Add the PendingCSRRequest proto (#68759)

* Document CRL changes, fix typos

* Add the PendingCSRRequest proto

* Add PendingCSRRequest to client/proto.Event

* make grpc

* Document that a successful CreateCSRResponse always has a CSR

* make grpc

api/client/proto/event_protohybrid.pb.go

@@ -215,6 +215,7 @@ type Event struct {
 	//	*Event_ValidatedMFAChallengeV2
 	//	*Event_BeamsConfig
 	//	*Event_Classifier
+	//	*Event_PendingCSRRequest
 	Resource      isEvent_Resource `protobuf_oneof:"Resource"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -1088,6 +1089,15 @@ func (x *Event) GetClassifier() *v124.Classifier {
 	return nil
 }
 
+func (x *Event) GetPendingCSRRequest() *v123.PendingCSRRequest {
+	if x != nil {
+		if x, ok := x.Resource.(*Event_PendingCSRRequest); ok {
+			return x.PendingCSRRequest
+		}
+	}
+	return nil
+}
+
 func (x *Event) SetType(v Operation) {
 	x.Type = v
 }
@@ -1829,6 +1839,14 @@ func (x *Event) SetClassifier(v *v124.Classifier) {
 	x.Resource = &Event_Classifier{v}
 }
 
+func (x *Event) SetPendingCSRRequest(v *v123.PendingCSRRequest) {
+	if v == nil {
+		x.Resource = nil
+		return
+	}
+	x.Resource = &Event_PendingCSRRequest{v}
+}
+
 func (x *Event) HasResource() bool {
 	if x == nil {
 		return false
@@ -2573,6 +2591,14 @@ func (x *Event) HasClassifier() bool {
 	return ok
 }
 
+func (x *Event) HasPendingCSRRequest() bool {
+	if x == nil {
+		return false
+	}
+	_, ok := x.Resource.(*Event_PendingCSRRequest)
+	return ok
+}
+
 func (x *Event) ClearResource() {
 	x.Resource = nil
 }
@@ -3130,6 +3156,12 @@ func (x *Event) ClearClassifier() {
 	}
 }
 
+func (x *Event) ClearPendingCSRRequest() {
+	if _, ok := x.Resource.(*Event_PendingCSRRequest); ok {
+		x.Resource = nil
+	}
+}
+
 const Event_Resource_not_set_case case_Event_Resource = 0
 const Event_ResourceHeader_case case_Event_Resource = 2
 const Event_CertAuthority_case case_Event_Resource = 3
@@ -3223,6 +3255,7 @@ const Event_Beam_case case_Event_Resource = 95
 const Event_ValidatedMFAChallengeV2_case case_Event_Resource = 96
 const Event_BeamsConfig_case case_Event_Resource = 97
 const Event_Classifier_case case_Event_Resource = 98
+const Event_PendingCSRRequest_case case_Event_Resource = 99
 
 func (x *Event) WhichResource() case_Event_Resource {
 	if x == nil {
@@ -3413,6 +3446,8 @@ func (x *Event) WhichResource() case_Event_Resource {
 		return Event_BeamsConfig_case
 	case *Event_Classifier:
 		return Event_Classifier_case
+	case *Event_PendingCSRRequest:
+		return Event_PendingCSRRequest_case
 	default:
 		return Event_Resource_not_set_case
 	}
@@ -3617,6 +3652,9 @@ type Event_builder struct {
 	BeamsConfig *v125.BeamsConfig
 	// Classifier is a resource for defining session summarization classifiers.
 	Classifier *v124.Classifier
+	// PendingCSRRequest allows asynchronous, watcher-based CSR requests to
+	// other Auth server instances.
+	PendingCSRRequest *v123.PendingCSRRequest
 	// -- end of Resource
 }
 
@@ -3901,6 +3939,9 @@ func (b0 Event_builder) Build() *Event {
 	if b.Classifier != nil {
 		x.Resource = &Event_Classifier{b.Classifier}
 	}
+	if b.PendingCSRRequest != nil {
+		x.Resource = &Event_PendingCSRRequest{b.PendingCSRRequest}
+	}
 	return m0
 }
 
@@ -4385,6 +4426,12 @@ type Event_Classifier struct {
 	Classifier *v124.Classifier `protobuf:"bytes,98,opt,name=Classifier,proto3,oneof"`
 }
 
+type Event_PendingCSRRequest struct {
+	// PendingCSRRequest allows asynchronous, watcher-based CSR requests to
+	// other Auth server instances.
+	PendingCSRRequest *v123.PendingCSRRequest `protobuf:"bytes,99,opt,name=PendingCSRRequest,proto3,oneof"`
+}
+
 func (*Event_ResourceHeader) isEvent_Resource() {}
 
 func (*Event_CertAuthority) isEvent_Resource() {}
@@ -4569,11 +4616,13 @@ func (*Event_BeamsConfig) isEvent_Resource() {}
 
 func (*Event_Classifier) isEvent_Resource() {}
 
+func (*Event_PendingCSRRequest) isEvent_Resource() {}
+
 var File_teleport_legacy_client_proto_event_proto protoreflect.FileDescriptor
 
 const file_teleport_legacy_client_proto_event_proto_rawDesc = "" +
 	"\n" +
-	"(teleport/legacy/client/proto/event.proto\x12\x05proto\x1a'teleport/accesslist/v1/accesslist.proto\x1a?teleport/accessmonitoringrules/v1/access_monitoring_rules.proto\x1a-teleport/appauthconfig/v1/appauthconfig.proto\x1a'teleport/autoupdate/v1/autoupdate.proto\x1a\x1cteleport/beams/v1/beam.proto\x1a$teleport/beams/v1/beams_config.proto\x1a5teleport/clusterconfig/v1/access_graph_settings.proto\x1a'teleport/crownjewel/v1/crownjewel.proto\x1a#teleport/dbobject/v1/dbobject.proto\x1a1teleport/discoveryconfig/v1/discoveryconfig.proto\x1a7teleport/healthcheckconfig/v1/health_check_config.proto\x1a/teleport/identitycenter/v1/identitycenter.proto\x1a;teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto\x1a!teleport/legacy/types/types.proto\x1a,teleport/linuxdesktop/v1/linux_desktop.proto\x1a(teleport/machineid/v1/bot_instance.proto\x1a&teleport/machineid/v1/federation.proto\x1a)teleport/mfa/v1/validated_challenge.proto\x1a)teleport/mfa/v2/validated_challenge.proto\x1a-teleport/notifications/v1/notifications.proto\x1a'teleport/presence/v1/relay_server.proto\x1a+teleport/provisioning/v1/provisioning.proto\x1a:teleport/recordingencryption/v1/recording_encryption.proto\x1a*teleport/scopes/access/v1/assignment.proto\x1a$teleport/scopes/access/v1/role.proto\x1a'teleport/secreports/v1/secreports.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a'teleport/summarizer/v1/summarizer.proto\x1a/teleport/userloginstate/v1/userloginstate.proto\x1a1teleport/userprovisioning/v2/statichostuser.proto\x1a&teleport/usertasks/v1/user_tasks.proto\x1a+teleport/workloadidentity/v1/resource.proto\x1a6teleport/workloadidentity/v1/revocation_resource.proto\"\xcb8\n" +
+	"(teleport/legacy/client/proto/event.proto\x12\x05proto\x1a'teleport/accesslist/v1/accesslist.proto\x1a?teleport/accessmonitoringrules/v1/access_monitoring_rules.proto\x1a-teleport/appauthconfig/v1/appauthconfig.proto\x1a'teleport/autoupdate/v1/autoupdate.proto\x1a\x1cteleport/beams/v1/beam.proto\x1a$teleport/beams/v1/beams_config.proto\x1a5teleport/clusterconfig/v1/access_graph_settings.proto\x1a'teleport/crownjewel/v1/crownjewel.proto\x1a#teleport/dbobject/v1/dbobject.proto\x1a1teleport/discoveryconfig/v1/discoveryconfig.proto\x1a7teleport/healthcheckconfig/v1/health_check_config.proto\x1a/teleport/identitycenter/v1/identitycenter.proto\x1a;teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto\x1a!teleport/legacy/types/types.proto\x1a,teleport/linuxdesktop/v1/linux_desktop.proto\x1a(teleport/machineid/v1/bot_instance.proto\x1a&teleport/machineid/v1/federation.proto\x1a)teleport/mfa/v1/validated_challenge.proto\x1a)teleport/mfa/v2/validated_challenge.proto\x1a-teleport/notifications/v1/notifications.proto\x1a'teleport/presence/v1/relay_server.proto\x1a+teleport/provisioning/v1/provisioning.proto\x1a:teleport/recordingencryption/v1/recording_encryption.proto\x1a*teleport/scopes/access/v1/assignment.proto\x1a$teleport/scopes/access/v1/role.proto\x1a'teleport/secreports/v1/secreports.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a+teleport/subca/v1/pending_csr_request.proto\x1a'teleport/summarizer/v1/summarizer.proto\x1a/teleport/userloginstate/v1/userloginstate.proto\x1a1teleport/userprovisioning/v2/statichostuser.proto\x1a&teleport/usertasks/v1/user_tasks.proto\x1a+teleport/workloadidentity/v1/resource.proto\x1a6teleport/workloadidentity/v1/revocation_resource.proto\"\xa19\n" +
 	"\x05Event\x12$\n" +
 	"\x04Type\x18\x01 \x01(\x0e2\x10.proto.OperationR\x04Type\x12?\n" +
 	"\x0eResourceHeader\x18\x02 \x01(\v2\x15.types.ResourceHeaderH\x00R\x0eResourceHeader\x12>\n" +
@@ -4682,7 +4731,8 @@ const file_teleport_legacy_client_proto_event_proto_rawDesc = "" +
 	"\vBeamsConfig\x18a \x01(\v2\x1e.teleport.beams.v1.BeamsConfigH\x00R\vBeamsConfig\x12D\n" +
 	"\n" +
 	"Classifier\x18b \x01(\v2\".teleport.summarizer.v1.ClassifierH\x00R\n" +
-	"ClassifierB\n" +
+	"Classifier\x12T\n" +
+	"\x11PendingCSRRequest\x18c \x01(\v2$.teleport.subca.v1.PendingCSRRequestH\x00R\x11PendingCSRRequestB\n" +
 	"\n" +
 	"\bResourceJ\x04\b\a\x10\bJ\x04\b1\x102J\x04\b?\x10@J\x04\bD\x10EJ\x04\bX\x10YR\x12ExternalCloudAuditR\x0eStaticHostUserR\x13AutoUpdateAgentPlanR\x0fWorkloadCluster**\n" +
 	"\tOperation\x12\b\n" +
@@ -4785,6 +4835,7 @@ var file_teleport_legacy_client_proto_event_proto_goTypes = []any{
 	(*v21.ValidatedMFAChallenge)(nil),           // 88: teleport.mfa.v2.ValidatedMFAChallenge
 	(*v125.BeamsConfig)(nil),                    // 89: teleport.beams.v1.BeamsConfig
 	(*v124.Classifier)(nil),                     // 90: teleport.summarizer.v1.Classifier
+	(*v123.PendingCSRRequest)(nil),              // 91: teleport.subca.v1.PendingCSRRequest
 }
 var file_teleport_legacy_client_proto_event_proto_depIdxs = []int32{
 	0,  // 0: proto.Event.Type:type_name -> proto.Operation
@@ -4880,11 +4931,12 @@ var file_teleport_legacy_client_proto_event_proto_depIdxs = []int32{
 	88, // 90: proto.Event.ValidatedMFAChallengeV2:type_name -> teleport.mfa.v2.ValidatedMFAChallenge
 	89, // 91: proto.Event.BeamsConfig:type_name -> teleport.beams.v1.BeamsConfig
 	90, // 92: proto.Event.Classifier:type_name -> teleport.summarizer.v1.Classifier
-	93, // [93:93] is the sub-list for method output_type
-	93, // [93:93] is the sub-list for method input_type
-	93, // [93:93] is the sub-list for extension type_name
-	93, // [93:93] is the sub-list for extension extendee
-	0,  // [0:93] is the sub-list for field type_name
+	91, // 93: proto.Event.PendingCSRRequest:type_name -> teleport.subca.v1.PendingCSRRequest
+	94, // [94:94] is the sub-list for method output_type
+	94, // [94:94] is the sub-list for method input_type
+	94, // [94:94] is the sub-list for extension type_name
+	94, // [94:94] is the sub-list for extension extendee
+	0,  // [0:94] is the sub-list for field type_name
 }
 
 func init() { file_teleport_legacy_client_proto_event_proto_init() }
@@ -4985,6 +5037,7 @@ func file_teleport_legacy_client_proto_event_proto_init() {
 		(*Event_ValidatedMFAChallengeV2)(nil),
 		(*Event_BeamsConfig)(nil),
 		(*Event_Classifier)(nil),
+		(*Event_PendingCSRRequest)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{

api/client/proto/event_protoopaque.pb.go

@@ -984,6 +984,15 @@ func (x *Event) GetClassifier() *v124.Classifier {
 	return nil
 }
 
+func (x *Event) GetPendingCSRRequest() *v123.PendingCSRRequest {
+	if x != nil {
+		if x, ok := x.xxx_hidden_Resource.(*event_PendingCSRRequest); ok {
+			return x.PendingCSRRequest
+		}
+	}
+	return nil
+}
+
 func (x *Event) SetType(v Operation) {
 	x.xxx_hidden_Type = v
 }
@@ -1725,6 +1734,14 @@ func (x *Event) SetClassifier(v *v124.Classifier) {
 	x.xxx_hidden_Resource = &event_Classifier{v}
 }
 
+func (x *Event) SetPendingCSRRequest(v *v123.PendingCSRRequest) {
+	if v == nil {
+		x.xxx_hidden_Resource = nil
+		return
+	}
+	x.xxx_hidden_Resource = &event_PendingCSRRequest{v}
+}
+
 func (x *Event) HasResource() bool {
 	if x == nil {
 		return false
@@ -2469,6 +2486,14 @@ func (x *Event) HasClassifier() bool {
 	return ok
 }
 
+func (x *Event) HasPendingCSRRequest() bool {
+	if x == nil {
+		return false
+	}
+	_, ok := x.xxx_hidden_Resource.(*event_PendingCSRRequest)
+	return ok
+}
+
 func (x *Event) ClearResource() {
 	x.xxx_hidden_Resource = nil
 }
@@ -3026,6 +3051,12 @@ func (x *Event) ClearClassifier() {
 	}
 }
 
+func (x *Event) ClearPendingCSRRequest() {
+	if _, ok := x.xxx_hidden_Resource.(*event_PendingCSRRequest); ok {
+		x.xxx_hidden_Resource = nil
+	}
+}
+
 const Event_Resource_not_set_case case_Event_Resource = 0
 const Event_ResourceHeader_case case_Event_Resource = 2
 const Event_CertAuthority_case case_Event_Resource = 3
@@ -3119,6 +3150,7 @@ const Event_Beam_case case_Event_Resource = 95
 const Event_ValidatedMFAChallengeV2_case case_Event_Resource = 96
 const Event_BeamsConfig_case case_Event_Resource = 97
 const Event_Classifier_case case_Event_Resource = 98
+const Event_PendingCSRRequest_case case_Event_Resource = 99
 
 func (x *Event) WhichResource() case_Event_Resource {
 	if x == nil {
@@ -3309,6 +3341,8 @@ func (x *Event) WhichResource() case_Event_Resource {
 		return Event_BeamsConfig_case
 	case *event_Classifier:
 		return Event_Classifier_case
+	case *event_PendingCSRRequest:
+		return Event_PendingCSRRequest_case
 	default:
 		return Event_Resource_not_set_case
 	}
@@ -3513,6 +3547,9 @@ type Event_builder struct {
 	BeamsConfig *v125.BeamsConfig
 	// Classifier is a resource for defining session summarization classifiers.
 	Classifier *v124.Classifier
+	// PendingCSRRequest allows asynchronous, watcher-based CSR requests to
+	// other Auth server instances.
+	PendingCSRRequest *v123.PendingCSRRequest
 	// -- end of xxx_hidden_Resource
 }
 
@@ -3797,6 +3834,9 @@ func (b0 Event_builder) Build() *Event {
 	if b.Classifier != nil {
 		x.xxx_hidden_Resource = &event_Classifier{b.Classifier}
 	}
+	if b.PendingCSRRequest != nil {
+		x.xxx_hidden_Resource = &event_PendingCSRRequest{b.PendingCSRRequest}
+	}
 	return m0
 }
 
@@ -4281,6 +4321,12 @@ type event_Classifier struct {
 	Classifier *v124.Classifier `protobuf:"bytes,98,opt,name=Classifier,proto3,oneof"`
 }
 
