Add allowRequesterSpecifiedNotBeforeTime to CaPool and requestedNotBeforeTime to Certificate

[nat-hill]

Description

This PR adds support for two new flags related to certificate backdating in the Private CA product:

1. allow_requester_specified_not_before_time in google_privateca_ca_pool: Allows configuring a CA pool to permit requesters to specify the not_before_time in certificate requests.
2. requested_not_before_time in google_privateca_certificate: Allows specifying a custom not_before_time when requesting a certificate (requires the pool to have allow_requester_specified_not_before_time enabled).

Key Changes

• Added field definitions to CaPool.yaml and Certificate.yaml.
• Created a single-step acceptance test (privateca_certificate_with_requested_not_before_time).
• Used time_static resource with a depends_on block in the test config to ensure the timestamp is dynamically set after the Certificate Authority is created, satisfying the API CA not_before_time restriction.
• Fixed a bug in custom flatteners (privateca_certificate_509_config.go.tmpl and privateca_certificate_template_509_config.go.tmpl) where they returned an empty map instead of nil when input was nil, which was blocking my test.

📋 Checklist

• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Generated Terraform providers, and ran make test and make lint in the generated providers to ensure it passes unit and linter tests.
• Ran relevant acceptance tests using my own Google Cloud project and credentials.
• Read the Release Notes Guide before writing my release note below.
• [ ]

🚀 Release Note Template for Downstream PRs

privateca: added `allow_requester_specified_not_before_time` field to `google_privateca_ca_pool` resource

privateca: added `requested_not_before_time` field to `google_privateca_certificate` resource

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@SirGitsalot, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 5ce61c4:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	9 files changed, 334 insertions(+), 4 deletions(-)
google-beta provider	View Diff	9 files changed, 334 insertions(+), 4 deletions(-)
terraform-google-conversion	View Diff	10 files changed, 77 insertions(+), 3 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
46	37	8	1

Affected Service Packages

• privateca

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccPrivatecaCertificate_privatecaCertificateWithRequestedNotBeforeTimeExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	❌ Error · Log	TestAccPrivatecaCertificate_privatecaCertificateWithRequestedNotBeforeTimeExample

Caution

Issues requiring attention before PR completion

🔴 Replaying Rerun Failed: Some tests failed due to non-determinism when VCR replayed the response. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@nat-hill, @SirGitsalot VCR tests complete for 5ce61c4!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 31ff088:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	9 files changed, 335 insertions(+), 4 deletions(-)
google-beta provider	View Diff	9 files changed, 335 insertions(+), 4 deletions(-)
terraform-google-conversion	View Diff	10 files changed, 77 insertions(+), 3 deletions(-)

Test report

Important

Manual Verification Required

VCR cannot automatically execute the following tests added in this PR. Please verify them manually:

🔴 TestAccPrivatecaCertificate_privatecaCertificateWithRequestedNotBeforeTimeExample

Analytics

Total Tests	Passed	Skipped	Affected
46	37	9	0

Affected Service Packages

• privateca

Learn how VCR tests work

---

Step 1: Replaying Mode

🟢 All tests passed in Replaying mode! No Recording was needed.

Caution

Issues requiring attention before PR completion

🔴 Manual Verification Required: New tests were added that are skipped in presubmit tests. See the "Manual Verification Required" section at the top for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the replaying VCR build log

@nat-hill, @SirGitsalot VCR tests complete for 31ff088!