For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza. */
    Pseudonym?: string;
    /** Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third. */
    GenerationQualifier?: string;
    /** Contains a sequence of one or more X.500 relative distinguished names (RDNs), each of which consists of an object identifier (OID) and a value. For more information, see NIST’s definition of Object Id */
    CustomAttributes?: any[];
}
export interface CsrExtensions {
    /** Indicates the purpose of the certificate and of the key contained in the certificate. */
    KeyUsage?: any;
    /** For CA certificates, provides a path to additional information pertaining to the CA, such as revocation and policy. For more information, see Subject Information Access in RFC 5280. */
    SubjectInformationAccess?: any[];
}
export interface CertificateAuthorityConfiguration {
    /** Type of the public key algorithm and size, in bits, of the key pair that your CA creates when it issues a certificate. When you create a subordinate CA, you must use a key algorithm supported by the p */
    KeyAlgorithm: 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1' | 'ML_DSA_44' | 'ML_DSA_65' | 'ML_DSA_87' | 'SM2';
    /** Name of the algorithm your private CA uses to sign certificate requests. This parameter should not be confused with the SigningAlgorithm parameter used to sign certificates when they are issued. */
    SigningAlgorithm: 'SHA256WITHECDSA' | 'SHA384WITHECDSA' | 'SHA512WITHECDSA' | 'SHA256WITHRSA' | 'SHA384WITHRSA' | 'SHA512WITHRSA' | 'SM3WITHSM2' | 'ML_DSA_44' | 'ML_DSA_65' | 'ML_DSA_87';
    /** Structure that contains X.500 distinguished name information for your private CA. */
    Subject: ASN1Subject;
    /** Specifies information to be added to the extension section of the certificate signing request (CSR). */
    CsrExtensions?: CsrExtensions;
}
export interface CrlConfiguration {
    /** Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. You can use this value to enable certificate revocation for a new CA when you call the CreateCertificateAuthority  */
    Enabled: boolean;
    /** Validity period of the CRL in days. */
    ExpirationInDays?: number;
    /** Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point. Use this value if you don't want the name of your S3 bucket to be  */
    CustomCname?: string;
    /** Name of the S3 bucket that contains the CRL. If you do not provide a value for the CustomCname argument, the name of your S3 bucket is placed into the CRL Distribution Points extension of the issued c */
    S3BucketName?: string;
    /** Determines whether the CRL will be publicly readable or privately held in the CRL Amazon S3 bucket. If you choose PUBLIC_READ, the CRL will be accessible over the public internet. If you choose BUCKET */
    S3ObjectAcl?: 'PUBLIC_READ' | 'BUCKET_OWNER_FULL_CONTROL';
    /** Configures the behavior of the CRL Distribution Point extension for certificates issued by your certificate authority. If this field is not provided, then the CRl Distribution Point Extension will be  */
    CrlDistributionPointExtensionConfiguration?: any;
    /** Specifies whether to create a complete or partitioned CRL. This setting determines the maximum number of certificates that the certificate authority can issue and revoke. For more information, see Ama */
    CrlType?: 'COMPLETE' | 'PARTITIONED';
    /** Designates a custom ﬁle path in S3 for CRL(s). For example, http://&lt;CustomName&gt;/ &lt;CustomPath&gt;/&lt;CrlPartition_GUID&gt;.crl. */
    CustomPath?: string;
}
export interface OcspConfiguration {
    /** Flag enabling use of the Online Certificate Status Protocol (OCSP) for validating certificate revocation status. */
    Enabled: boolean;
    /** By default, Amazon Web Services Private CA injects an Amazon Web Services domain into certificates being validated by the Online Certificate Status Protocol (OCSP). A customer can alternatively use th */
    OcspCustomCname?: string;
}
export interface RevocationConfiguration {
    /** Configuration of the certificate revocation list (CRL), if any, maintained by your private CA. A CRL is typically updated approximately 30 minutes after a certificate is revoked. If for any reason a C */
    CrlConfiguration?: CrlConfiguration;
    /** Configuration of Online Certificate Status Protocol (OCSP) support, if any, maintained by your private CA. When you revoke a certificate, OCSP responses may take up to 60 minutes to reflect the new st */
    OcspConfiguration?: OcspConfiguration;
}
export interface Tag {
    /** Key (name) of the tag. */
    Key: string;
    /** Value of the tag. */
    Value?: string;
}
export interface Extensions {
    /** Contains a sequence of one or more policy information terms, each of which consists of an object identifier (OID) and optional qualifiers. For more information, see NIST's definition of Object Identif */
    CertificatePolicies?: any[];
    /** Specifies additional purposes for which the certified public key may be used other than basic purposes indicated in the KeyUsage extension. */
    ExtendedKeyUsage?: any[];