+type event_PendingCSRRequest struct {
+	// PendingCSRRequest allows asynchronous, watcher-based CSR requests to
+	// other Auth server instances.
+	PendingCSRRequest *v123.PendingCSRRequest `protobuf:"bytes,99,opt,name=PendingCSRRequest,proto3,oneof"`
+}
+
 func (*event_ResourceHeader) isEvent_Resource() {}
 
 func (*event_CertAuthority) isEvent_Resource() {}
@@ -4465,11 +4511,13 @@ func (*event_BeamsConfig) isEvent_Resource() {}
 
 func (*event_Classifier) isEvent_Resource() {}
 
+func (*event_PendingCSRRequest) isEvent_Resource() {}
+
 var File_teleport_legacy_client_proto_event_proto protoreflect.FileDescriptor
 
 const file_teleport_legacy_client_proto_event_proto_rawDesc = "" +
 	"\n" +
-	"(teleport/legacy/client/proto/event.proto\x12\x05proto\x1a'teleport/accesslist/v1/accesslist.proto\x1a?teleport/accessmonitoringrules/v1/access_monitoring_rules.proto\x1a-teleport/appauthconfig/v1/appauthconfig.proto\x1a'teleport/autoupdate/v1/autoupdate.proto\x1a\x1cteleport/beams/v1/beam.proto\x1a$teleport/beams/v1/beams_config.proto\x1a5teleport/clusterconfig/v1/access_graph_settings.proto\x1a'teleport/crownjewel/v1/crownjewel.proto\x1a#teleport/dbobject/v1/dbobject.proto\x1a1teleport/discoveryconfig/v1/discoveryconfig.proto\x1a7teleport/healthcheckconfig/v1/health_check_config.proto\x1a/teleport/identitycenter/v1/identitycenter.proto\x1a;teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto\x1a!teleport/legacy/types/types.proto\x1a,teleport/linuxdesktop/v1/linux_desktop.proto\x1a(teleport/machineid/v1/bot_instance.proto\x1a&teleport/machineid/v1/federation.proto\x1a)teleport/mfa/v1/validated_challenge.proto\x1a)teleport/mfa/v2/validated_challenge.proto\x1a-teleport/notifications/v1/notifications.proto\x1a'teleport/presence/v1/relay_server.proto\x1a+teleport/provisioning/v1/provisioning.proto\x1a:teleport/recordingencryption/v1/recording_encryption.proto\x1a*teleport/scopes/access/v1/assignment.proto\x1a$teleport/scopes/access/v1/role.proto\x1a'teleport/secreports/v1/secreports.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a'teleport/summarizer/v1/summarizer.proto\x1a/teleport/userloginstate/v1/userloginstate.proto\x1a1teleport/userprovisioning/v2/statichostuser.proto\x1a&teleport/usertasks/v1/user_tasks.proto\x1a+teleport/workloadidentity/v1/resource.proto\x1a6teleport/workloadidentity/v1/revocation_resource.proto\"\xcb8\n" +
+	"(teleport/legacy/client/proto/event.proto\x12\x05proto\x1a'teleport/accesslist/v1/accesslist.proto\x1a?teleport/accessmonitoringrules/v1/access_monitoring_rules.proto\x1a-teleport/appauthconfig/v1/appauthconfig.proto\x1a'teleport/autoupdate/v1/autoupdate.proto\x1a\x1cteleport/beams/v1/beam.proto\x1a$teleport/beams/v1/beams_config.proto\x1a5teleport/clusterconfig/v1/access_graph_settings.proto\x1a'teleport/crownjewel/v1/crownjewel.proto\x1a#teleport/dbobject/v1/dbobject.proto\x1a1teleport/discoveryconfig/v1/discoveryconfig.proto\x1a7teleport/healthcheckconfig/v1/health_check_config.proto\x1a/teleport/identitycenter/v1/identitycenter.proto\x1a;teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto\x1a!teleport/legacy/types/types.proto\x1a,teleport/linuxdesktop/v1/linux_desktop.proto\x1a(teleport/machineid/v1/bot_instance.proto\x1a&teleport/machineid/v1/federation.proto\x1a)teleport/mfa/v1/validated_challenge.proto\x1a)teleport/mfa/v2/validated_challenge.proto\x1a-teleport/notifications/v1/notifications.proto\x1a'teleport/presence/v1/relay_server.proto\x1a+teleport/provisioning/v1/provisioning.proto\x1a:teleport/recordingencryption/v1/recording_encryption.proto\x1a*teleport/scopes/access/v1/assignment.proto\x1a$teleport/scopes/access/v1/role.proto\x1a'teleport/secreports/v1/secreports.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a+teleport/subca/v1/pending_csr_request.proto\x1a'teleport/summarizer/v1/summarizer.proto\x1a/teleport/userloginstate/v1/userloginstate.proto\x1a1teleport/userprovisioning/v2/statichostuser.proto\x1a&teleport/usertasks/v1/user_tasks.proto\x1a+teleport/workloadidentity/v1/resource.proto\x1a6teleport/workloadidentity/v1/revocation_resource.proto\"\xa19\n" +
 	"\x05Event\x12$\n" +
 	"\x04Type\x18\x01 \x01(\x0e2\x10.proto.OperationR\x04Type\x12?\n" +
 	"\x0eResourceHeader\x18\x02 \x01(\v2\x15.types.ResourceHeaderH\x00R\x0eResourceHeader\x12>\n" +
@@ -4578,7 +4626,8 @@ const file_teleport_legacy_client_proto_event_proto_rawDesc = "" +
 	"\vBeamsConfig\x18a \x01(\v2\x1e.teleport.beams.v1.BeamsConfigH\x00R\vBeamsConfig\x12D\n" +
 	"\n" +
 	"Classifier\x18b \x01(\v2\".teleport.summarizer.v1.ClassifierH\x00R\n" +
-	"ClassifierB\n" +
+	"Classifier\x12T\n" +
+	"\x11PendingCSRRequest\x18c \x01(\v2$.teleport.subca.v1.PendingCSRRequestH\x00R\x11PendingCSRRequestB\n" +
 	"\n" +
 	"\bResourceJ\x04\b\a\x10\bJ\x04\b1\x102J\x04\b?\x10@J\x04\bD\x10EJ\x04\bX\x10YR\x12ExternalCloudAuditR\x0eStaticHostUserR\x13AutoUpdateAgentPlanR\x0fWorkloadCluster**\n" +
 	"\tOperation\x12\b\n" +
@@ -4681,6 +4730,7 @@ var file_teleport_legacy_client_proto_event_proto_goTypes = []any{
 	(*v21.ValidatedMFAChallenge)(nil),           // 88: teleport.mfa.v2.ValidatedMFAChallenge
 	(*v125.BeamsConfig)(nil),                    // 89: teleport.beams.v1.BeamsConfig
 	(*v124.Classifier)(nil),                     // 90: teleport.summarizer.v1.Classifier
+	(*v123.PendingCSRRequest)(nil),              // 91: teleport.subca.v1.PendingCSRRequest
 }
 var file_teleport_legacy_client_proto_event_proto_depIdxs = []int32{
 	0,  // 0: proto.Event.Type:type_name -> proto.Operation
@@ -4776,11 +4826,12 @@ var file_teleport_legacy_client_proto_event_proto_depIdxs = []int32{
 	88, // 90: proto.Event.ValidatedMFAChallengeV2:type_name -> teleport.mfa.v2.ValidatedMFAChallenge
 	89, // 91: proto.Event.BeamsConfig:type_name -> teleport.beams.v1.BeamsConfig
 	90, // 92: proto.Event.Classifier:type_name -> teleport.summarizer.v1.Classifier
-	93, // [93:93] is the sub-list for method output_type
-	93, // [93:93] is the sub-list for method input_type
-	93, // [93:93] is the sub-list for extension type_name
-	93, // [93:93] is the sub-list for extension extendee
-	0,  // [0:93] is the sub-list for field type_name
+	91, // 93: proto.Event.PendingCSRRequest:type_name -> teleport.subca.v1.PendingCSRRequest
+	94, // [94:94] is the sub-list for method output_type
+	94, // [94:94] is the sub-list for method input_type
+	94, // [94:94] is the sub-list for extension type_name
+	94, // [94:94] is the sub-list for extension extendee
+	0,  // [0:94] is the sub-list for field type_name
 }
 
 func init() { file_teleport_legacy_client_proto_event_proto_init() }
@@ -4881,6 +4932,7 @@ func file_teleport_legacy_client_proto_event_proto_init() {
 		(*event_ValidatedMFAChallengeV2)(nil),
 		(*event_BeamsConfig)(nil),
 		(*event_Classifier)(nil),
+		(*event_PendingCSRRequest)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{

api/gen/proto/go/teleport/subca/v1/cert_authority_override_protohybrid.pb.go

@@ -46,7 +46,7 @@ const (
 // self-signed root).
 //
 // Key material is never impacted by overrides, only certificates can be
-// overriden.
+// overridden.
 //
 // https://github.com/gravitational/teleport/blob/master/rfd/0237-sub-ca-support.md
 type CertAuthorityOverride struct {
@@ -293,6 +293,10 @@ type CertAuthorityOverrideStatus struct {
 	state protoimpl.MessageState `protogen:"hybrid.v1"`
 	// CRLs generated for each certificate override, keyed by normalized/lowercase
 	// public_key_hash.
+	//
+	// CRLs for disabled overrides may be created asynchronously, using
+	// CertAuthorityOverride watchers, if the Auth server performing the writes
+	// lacks access to certain keys.
 	PublicKeyHashToCrl map[string]*CertificateRevocationList `protobuf:"bytes,1,rep,name=public_key_hash_to_crl,json=publicKeyHashToCrl,proto3" json:"public_key_hash_to_crl,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields      protoimpl.UnknownFields
 	sizeCache          protoimpl.SizeCache
@@ -339,6 +343,10 @@ type CertAuthorityOverrideStatus_builder struct {
 
 	// CRLs generated for each certificate override, keyed by normalized/lowercase
 	// public_key_hash.
+	//
+	// CRLs for disabled overrides may be created asynchronously, using
+	// CertAuthorityOverride watchers, if the Auth server performing the writes
+	// lacks access to certain keys.
 	PublicKeyHashToCrl map[string]*CertificateRevocationList
 }
 

api/gen/proto/go/teleport/subca/v1/cert_authority_override_protoopaque.pb.go

@@ -46,7 +46,7 @@ const (
 // self-signed root).
 //
 // Key material is never impacted by overrides, only certificates can be
-// overriden.
+// overridden.
 //
 // https://github.com/gravitational/teleport/blob/master/rfd/0237-sub-ca-support.md
 type CertAuthorityOverride struct {
@@ -329,6 +329,10 @@ type CertAuthorityOverrideStatus_builder struct {
 
 	// CRLs generated for each certificate override, keyed by normalized/lowercase
 	// public_key_hash.
+	//
+	// CRLs for disabled overrides may be created asynchronously, using
+	// CertAuthorityOverride watchers, if the Auth server performing the writes
+	// lacks access to certain keys.
 	PublicKeyHashToCrl map[string]*CertificateRevocationList
 }
 

api/gen/proto/go/teleport/subca/v1/certificate_override_protohybrid.pb.go

@@ -72,6 +72,9 @@ type CertificateOverride struct {
 	// A disabled override may exist for recording purposes, to be enabled later,
 	// or simply to mark a certain public key as not overridden. In the latter
 	// case the certificate may be absent.
+	//
+	// Disabled overrides allow CRLs to be created asynchronously, using
+	// CertAuthorityOverride watchers.
 	Disabled      bool `protobuf:"varint,4,opt,name=disabled,proto3" json:"disabled,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -177,6 +180,9 @@ type CertificateOverride_builder struct {
 	// A disabled override may exist for recording purposes, to be enabled later,
 	// or simply to mark a certain public key as not overridden. In the latter
 	// case the certificate may be absent.
+	//
+	// Disabled overrides allow CRLs to be created asynchronously, using
+	// CertAuthorityOverride watchers.
 	Disabled bool
 }
 

api/gen/proto/go/teleport/subca/v1/certificate_override_protoopaque.pb.go

@@ -152,6 +152,9 @@ type CertificateOverride_builder struct {
 	// A disabled override may exist for recording purposes, to be enabled later,
 	// or simply to mark a certain public key as not overridden. In the latter
 	// case the certificate may be absent.
+	//
+	// Disabled overrides allow CRLs to be created asynchronously, using
+	// CertAuthorityOverride watchers.
 	Disabled bool
 }
 

