Use AWS Private CA certificate templates - AWS Private Certificate Authority

Use AWS Private CA certificate templates

AWS Private CA uses configuration templates to issue both CA certificates and end-entity certificates. When you issue a CA certificate from the PCA console, the appropriate root or subordinate CA certificate template is applied automatically.

If you use the CLI or API to issue a certificate, you can supply a template ARN as a parameter to the IssueCertificate action. If you provide no ARN, then the EndEntityCertificate/V1 template is applied by default. For more information, see the IssueCertificate API and issue-certificate command documentation.

Note

AWS Certificate Manager (ACM) users with cross-account shared access to a private CA can issue managed certificates that are signed by the CA. When you grant permission to the IssueCertificate action, you can restrict the certificate templates used for certificate issuance by adding a acm-pca:TemplateArn Condition to the policy.

For more information, see Resource-based policies.

Topics