    KeyUsage?: any;
    /** The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field */
    SubjectAlternativeNames?: any[];
    /** Contains a sequence of one or more X.509 extensions, each of which consists of an object identifier (OID), a base64-encoded value, and the critical flag. For more information, see the Global OID refer */
    CustomExtensions?: any[];
}
export interface ApiPassthrough {
    /** Specifies X.509 extension information for a certificate. */
    Extensions?: Extensions;
    Subject?: ASN1Subject;
}
export interface Validity {
    /** A long integer interpreted according to the value of Type, below. */
    Value: number;
    /** Determines how Amazon Web Services Private CA interprets the Value parameter, an integer. Supported validity types include those listed below. Type definitions with values include a sample input value */
    Type: 'END_DATE' | 'ABSOLUTE' | 'DAYS' | 'MONTHS' | 'YEARS';
}
export interface CreateCertificateAuthorityInput {
    /** Name and bit size of the private key algorithm, the name of the signing algorithm, and X.500 certificate subject information. */
    CertificateAuthorityConfiguration: CertificateAuthorityConfiguration;
    /** The type of the certificate authority. */
    CertificateAuthorityType: 'ROOT' | 'SUBORDINATE';
    /** Custom string that can be used to distinguish between calls to the CreateCertificateAuthority action. Idempotency tokens for CreateCertificateAuthority time out after five minutes. Therefore, if you c */
    IdempotencyToken?: string;
    /** Specifies a cryptographic key management compliance standard for handling and protecting CA keys. Default: FIPS_140_2_LEVEL_3_OR_HIGHER Some Amazon Web Services Regions don't support the default value */
    KeyStorageSecurityStandard?: 'FIPS_140_2_LEVEL_2_OR_HIGHER' | 'FIPS_140_2_LEVEL_3_OR_HIGHER' | 'CCPC_LEVEL_1_OR_HIGHER';
    /** Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. By default, both certificate validation mechanisms  */
    RevocationConfiguration?: RevocationConfiguration;
    /** Key-value pairs that will be attached to the new private CA. You can associate up to 50 tags with a private CA. For information using tags with IAM to manage permissions, see Controlling Access Using  */
    Tags?: Tag[];
    /** Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. */
    UsageMode?: 'GENERAL_PURPOSE' | 'SHORT_LIVED_CERTIFICATE';
}
export interface CreateCertificateAuthorityAuditReportInput {
    /** The format in which to create the report. This can be either JSON or CSV. */
    AuditReportResponseFormat: 'JSON' | 'CSV';
    /** The Amazon Resource Name (ARN) of the CA to be audited. This is of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012 . */
    CertificateAuthorityArn: string;
    /** The name of the S3 bucket that will contain the audit report. */
    S3BucketName: string;
}
export interface CreatePermissionInput {
    /** The actions that the specified Amazon Web Services service principal can use. These include IssueCertificate, GetCertificate, and ListPermissions. */
    Actions: 'IssueCertificate' | 'GetCertificate' | 'ListPermissions'[];
    /** The Amazon Resource Name (ARN) of the CA that grants the permissions. You can find the ARN by calling the ListCertificateAuthorities action. This must have the following form: arn:aws:acm-pca:region:a */
    CertificateAuthorityArn: string;
    /** The Amazon Web Services service or identity that receives the permission. At this time, the only valid principal is acm.amazonaws.com. */
    Principal: string;
    /** The ID of the calling account. */
    SourceAccount?: string;
}
export interface DeleteCertificateAuthorityInput {
    /** The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must have the following form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234- */
    CertificateAuthorityArn: string;
    /** The number of days to make a CA restorable after it has been deleted. This can be anywhere from 7 to 30 days, with 30 being the default. */
    PermanentDeletionTimeInDays?: number;
}
export interface DeletePermissionInput {
    /** The Amazon Resource Number (ARN) of the private CA that issued the permissions. You can find the CA's ARN by calling the ListCertificateAuthorities action. This must have the following form: arn:aws:a */
    CertificateAuthorityArn: string;
    /** The Amazon Web Services service or identity that will have its CA permissions revoked. At this time, the only valid service principal is acm.amazonaws.com */
    Principal: string;
    /** The Amazon Web Services account that calls this action. */
    SourceAccount?: string;
}
export interface DeletePolicyInput {
    /** The Amazon Resource Number (ARN) of the private CA that will have its policy deleted. You can find the CA's ARN by calling the ListCertificateAuthorities action. The ARN value must have the form arn:a */
    ResourceArn: string;
}
export interface DescribeCertificateAuthorityInput {
    /** The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-1234 */
    CertificateAuthorityArn: string;
}