api/gen/proto/go/teleport/subca/v1/pending_csr_request_protohybrid.pb.go

@@ -0,0 +1,587 @@
+// Copyright 2026 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11-devel
+// 	protoc        (unknown)
+// source: teleport/subca/v1/pending_csr_request.proto
+
+//go:build teleport_protohybrid
+
+package subcav1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	status "google.golang.org/genproto/googleapis/rpc/status"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// A pending CSR request, created as part of a CreateCSR invocation on
+// multi-Auth, multi-HSM clusters.
+//
+// Requests are registered by the requester Auth server (the one processing the
+// CreateCSR call), in multi-HSM scenarios, when certain keys can't be used.
+// Auth servers watch PendingCSRRequest resources and fulfill requests
+// automatically, assigning a CSR and status to the corresponding PendingCSR
+// message. Once all pending CSRs have a terminal result, the RPC resumes.
+//
+// PendingCSRRequest are system-managed, "UncollectedKind" resources. They are
+// not user visible.
+type PendingCSRRequest struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Kind is "pending_csr_request".
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// Sub kind is unused.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// Version is "v1".
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// Metadata for the resource.
+	// The name of the resource is the request identifier.
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Spec for the resource.
+	Spec *PendingCSRRequestSpec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+	// Status for the resource.
+	Status        *PendingCSRRequestStatus `protobuf:"bytes,6,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PendingCSRRequest) Reset() {
+	*x = PendingCSRRequest{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSRRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSRRequest) ProtoMessage() {}
+
+func (x *PendingCSRRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSRRequest) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *PendingCSRRequest) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *PendingCSRRequest) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *PendingCSRRequest) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *PendingCSRRequest) GetSpec() *PendingCSRRequestSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *PendingCSRRequest) GetStatus() *PendingCSRRequestStatus {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+func (x *PendingCSRRequest) SetKind(v string) {
+	x.Kind = v
+}
+
+func (x *PendingCSRRequest) SetSubKind(v string) {
+	x.SubKind = v
+}
+
+func (x *PendingCSRRequest) SetVersion(v string) {
+	x.Version = v
+}
+
+func (x *PendingCSRRequest) SetMetadata(v *v1.Metadata) {
+	x.Metadata = v
+}
+
+func (x *PendingCSRRequest) SetSpec(v *PendingCSRRequestSpec) {
+	x.Spec = v
+}
+
+func (x *PendingCSRRequest) SetStatus(v *PendingCSRRequestStatus) {
+	x.Status = v
+}
+
+func (x *PendingCSRRequest) HasMetadata() bool {
+	if x == nil {
+		return false
+	}
+	return x.Metadata != nil
+}
+
+func (x *PendingCSRRequest) HasSpec() bool {
+	if x == nil {
+		return false
+	}
+	return x.Spec != nil
+}
+
+func (x *PendingCSRRequest) HasStatus() bool {
+	if x == nil {
+		return false
+	}
+	return x.Status != nil
+}
+
+func (x *PendingCSRRequest) ClearMetadata() {
+	x.Metadata = nil
+}
+
+func (x *PendingCSRRequest) ClearSpec() {
+	x.Spec = nil
+}
+
+func (x *PendingCSRRequest) ClearStatus() {
+	x.Status = nil
+}
+
+type PendingCSRRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Kind is "pending_csr_request".
+	Kind string
+	// Sub kind is unused.
+	SubKind string
+	// Version is "v1".
+	Version string
+	// Metadata for the resource.
+	// The name of the resource is the request identifier.
+	Metadata *v1.Metadata
+	// Spec for the resource.
+	Spec *PendingCSRRequestSpec
+	// Status for the resource.
+	Status *PendingCSRRequestStatus
+}
+
+func (b0 PendingCSRRequest_builder) Build() *PendingCSRRequest {
+	m0 := &PendingCSRRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.Kind = b.Kind
+	x.SubKind = b.SubKind
+	x.Version = b.Version
+	x.Metadata = b.Metadata
+	x.Spec = b.Spec
+	x.Status = b.Status
+	return m0
+}
+
+// Spec of a [PendingCSRRequest] resource.
+type PendingCSRRequestSpec struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Cluster of the CSR request.
+	ClusterName string `protobuf:"bytes,1,opt,name=cluster_name,json=clusterName,proto3" json:"cluster_name,omitempty"`
+	// CA type of the CSR request.
+	CaType string `protobuf:"bytes,2,opt,name=ca_type,json=caType,proto3" json:"ca_type,omitempty"`
+	// Custom subject for the CSRs.
+	// Optional.
+	CustomSubject *DistinguishedName `protobuf:"bytes,3,opt,name=custom_subject,json=customSubject,proto3" json:"custom_subject,omitempty"`
+	// Public key hashes of the requested CSRs.
+	PublicKeyHashes []*PublicKeyHash `protobuf:"bytes,4,rep,name=public_key_hashes,json=publicKeyHashes,proto3" json:"public_key_hashes,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *PendingCSRRequestSpec) Reset() {
+	*x = PendingCSRRequestSpec{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSRRequestSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSRRequestSpec) ProtoMessage() {}
+
+func (x *PendingCSRRequestSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSRRequestSpec) GetClusterName() string {
+	if x != nil {
+		return x.ClusterName
+	}
+	return ""
+}
+
+func (x *PendingCSRRequestSpec) GetCaType() string {
+	if x != nil {
+		return x.CaType
+	}
+	return ""
+}
+
+func (x *PendingCSRRequestSpec) GetCustomSubject() *DistinguishedName {
+	if x != nil {
+		return x.CustomSubject
+	}
+	return nil
+}
+
+func (x *PendingCSRRequestSpec) GetPublicKeyHashes() []*PublicKeyHash {
+	if x != nil {
+		return x.PublicKeyHashes
+	}
+	return nil
+}
+
+func (x *PendingCSRRequestSpec) SetClusterName(v string) {
+	x.ClusterName = v
+}
+
+func (x *PendingCSRRequestSpec) SetCaType(v string) {
+	x.CaType = v
+}
+
+func (x *PendingCSRRequestSpec) SetCustomSubject(v *DistinguishedName) {
+	x.CustomSubject = v
+}
+
+func (x *PendingCSRRequestSpec) SetPublicKeyHashes(v []*PublicKeyHash) {
+	x.PublicKeyHashes = v
+}
+
+func (x *PendingCSRRequestSpec) HasCustomSubject() bool {
+	if x == nil {
+		return false
+	}
+	return x.CustomSubject != nil
+}
+
+func (x *PendingCSRRequestSpec) ClearCustomSubject() {
+	x.CustomSubject = nil
+}
+
+type PendingCSRRequestSpec_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Cluster of the CSR request.
+	ClusterName string
+	// CA type of the CSR request.
+	CaType string
+	// Custom subject for the CSRs.
+	// Optional.
+	CustomSubject *DistinguishedName
+	// Public key hashes of the requested CSRs.
+	PublicKeyHashes []*PublicKeyHash
+}
+
+func (b0 PendingCSRRequestSpec_builder) Build() *PendingCSRRequestSpec {
+	m0 := &PendingCSRRequestSpec{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.ClusterName = b.ClusterName
+	x.CaType = b.CaType
+	x.CustomSubject = b.CustomSubject
+	x.PublicKeyHashes = b.PublicKeyHashes
+	return m0
+}
+
+// Status of a [PendingCSRRequest] resource.
+type PendingCSRRequestStatus struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Fulfilled pending CSR requests.
+	PublicKeyHashToPendingCsr map[string]*PendingCSR `protobuf:"bytes,1,rep,name=public_key_hash_to_pending_csr,json=publicKeyHashToPendingCsr,proto3" json:"public_key_hash_to_pending_csr,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields             protoimpl.UnknownFields
+	sizeCache                 protoimpl.SizeCache
+}
+
+func (x *PendingCSRRequestStatus) Reset() {
+	*x = PendingCSRRequestStatus{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSRRequestStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSRRequestStatus) ProtoMessage() {}
+
+func (x *PendingCSRRequestStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSRRequestStatus) GetPublicKeyHashToPendingCsr() map[string]*PendingCSR {
+	if x != nil {
+		return x.PublicKeyHashToPendingCsr
+	}
+	return nil
+}
+
+func (x *PendingCSRRequestStatus) SetPublicKeyHashToPendingCsr(v map[string]*PendingCSR) {
+	x.PublicKeyHashToPendingCsr = v
+}
+
+type PendingCSRRequestStatus_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Fulfilled pending CSR requests.
+	PublicKeyHashToPendingCsr map[string]*PendingCSR
+}
+
+func (b0 PendingCSRRequestStatus_builder) Build() *PendingCSRRequestStatus {
+	m0 := &PendingCSRRequestStatus{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.PublicKeyHashToPendingCsr = b.PublicKeyHashToPendingCsr
+	return m0
+}
+
+// A pending CSR, to be fulfilled as part of a [PendingCSRRequest].
+type PendingCSR struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// Status of the CSR signing attempt.
+	Status *status.Status `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	// The CSR itself. Non-nil if status is OK.
+	Csr           *CertificateSigningRequest `protobuf:"bytes,2,opt,name=csr,proto3" json:"csr,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PendingCSR) Reset() {
+	*x = PendingCSR{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSR) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSR) ProtoMessage() {}
+
+func (x *PendingCSR) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSR) GetStatus() *status.Status {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+func (x *PendingCSR) GetCsr() *CertificateSigningRequest {
+	if x != nil {
+		return x.Csr
+	}
+	return nil
+}
+
+func (x *PendingCSR) SetStatus(v *status.Status) {
+	x.Status = v
+}
+
+func (x *PendingCSR) SetCsr(v *CertificateSigningRequest) {
+	x.Csr = v
+}
+
+func (x *PendingCSR) HasStatus() bool {
+	if x == nil {
+		return false
+	}
+	return x.Status != nil
+}
+
+func (x *PendingCSR) HasCsr() bool {
+	if x == nil {
+		return false
+	}
+	return x.Csr != nil
+}
+
+func (x *PendingCSR) ClearStatus() {
+	x.Status = nil
+}
+
+func (x *PendingCSR) ClearCsr() {
+	x.Csr = nil
+}
+
+type PendingCSR_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Status of the CSR signing attempt.
+	Status *status.Status
+	// The CSR itself. Non-nil if status is OK.
+	Csr *CertificateSigningRequest
+}
+
+func (b0 PendingCSR_builder) Build() *PendingCSR {
+	m0 := &PendingCSR{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.Status = b.Status
+	x.Csr = b.Csr
+	return m0
+}
+
+var File_teleport_subca_v1_pending_csr_request_proto protoreflect.FileDescriptor
+
+const file_teleport_subca_v1_pending_csr_request_proto_rawDesc = "" +
+	"\n" +
+	"+teleport/subca/v1/pending_csr_request.proto\x12\x11teleport.subca.v1\x1a\x17google/rpc/status.proto\x1a!teleport/header/v1/metadata.proto\x1a\x1bteleport/subca/v1/csr.proto\x1a*teleport/subca/v1/distinguished_name.proto\x1a'teleport/subca/v1/public_key_hash.proto\"\x98\x02\n" +
+	"\x11PendingCSRRequest\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12<\n" +
+	"\x04spec\x18\x05 \x01(\v2(.teleport.subca.v1.PendingCSRRequestSpecR\x04spec\x12B\n" +
+	"\x06status\x18\x06 \x01(\v2*.teleport.subca.v1.PendingCSRRequestStatusR\x06status\"\xee\x01\n" +
+	"\x15PendingCSRRequestSpec\x12!\n" +
+	"\fcluster_name\x18\x01 \x01(\tR\vclusterName\x12\x17\n" +
+	"\aca_type\x18\x02 \x01(\tR\x06caType\x12K\n" +
+	"\x0ecustom_subject\x18\x03 \x01(\v2$.teleport.subca.v1.DistinguishedNameR\rcustomSubject\x12L\n" +
+	"\x11public_key_hashes\x18\x04 \x03(\v2 .teleport.subca.v1.PublicKeyHashR\x0fpublicKeyHashes\"\x95\x02\n" +
+	"\x17PendingCSRRequestStatus\x12\x8c\x01\n" +
+	"\x1epublic_key_hash_to_pending_csr\x18\x01 \x03(\v2I.teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntryR\x19publicKeyHashToPendingCsr\x1ak\n" +
+	"\x1ePublicKeyHashToPendingCsrEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x123\n" +
+	"\x05value\x18\x02 \x01(\v2\x1d.teleport.subca.v1.PendingCSRR\x05value:\x028\x01\"x\n" +
+	"\n" +
+	"PendingCSR\x12*\n" +
+	"\x06status\x18\x01 \x01(\v2\x12.google.rpc.StatusR\x06status\x12>\n" +
+	"\x03csr\x18\x02 \x01(\v2,.teleport.subca.v1.CertificateSigningRequestR\x03csrBNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/subca/v1;subcav1b\x06proto3"
+
+var file_teleport_subca_v1_pending_csr_request_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_teleport_subca_v1_pending_csr_request_proto_goTypes = []any{
+	(*PendingCSRRequest)(nil),         // 0: teleport.subca.v1.PendingCSRRequest
+	(*PendingCSRRequestSpec)(nil),     // 1: teleport.subca.v1.PendingCSRRequestSpec
+	(*PendingCSRRequestStatus)(nil),   // 2: teleport.subca.v1.PendingCSRRequestStatus
+	(*PendingCSR)(nil),                // 3: teleport.subca.v1.PendingCSR
+	nil,                               // 4: teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntry
+	(*v1.Metadata)(nil),               // 5: teleport.header.v1.Metadata
+	(*DistinguishedName)(nil),         // 6: teleport.subca.v1.DistinguishedName
+	(*PublicKeyHash)(nil),             // 7: teleport.subca.v1.PublicKeyHash
+	(*status.Status)(nil),             // 8: google.rpc.Status
+	(*CertificateSigningRequest)(nil), // 9: teleport.subca.v1.CertificateSigningRequest
+}
+var file_teleport_subca_v1_pending_csr_request_proto_depIdxs = []int32{
+	5, // 0: teleport.subca.v1.PendingCSRRequest.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.subca.v1.PendingCSRRequest.spec:type_name -> teleport.subca.v1.PendingCSRRequestSpec
+	2, // 2: teleport.subca.v1.PendingCSRRequest.status:type_name -> teleport.subca.v1.PendingCSRRequestStatus
+	6, // 3: teleport.subca.v1.PendingCSRRequestSpec.custom_subject:type_name -> teleport.subca.v1.DistinguishedName
+	7, // 4: teleport.subca.v1.PendingCSRRequestSpec.public_key_hashes:type_name -> teleport.subca.v1.PublicKeyHash
+	4, // 5: teleport.subca.v1.PendingCSRRequestStatus.public_key_hash_to_pending_csr:type_name -> teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntry
+	8, // 6: teleport.subca.v1.PendingCSR.status:type_name -> google.rpc.Status
+	9, // 7: teleport.subca.v1.PendingCSR.csr:type_name -> teleport.subca.v1.CertificateSigningRequest
+	3, // 8: teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntry.value:type_name -> teleport.subca.v1.PendingCSR
+	9, // [9:9] is the sub-list for method output_type
+	9, // [9:9] is the sub-list for method input_type
+	9, // [9:9] is the sub-list for extension type_name
+	9, // [9:9] is the sub-list for extension extendee
+	0, // [0:9] is the sub-list for field type_name
+}
+
+func init() { file_teleport_subca_v1_pending_csr_request_proto_init() }
+func file_teleport_subca_v1_pending_csr_request_proto_init() {
+	if File_teleport_subca_v1_pending_csr_request_proto != nil {
+		return
+	}
+	file_teleport_subca_v1_csr_proto_init()
+	file_teleport_subca_v1_distinguished_name_proto_init()
+	file_teleport_subca_v1_public_key_hash_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_subca_v1_pending_csr_request_proto_rawDesc), len(file_teleport_subca_v1_pending_csr_request_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_subca_v1_pending_csr_request_proto_goTypes,
+		DependencyIndexes: file_teleport_subca_v1_pending_csr_request_proto_depIdxs,
+		MessageInfos:      file_teleport_subca_v1_pending_csr_request_proto_msgTypes,
+	}.Build()
+	File_teleport_subca_v1_pending_csr_request_proto = out.File
+	file_teleport_subca_v1_pending_csr_request_proto_goTypes = nil
+	file_teleport_subca_v1_pending_csr_request_proto_depIdxs = nil
+}

