---
title: Google Cloud Certificate Authority Service
description: >-
  Monitor Google Cloud Certificate Authority Service certificate issuance and CA
  health.
breadcrumbs: Docs > Integrations > Google Cloud Certificate Authority Service
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Google Cloud Certificate Authority Service
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

[Google Cloud Certificate Authority Service](https://cloud.google.com/certificate-authority-service/docs) is a managed private certificate authority (CA) service that lets you deploy and manage CA hierarchies for issuing private TLS and mutual TLS (mTLS) certificates. Monitor certificate issuance, expiration, and CA resource health to help avoid outages caused by expired or revoked certificates.

## Setup{% #setup %}

### Installation{% #installation %}

If you haven't already, set up the [Google Cloud Platform integration](https://docs.datadoghq.com/integrations/google-cloud-platform.md) first. There are no other installation steps.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

|  |
|  |
| **gcp.privateca.ca.cert.ca_cert_creation**(count)     | The number of CA certificates issued by a CA. These are certificates with the CA:TRUE basic constraint. |
| **gcp.privateca.ca.cert.create_count**(count)          | The number of certificates issued by a CA.                                                              |
| **gcp.privateca.ca.cert.create_failure_count**(count) | The number of certificate creation failures.                                                            |
| **gcp.privateca.ca.cert.create_request_count**(count) | The number of certificate creation requests per CA.                                                     |
| **gcp.privateca.ca.cert_chain_expiration**(gauge)     | Time until each parent certificate in the CA's issuing chain expires.*Shown as second*                  |
| **gcp.privateca.ca.cert_expiration**(gauge)            | Time until the CA certificate expires.*Shown as second*                                                 |
| **gcp.privateca.ca.cert_revoked**(gauge)               | Whether the CA certificate has been revoked. The value is 1 when revoked and 0 otherwise.               |
| **gcp.privateca.ca.resource_state**(gauge)             | State of the certificate authority. The value is 1 when enabled and 0 otherwise.                        |
| **gcp.privateca.gcs.bucket_issue**(gauge)              | Errors for Cloud Storage buckets. The value is 1 when there are issues and 0 otherwise.                 |
| **gcp.privateca.kms.key_issue**(gauge)                 | Errors for Cloud KMS signing keys. The value is 1 when there are issues and 0 otherwise.                |

### Events{% #events %}

The Google Cloud Certificate Authority Service integration does not include any events.

### Service Checks{% #service-checks %}

The Google Cloud Certificate Authority Service integration does not include any service checks.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).