export interface DescribeCertificateAuthorityAuditReportInput {
    /** The report ID returned by calling the CreateCertificateAuthorityAuditReport action. */
    AuditReportId: string;
    /** The Amazon Resource Name (ARN) of the private CA. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012 . */
    CertificateAuthorityArn: string;
}
export interface GetCertificateInput {
    /** The ARN of the issued certificate. The ARN contains the certificate serial number and must be in the following form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456 */
    CertificateArn: string;
    /** The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-1234 */
    CertificateAuthorityArn: string;
}
export interface GetCertificateAuthorityCertificateInput {
    /** The Amazon Resource Name (ARN) of your private CA. This is of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012 . */
    CertificateAuthorityArn: string;
}
export interface GetCertificateAuthorityCsrInput {
    /** The Amazon Resource Name (ARN) that was returned when you called the CreateCertificateAuthority action. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-123 */
    CertificateAuthorityArn: string;
}
export interface GetPolicyInput {
    /** The Amazon Resource Number (ARN) of the private CA that will have its policy retrieved. You can find the CA's ARN by calling the ListCertificateAuthorities action. */
    ResourceArn: string;
}
export interface ImportCertificateAuthorityCertificateInput {
    /** The PEM-encoded certificate for a private CA. This may be a self-signed certificate in the case of a root CA, or it may be signed by another CA that you control. */
    Certificate: string;
    /** The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-1234 */
    CertificateAuthorityArn: string;
    /** A PEM-encoded file that contains all of your certificates, other than the certificate you're importing, chaining up to your root CA. Your Amazon Web Services Private CA-hosted or on-premises root cert */
    CertificateChain?: string;
}
export interface IssueCertificateInput {
    /** The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-1234 */
    CertificateAuthorityArn: string;
    /** The certificate signing request (CSR) for the certificate you want to issue. As an example, you can use the following OpenSSL command to create the CSR and a 2048 bit RSA private key. openssl req -new */
    Csr: string;
    /** The name of the algorithm that will be used to sign the certificate to be issued. This parameter should not be confused with the SigningAlgorithm parameter used to sign a CSR in the CreateCertificateA */
    SigningAlgorithm: 'SHA256WITHECDSA' | 'SHA384WITHECDSA' | 'SHA512WITHECDSA' | 'SHA256WITHRSA' | 'SHA384WITHRSA' | 'SHA512WITHRSA' | 'SM3WITHSM2' | 'ML_DSA_44' | 'ML_DSA_65' | 'ML_DSA_87';
    /** Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certif */
    Validity: Validity;
    /** Specifies X.509 certificate information to be included in the issued certificate. An APIPassthrough or APICSRPassthrough template variant must be selected, or else this parameter is ignored. For more  */
    ApiPassthrough?: ApiPassthrough;
    /** Alphanumeric string that can be used to distinguish between calls to the IssueCertificate action. Idempotency tokens for IssueCertificate time out after five minutes. Therefore, if you call IssueCerti */
    IdempotencyToken?: string;
    /** Specifies a custom configuration template to use when issuing a certificate. If this parameter is not provided, Amazon Web Services Private CA defaults to the EndEntityCertificate/V1 template. For CA  */
    TemplateArn?: string;
    /** Information describing the start of the validity period of the certificate. This parameter sets the “Not Before" date for the certificate. By default, when issuing a certificate, Amazon Web Services P */
    ValidityNotBefore?: Validity;
}
export interface ListCertificateAuthoritiesInput {
    /** Use this parameter when paginating results to specify the maximum number of items to return in the response on each page. If additional items exist beyond the number you specify, the NextToken element */
    MaxResults?: number;
    /** Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just receiv */
    NextToken?: string;
    /** Use this parameter to filter the returned set of certificate authorities based on their owner. The default is SELF. */
    ResourceOwner?: 'SELF' | 'OTHER_ACCOUNTS';
}
export interface ListPermissionsInput {
    /** The Amazon Resource Number (ARN) of the private CA to inspect. You can find the ARN by calling the ListCertificateAuthorities action. This must be of the form: arn:aws:acm-pca:region:account:certifica */
    CertificateAuthorityArn: string;
    /** When paginating results, use this parameter to specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the NextToken element is sent in  */
    MaxResults?: number;
    /** When paginating results, use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextToken from the response you just received. */
    NextToken?: string;
}
export interface ListTagsInput {