api/gen/proto/go/teleport/subca/v1/pending_csr_request_protoopaque.pb.go

@@ -0,0 +1,574 @@
+// Copyright 2026 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11-devel
+// 	protoc        (unknown)
+// source: teleport/subca/v1/pending_csr_request.proto
+
+//go:build !teleport_protohybrid
+
+package subcav1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	status "google.golang.org/genproto/googleapis/rpc/status"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// A pending CSR request, created as part of a CreateCSR invocation on
+// multi-Auth, multi-HSM clusters.
+//
+// Requests are registered by the requester Auth server (the one processing the
+// CreateCSR call), in multi-HSM scenarios, when certain keys can't be used.
+// Auth servers watch PendingCSRRequest resources and fulfill requests
+// automatically, assigning a CSR and status to the corresponding PendingCSR
+// message. Once all pending CSRs have a terminal result, the RPC resumes.
+//
+// PendingCSRRequest are system-managed, "UncollectedKind" resources. They are
+// not user visible.
+type PendingCSRRequest struct {
+	state               protoimpl.MessageState   `protogen:"opaque.v1"`
+	xxx_hidden_Kind     string                   `protobuf:"bytes,1,opt,name=kind,proto3"`
+	xxx_hidden_SubKind  string                   `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3"`
+	xxx_hidden_Version  string                   `protobuf:"bytes,3,opt,name=version,proto3"`
+	xxx_hidden_Metadata *v1.Metadata             `protobuf:"bytes,4,opt,name=metadata,proto3"`
+	xxx_hidden_Spec     *PendingCSRRequestSpec   `protobuf:"bytes,5,opt,name=spec,proto3"`
+	xxx_hidden_Status   *PendingCSRRequestStatus `protobuf:"bytes,6,opt,name=status,proto3"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *PendingCSRRequest) Reset() {
+	*x = PendingCSRRequest{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSRRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSRRequest) ProtoMessage() {}
+
+func (x *PendingCSRRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSRRequest) GetKind() string {
+	if x != nil {
+		return x.xxx_hidden_Kind
+	}
+	return ""
+}
+
+func (x *PendingCSRRequest) GetSubKind() string {
+	if x != nil {
+		return x.xxx_hidden_SubKind
+	}
+	return ""
+}
+
+func (x *PendingCSRRequest) GetVersion() string {
+	if x != nil {
+		return x.xxx_hidden_Version
+	}
+	return ""
+}
+
+func (x *PendingCSRRequest) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.xxx_hidden_Metadata
+	}
+	return nil
+}
+
+func (x *PendingCSRRequest) GetSpec() *PendingCSRRequestSpec {
+	if x != nil {
+		return x.xxx_hidden_Spec
+	}
+	return nil
+}
+
+func (x *PendingCSRRequest) GetStatus() *PendingCSRRequestStatus {
+	if x != nil {
+		return x.xxx_hidden_Status
+	}
+	return nil
+}
+
+func (x *PendingCSRRequest) SetKind(v string) {
+	x.xxx_hidden_Kind = v
+}
+
+func (x *PendingCSRRequest) SetSubKind(v string) {
+	x.xxx_hidden_SubKind = v
+}
+
+func (x *PendingCSRRequest) SetVersion(v string) {
+	x.xxx_hidden_Version = v
+}
+
+func (x *PendingCSRRequest) SetMetadata(v *v1.Metadata) {
+	x.xxx_hidden_Metadata = v
+}
+
+func (x *PendingCSRRequest) SetSpec(v *PendingCSRRequestSpec) {
+	x.xxx_hidden_Spec = v
+}
+
+func (x *PendingCSRRequest) SetStatus(v *PendingCSRRequestStatus) {
+	x.xxx_hidden_Status = v
+}
+
+func (x *PendingCSRRequest) HasMetadata() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_Metadata != nil
+}
+
+func (x *PendingCSRRequest) HasSpec() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_Spec != nil
+}
+
+func (x *PendingCSRRequest) HasStatus() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_Status != nil
+}
+
+func (x *PendingCSRRequest) ClearMetadata() {
+	x.xxx_hidden_Metadata = nil
+}
+
+func (x *PendingCSRRequest) ClearSpec() {
+	x.xxx_hidden_Spec = nil
+}
+
+func (x *PendingCSRRequest) ClearStatus() {
+	x.xxx_hidden_Status = nil
+}
+
+type PendingCSRRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Kind is "pending_csr_request".
+	Kind string
+	// Sub kind is unused.
+	SubKind string
+	// Version is "v1".
+	Version string
+	// Metadata for the resource.
+	// The name of the resource is the request identifier.
+	Metadata *v1.Metadata
+	// Spec for the resource.
+	Spec *PendingCSRRequestSpec
+	// Status for the resource.
+	Status *PendingCSRRequestStatus
+}
+
+func (b0 PendingCSRRequest_builder) Build() *PendingCSRRequest {
+	m0 := &PendingCSRRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.xxx_hidden_Kind = b.Kind
+	x.xxx_hidden_SubKind = b.SubKind
+	x.xxx_hidden_Version = b.Version
+	x.xxx_hidden_Metadata = b.Metadata
+	x.xxx_hidden_Spec = b.Spec
+	x.xxx_hidden_Status = b.Status
+	return m0
+}
+
+// Spec of a [PendingCSRRequest] resource.
+type PendingCSRRequestSpec struct {
+	state                      protoimpl.MessageState `protogen:"opaque.v1"`
+	xxx_hidden_ClusterName     string                 `protobuf:"bytes,1,opt,name=cluster_name,json=clusterName,proto3"`
+	xxx_hidden_CaType          string                 `protobuf:"bytes,2,opt,name=ca_type,json=caType,proto3"`
+	xxx_hidden_CustomSubject   *DistinguishedName     `protobuf:"bytes,3,opt,name=custom_subject,json=customSubject,proto3"`
+	xxx_hidden_PublicKeyHashes *[]*PublicKeyHash      `protobuf:"bytes,4,rep,name=public_key_hashes,json=publicKeyHashes,proto3"`
+	unknownFields              protoimpl.UnknownFields
+	sizeCache                  protoimpl.SizeCache
+}
+
+func (x *PendingCSRRequestSpec) Reset() {
+	*x = PendingCSRRequestSpec{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSRRequestSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSRRequestSpec) ProtoMessage() {}
+
+func (x *PendingCSRRequestSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSRRequestSpec) GetClusterName() string {
+	if x != nil {
+		return x.xxx_hidden_ClusterName
+	}
+	return ""
+}
+
+func (x *PendingCSRRequestSpec) GetCaType() string {
+	if x != nil {
+		return x.xxx_hidden_CaType
+	}
+	return ""
+}
+
+func (x *PendingCSRRequestSpec) GetCustomSubject() *DistinguishedName {
+	if x != nil {
+		return x.xxx_hidden_CustomSubject
+	}
+	return nil
+}
+
+func (x *PendingCSRRequestSpec) GetPublicKeyHashes() []*PublicKeyHash {
+	if x != nil {
+		if x.xxx_hidden_PublicKeyHashes != nil {
+			return *x.xxx_hidden_PublicKeyHashes
+		}
+	}
+	return nil
+}
+
+func (x *PendingCSRRequestSpec) SetClusterName(v string) {
+	x.xxx_hidden_ClusterName = v
+}
+
+func (x *PendingCSRRequestSpec) SetCaType(v string) {
+	x.xxx_hidden_CaType = v
+}
+
+func (x *PendingCSRRequestSpec) SetCustomSubject(v *DistinguishedName) {
+	x.xxx_hidden_CustomSubject = v
+}
+
+func (x *PendingCSRRequestSpec) SetPublicKeyHashes(v []*PublicKeyHash) {
+	x.xxx_hidden_PublicKeyHashes = &v
+}
+
+func (x *PendingCSRRequestSpec) HasCustomSubject() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_CustomSubject != nil
+}
+
+func (x *PendingCSRRequestSpec) ClearCustomSubject() {
+	x.xxx_hidden_CustomSubject = nil
+}
+
+type PendingCSRRequestSpec_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Cluster of the CSR request.
+	ClusterName string
+	// CA type of the CSR request.
+	CaType string
+	// Custom subject for the CSRs.
+	// Optional.
+	CustomSubject *DistinguishedName
+	// Public key hashes of the requested CSRs.
+	PublicKeyHashes []*PublicKeyHash
+}
+
+func (b0 PendingCSRRequestSpec_builder) Build() *PendingCSRRequestSpec {
+	m0 := &PendingCSRRequestSpec{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.xxx_hidden_ClusterName = b.ClusterName
+	x.xxx_hidden_CaType = b.CaType
+	x.xxx_hidden_CustomSubject = b.CustomSubject
+	x.xxx_hidden_PublicKeyHashes = &b.PublicKeyHashes
+	return m0
+}
+
+// Status of a [PendingCSRRequest] resource.
+type PendingCSRRequestStatus struct {
+	state                                protoimpl.MessageState `protogen:"opaque.v1"`
+	xxx_hidden_PublicKeyHashToPendingCsr map[string]*PendingCSR `protobuf:"bytes,1,rep,name=public_key_hash_to_pending_csr,json=publicKeyHashToPendingCsr,proto3" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields                        protoimpl.UnknownFields
+	sizeCache                            protoimpl.SizeCache
+}
+
+func (x *PendingCSRRequestStatus) Reset() {
+	*x = PendingCSRRequestStatus{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSRRequestStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSRRequestStatus) ProtoMessage() {}
+
+func (x *PendingCSRRequestStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSRRequestStatus) GetPublicKeyHashToPendingCsr() map[string]*PendingCSR {
+	if x != nil {
+		return x.xxx_hidden_PublicKeyHashToPendingCsr
+	}
+	return nil
+}
+
+func (x *PendingCSRRequestStatus) SetPublicKeyHashToPendingCsr(v map[string]*PendingCSR) {
+	x.xxx_hidden_PublicKeyHashToPendingCsr = v
+}
+
+type PendingCSRRequestStatus_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Fulfilled pending CSR requests.
+	PublicKeyHashToPendingCsr map[string]*PendingCSR
+}
+
+func (b0 PendingCSRRequestStatus_builder) Build() *PendingCSRRequestStatus {
+	m0 := &PendingCSRRequestStatus{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.xxx_hidden_PublicKeyHashToPendingCsr = b.PublicKeyHashToPendingCsr
+	return m0
+}
+
+// A pending CSR, to be fulfilled as part of a [PendingCSRRequest].
+type PendingCSR struct {
+	state             protoimpl.MessageState     `protogen:"opaque.v1"`
+	xxx_hidden_Status *status.Status             `protobuf:"bytes,1,opt,name=status,proto3"`
+	xxx_hidden_Csr    *CertificateSigningRequest `protobuf:"bytes,2,opt,name=csr,proto3"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *PendingCSR) Reset() {
+	*x = PendingCSR{}
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PendingCSR) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PendingCSR) ProtoMessage() {}
+
+func (x *PendingCSR) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_pending_csr_request_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *PendingCSR) GetStatus() *status.Status {
+	if x != nil {
+		return x.xxx_hidden_Status
+	}
+	return nil
+}
+
+func (x *PendingCSR) GetCsr() *CertificateSigningRequest {
+	if x != nil {
+		return x.xxx_hidden_Csr
+	}
+	return nil
+}
+
+func (x *PendingCSR) SetStatus(v *status.Status) {
+	x.xxx_hidden_Status = v
+}
+
+func (x *PendingCSR) SetCsr(v *CertificateSigningRequest) {
+	x.xxx_hidden_Csr = v
+}
+
+func (x *PendingCSR) HasStatus() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_Status != nil
+}
+
+func (x *PendingCSR) HasCsr() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_Csr != nil
+}
+
+func (x *PendingCSR) ClearStatus() {
+	x.xxx_hidden_Status = nil
+}
+
+func (x *PendingCSR) ClearCsr() {
+	x.xxx_hidden_Csr = nil
+}
+
+type PendingCSR_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Status of the CSR signing attempt.
+	Status *status.Status
+	// The CSR itself. Non-nil if status is OK.
+	Csr *CertificateSigningRequest
+}
+
+func (b0 PendingCSR_builder) Build() *PendingCSR {
+	m0 := &PendingCSR{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.xxx_hidden_Status = b.Status
+	x.xxx_hidden_Csr = b.Csr
+	return m0
+}
+
+var File_teleport_subca_v1_pending_csr_request_proto protoreflect.FileDescriptor
+
+const file_teleport_subca_v1_pending_csr_request_proto_rawDesc = "" +
+	"\n" +
+	"+teleport/subca/v1/pending_csr_request.proto\x12\x11teleport.subca.v1\x1a\x17google/rpc/status.proto\x1a!teleport/header/v1/metadata.proto\x1a\x1bteleport/subca/v1/csr.proto\x1a*teleport/subca/v1/distinguished_name.proto\x1a'teleport/subca/v1/public_key_hash.proto\"\x98\x02\n" +
+	"\x11PendingCSRRequest\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x19\n" +
+	"\bsub_kind\x18\x02 \x01(\tR\asubKind\x12\x18\n" +
+	"\aversion\x18\x03 \x01(\tR\aversion\x128\n" +
+	"\bmetadata\x18\x04 \x01(\v2\x1c.teleport.header.v1.MetadataR\bmetadata\x12<\n" +
+	"\x04spec\x18\x05 \x01(\v2(.teleport.subca.v1.PendingCSRRequestSpecR\x04spec\x12B\n" +
+	"\x06status\x18\x06 \x01(\v2*.teleport.subca.v1.PendingCSRRequestStatusR\x06status\"\xee\x01\n" +
+	"\x15PendingCSRRequestSpec\x12!\n" +
+	"\fcluster_name\x18\x01 \x01(\tR\vclusterName\x12\x17\n" +
+	"\aca_type\x18\x02 \x01(\tR\x06caType\x12K\n" +
+	"\x0ecustom_subject\x18\x03 \x01(\v2$.teleport.subca.v1.DistinguishedNameR\rcustomSubject\x12L\n" +
+	"\x11public_key_hashes\x18\x04 \x03(\v2 .teleport.subca.v1.PublicKeyHashR\x0fpublicKeyHashes\"\x95\x02\n" +
+	"\x17PendingCSRRequestStatus\x12\x8c\x01\n" +
+	"\x1epublic_key_hash_to_pending_csr\x18\x01 \x03(\v2I.teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntryR\x19publicKeyHashToPendingCsr\x1ak\n" +
+	"\x1ePublicKeyHashToPendingCsrEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x123\n" +
+	"\x05value\x18\x02 \x01(\v2\x1d.teleport.subca.v1.PendingCSRR\x05value:\x028\x01\"x\n" +
+	"\n" +
+	"PendingCSR\x12*\n" +
+	"\x06status\x18\x01 \x01(\v2\x12.google.rpc.StatusR\x06status\x12>\n" +
+	"\x03csr\x18\x02 \x01(\v2,.teleport.subca.v1.CertificateSigningRequestR\x03csrBNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/subca/v1;subcav1b\x06proto3"
+
+var file_teleport_subca_v1_pending_csr_request_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_teleport_subca_v1_pending_csr_request_proto_goTypes = []any{
+	(*PendingCSRRequest)(nil),         // 0: teleport.subca.v1.PendingCSRRequest
+	(*PendingCSRRequestSpec)(nil),     // 1: teleport.subca.v1.PendingCSRRequestSpec
+	(*PendingCSRRequestStatus)(nil),   // 2: teleport.subca.v1.PendingCSRRequestStatus
+	(*PendingCSR)(nil),                // 3: teleport.subca.v1.PendingCSR
+	nil,                               // 4: teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntry
+	(*v1.Metadata)(nil),               // 5: teleport.header.v1.Metadata
+	(*DistinguishedName)(nil),         // 6: teleport.subca.v1.DistinguishedName
+	(*PublicKeyHash)(nil),             // 7: teleport.subca.v1.PublicKeyHash
+	(*status.Status)(nil),             // 8: google.rpc.Status
+	(*CertificateSigningRequest)(nil), // 9: teleport.subca.v1.CertificateSigningRequest
+}
+var file_teleport_subca_v1_pending_csr_request_proto_depIdxs = []int32{
+	5, // 0: teleport.subca.v1.PendingCSRRequest.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.subca.v1.PendingCSRRequest.spec:type_name -> teleport.subca.v1.PendingCSRRequestSpec
+	2, // 2: teleport.subca.v1.PendingCSRRequest.status:type_name -> teleport.subca.v1.PendingCSRRequestStatus
+	6, // 3: teleport.subca.v1.PendingCSRRequestSpec.custom_subject:type_name -> teleport.subca.v1.DistinguishedName
+	7, // 4: teleport.subca.v1.PendingCSRRequestSpec.public_key_hashes:type_name -> teleport.subca.v1.PublicKeyHash
+	4, // 5: teleport.subca.v1.PendingCSRRequestStatus.public_key_hash_to_pending_csr:type_name -> teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntry
+	8, // 6: teleport.subca.v1.PendingCSR.status:type_name -> google.rpc.Status
+	9, // 7: teleport.subca.v1.PendingCSR.csr:type_name -> teleport.subca.v1.CertificateSigningRequest
+	3, // 8: teleport.subca.v1.PendingCSRRequestStatus.PublicKeyHashToPendingCsrEntry.value:type_name -> teleport.subca.v1.PendingCSR
+	9, // [9:9] is the sub-list for method output_type
+	9, // [9:9] is the sub-list for method input_type
+	9, // [9:9] is the sub-list for extension type_name
+	9, // [9:9] is the sub-list for extension extendee
+	0, // [0:9] is the sub-list for field type_name
+}
+
+func init() { file_teleport_subca_v1_pending_csr_request_proto_init() }
+func file_teleport_subca_v1_pending_csr_request_proto_init() {
+	if File_teleport_subca_v1_pending_csr_request_proto != nil {
+		return
+	}
+	file_teleport_subca_v1_csr_proto_init()
+	file_teleport_subca_v1_distinguished_name_proto_init()
+	file_teleport_subca_v1_public_key_hash_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_subca_v1_pending_csr_request_proto_rawDesc), len(file_teleport_subca_v1_pending_csr_request_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_subca_v1_pending_csr_request_proto_goTypes,
+		DependencyIndexes: file_teleport_subca_v1_pending_csr_request_proto_depIdxs,
+		MessageInfos:      file_teleport_subca_v1_pending_csr_request_proto_msgTypes,
+	}.Build()
+	File_teleport_subca_v1_pending_csr_request_proto = out.File
+	file_teleport_subca_v1_pending_csr_request_proto_goTypes = nil
+	file_teleport_subca_v1_pending_csr_request_proto_depIdxs = nil
+}

api/gen/proto/go/teleport/subca/v1/subca_service_grpc.pb.go

@@ -73,11 +73,17 @@ type SubCAServiceClient interface {
 	// CreateCSR creates certificate signing requests for all certificates of the
 	// specified CA, in preparation for the creation of a CertAuthorityOverride.
 	//
-	// On clusters that use HSMs this must be called on every Auth server
-	// instance, so it every private key is covered. Each Auth issues CSRs for all
-	// the private keys it holds.
+	// On clusters where Auth server instances have access to distinct keys
+	// (multi-Auth, multi-HSM), CreateCSR attempts to collect CSRs from all Auth
+	// servers using PendingCSRRequest watchers. Attempts are gated by a timeout.
+	// If the timeout expires, the RPC returns as many CSRs as it managed to
+	// collect.
 	//
-	// CreateCSR requires cert_authority_override:read+list permissions.
+	// If local_only is set, the request will not fan out to other Auth servers;
+	// instead it will use local keys. In this case, each Auth server must be
+	// contacted independently to create their corresponding CSRs.
+	//
+	// CreateCSR requires cert_authority_override:create+update permissions.
 	CreateCSR(ctx context.Context, in *CreateCSRRequest, opts ...grpc.CallOption) (*CreateCSRResponse, error)
 	// CreateCertAuthorityOverride creates a CertAuthorityOverride resource.
 	//
@@ -98,7 +104,7 @@ type SubCAServiceClient interface {
 	// Added certificate overrides may take effect immediately depending on the
 	// value of CertificateOverride.disabled. See it for reference.
 	UpsertCertAuthorityOverride(ctx context.Context, in *UpsertCertAuthorityOverrideRequest, opts ...grpc.CallOption) (*UpsertCertAuthorityOverrideResponse, error)
-	// AddCertificateOverride adds a single CertiticateOverride to a
+	// AddCertificateOverride adds a single CertificateOverride to a
 	// CertAuthorityOverride resource.
 	//
 	// The CertAuthorityOverride resource may be created as a consequence of this
@@ -107,13 +113,13 @@ type SubCAServiceClient interface {
 	// Added certificate overrides may take effect immediately depending on the
 	// value of CertificateOverride.disabled. See it for reference.
 	AddCertificateOverride(ctx context.Context, in *AddCertificateOverrideRequest, opts ...grpc.CallOption) (*AddCertificateOverrideResponse, error)
-	// UpdateCertificateOverride updates a single CertiticateOverride in a
+	// UpdateCertificateOverride updates a single CertificateOverride in a
 	// CertAuthorityOverride resource.
 	//
 	// Disabling an active override is disallowed. See
 	// UpdateCertificateOverrideRequest.force_immediate_disable.
 	UpdateCertificateOverride(ctx context.Context, in *UpdateCertificateOverrideRequest, opts ...grpc.CallOption) (*UpdateCertificateOverrideResponse, error)
-	// RemoveCertificateOverride removes a single CertiticateOverride inside a
+	// RemoveCertificateOverride removes a single CertificateOverride inside a
 	// CertAuthorityOverride resource.
 	//
 	// If the last CertificateOverride of a CertAuthorityOverride is removed as a
@@ -276,11 +282,17 @@ type SubCAServiceServer interface {
 	// CreateCSR creates certificate signing requests for all certificates of the
 	// specified CA, in preparation for the creation of a CertAuthorityOverride.
 	//
-	// On clusters that use HSMs this must be called on every Auth server
-	// instance, so it every private key is covered. Each Auth issues CSRs for all
-	// the private keys it holds.
+	// On clusters where Auth server instances have access to distinct keys
+	// (multi-Auth, multi-HSM), CreateCSR attempts to collect CSRs from all Auth
+	// servers using PendingCSRRequest watchers. Attempts are gated by a timeout.
+	// If the timeout expires, the RPC returns as many CSRs as it managed to
+	// collect.
 	//
-	// CreateCSR requires cert_authority_override:read+list permissions.
+	// If local_only is set, the request will not fan out to other Auth servers;
+	// instead it will use local keys. In this case, each Auth server must be
+	// contacted independently to create their corresponding CSRs.
+	//
+	// CreateCSR requires cert_authority_override:create+update permissions.
 	CreateCSR(context.Context, *CreateCSRRequest) (*CreateCSRResponse, error)
 	// CreateCertAuthorityOverride creates a CertAuthorityOverride resource.
 	//
@@ -301,7 +313,7 @@ type SubCAServiceServer interface {
 	// Added certificate overrides may take effect immediately depending on the
 	// value of CertificateOverride.disabled. See it for reference.
 	UpsertCertAuthorityOverride(context.Context, *UpsertCertAuthorityOverrideRequest) (*UpsertCertAuthorityOverrideResponse, error)
-	// AddCertificateOverride adds a single CertiticateOverride to a
+	// AddCertificateOverride adds a single CertificateOverride to a
 	// CertAuthorityOverride resource.
 	//
 	// The CertAuthorityOverride resource may be created as a consequence of this
@@ -310,13 +322,13 @@ type SubCAServiceServer interface {
 	// Added certificate overrides may take effect immediately depending on the
 	// value of CertificateOverride.disabled. See it for reference.
 	AddCertificateOverride(context.Context, *AddCertificateOverrideRequest) (*AddCertificateOverrideResponse, error)
-	// UpdateCertificateOverride updates a single CertiticateOverride in a
+	// UpdateCertificateOverride updates a single CertificateOverride in a
 	// CertAuthorityOverride resource.
 	//
 	// Disabling an active override is disallowed. See
 	// UpdateCertificateOverrideRequest.force_immediate_disable.
 	UpdateCertificateOverride(context.Context, *UpdateCertificateOverrideRequest) (*UpdateCertificateOverrideResponse, error)
-	// RemoveCertificateOverride removes a single CertiticateOverride inside a
+	// RemoveCertificateOverride removes a single CertificateOverride inside a
 	// CertAuthorityOverride resource.
 	//
 	// If the last CertificateOverride of a CertAuthorityOverride is removed as a

api/gen/proto/go/teleport/subca/v1/subca_service_protohybrid.pb.go

@@ -54,6 +54,9 @@ type CreateCSRRequest struct {
 	//
 	// Optional. If present the request must target a single certificate.
 	CustomSubject *DistinguishedName `protobuf:"bytes,3,opt,name=custom_subject,json=customSubject,proto3" json:"custom_subject,omitempty"`
+	// If true, don't fan out CSR requests of unusable private keys to other Auth
+	// servers.
+	LocalOnly     bool `protobuf:"varint,4,opt,name=local_only,json=localOnly,proto3" json:"local_only,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -104,6 +107,13 @@ func (x *CreateCSRRequest) GetCustomSubject() *DistinguishedName {
 	return nil
 }
 
+func (x *CreateCSRRequest) GetLocalOnly() bool {
+	if x != nil {
+		return x.LocalOnly
+	}
+	return false
+}
+
 func (x *CreateCSRRequest) SetCaType(v string) {
 	x.CaType = v
 }
@@ -116,6 +126,10 @@ func (x *CreateCSRRequest) SetCustomSubject(v *DistinguishedName) {
 	x.CustomSubject = v
 }
 
+func (x *CreateCSRRequest) SetLocalOnly(v bool) {
+	x.LocalOnly = v
+}
+
 func (x *CreateCSRRequest) HasPublicKeyHash() bool {
 	if x == nil {
 		return false
@@ -155,6 +169,9 @@ type CreateCSRRequest_builder struct {
 	//
 	// Optional. If present the request must target a single certificate.
 	CustomSubject *DistinguishedName
+	// If true, don't fan out CSR requests of unusable private keys to other Auth
+	// servers.
+	LocalOnly bool
 }
 
 func (b0 CreateCSRRequest_builder) Build() *CreateCSRRequest {
@@ -164,14 +181,21 @@ func (b0 CreateCSRRequest_builder) Build() *CreateCSRRequest {
 	x.CaType = b.CaType
 	x.PublicKeyHash = b.PublicKeyHash
 	x.CustomSubject = b.CustomSubject
+	x.LocalOnly = b.LocalOnly
 	return m0
 }
 
 // Response for CreateCSR.
+//
+// A successful response contains at least one CSR and zero or more warnings.
+// If the server is incapable of returning any CSRs the response will be an
+// error (instead of a CreateCSRResponse).
 type CreateCSRResponse struct {
 	state protoimpl.MessageState `protogen:"hybrid.v1"`
 	// Created CSRs.
-	Csrs          []*CertificateSigningRequest `protobuf:"bytes,1,rep,name=csrs,proto3" json:"csrs,omitempty"`
+	Csrs []*CertificateSigningRequest `protobuf:"bytes,1,rep,name=csrs,proto3" json:"csrs,omitempty"`
+	// Warnings about missing/skipped CSRs.
+	Warnings      []*CreateCSRWarning `protobuf:"bytes,2,rep,name=warnings,proto3" json:"warnings,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -208,15 +232,28 @@ func (x *CreateCSRResponse) GetCsrs() []*CertificateSigningRequest {
 	return nil
 }
 
