Add Backdate Duration to Issuance Policy (GoogleCloudPlatform#13678)

Author: be74e3b1-6b98-4ba5-b172-9f27fa619e71

mmv1/products/privateca/CaPool.yaml

@@ -129,6 +129,14 @@ properties:
                     - 'ECDSA_P256'
                     - 'ECDSA_P384'
                     - 'EDDSA_25519'
+      - name: 'backdateDuration'
+        type: String
+        description: |
+          The duration to backdate all certificates issued from this CaPool. If not set, the
+          certificates will be issued with a not_before_time of the issuance time (i.e. the current
+          time). If set, the certificates will be issued with a not_before_time of the issuance
+          time minus the backdate_duration. The not_after_time will be adjusted to preserve the
+          requested lifetime. The backdate_duration must be less than or equal to 48 hours.
       - name: 'maximumLifetime'
         type: String
         description: |

mmv1/templates/terraform/examples/privateca_capool_all_fields.tf.tmpl

@@ -22,6 +22,7 @@ resource "google_privateca_ca_pool" "{{$.PrimaryResourceId}}" {
         max_modulus_size = 10
       }
     }
+    backdate_duration = "3600s"
     maximum_lifetime = "50000s"
     allowed_issuance_modes {
       allow_csr_based_issuance = true