    /** The Amazon Resource Name (ARN) that was returned when you called the CreateCertificateAuthority action. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-123 */
    CertificateAuthorityArn: string;
    /** Use this parameter when paginating results to specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the NextToken element is sent in t */
    MaxResults?: number;
    /** Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of NextToken from the response you just received. */
    NextToken?: string;
}
export interface PutPolicyInput {
    /** The path and file name of a JSON-formatted IAM policy to attach to the specified private CA resource. If this policy does not contain all required statements or if it includes any statement that is no */
    Policy: string;
    /** The Amazon Resource Number (ARN) of the private CA to associate with the policy. The ARN of the CA can be found by calling the ListCertificateAuthorities action. */
    ResourceArn: string;
}
export interface RestoreCertificateAuthorityInput {
    /** The Amazon Resource Name (ARN) that was returned when you called the CreateCertificateAuthority action. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-123 */
    CertificateAuthorityArn: string;
}
export interface RevokeCertificateInput {
    /** Amazon Resource Name (ARN) of the private CA that issued the certificate to be revoked. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789 */
    CertificateAuthorityArn: string;
    /** Serial number of the certificate to be revoked. This must be in hexadecimal format. You can retrieve the serial number by calling GetCertificate with the Amazon Resource Name (ARN) of the certificate  */
    CertificateSerial: string;
    /** Specifies why you revoked the certificate. */
    RevocationReason: 'UNSPECIFIED' | 'KEY_COMPROMISE' | 'CERTIFICATE_AUTHORITY_COMPROMISE' | 'AFFILIATION_CHANGED' | 'SUPERSEDED' | 'CESSATION_OF_OPERATION' | 'PRIVILEGE_WITHDRAWN' | 'A_A_COMPROMISE';
}
export interface TagCertificateAuthorityInput {
    /** The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-1234 */
    CertificateAuthorityArn: string;
    /** List of tags to be associated with the CA. */
    Tags: Tag[];
}
export interface UntagCertificateAuthorityInput {
    /** The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-1234 */
    CertificateAuthorityArn: string;
    /** List of tags to be removed from the CA. */
    Tags: Tag[];
}
export interface UpdateCertificateAuthorityInput {
    /** Amazon Resource Name (ARN) of the private CA that issued the certificate to be revoked. This must be of the form: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789 */
    CertificateAuthorityArn: string;
    /** Contains information to enable support for Online Certificate Status Protocol (OCSP), certificate revocation list (CRL), both protocols, or neither. If you don't supply this parameter, existing capibi */
    RevocationConfiguration?: RevocationConfiguration;
    /** Status of your private CA. */
    Status?: 'CREATING' | 'PENDING_CERTIFICATE' | 'ACTIVE' | 'DELETED' | 'DISABLED' | 'EXPIRED' | 'FAILED';
}
/** ACM PCA service binding for Step Functions SDK integrations. */
export declare class ACMPCA {
    constructor();
    createCertificateAuthority<T>(params: CreateCertificateAuthorityInput): Promise<T>;
    createCertificateAuthorityAuditReport<T>(params: CreateCertificateAuthorityAuditReportInput): Promise<T>;
    createPermission<T>(params: CreatePermissionInput): Promise<T>;
    deleteCertificateAuthority<T>(params: DeleteCertificateAuthorityInput): Promise<T>;
    deletePermission<T>(params: DeletePermissionInput): Promise<T>;
    deletePolicy<T>(params: DeletePolicyInput): Promise<T>;
    describeCertificateAuthority<T>(params: DescribeCertificateAuthorityInput): Promise<T>;
    describeCertificateAuthorityAuditReport<T>(params: DescribeCertificateAuthorityAuditReportInput): Promise<T>;
    getCertificate<T>(params: GetCertificateInput): Promise<T>;
    getCertificateAuthorityCertificate<T>(params: GetCertificateAuthorityCertificateInput): Promise<T>;
    getCertificateAuthorityCsr<T>(params: GetCertificateAuthorityCsrInput): Promise<T>;
    getPolicy<T>(params: GetPolicyInput): Promise<T>;
    importCertificateAuthorityCertificate<T>(params: ImportCertificateAuthorityCertificateInput): Promise<T>;
    issueCertificate<T>(params: IssueCertificateInput): Promise<T>;
    listCertificateAuthorities<T>(params: ListCertificateAuthoritiesInput): Promise<T>;
    listPermissions<T>(params: ListPermissionsInput): Promise<T>;
    listTags<T>(params: ListTagsInput): Promise<T>;
    putPolicy<T>(params: PutPolicyInput): Promise<T>;
    restoreCertificateAuthority<T>(params: RestoreCertificateAuthorityInput): Promise<T>;
    revokeCertificate<T>(params: RevokeCertificateInput): Promise<T>;
    tagCertificateAuthority<T>(params: TagCertificateAuthorityInput): Promise<T>;
    untagCertificateAuthority<T>(params: UntagCertificateAuthorityInput): Promise<T>;
    updateCertificateAuthority<T>(params: UpdateCertificateAuthorityInput): Promise<T>;
}
//# sourceMappingURL=ACMPCA.d.ts.map