+func (x *CreateCSRResponse) GetWarnings() []*CreateCSRWarning {
+	if x != nil {
+		return x.Warnings
+	}
+	return nil
+}
+
 func (x *CreateCSRResponse) SetCsrs(v []*CertificateSigningRequest) {
 	x.Csrs = v
 }
 
+func (x *CreateCSRResponse) SetWarnings(v []*CreateCSRWarning) {
+	x.Warnings = v
+}
+
 type CreateCSRResponse_builder struct {
 	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
 
 	// Created CSRs.
 	Csrs []*CertificateSigningRequest
+	// Warnings about missing/skipped CSRs.
+	Warnings []*CreateCSRWarning
 }
 
 func (b0 CreateCSRResponse_builder) Build() *CreateCSRResponse {
@@ -224,6 +261,85 @@ func (b0 CreateCSRResponse_builder) Build() *CreateCSRResponse {
 	b, x := &b0, m0
 	_, _ = b, x
 	x.Csrs = b.Csrs
+	x.Warnings = b.Warnings
+	return m0
+}
+
+// A warning returned as part of a CreateCSRResponse.
+type CreateCSRWarning struct {
+	state protoimpl.MessageState `protogen:"hybrid.v1"`
+	// The end-user warning message.
+	UserMessage string `protobuf:"bytes,1,opt,name=user_message,json=userMessage,proto3" json:"user_message,omitempty"`
+	// Public key hash of the certificate/public key that generated the warning.
+	// Empty if not applicable.
+	PublicKeyHash string `protobuf:"bytes,2,opt,name=public_key_hash,json=publicKeyHash,proto3" json:"public_key_hash,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateCSRWarning) Reset() {
+	*x = CreateCSRWarning{}
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateCSRWarning) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateCSRWarning) ProtoMessage() {}
+
+func (x *CreateCSRWarning) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *CreateCSRWarning) GetUserMessage() string {
+	if x != nil {
+		return x.UserMessage
+	}
+	return ""
+}
+
+func (x *CreateCSRWarning) GetPublicKeyHash() string {
+	if x != nil {
+		return x.PublicKeyHash
+	}
+	return ""
+}
+
+func (x *CreateCSRWarning) SetUserMessage(v string) {
+	x.UserMessage = v
+}
+
+func (x *CreateCSRWarning) SetPublicKeyHash(v string) {
+	x.PublicKeyHash = v
+}
+
+type CreateCSRWarning_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// The end-user warning message.
+	UserMessage string
+	// Public key hash of the certificate/public key that generated the warning.
+	// Empty if not applicable.
+	PublicKeyHash string
+}
+
+func (b0 CreateCSRWarning_builder) Build() *CreateCSRWarning {
+	m0 := &CreateCSRWarning{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.UserMessage = b.UserMessage
+	x.PublicKeyHash = b.PublicKeyHash
 	return m0
 }
 
@@ -239,7 +355,7 @@ type CreateCertAuthorityOverrideRequest struct {
 
 func (x *CreateCertAuthorityOverrideRequest) Reset() {
 	*x = CreateCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -251,7 +367,7 @@ func (x *CreateCertAuthorityOverrideRequest) String() string {
 func (*CreateCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *CreateCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -311,7 +427,7 @@ type CreateCertAuthorityOverrideResponse struct {
 
 func (x *CreateCertAuthorityOverrideResponse) Reset() {
 	*x = CreateCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -323,7 +439,7 @@ func (x *CreateCertAuthorityOverrideResponse) String() string {
 func (*CreateCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *CreateCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -388,7 +504,7 @@ type UpdateCertAuthorityOverrideRequest struct {
 
 func (x *UpdateCertAuthorityOverrideRequest) Reset() {
 	*x = UpdateCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -400,7 +516,7 @@ func (x *UpdateCertAuthorityOverrideRequest) String() string {
 func (*UpdateCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *UpdateCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -477,7 +593,7 @@ type UpdateCertAuthorityOverrideResponse struct {
 
 func (x *UpdateCertAuthorityOverrideResponse) Reset() {
 	*x = UpdateCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -489,7 +605,7 @@ func (x *UpdateCertAuthorityOverrideResponse) String() string {
 func (*UpdateCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *UpdateCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -554,7 +670,7 @@ type UpsertCertAuthorityOverrideRequest struct {
 
 func (x *UpsertCertAuthorityOverrideRequest) Reset() {
 	*x = UpsertCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -566,7 +682,7 @@ func (x *UpsertCertAuthorityOverrideRequest) String() string {
 func (*UpsertCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *UpsertCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -643,7 +759,7 @@ type UpsertCertAuthorityOverrideResponse struct {
 
 func (x *UpsertCertAuthorityOverrideResponse) Reset() {
 	*x = UpsertCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -655,7 +771,7 @@ func (x *UpsertCertAuthorityOverrideResponse) String() string {
 func (*UpsertCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *UpsertCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -721,7 +837,7 @@ type AddCertificateOverrideRequest struct {
 
 func (x *AddCertificateOverrideRequest) Reset() {
 	*x = AddCertificateOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -733,7 +849,7 @@ func (x *AddCertificateOverrideRequest) String() string {
 func (*AddCertificateOverrideRequest) ProtoMessage() {}
 
 func (x *AddCertificateOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -834,7 +950,7 @@ type AddCertificateOverrideResponse struct {
 
 func (x *AddCertificateOverrideResponse) Reset() {
 	*x = AddCertificateOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -846,7 +962,7 @@ func (x *AddCertificateOverrideResponse) String() string {
 func (*AddCertificateOverrideResponse) ProtoMessage() {}
 
 func (x *AddCertificateOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -915,7 +1031,7 @@ type UpdateCertificateOverrideRequest struct {
 
 func (x *UpdateCertificateOverrideRequest) Reset() {
 	*x = UpdateCertificateOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -927,7 +1043,7 @@ func (x *UpdateCertificateOverrideRequest) String() string {
 func (*UpdateCertificateOverrideRequest) ProtoMessage() {}
 
 func (x *UpdateCertificateOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1054,7 +1170,7 @@ type UpdateCertificateOverrideResponse struct {
 
 func (x *UpdateCertificateOverrideResponse) Reset() {
 	*x = UpdateCertificateOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1066,7 +1182,7 @@ func (x *UpdateCertificateOverrideResponse) String() string {
 func (*UpdateCertificateOverrideResponse) ProtoMessage() {}
 
 func (x *UpdateCertificateOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1130,7 +1246,7 @@ type RemoveCertificateOverrideRequest struct {
 
 func (x *RemoveCertificateOverrideRequest) Reset() {
 	*x = RemoveCertificateOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1142,7 +1258,7 @@ func (x *RemoveCertificateOverrideRequest) String() string {
 func (*RemoveCertificateOverrideRequest) ProtoMessage() {}
 
 func (x *RemoveCertificateOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1216,7 +1332,7 @@ type RemoveCertificateOverrideResponse struct {
 
 func (x *RemoveCertificateOverrideResponse) Reset() {
 	*x = RemoveCertificateOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1228,7 +1344,7 @@ func (x *RemoveCertificateOverrideResponse) String() string {
 func (*RemoveCertificateOverrideResponse) ProtoMessage() {}
 
 func (x *RemoveCertificateOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1262,7 +1378,7 @@ type GetCertAuthorityOverrideRequest struct {
 
 func (x *GetCertAuthorityOverrideRequest) Reset() {
 	*x = GetCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1274,7 +1390,7 @@ func (x *GetCertAuthorityOverrideRequest) String() string {
 func (*GetCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *GetCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1333,7 +1449,7 @@ type GetCertAuthorityOverrideResponse struct {
 
 func (x *GetCertAuthorityOverrideResponse) Reset() {
 	*x = GetCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1345,7 +1461,7 @@ func (x *GetCertAuthorityOverrideResponse) String() string {
 func (*GetCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *GetCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1407,7 +1523,7 @@ type ListCertAuthorityOverrideRequest struct {
 
 func (x *ListCertAuthorityOverrideRequest) Reset() {
 	*x = ListCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1419,7 +1535,7 @@ func (x *ListCertAuthorityOverrideRequest) String() string {
 func (*ListCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *ListCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1485,7 +1601,7 @@ type ListCertAuthorityOverrideResponse struct {
 
 func (x *ListCertAuthorityOverrideResponse) Reset() {
 	*x = ListCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1497,7 +1613,7 @@ func (x *ListCertAuthorityOverrideResponse) String() string {
 func (*ListCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *ListCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1566,7 +1682,7 @@ type DeleteCertAuthorityOverrideRequest struct {
 
 func (x *DeleteCertAuthorityOverrideRequest) Reset() {
 	*x = DeleteCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1578,7 +1694,7 @@ func (x *DeleteCertAuthorityOverrideRequest) String() string {
 func (*DeleteCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *DeleteCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1653,7 +1769,7 @@ type DeleteCertAuthorityOverrideResponse struct {
 
 func (x *DeleteCertAuthorityOverrideResponse) Reset() {
 	*x = DeleteCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1665,7 +1781,7 @@ func (x *DeleteCertAuthorityOverrideResponse) String() string {
 func (*DeleteCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *DeleteCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1692,13 +1808,19 @@ var File_teleport_subca_v1_subca_service_proto protoreflect.FileDescriptor
 
 const file_teleport_subca_v1_subca_service_proto_rawDesc = "" +
 	"\n" +
-	"%teleport/subca/v1/subca_service.proto\x12\x11teleport.subca.v1\x1a google/protobuf/field_mask.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a2teleport/subca/v1/cert_authority_override_id.proto\x1a,teleport/subca/v1/certificate_override.proto\x1a/teleport/subca/v1/certificate_override_id.proto\x1a\x1bteleport/subca/v1/csr.proto\x1a*teleport/subca/v1/distinguished_name.proto\x1a'teleport/subca/v1/public_key_hash.proto\"\xc2\x01\n" +
+	"%teleport/subca/v1/subca_service.proto\x12\x11teleport.subca.v1\x1a google/protobuf/field_mask.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a2teleport/subca/v1/cert_authority_override_id.proto\x1a,teleport/subca/v1/certificate_override.proto\x1a/teleport/subca/v1/certificate_override_id.proto\x1a\x1bteleport/subca/v1/csr.proto\x1a*teleport/subca/v1/distinguished_name.proto\x1a'teleport/subca/v1/public_key_hash.proto\"\xe1\x01\n" +
 	"\x10CreateCSRRequest\x12\x17\n" +
 	"\aca_type\x18\x01 \x01(\tR\x06caType\x12H\n" +
 	"\x0fpublic_key_hash\x18\x02 \x01(\v2 .teleport.subca.v1.PublicKeyHashR\rpublicKeyHash\x12K\n" +
-	"\x0ecustom_subject\x18\x03 \x01(\v2$.teleport.subca.v1.DistinguishedNameR\rcustomSubject\"U\n" +
+	"\x0ecustom_subject\x18\x03 \x01(\v2$.teleport.subca.v1.DistinguishedNameR\rcustomSubject\x12\x1d\n" +
+	"\n" +
+	"local_only\x18\x04 \x01(\bR\tlocalOnly\"\x96\x01\n" +
 	"\x11CreateCSRResponse\x12@\n" +
-	"\x04csrs\x18\x01 \x03(\v2,.teleport.subca.v1.CertificateSigningRequestR\x04csrs\"o\n" +
+	"\x04csrs\x18\x01 \x03(\v2,.teleport.subca.v1.CertificateSigningRequestR\x04csrs\x12?\n" +
+	"\bwarnings\x18\x02 \x03(\v2#.teleport.subca.v1.CreateCSRWarningR\bwarnings\"]\n" +
+	"\x10CreateCSRWarning\x12!\n" +
+	"\fuser_message\x18\x01 \x01(\tR\vuserMessage\x12&\n" +
+	"\x0fpublic_key_hash\x18\x02 \x01(\tR\rpublicKeyHash\"o\n" +
 	"\"CreateCertAuthorityOverrideRequest\x12I\n" +
 	"\vca_override\x18\x01 \x01(\v2(.teleport.subca.v1.CertAuthorityOverrideR\n" +
 	"caOverride\"p\n" +
@@ -1766,84 +1888,86 @@ const file_teleport_subca_v1_subca_service_proto_rawDesc = "" +
 	"\x19ListCertAuthorityOverride\x123.teleport.subca.v1.ListCertAuthorityOverrideRequest\x1a4.teleport.subca.v1.ListCertAuthorityOverrideResponse\x12\x8c\x01\n" +
 	"\x1bDeleteCertAuthorityOverride\x125.teleport.subca.v1.DeleteCertAuthorityOverrideRequest\x1a6.teleport.subca.v1.DeleteCertAuthorityOverrideResponseBNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/subca/v1;subcav1b\x06proto3"
 
