# CfnCertificateProps

Properties for defining a `CfnCertificate`.

Extends: CfnCertificateProps
Used as props by: CfnCertificate

- Source: Generated code
- Type last changed: v2.227.0 · 21 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_acmpca as acmpca } from 'aws-cdk-lib';
const cfnCertificateProps: acmpca.CfnCertificateProps = {
  certificateAuthorityArn: 'certificateAuthorityArn',
  certificateSigningRequest: 'certificateSigningRequest',
  signingAlgorithm: 'signingAlgorithm',
  validity: {
    type: 'type',
    value: 123,
  },

  // the properties below are optional
  apiPassthrough: {
    extensions: {
      certificatePolicies: [{
        certPolicyId: 'certPolicyId',

        // the properties below are optional
        policyQualifiers: [{
          policyQualifierId: 'policyQualifierId',
          qualifier: {
            cpsUri: 'cpsUri',
          },
        }],
      }],
      customExtensions: [{
        objectIdentifier: 'objectIdentifier',
        value: 'value',

        // the properties below are optional
        critical: false,
      }],
      extendedKeyUsage: [{
        extendedKeyUsageObjectIdentifier: 'extendedKeyUsageObjectIdentifier',
        extendedKeyUsageType: 'extendedKeyUsageType',
      }],
      keyUsage: {
        crlSign: false,
        dataEncipherment: false,
        decipherOnly: false,
        digitalSignature: false,
        encipherOnly: false,
        keyAgreement: false,
        keyCertSign: false,
        keyEncipherment: false,
        nonRepudiation: false,
      },
      subjectAlternativeNames: [{
        directoryName: {
          commonName: 'commonName',
          country: 'country',
          customAttributes: [{
            objectIdentifier: 'objectIdentifier',
            value: 'value',
          }],
          distinguishedNameQualifier: 'distinguishedNameQualifier',
          generationQualifier: 'generationQualifier',
          givenName: 'givenName',
          initials: 'initials',
          locality: 'locality',
          organization: 'organization',
          organizationalUnit: 'organizationalUnit',
          pseudonym: 'pseudonym',
          serialNumber: 'serialNumber',
          state: 'state',
          surname: 'surname',
          title: 'title',
        },
        dnsName: 'dnsName',
        ediPartyName: {
          nameAssigner: 'nameAssigner',
          partyName: 'partyName',
        },
        ipAddress: 'ipAddress',
        otherName: {
          typeId: 'typeId',
          value: 'value',
        },
        registeredId: 'registeredId',
        rfc822Name: 'rfc822Name',
        uniformResourceIdentifier: 'uniformResourceIdentifier',
      }],
    },
    subject: {
      commonName: 'commonName',
      country: 'country',
      customAttributes: [{
        objectIdentifier: 'objectIdentifier',
        value: 'value',
      }],
      distinguishedNameQualifier: 'distinguishedNameQualifier',
      generationQualifier: 'generationQualifier',
      givenName: 'givenName',
      initials: 'initials',
      locality: 'locality',
      organization: 'organization',
      organizationalUnit: 'organizationalUnit',
      pseudonym: 'pseudonym',
      serialNumber: 'serialNumber',
      state: 'state',
      surname: 'surname',
      title: 'title',
    },
  },
  templateArn: 'templateArn',
  validityNotBefore: {
    type: 'type',
    value: 123,
  },
};
```

## Properties

- `apiPassthrough`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnCertificate.ApiPassthroughProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.ApiPassthroughProperty.html) — Specifies X.509 certificate information to be included in the issued certificate. An `APIPassthrough` or `APICSRPassthrough` template variant must be selected, or else this parameter is ignored.

- `certificateAuthorityArn`: string | [ICertificateAuthorityRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_acmpca.ICertificateAuthorityRef.html) (required) — The Amazon Resource Name (ARN) for the private CA issues the certificate.

- `certificateSigningRequest`: string (required) — The certificate signing request (CSR) for the certificate.

- `signingAlgorithm`: string (required) — The name of the algorithm that will be used to sign the certificate to be issued.

  This parameter should not be confused with the `SigningAlgorithm` parameter used to sign a CSR in the `CreateCertificateAuthority` action.

  > The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key.

- `templateArn`: string | [ICertificateAuthorityRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_acmpca.ICertificateAuthorityRef.html) — Specifies a custom configuration template to use when issuing a certificate.

  If this parameter is not provided, AWS Private CA defaults to the `EndEntityCertificate/V1` template. For more information about AWS Private CA templates, see [Using Templates](https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html) .

- `validity`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnCertificate.ValidityProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.ValidityProperty.html) (required) — The period of time during which the certificate will be valid.

- `validityNotBefore`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnCertificate.ValidityProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_acmpca.CfnCertificate.ValidityProperty.html) — Information describing the start of the validity period of the certificate.

  This parameter sets the “Not Before" date for the certificate.

  By default, when issuing a certificate, AWS Private CA sets the "Not Before" date to the issuance time minus 60 minutes. This compensates for clock inconsistencies across computer systems. The `ValidityNotBefore` parameter can be used to customize the “Not Before” value.

  Unlike the `Validity` parameter, the `ValidityNotBefore` parameter is optional.

  The `ValidityNotBefore` value is expressed as an explicit date and time, using the `Validity` type value `ABSOLUTE` .