-var file_teleport_subca_v1_subca_service_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
+var file_teleport_subca_v1_subca_service_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
 var file_teleport_subca_v1_subca_service_proto_goTypes = []any{
 	(*CreateCSRRequest)(nil),                    // 0: teleport.subca.v1.CreateCSRRequest
 	(*CreateCSRResponse)(nil),                   // 1: teleport.subca.v1.CreateCSRResponse
-	(*CreateCertAuthorityOverrideRequest)(nil),  // 2: teleport.subca.v1.CreateCertAuthorityOverrideRequest
-	(*CreateCertAuthorityOverrideResponse)(nil), // 3: teleport.subca.v1.CreateCertAuthorityOverrideResponse
-	(*UpdateCertAuthorityOverrideRequest)(nil),  // 4: teleport.subca.v1.UpdateCertAuthorityOverrideRequest
-	(*UpdateCertAuthorityOverrideResponse)(nil), // 5: teleport.subca.v1.UpdateCertAuthorityOverrideResponse
-	(*UpsertCertAuthorityOverrideRequest)(nil),  // 6: teleport.subca.v1.UpsertCertAuthorityOverrideRequest
-	(*UpsertCertAuthorityOverrideResponse)(nil), // 7: teleport.subca.v1.UpsertCertAuthorityOverrideResponse
-	(*AddCertificateOverrideRequest)(nil),       // 8: teleport.subca.v1.AddCertificateOverrideRequest
-	(*AddCertificateOverrideResponse)(nil),      // 9: teleport.subca.v1.AddCertificateOverrideResponse
-	(*UpdateCertificateOverrideRequest)(nil),    // 10: teleport.subca.v1.UpdateCertificateOverrideRequest
-	(*UpdateCertificateOverrideResponse)(nil),   // 11: teleport.subca.v1.UpdateCertificateOverrideResponse
-	(*RemoveCertificateOverrideRequest)(nil),    // 12: teleport.subca.v1.RemoveCertificateOverrideRequest
-	(*RemoveCertificateOverrideResponse)(nil),   // 13: teleport.subca.v1.RemoveCertificateOverrideResponse
-	(*GetCertAuthorityOverrideRequest)(nil),     // 14: teleport.subca.v1.GetCertAuthorityOverrideRequest
-	(*GetCertAuthorityOverrideResponse)(nil),    // 15: teleport.subca.v1.GetCertAuthorityOverrideResponse
-	(*ListCertAuthorityOverrideRequest)(nil),    // 16: teleport.subca.v1.ListCertAuthorityOverrideRequest
-	(*ListCertAuthorityOverrideResponse)(nil),   // 17: teleport.subca.v1.ListCertAuthorityOverrideResponse
-	(*DeleteCertAuthorityOverrideRequest)(nil),  // 18: teleport.subca.v1.DeleteCertAuthorityOverrideRequest
-	(*DeleteCertAuthorityOverrideResponse)(nil), // 19: teleport.subca.v1.DeleteCertAuthorityOverrideResponse
-	(*PublicKeyHash)(nil),                       // 20: teleport.subca.v1.PublicKeyHash
-	(*DistinguishedName)(nil),                   // 21: teleport.subca.v1.DistinguishedName
-	(*CertificateSigningRequest)(nil),           // 22: teleport.subca.v1.CertificateSigningRequest
-	(*CertAuthorityOverride)(nil),               // 23: teleport.subca.v1.CertAuthorityOverride
-	(*CertAuthorityOverrideID)(nil),             // 24: teleport.subca.v1.CertAuthorityOverrideID
-	(*CertificateOverride)(nil),                 // 25: teleport.subca.v1.CertificateOverride
-	(*fieldmaskpb.FieldMask)(nil),               // 26: google.protobuf.FieldMask
-	(*CertificateOverrideID)(nil),               // 27: teleport.subca.v1.CertificateOverrideID
+	(*CreateCSRWarning)(nil),                    // 2: teleport.subca.v1.CreateCSRWarning
+	(*CreateCertAuthorityOverrideRequest)(nil),  // 3: teleport.subca.v1.CreateCertAuthorityOverrideRequest
+	(*CreateCertAuthorityOverrideResponse)(nil), // 4: teleport.subca.v1.CreateCertAuthorityOverrideResponse
+	(*UpdateCertAuthorityOverrideRequest)(nil),  // 5: teleport.subca.v1.UpdateCertAuthorityOverrideRequest
+	(*UpdateCertAuthorityOverrideResponse)(nil), // 6: teleport.subca.v1.UpdateCertAuthorityOverrideResponse
+	(*UpsertCertAuthorityOverrideRequest)(nil),  // 7: teleport.subca.v1.UpsertCertAuthorityOverrideRequest
+	(*UpsertCertAuthorityOverrideResponse)(nil), // 8: teleport.subca.v1.UpsertCertAuthorityOverrideResponse
+	(*AddCertificateOverrideRequest)(nil),       // 9: teleport.subca.v1.AddCertificateOverrideRequest
+	(*AddCertificateOverrideResponse)(nil),      // 10: teleport.subca.v1.AddCertificateOverrideResponse
+	(*UpdateCertificateOverrideRequest)(nil),    // 11: teleport.subca.v1.UpdateCertificateOverrideRequest
+	(*UpdateCertificateOverrideResponse)(nil),   // 12: teleport.subca.v1.UpdateCertificateOverrideResponse
+	(*RemoveCertificateOverrideRequest)(nil),    // 13: teleport.subca.v1.RemoveCertificateOverrideRequest
+	(*RemoveCertificateOverrideResponse)(nil),   // 14: teleport.subca.v1.RemoveCertificateOverrideResponse
+	(*GetCertAuthorityOverrideRequest)(nil),     // 15: teleport.subca.v1.GetCertAuthorityOverrideRequest
+	(*GetCertAuthorityOverrideResponse)(nil),    // 16: teleport.subca.v1.GetCertAuthorityOverrideResponse
+	(*ListCertAuthorityOverrideRequest)(nil),    // 17: teleport.subca.v1.ListCertAuthorityOverrideRequest
+	(*ListCertAuthorityOverrideResponse)(nil),   // 18: teleport.subca.v1.ListCertAuthorityOverrideResponse
+	(*DeleteCertAuthorityOverrideRequest)(nil),  // 19: teleport.subca.v1.DeleteCertAuthorityOverrideRequest
+	(*DeleteCertAuthorityOverrideResponse)(nil), // 20: teleport.subca.v1.DeleteCertAuthorityOverrideResponse
+	(*PublicKeyHash)(nil),                       // 21: teleport.subca.v1.PublicKeyHash
+	(*DistinguishedName)(nil),                   // 22: teleport.subca.v1.DistinguishedName
+	(*CertificateSigningRequest)(nil),           // 23: teleport.subca.v1.CertificateSigningRequest
+	(*CertAuthorityOverride)(nil),               // 24: teleport.subca.v1.CertAuthorityOverride
+	(*CertAuthorityOverrideID)(nil),             // 25: teleport.subca.v1.CertAuthorityOverrideID
+	(*CertificateOverride)(nil),                 // 26: teleport.subca.v1.CertificateOverride
+	(*fieldmaskpb.FieldMask)(nil),               // 27: google.protobuf.FieldMask
+	(*CertificateOverrideID)(nil),               // 28: teleport.subca.v1.CertificateOverrideID
 }
 var file_teleport_subca_v1_subca_service_proto_depIdxs = []int32{
-	20, // 0: teleport.subca.v1.CreateCSRRequest.public_key_hash:type_name -> teleport.subca.v1.PublicKeyHash
-	21, // 1: teleport.subca.v1.CreateCSRRequest.custom_subject:type_name -> teleport.subca.v1.DistinguishedName
-	22, // 2: teleport.subca.v1.CreateCSRResponse.csrs:type_name -> teleport.subca.v1.CertificateSigningRequest
-	23, // 3: teleport.subca.v1.CreateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 4: teleport.subca.v1.CreateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 5: teleport.subca.v1.UpdateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 6: teleport.subca.v1.UpdateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 7: teleport.subca.v1.UpsertCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 8: teleport.subca.v1.UpsertCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	24, // 9: teleport.subca.v1.AddCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	25, // 10: teleport.subca.v1.AddCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	25, // 11: teleport.subca.v1.AddCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	24, // 12: teleport.subca.v1.UpdateCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	25, // 13: teleport.subca.v1.UpdateCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	26, // 14: teleport.subca.v1.UpdateCertificateOverrideRequest.update_mask:type_name -> google.protobuf.FieldMask
-	25, // 15: teleport.subca.v1.UpdateCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	27, // 16: teleport.subca.v1.RemoveCertificateOverrideRequest.certificate_override_id:type_name -> teleport.subca.v1.CertificateOverrideID
-	24, // 17: teleport.subca.v1.GetCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	23, // 18: teleport.subca.v1.GetCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 19: teleport.subca.v1.ListCertAuthorityOverrideResponse.ca_overrides:type_name -> teleport.subca.v1.CertAuthorityOverride
-	24, // 20: teleport.subca.v1.DeleteCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	0,  // 21: teleport.subca.v1.SubCAService.CreateCSR:input_type -> teleport.subca.v1.CreateCSRRequest
-	2,  // 22: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:input_type -> teleport.subca.v1.CreateCertAuthorityOverrideRequest
-	4,  // 23: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:input_type -> teleport.subca.v1.UpdateCertAuthorityOverrideRequest
-	6,  // 24: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:input_type -> teleport.subca.v1.UpsertCertAuthorityOverrideRequest
-	8,  // 25: teleport.subca.v1.SubCAService.AddCertificateOverride:input_type -> teleport.subca.v1.AddCertificateOverrideRequest
-	10, // 26: teleport.subca.v1.SubCAService.UpdateCertificateOverride:input_type -> teleport.subca.v1.UpdateCertificateOverrideRequest
-	12, // 27: teleport.subca.v1.SubCAService.RemoveCertificateOverride:input_type -> teleport.subca.v1.RemoveCertificateOverrideRequest
-	14, // 28: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:input_type -> teleport.subca.v1.GetCertAuthorityOverrideRequest
-	16, // 29: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:input_type -> teleport.subca.v1.ListCertAuthorityOverrideRequest
-	18, // 30: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:input_type -> teleport.subca.v1.DeleteCertAuthorityOverrideRequest
-	1,  // 31: teleport.subca.v1.SubCAService.CreateCSR:output_type -> teleport.subca.v1.CreateCSRResponse
-	3,  // 32: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:output_type -> teleport.subca.v1.CreateCertAuthorityOverrideResponse
-	5,  // 33: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:output_type -> teleport.subca.v1.UpdateCertAuthorityOverrideResponse
-	7,  // 34: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:output_type -> teleport.subca.v1.UpsertCertAuthorityOverrideResponse
-	9,  // 35: teleport.subca.v1.SubCAService.AddCertificateOverride:output_type -> teleport.subca.v1.AddCertificateOverrideResponse
-	11, // 36: teleport.subca.v1.SubCAService.UpdateCertificateOverride:output_type -> teleport.subca.v1.UpdateCertificateOverrideResponse
-	13, // 37: teleport.subca.v1.SubCAService.RemoveCertificateOverride:output_type -> teleport.subca.v1.RemoveCertificateOverrideResponse
-	15, // 38: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:output_type -> teleport.subca.v1.GetCertAuthorityOverrideResponse
-	17, // 39: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:output_type -> teleport.subca.v1.ListCertAuthorityOverrideResponse
-	19, // 40: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:output_type -> teleport.subca.v1.DeleteCertAuthorityOverrideResponse
-	31, // [31:41] is the sub-list for method output_type
-	21, // [21:31] is the sub-list for method input_type
-	21, // [21:21] is the sub-list for extension type_name
-	21, // [21:21] is the sub-list for extension extendee
-	0,  // [0:21] is the sub-list for field type_name
+	21, // 0: teleport.subca.v1.CreateCSRRequest.public_key_hash:type_name -> teleport.subca.v1.PublicKeyHash
+	22, // 1: teleport.subca.v1.CreateCSRRequest.custom_subject:type_name -> teleport.subca.v1.DistinguishedName
+	23, // 2: teleport.subca.v1.CreateCSRResponse.csrs:type_name -> teleport.subca.v1.CertificateSigningRequest
+	2,  // 3: teleport.subca.v1.CreateCSRResponse.warnings:type_name -> teleport.subca.v1.CreateCSRWarning
+	24, // 4: teleport.subca.v1.CreateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 5: teleport.subca.v1.CreateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 6: teleport.subca.v1.UpdateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 7: teleport.subca.v1.UpdateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 8: teleport.subca.v1.UpsertCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 9: teleport.subca.v1.UpsertCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	25, // 10: teleport.subca.v1.AddCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	26, // 11: teleport.subca.v1.AddCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	26, // 12: teleport.subca.v1.AddCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	25, // 13: teleport.subca.v1.UpdateCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	26, // 14: teleport.subca.v1.UpdateCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	27, // 15: teleport.subca.v1.UpdateCertificateOverrideRequest.update_mask:type_name -> google.protobuf.FieldMask
+	26, // 16: teleport.subca.v1.UpdateCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	28, // 17: teleport.subca.v1.RemoveCertificateOverrideRequest.certificate_override_id:type_name -> teleport.subca.v1.CertificateOverrideID
+	25, // 18: teleport.subca.v1.GetCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	24, // 19: teleport.subca.v1.GetCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 20: teleport.subca.v1.ListCertAuthorityOverrideResponse.ca_overrides:type_name -> teleport.subca.v1.CertAuthorityOverride
+	25, // 21: teleport.subca.v1.DeleteCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	0,  // 22: teleport.subca.v1.SubCAService.CreateCSR:input_type -> teleport.subca.v1.CreateCSRRequest
+	3,  // 23: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:input_type -> teleport.subca.v1.CreateCertAuthorityOverrideRequest
+	5,  // 24: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:input_type -> teleport.subca.v1.UpdateCertAuthorityOverrideRequest
+	7,  // 25: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:input_type -> teleport.subca.v1.UpsertCertAuthorityOverrideRequest
+	9,  // 26: teleport.subca.v1.SubCAService.AddCertificateOverride:input_type -> teleport.subca.v1.AddCertificateOverrideRequest
+	11, // 27: teleport.subca.v1.SubCAService.UpdateCertificateOverride:input_type -> teleport.subca.v1.UpdateCertificateOverrideRequest
+	13, // 28: teleport.subca.v1.SubCAService.RemoveCertificateOverride:input_type -> teleport.subca.v1.RemoveCertificateOverrideRequest
+	15, // 29: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:input_type -> teleport.subca.v1.GetCertAuthorityOverrideRequest
+	17, // 30: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:input_type -> teleport.subca.v1.ListCertAuthorityOverrideRequest
+	19, // 31: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:input_type -> teleport.subca.v1.DeleteCertAuthorityOverrideRequest
+	1,  // 32: teleport.subca.v1.SubCAService.CreateCSR:output_type -> teleport.subca.v1.CreateCSRResponse
+	4,  // 33: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:output_type -> teleport.subca.v1.CreateCertAuthorityOverrideResponse
+	6,  // 34: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:output_type -> teleport.subca.v1.UpdateCertAuthorityOverrideResponse
+	8,  // 35: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:output_type -> teleport.subca.v1.UpsertCertAuthorityOverrideResponse
+	10, // 36: teleport.subca.v1.SubCAService.AddCertificateOverride:output_type -> teleport.subca.v1.AddCertificateOverrideResponse
+	12, // 37: teleport.subca.v1.SubCAService.UpdateCertificateOverride:output_type -> teleport.subca.v1.UpdateCertificateOverrideResponse
+	14, // 38: teleport.subca.v1.SubCAService.RemoveCertificateOverride:output_type -> teleport.subca.v1.RemoveCertificateOverrideResponse
+	16, // 39: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:output_type -> teleport.subca.v1.GetCertAuthorityOverrideResponse
+	18, // 40: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:output_type -> teleport.subca.v1.ListCertAuthorityOverrideResponse
+	20, // 41: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:output_type -> teleport.subca.v1.DeleteCertAuthorityOverrideResponse
+	32, // [32:42] is the sub-list for method output_type
+	22, // [22:32] is the sub-list for method input_type
+	22, // [22:22] is the sub-list for extension type_name
+	22, // [22:22] is the sub-list for extension extendee
+	0,  // [0:22] is the sub-list for field type_name
 }
 
 func init() { file_teleport_subca_v1_subca_service_proto_init() }
@@ -1864,7 +1988,7 @@ func file_teleport_subca_v1_subca_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_subca_v1_subca_service_proto_rawDesc), len(file_teleport_subca_v1_subca_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   20,
+			NumMessages:   21,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

api/gen/proto/go/teleport/subca/v1/subca_service_protoopaque.pb.go

@@ -43,6 +43,7 @@ type CreateCSRRequest struct {
 	xxx_hidden_CaType        string                 `protobuf:"bytes,1,opt,name=ca_type,json=caType,proto3"`
 	xxx_hidden_PublicKeyHash *PublicKeyHash         `protobuf:"bytes,2,opt,name=public_key_hash,json=publicKeyHash,proto3"`
 	xxx_hidden_CustomSubject *DistinguishedName     `protobuf:"bytes,3,opt,name=custom_subject,json=customSubject,proto3"`
+	xxx_hidden_LocalOnly     bool                   `protobuf:"varint,4,opt,name=local_only,json=localOnly,proto3"`
 	unknownFields            protoimpl.UnknownFields
 	sizeCache                protoimpl.SizeCache
 }
@@ -93,6 +94,13 @@ func (x *CreateCSRRequest) GetCustomSubject() *DistinguishedName {
 	return nil
 }
 
+func (x *CreateCSRRequest) GetLocalOnly() bool {
+	if x != nil {
+		return x.xxx_hidden_LocalOnly
+	}
+	return false
+}
+
 func (x *CreateCSRRequest) SetCaType(v string) {
 	x.xxx_hidden_CaType = v
 }
@@ -105,6 +113,10 @@ func (x *CreateCSRRequest) SetCustomSubject(v *DistinguishedName) {
 	x.xxx_hidden_CustomSubject = v
 }
 
+func (x *CreateCSRRequest) SetLocalOnly(v bool) {
+	x.xxx_hidden_LocalOnly = v
+}
+
 func (x *CreateCSRRequest) HasPublicKeyHash() bool {
 	if x == nil {
 		return false
@@ -144,6 +156,9 @@ type CreateCSRRequest_builder struct {
 	//
 	// Optional. If present the request must target a single certificate.
 	CustomSubject *DistinguishedName
+	// If true, don't fan out CSR requests of unusable private keys to other Auth
+	// servers.
+	LocalOnly bool
 }
 
 func (b0 CreateCSRRequest_builder) Build() *CreateCSRRequest {
@@ -153,15 +168,21 @@ func (b0 CreateCSRRequest_builder) Build() *CreateCSRRequest {
 	x.xxx_hidden_CaType = b.CaType
 	x.xxx_hidden_PublicKeyHash = b.PublicKeyHash
 	x.xxx_hidden_CustomSubject = b.CustomSubject
+	x.xxx_hidden_LocalOnly = b.LocalOnly
 	return m0
 }
 
 // Response for CreateCSR.
+//
+// A successful response contains at least one CSR and zero or more warnings.
+// If the server is incapable of returning any CSRs the response will be an
+// error (instead of a CreateCSRResponse).
 type CreateCSRResponse struct {
-	state           protoimpl.MessageState        `protogen:"opaque.v1"`
-	xxx_hidden_Csrs *[]*CertificateSigningRequest `protobuf:"bytes,1,rep,name=csrs,proto3"`
-	unknownFields   protoimpl.UnknownFields
-	sizeCache       protoimpl.SizeCache
+	state               protoimpl.MessageState        `protogen:"opaque.v1"`
+	xxx_hidden_Csrs     *[]*CertificateSigningRequest `protobuf:"bytes,1,rep,name=csrs,proto3"`
+	xxx_hidden_Warnings *[]*CreateCSRWarning          `protobuf:"bytes,2,rep,name=warnings,proto3"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *CreateCSRResponse) Reset() {
@@ -198,15 +219,30 @@ func (x *CreateCSRResponse) GetCsrs() []*CertificateSigningRequest {
 	return nil
 }
 
+func (x *CreateCSRResponse) GetWarnings() []*CreateCSRWarning {
+	if x != nil {
+		if x.xxx_hidden_Warnings != nil {
+			return *x.xxx_hidden_Warnings
+		}
+	}
+	return nil
+}
+
 func (x *CreateCSRResponse) SetCsrs(v []*CertificateSigningRequest) {
 	x.xxx_hidden_Csrs = &v
 }
 
+func (x *CreateCSRResponse) SetWarnings(v []*CreateCSRWarning) {
+	x.xxx_hidden_Warnings = &v
+}
+
 type CreateCSRResponse_builder struct {
 	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
 
 	// Created CSRs.
 	Csrs []*CertificateSigningRequest
+	// Warnings about missing/skipped CSRs.
+	Warnings []*CreateCSRWarning
 }
 
 func (b0 CreateCSRResponse_builder) Build() *CreateCSRResponse {
@@ -214,6 +250,82 @@ func (b0 CreateCSRResponse_builder) Build() *CreateCSRResponse {
 	b, x := &b0, m0
 	_, _ = b, x
 	x.xxx_hidden_Csrs = &b.Csrs
+	x.xxx_hidden_Warnings = &b.Warnings
+	return m0
+}
+
+// A warning returned as part of a CreateCSRResponse.
+type CreateCSRWarning struct {
+	state                    protoimpl.MessageState `protogen:"opaque.v1"`
+	xxx_hidden_UserMessage   string                 `protobuf:"bytes,1,opt,name=user_message,json=userMessage,proto3"`
+	xxx_hidden_PublicKeyHash string                 `protobuf:"bytes,2,opt,name=public_key_hash,json=publicKeyHash,proto3"`
+	unknownFields            protoimpl.UnknownFields
+	sizeCache                protoimpl.SizeCache
+}
+
+func (x *CreateCSRWarning) Reset() {
+	*x = CreateCSRWarning{}
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateCSRWarning) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateCSRWarning) ProtoMessage() {}
+
+func (x *CreateCSRWarning) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *CreateCSRWarning) GetUserMessage() string {
+	if x != nil {
+		return x.xxx_hidden_UserMessage
+	}
+	return ""
+}
+
+func (x *CreateCSRWarning) GetPublicKeyHash() string {
+	if x != nil {
+		return x.xxx_hidden_PublicKeyHash
+	}
+	return ""
+}
+
+func (x *CreateCSRWarning) SetUserMessage(v string) {
+	x.xxx_hidden_UserMessage = v
+}
+
+func (x *CreateCSRWarning) SetPublicKeyHash(v string) {
+	x.xxx_hidden_PublicKeyHash = v
+}
+
+type CreateCSRWarning_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// The end-user warning message.
+	UserMessage string
+	// Public key hash of the certificate/public key that generated the warning.
+	// Empty if not applicable.
+	PublicKeyHash string
+}
+
+func (b0 CreateCSRWarning_builder) Build() *CreateCSRWarning {
+	m0 := &CreateCSRWarning{}
+	b, x := &b0, m0
+	_, _ = b, x
+	x.xxx_hidden_UserMessage = b.UserMessage
+	x.xxx_hidden_PublicKeyHash = b.PublicKeyHash
 	return m0
 }
 
@@ -227,7 +339,7 @@ type CreateCertAuthorityOverrideRequest struct {
 
 func (x *CreateCertAuthorityOverrideRequest) Reset() {
 	*x = CreateCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -239,7 +351,7 @@ func (x *CreateCertAuthorityOverrideRequest) String() string {
 func (*CreateCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *CreateCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[2]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -298,7 +410,7 @@ type CreateCertAuthorityOverrideResponse struct {
 
 func (x *CreateCertAuthorityOverrideResponse) Reset() {
 	*x = CreateCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -310,7 +422,7 @@ func (x *CreateCertAuthorityOverrideResponse) String() string {
 func (*CreateCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *CreateCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[3]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -369,7 +481,7 @@ type UpdateCertAuthorityOverrideRequest struct {
 
 func (x *UpdateCertAuthorityOverrideRequest) Reset() {
 	*x = UpdateCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -381,7 +493,7 @@ func (x *UpdateCertAuthorityOverrideRequest) String() string {
 func (*UpdateCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *UpdateCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[4]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -457,7 +569,7 @@ type UpdateCertAuthorityOverrideResponse struct {
 
 func (x *UpdateCertAuthorityOverrideResponse) Reset() {
 	*x = UpdateCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -469,7 +581,7 @@ func (x *UpdateCertAuthorityOverrideResponse) String() string {
 func (*UpdateCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *UpdateCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[5]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -528,7 +640,7 @@ type UpsertCertAuthorityOverrideRequest struct {
 
 func (x *UpsertCertAuthorityOverrideRequest) Reset() {
 	*x = UpsertCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -540,7 +652,7 @@ func (x *UpsertCertAuthorityOverrideRequest) String() string {
 func (*UpsertCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *UpsertCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[6]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -616,7 +728,7 @@ type UpsertCertAuthorityOverrideResponse struct {
 
 func (x *UpsertCertAuthorityOverrideResponse) Reset() {
 	*x = UpsertCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -628,7 +740,7 @@ func (x *UpsertCertAuthorityOverrideResponse) String() string {
 func (*UpsertCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *UpsertCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[7]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -688,7 +800,7 @@ type AddCertificateOverrideRequest struct {
 
 func (x *AddCertificateOverrideRequest) Reset() {
 	*x = AddCertificateOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -700,7 +812,7 @@ func (x *AddCertificateOverrideRequest) String() string {
 func (*AddCertificateOverrideRequest) ProtoMessage() {}
 
 func (x *AddCertificateOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[8]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -800,7 +912,7 @@ type AddCertificateOverrideResponse struct {
 
 func (x *AddCertificateOverrideResponse) Reset() {
 	*x = AddCertificateOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -812,7 +924,7 @@ func (x *AddCertificateOverrideResponse) String() string {
 func (*AddCertificateOverrideResponse) ProtoMessage() {}
 
 func (x *AddCertificateOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[9]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -873,7 +985,7 @@ type UpdateCertificateOverrideRequest struct {
 
 func (x *UpdateCertificateOverrideRequest) Reset() {
 	*x = UpdateCertificateOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -885,7 +997,7 @@ func (x *UpdateCertificateOverrideRequest) String() string {
 func (*UpdateCertificateOverrideRequest) ProtoMessage() {}
 
 func (x *UpdateCertificateOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[10]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1011,7 +1123,7 @@ type UpdateCertificateOverrideResponse struct {
 
 func (x *UpdateCertificateOverrideResponse) Reset() {
 	*x = UpdateCertificateOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1023,7 +1135,7 @@ func (x *UpdateCertificateOverrideResponse) String() string {
 func (*UpdateCertificateOverrideResponse) ProtoMessage() {}
 
 func (x *UpdateCertificateOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[11]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1082,7 +1194,7 @@ type RemoveCertificateOverrideRequest struct {
 
 func (x *RemoveCertificateOverrideRequest) Reset() {
 	*x = RemoveCertificateOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1094,7 +1206,7 @@ func (x *RemoveCertificateOverrideRequest) String() string {
 func (*RemoveCertificateOverrideRequest) ProtoMessage() {}
 
 func (x *RemoveCertificateOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[12]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1168,7 +1280,7 @@ type RemoveCertificateOverrideResponse struct {
 
 func (x *RemoveCertificateOverrideResponse) Reset() {
 	*x = RemoveCertificateOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1180,7 +1292,7 @@ func (x *RemoveCertificateOverrideResponse) String() string {
 func (*RemoveCertificateOverrideResponse) ProtoMessage() {}
 
 func (x *RemoveCertificateOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[13]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1213,7 +1325,7 @@ type GetCertAuthorityOverrideRequest struct {
 
 func (x *GetCertAuthorityOverrideRequest) Reset() {
 	*x = GetCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1225,7 +1337,7 @@ func (x *GetCertAuthorityOverrideRequest) String() string {
 func (*GetCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *GetCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[14]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1283,7 +1395,7 @@ type GetCertAuthorityOverrideResponse struct {
 
 func (x *GetCertAuthorityOverrideResponse) Reset() {
 	*x = GetCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1295,7 +1407,7 @@ func (x *GetCertAuthorityOverrideResponse) String() string {
 func (*GetCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *GetCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[15]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1354,7 +1466,7 @@ type ListCertAuthorityOverrideRequest struct {
 
 func (x *ListCertAuthorityOverrideRequest) Reset() {
 	*x = ListCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1366,7 +1478,7 @@ func (x *ListCertAuthorityOverrideRequest) String() string {
 func (*ListCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *ListCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[16]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1429,7 +1541,7 @@ type ListCertAuthorityOverrideResponse struct {
 
 func (x *ListCertAuthorityOverrideResponse) Reset() {
 	*x = ListCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1441,7 +1553,7 @@ func (x *ListCertAuthorityOverrideResponse) String() string {
 func (*ListCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *ListCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[17]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1506,7 +1618,7 @@ type DeleteCertAuthorityOverrideRequest struct {
 
 func (x *DeleteCertAuthorityOverrideRequest) Reset() {
 	*x = DeleteCertAuthorityOverrideRequest{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1518,7 +1630,7 @@ func (x *DeleteCertAuthorityOverrideRequest) String() string {
 func (*DeleteCertAuthorityOverrideRequest) ProtoMessage() {}
 
 func (x *DeleteCertAuthorityOverrideRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[18]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1593,7 +1705,7 @@ type DeleteCertAuthorityOverrideResponse struct {
 
 func (x *DeleteCertAuthorityOverrideResponse) Reset() {
 	*x = DeleteCertAuthorityOverrideResponse{}
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1605,7 +1717,7 @@ func (x *DeleteCertAuthorityOverrideResponse) String() string {
 func (*DeleteCertAuthorityOverrideResponse) ProtoMessage() {}
 
 func (x *DeleteCertAuthorityOverrideResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[19]
+	mi := &file_teleport_subca_v1_subca_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1632,13 +1744,19 @@ var File_teleport_subca_v1_subca_service_proto protoreflect.FileDescriptor
 
 const file_teleport_subca_v1_subca_service_proto_rawDesc = "" +
 	"\n" +
-	"%teleport/subca/v1/subca_service.proto\x12\x11teleport.subca.v1\x1a google/protobuf/field_mask.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a2teleport/subca/v1/cert_authority_override_id.proto\x1a,teleport/subca/v1/certificate_override.proto\x1a/teleport/subca/v1/certificate_override_id.proto\x1a\x1bteleport/subca/v1/csr.proto\x1a*teleport/subca/v1/distinguished_name.proto\x1a'teleport/subca/v1/public_key_hash.proto\"\xc2\x01\n" +
+	"%teleport/subca/v1/subca_service.proto\x12\x11teleport.subca.v1\x1a google/protobuf/field_mask.proto\x1a/teleport/subca/v1/cert_authority_override.proto\x1a2teleport/subca/v1/cert_authority_override_id.proto\x1a,teleport/subca/v1/certificate_override.proto\x1a/teleport/subca/v1/certificate_override_id.proto\x1a\x1bteleport/subca/v1/csr.proto\x1a*teleport/subca/v1/distinguished_name.proto\x1a'teleport/subca/v1/public_key_hash.proto\"\xe1\x01\n" +
 	"\x10CreateCSRRequest\x12\x17\n" +
 	"\aca_type\x18\x01 \x01(\tR\x06caType\x12H\n" +
 	"\x0fpublic_key_hash\x18\x02 \x01(\v2 .teleport.subca.v1.PublicKeyHashR\rpublicKeyHash\x12K\n" +
-	"\x0ecustom_subject\x18\x03 \x01(\v2$.teleport.subca.v1.DistinguishedNameR\rcustomSubject\"U\n" +
+	"\x0ecustom_subject\x18\x03 \x01(\v2$.teleport.subca.v1.DistinguishedNameR\rcustomSubject\x12\x1d\n" +
+	"\n" +
+	"local_only\x18\x04 \x01(\bR\tlocalOnly\"\x96\x01\n" +
 	"\x11CreateCSRResponse\x12@\n" +
-	"\x04csrs\x18\x01 \x03(\v2,.teleport.subca.v1.CertificateSigningRequestR\x04csrs\"o\n" +
+	"\x04csrs\x18\x01 \x03(\v2,.teleport.subca.v1.CertificateSigningRequestR\x04csrs\x12?\n" +
+	"\bwarnings\x18\x02 \x03(\v2#.teleport.subca.v1.CreateCSRWarningR\bwarnings\"]\n" +
+	"\x10CreateCSRWarning\x12!\n" +
+	"\fuser_message\x18\x01 \x01(\tR\vuserMessage\x12&\n" +
+	"\x0fpublic_key_hash\x18\x02 \x01(\tR\rpublicKeyHash\"o\n" +
 	"\"CreateCertAuthorityOverrideRequest\x12I\n" +
 	"\vca_override\x18\x01 \x01(\v2(.teleport.subca.v1.CertAuthorityOverrideR\n" +
 	"caOverride\"p\n" +
@@ -1706,84 +1824,86 @@ const file_teleport_subca_v1_subca_service_proto_rawDesc = "" +
 	"\x19ListCertAuthorityOverride\x123.teleport.subca.v1.ListCertAuthorityOverrideRequest\x1a4.teleport.subca.v1.ListCertAuthorityOverrideResponse\x12\x8c\x01\n" +
 	"\x1bDeleteCertAuthorityOverride\x125.teleport.subca.v1.DeleteCertAuthorityOverrideRequest\x1a6.teleport.subca.v1.DeleteCertAuthorityOverrideResponseBNZLgithub.com/gravitational/teleport/api/gen/proto/go/teleport/subca/v1;subcav1b\x06proto3"
 
-var file_teleport_subca_v1_subca_service_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
+var file_teleport_subca_v1_subca_service_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
 var file_teleport_subca_v1_subca_service_proto_goTypes = []any{
 	(*CreateCSRRequest)(nil),                    // 0: teleport.subca.v1.CreateCSRRequest
 	(*CreateCSRResponse)(nil),                   // 1: teleport.subca.v1.CreateCSRResponse
-	(*CreateCertAuthorityOverrideRequest)(nil),  // 2: teleport.subca.v1.CreateCertAuthorityOverrideRequest
-	(*CreateCertAuthorityOverrideResponse)(nil), // 3: teleport.subca.v1.CreateCertAuthorityOverrideResponse
-	(*UpdateCertAuthorityOverrideRequest)(nil),  // 4: teleport.subca.v1.UpdateCertAuthorityOverrideRequest
-	(*UpdateCertAuthorityOverrideResponse)(nil), // 5: teleport.subca.v1.UpdateCertAuthorityOverrideResponse
-	(*UpsertCertAuthorityOverrideRequest)(nil),  // 6: teleport.subca.v1.UpsertCertAuthorityOverrideRequest
-	(*UpsertCertAuthorityOverrideResponse)(nil), // 7: teleport.subca.v1.UpsertCertAuthorityOverrideResponse
-	(*AddCertificateOverrideRequest)(nil),       // 8: teleport.subca.v1.AddCertificateOverrideRequest
-	(*AddCertificateOverrideResponse)(nil),      // 9: teleport.subca.v1.AddCertificateOverrideResponse
-	(*UpdateCertificateOverrideRequest)(nil),    // 10: teleport.subca.v1.UpdateCertificateOverrideRequest
-	(*UpdateCertificateOverrideResponse)(nil),   // 11: teleport.subca.v1.UpdateCertificateOverrideResponse
-	(*RemoveCertificateOverrideRequest)(nil),    // 12: teleport.subca.v1.RemoveCertificateOverrideRequest
-	(*RemoveCertificateOverrideResponse)(nil),   // 13: teleport.subca.v1.RemoveCertificateOverrideResponse
-	(*GetCertAuthorityOverrideRequest)(nil),     // 14: teleport.subca.v1.GetCertAuthorityOverrideRequest
-	(*GetCertAuthorityOverrideResponse)(nil),    // 15: teleport.subca.v1.GetCertAuthorityOverrideResponse
-	(*ListCertAuthorityOverrideRequest)(nil),    // 16: teleport.subca.v1.ListCertAuthorityOverrideRequest
-	(*ListCertAuthorityOverrideResponse)(nil),   // 17: teleport.subca.v1.ListCertAuthorityOverrideResponse
-	(*DeleteCertAuthorityOverrideRequest)(nil),  // 18: teleport.subca.v1.DeleteCertAuthorityOverrideRequest
-	(*DeleteCertAuthorityOverrideResponse)(nil), // 19: teleport.subca.v1.DeleteCertAuthorityOverrideResponse
-	(*PublicKeyHash)(nil),                       // 20: teleport.subca.v1.PublicKeyHash
-	(*DistinguishedName)(nil),                   // 21: teleport.subca.v1.DistinguishedName
-	(*CertificateSigningRequest)(nil),           // 22: teleport.subca.v1.CertificateSigningRequest
-	(*CertAuthorityOverride)(nil),               // 23: teleport.subca.v1.CertAuthorityOverride
-	(*CertAuthorityOverrideID)(nil),             // 24: teleport.subca.v1.CertAuthorityOverrideID
-	(*CertificateOverride)(nil),                 // 25: teleport.subca.v1.CertificateOverride
-	(*fieldmaskpb.FieldMask)(nil),               // 26: google.protobuf.FieldMask
-	(*CertificateOverrideID)(nil),               // 27: teleport.subca.v1.CertificateOverrideID
+	(*CreateCSRWarning)(nil),                    // 2: teleport.subca.v1.CreateCSRWarning
+	(*CreateCertAuthorityOverrideRequest)(nil),  // 3: teleport.subca.v1.CreateCertAuthorityOverrideRequest
+	(*CreateCertAuthorityOverrideResponse)(nil), // 4: teleport.subca.v1.CreateCertAuthorityOverrideResponse
+	(*UpdateCertAuthorityOverrideRequest)(nil),  // 5: teleport.subca.v1.UpdateCertAuthorityOverrideRequest
+	(*UpdateCertAuthorityOverrideResponse)(nil), // 6: teleport.subca.v1.UpdateCertAuthorityOverrideResponse
+	(*UpsertCertAuthorityOverrideRequest)(nil),  // 7: teleport.subca.v1.UpsertCertAuthorityOverrideRequest
+	(*UpsertCertAuthorityOverrideResponse)(nil), // 8: teleport.subca.v1.UpsertCertAuthorityOverrideResponse
+	(*AddCertificateOverrideRequest)(nil),       // 9: teleport.subca.v1.AddCertificateOverrideRequest
+	(*AddCertificateOverrideResponse)(nil),      // 10: teleport.subca.v1.AddCertificateOverrideResponse
+	(*UpdateCertificateOverrideRequest)(nil),    // 11: teleport.subca.v1.UpdateCertificateOverrideRequest
+	(*UpdateCertificateOverrideResponse)(nil),   // 12: teleport.subca.v1.UpdateCertificateOverrideResponse
+	(*RemoveCertificateOverrideRequest)(nil),    // 13: teleport.subca.v1.RemoveCertificateOverrideRequest
+	(*RemoveCertificateOverrideResponse)(nil),   // 14: teleport.subca.v1.RemoveCertificateOverrideResponse
+	(*GetCertAuthorityOverrideRequest)(nil),     // 15: teleport.subca.v1.GetCertAuthorityOverrideRequest
+	(*GetCertAuthorityOverrideResponse)(nil),    // 16: teleport.subca.v1.GetCertAuthorityOverrideResponse
+	(*ListCertAuthorityOverrideRequest)(nil),    // 17: teleport.subca.v1.ListCertAuthorityOverrideRequest
+	(*ListCertAuthorityOverrideResponse)(nil),   // 18: teleport.subca.v1.ListCertAuthorityOverrideResponse
+	(*DeleteCertAuthorityOverrideRequest)(nil),  // 19: teleport.subca.v1.DeleteCertAuthorityOverrideRequest
+	(*DeleteCertAuthorityOverrideResponse)(nil), // 20: teleport.subca.v1.DeleteCertAuthorityOverrideResponse
+	(*PublicKeyHash)(nil),                       // 21: teleport.subca.v1.PublicKeyHash
+	(*DistinguishedName)(nil),                   // 22: teleport.subca.v1.DistinguishedName
+	(*CertificateSigningRequest)(nil),           // 23: teleport.subca.v1.CertificateSigningRequest
+	(*CertAuthorityOverride)(nil),               // 24: teleport.subca.v1.CertAuthorityOverride
+	(*CertAuthorityOverrideID)(nil),             // 25: teleport.subca.v1.CertAuthorityOverrideID
+	(*CertificateOverride)(nil),                 // 26: teleport.subca.v1.CertificateOverride
+	(*fieldmaskpb.FieldMask)(nil),               // 27: google.protobuf.FieldMask
+	(*CertificateOverrideID)(nil),               // 28: teleport.subca.v1.CertificateOverrideID
 }
 var file_teleport_subca_v1_subca_service_proto_depIdxs = []int32{
-	20, // 0: teleport.subca.v1.CreateCSRRequest.public_key_hash:type_name -> teleport.subca.v1.PublicKeyHash
-	21, // 1: teleport.subca.v1.CreateCSRRequest.custom_subject:type_name -> teleport.subca.v1.DistinguishedName
-	22, // 2: teleport.subca.v1.CreateCSRResponse.csrs:type_name -> teleport.subca.v1.CertificateSigningRequest
-	23, // 3: teleport.subca.v1.CreateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 4: teleport.subca.v1.CreateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 5: teleport.subca.v1.UpdateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 6: teleport.subca.v1.UpdateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 7: teleport.subca.v1.UpsertCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 8: teleport.subca.v1.UpsertCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	24, // 9: teleport.subca.v1.AddCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	25, // 10: teleport.subca.v1.AddCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	25, // 11: teleport.subca.v1.AddCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	24, // 12: teleport.subca.v1.UpdateCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	25, // 13: teleport.subca.v1.UpdateCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	26, // 14: teleport.subca.v1.UpdateCertificateOverrideRequest.update_mask:type_name -> google.protobuf.FieldMask
-	25, // 15: teleport.subca.v1.UpdateCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
-	27, // 16: teleport.subca.v1.RemoveCertificateOverrideRequest.certificate_override_id:type_name -> teleport.subca.v1.CertificateOverrideID
-	24, // 17: teleport.subca.v1.GetCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	23, // 18: teleport.subca.v1.GetCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
-	23, // 19: teleport.subca.v1.ListCertAuthorityOverrideResponse.ca_overrides:type_name -> teleport.subca.v1.CertAuthorityOverride
-	24, // 20: teleport.subca.v1.DeleteCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
-	0,  // 21: teleport.subca.v1.SubCAService.CreateCSR:input_type -> teleport.subca.v1.CreateCSRRequest
-	2,  // 22: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:input_type -> teleport.subca.v1.CreateCertAuthorityOverrideRequest
-	4,  // 23: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:input_type -> teleport.subca.v1.UpdateCertAuthorityOverrideRequest
-	6,  // 24: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:input_type -> teleport.subca.v1.UpsertCertAuthorityOverrideRequest
-	8,  // 25: teleport.subca.v1.SubCAService.AddCertificateOverride:input_type -> teleport.subca.v1.AddCertificateOverrideRequest
-	10, // 26: teleport.subca.v1.SubCAService.UpdateCertificateOverride:input_type -> teleport.subca.v1.UpdateCertificateOverrideRequest
-	12, // 27: teleport.subca.v1.SubCAService.RemoveCertificateOverride:input_type -> teleport.subca.v1.RemoveCertificateOverrideRequest
-	14, // 28: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:input_type -> teleport.subca.v1.GetCertAuthorityOverrideRequest
-	16, // 29: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:input_type -> teleport.subca.v1.ListCertAuthorityOverrideRequest
-	18, // 30: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:input_type -> teleport.subca.v1.DeleteCertAuthorityOverrideRequest
-	1,  // 31: teleport.subca.v1.SubCAService.CreateCSR:output_type -> teleport.subca.v1.CreateCSRResponse
-	3,  // 32: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:output_type -> teleport.subca.v1.CreateCertAuthorityOverrideResponse
-	5,  // 33: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:output_type -> teleport.subca.v1.UpdateCertAuthorityOverrideResponse
-	7,  // 34: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:output_type -> teleport.subca.v1.UpsertCertAuthorityOverrideResponse
-	9,  // 35: teleport.subca.v1.SubCAService.AddCertificateOverride:output_type -> teleport.subca.v1.AddCertificateOverrideResponse
-	11, // 36: teleport.subca.v1.SubCAService.UpdateCertificateOverride:output_type -> teleport.subca.v1.UpdateCertificateOverrideResponse
-	13, // 37: teleport.subca.v1.SubCAService.RemoveCertificateOverride:output_type -> teleport.subca.v1.RemoveCertificateOverrideResponse
-	15, // 38: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:output_type -> teleport.subca.v1.GetCertAuthorityOverrideResponse
-	17, // 39: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:output_type -> teleport.subca.v1.ListCertAuthorityOverrideResponse
-	19, // 40: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:output_type -> teleport.subca.v1.DeleteCertAuthorityOverrideResponse
-	31, // [31:41] is the sub-list for method output_type
-	21, // [21:31] is the sub-list for method input_type
-	21, // [21:21] is the sub-list for extension type_name
-	21, // [21:21] is the sub-list for extension extendee
-	0,  // [0:21] is the sub-list for field type_name
+	21, // 0: teleport.subca.v1.CreateCSRRequest.public_key_hash:type_name -> teleport.subca.v1.PublicKeyHash
+	22, // 1: teleport.subca.v1.CreateCSRRequest.custom_subject:type_name -> teleport.subca.v1.DistinguishedName
+	23, // 2: teleport.subca.v1.CreateCSRResponse.csrs:type_name -> teleport.subca.v1.CertificateSigningRequest
+	2,  // 3: teleport.subca.v1.CreateCSRResponse.warnings:type_name -> teleport.subca.v1.CreateCSRWarning
+	24, // 4: teleport.subca.v1.CreateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 5: teleport.subca.v1.CreateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 6: teleport.subca.v1.UpdateCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 7: teleport.subca.v1.UpdateCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 8: teleport.subca.v1.UpsertCertAuthorityOverrideRequest.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 9: teleport.subca.v1.UpsertCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	25, // 10: teleport.subca.v1.AddCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	26, // 11: teleport.subca.v1.AddCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	26, // 12: teleport.subca.v1.AddCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	25, // 13: teleport.subca.v1.UpdateCertificateOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	26, // 14: teleport.subca.v1.UpdateCertificateOverrideRequest.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	27, // 15: teleport.subca.v1.UpdateCertificateOverrideRequest.update_mask:type_name -> google.protobuf.FieldMask
+	26, // 16: teleport.subca.v1.UpdateCertificateOverrideResponse.certificate_override:type_name -> teleport.subca.v1.CertificateOverride
+	28, // 17: teleport.subca.v1.RemoveCertificateOverrideRequest.certificate_override_id:type_name -> teleport.subca.v1.CertificateOverrideID
+	25, // 18: teleport.subca.v1.GetCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	24, // 19: teleport.subca.v1.GetCertAuthorityOverrideResponse.ca_override:type_name -> teleport.subca.v1.CertAuthorityOverride
+	24, // 20: teleport.subca.v1.ListCertAuthorityOverrideResponse.ca_overrides:type_name -> teleport.subca.v1.CertAuthorityOverride
+	25, // 21: teleport.subca.v1.DeleteCertAuthorityOverrideRequest.ca_id:type_name -> teleport.subca.v1.CertAuthorityOverrideID
+	0,  // 22: teleport.subca.v1.SubCAService.CreateCSR:input_type -> teleport.subca.v1.CreateCSRRequest
+	3,  // 23: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:input_type -> teleport.subca.v1.CreateCertAuthorityOverrideRequest
+	5,  // 24: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:input_type -> teleport.subca.v1.UpdateCertAuthorityOverrideRequest
+	7,  // 25: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:input_type -> teleport.subca.v1.UpsertCertAuthorityOverrideRequest
+	9,  // 26: teleport.subca.v1.SubCAService.AddCertificateOverride:input_type -> teleport.subca.v1.AddCertificateOverrideRequest
+	11, // 27: teleport.subca.v1.SubCAService.UpdateCertificateOverride:input_type -> teleport.subca.v1.UpdateCertificateOverrideRequest
+	13, // 28: teleport.subca.v1.SubCAService.RemoveCertificateOverride:input_type -> teleport.subca.v1.RemoveCertificateOverrideRequest
+	15, // 29: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:input_type -> teleport.subca.v1.GetCertAuthorityOverrideRequest
+	17, // 30: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:input_type -> teleport.subca.v1.ListCertAuthorityOverrideRequest
+	19, // 31: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:input_type -> teleport.subca.v1.DeleteCertAuthorityOverrideRequest
+	1,  // 32: teleport.subca.v1.SubCAService.CreateCSR:output_type -> teleport.subca.v1.CreateCSRResponse
+	4,  // 33: teleport.subca.v1.SubCAService.CreateCertAuthorityOverride:output_type -> teleport.subca.v1.CreateCertAuthorityOverrideResponse
+	6,  // 34: teleport.subca.v1.SubCAService.UpdateCertAuthorityOverride:output_type -> teleport.subca.v1.UpdateCertAuthorityOverrideResponse
+	8,  // 35: teleport.subca.v1.SubCAService.UpsertCertAuthorityOverride:output_type -> teleport.subca.v1.UpsertCertAuthorityOverrideResponse
+	10, // 36: teleport.subca.v1.SubCAService.AddCertificateOverride:output_type -> teleport.subca.v1.AddCertificateOverrideResponse
+	12, // 37: teleport.subca.v1.SubCAService.UpdateCertificateOverride:output_type -> teleport.subca.v1.UpdateCertificateOverrideResponse
+	14, // 38: teleport.subca.v1.SubCAService.RemoveCertificateOverride:output_type -> teleport.subca.v1.RemoveCertificateOverrideResponse
+	16, // 39: teleport.subca.v1.SubCAService.GetCertAuthorityOverride:output_type -> teleport.subca.v1.GetCertAuthorityOverrideResponse
+	18, // 40: teleport.subca.v1.SubCAService.ListCertAuthorityOverride:output_type -> teleport.subca.v1.ListCertAuthorityOverrideResponse
+	20, // 41: teleport.subca.v1.SubCAService.DeleteCertAuthorityOverride:output_type -> teleport.subca.v1.DeleteCertAuthorityOverrideResponse
+	32, // [32:42] is the sub-list for method output_type
+	22, // [22:32] is the sub-list for method input_type
+	22, // [22:22] is the sub-list for extension type_name
+	22, // [22:22] is the sub-list for extension extendee
+	0,  // [0:22] is the sub-list for field type_name
 }
 
 func init() { file_teleport_subca_v1_subca_service_proto_init() }
@@ -1804,7 +1924,7 @@ func file_teleport_subca_v1_subca_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_subca_v1_subca_service_proto_rawDesc), len(file_teleport_subca_v1_subca_service_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   20,
+			NumMessages:   21,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

api/proto/teleport/legacy/client/proto/event.proto

@@ -43,6 +43,7 @@ import "teleport/scopes/access/v1/assignment.proto";
 import "teleport/scopes/access/v1/role.proto";
 import "teleport/secreports/v1/secreports.proto";
 import "teleport/subca/v1/cert_authority_override.proto";
+import "teleport/subca/v1/pending_csr_request.proto";
 import "teleport/summarizer/v1/summarizer.proto";
 import "teleport/userloginstate/v1/userloginstate.proto";
 import "teleport/userprovisioning/v2/statichostuser.proto";
@@ -268,5 +269,8 @@ message Event {
     teleport.beams.v1.BeamsConfig BeamsConfig = 97;
     // Classifier is a resource for defining session summarization classifiers.
     teleport.summarizer.v1.Classifier Classifier = 98;
+    // PendingCSRRequest allows asynchronous, watcher-based CSR requests to
+    // other Auth server instances.
+    teleport.subca.v1.PendingCSRRequest PendingCSRRequest = 99;
   }
 }

api/proto/teleport/subca/v1/cert_authority_override.proto

@@ -31,7 +31,7 @@ option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport
 // self-signed root).
 //
 // Key material is never impacted by overrides, only certificates can be
-// overriden.
+// overridden.
 //
 // https://github.com/gravitational/teleport/blob/master/rfd/0237-sub-ca-support.md
 message CertAuthorityOverride {
@@ -63,5 +63,9 @@ message CertAuthorityOverrideSpec {
 message CertAuthorityOverrideStatus {
   // CRLs generated for each certificate override, keyed by normalized/lowercase
   // public_key_hash.
+  //
+  // CRLs for disabled overrides may be created asynchronously, using
+  // CertAuthorityOverride watchers, if the Auth server performing the writes
+  // lacks access to certain keys.
   map<string, CertificateRevocationList> public_key_hash_to_crl = 1;
 }

api/proto/teleport/subca/v1/certificate_override.proto

@@ -56,5 +56,8 @@ message CertificateOverride {
   // A disabled override may exist for recording purposes, to be enabled later,
   // or simply to mark a certain public key as not overridden. In the latter
   // case the certificate may be absent.
+  //
+  // Disabled overrides allow CRLs to be created asynchronously, using
+  // CertAuthorityOverride watchers.
   bool disabled = 4;
 }

api/proto/teleport/subca/v1/pending_csr_request.proto

@@ -0,0 +1,79 @@
+// Copyright 2026 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.subca.v1;
+
+import "google/rpc/status.proto";
+import "teleport/header/v1/metadata.proto";
+import "teleport/subca/v1/csr.proto";
+import "teleport/subca/v1/distinguished_name.proto";
+import "teleport/subca/v1/public_key_hash.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/subca/v1;subcav1";
+
+// A pending CSR request, created as part of a CreateCSR invocation on
+// multi-Auth, multi-HSM clusters.
+//
+// Requests are registered by the requester Auth server (the one processing the
+// CreateCSR call), in multi-HSM scenarios, when certain keys can't be used.
+// Auth servers watch PendingCSRRequest resources and fulfill requests
+// automatically, assigning a CSR and status to the corresponding PendingCSR
+// message. Once all pending CSRs have a terminal result, the RPC resumes.
+//
+// PendingCSRRequest are system-managed, "UncollectedKind" resources. They are
+// not user visible.
+message PendingCSRRequest {
+  // Kind is "pending_csr_request".
+  string kind = 1;
+  // Sub kind is unused.
+  string sub_kind = 2;
+  // Version is "v1".
+  string version = 3;
+  // Metadata for the resource.
+  // The name of the resource is the request identifier.
+  teleport.header.v1.Metadata metadata = 4;
+  // Spec for the resource.
+  PendingCSRRequestSpec spec = 5;
+  // Status for the resource.
+  PendingCSRRequestStatus status = 6;
+}
+
+// Spec of a [PendingCSRRequest] resource.
+message PendingCSRRequestSpec {
+  // Cluster of the CSR request.
+  string cluster_name = 1;
+  // CA type of the CSR request.
+  string ca_type = 2;
+  // Custom subject for the CSRs.
+  // Optional.
+  DistinguishedName custom_subject = 3;
+  // Public key hashes of the requested CSRs.
+  repeated PublicKeyHash public_key_hashes = 4;
+}
+
+// Status of a [PendingCSRRequest] resource.
+message PendingCSRRequestStatus {
+  // Fulfilled pending CSR requests.
+  map<string, PendingCSR> public_key_hash_to_pending_csr = 1;
+}
+
+// A pending CSR, to be fulfilled as part of a [PendingCSRRequest].
+message PendingCSR {
+  // Status of the CSR signing attempt.
+  google.rpc.Status status = 1;
+  // The CSR itself. Non-nil if status is OK.
+  CertificateSigningRequest csr = 2;
+}

api/proto/teleport/subca/v1/subca_service.proto

@@ -51,11 +51,17 @@ service SubCAService {
   // CreateCSR creates certificate signing requests for all certificates of the
   // specified CA, in preparation for the creation of a CertAuthorityOverride.
   //
-  // On clusters that use HSMs this must be called on every Auth server
-  // instance, so it every private key is covered. Each Auth issues CSRs for all
-  // the private keys it holds.
+  // On clusters where Auth server instances have access to distinct keys
+  // (multi-Auth, multi-HSM), CreateCSR attempts to collect CSRs from all Auth
+  // servers using PendingCSRRequest watchers. Attempts are gated by a timeout.
+  // If the timeout expires, the RPC returns as many CSRs as it managed to
+  // collect.
   //
-  // CreateCSR requires cert_authority_override:read+list permissions.
+  // If local_only is set, the request will not fan out to other Auth servers;
+  // instead it will use local keys. In this case, each Auth server must be
+  // contacted independently to create their corresponding CSRs.
+  //
+  // CreateCSR requires cert_authority_override:create+update permissions.
   rpc CreateCSR(CreateCSRRequest) returns (CreateCSRResponse);
 
   // CreateCertAuthorityOverride creates a CertAuthorityOverride resource.
@@ -80,7 +86,7 @@ service SubCAService {
   // value of CertificateOverride.disabled. See it for reference.
   rpc UpsertCertAuthorityOverride(UpsertCertAuthorityOverrideRequest) returns (UpsertCertAuthorityOverrideResponse);
 
-  // AddCertificateOverride adds a single CertiticateOverride to a
+  // AddCertificateOverride adds a single CertificateOverride to a
   // CertAuthorityOverride resource.
   //
   // The CertAuthorityOverride resource may be created as a consequence of this
@@ -90,14 +96,14 @@ service SubCAService {
   // value of CertificateOverride.disabled. See it for reference.
   rpc AddCertificateOverride(AddCertificateOverrideRequest) returns (AddCertificateOverrideResponse);
 
-  // UpdateCertificateOverride updates a single CertiticateOverride in a
+  // UpdateCertificateOverride updates a single CertificateOverride in a
   // CertAuthorityOverride resource.
   //
   // Disabling an active override is disallowed. See
   // UpdateCertificateOverrideRequest.force_immediate_disable.
   rpc UpdateCertificateOverride(UpdateCertificateOverrideRequest) returns (UpdateCertificateOverrideResponse);
 
-  // RemoveCertificateOverride removes a single CertiticateOverride inside a
+  // RemoveCertificateOverride removes a single CertificateOverride inside a
   // CertAuthorityOverride resource.
   //
   // If the last CertificateOverride of a CertAuthorityOverride is removed as a
@@ -145,12 +151,31 @@ message CreateCSRRequest {
   //
   // Optional. If present the request must target a single certificate.
   DistinguishedName custom_subject = 3;
+
+  // If true, don't fan out CSR requests of unusable private keys to other Auth
+  // servers.
+  bool local_only = 4;
 }
 
 // Response for CreateCSR.
+//
+// A successful response contains at least one CSR and zero or more warnings.
+// If the server is incapable of returning any CSRs the response will be an
+// error (instead of a CreateCSRResponse).
 message CreateCSRResponse {
   // Created CSRs.
   repeated CertificateSigningRequest csrs = 1;
+  // Warnings about missing/skipped CSRs.
+  repeated CreateCSRWarning warnings = 2;
+}
+
+// A warning returned as part of a CreateCSRResponse.
+message CreateCSRWarning {
+  // The end-user warning message.
+  string user_message = 1;
+  // Public key hash of the certificate/public key that generated the warning.
+  // Empty if not applicable.
+  string public_key_hash = 2;
 }
 
 // Request for CreateCertAuthorityOverride.