Package software.amazon.awscdk.services.acmpca

Class CfnCertificateAuthority

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.CfnElement
software.amazon.awscdk.CfnRefElement
software.amazon.awscdk.CfnResource
software.amazon.awscdk.services.acmpca.CfnCertificateAuthority
All Implemented Interfaces:
IInspectable, ITaggable, ICertificateAuthorityRef, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
@Generated(value="jsii-pacmak/1.116.0 (build 0eddcff)", date="2025-10-24T13:34:29.994Z") @Stability(Stable) public class CfnCertificateAuthority extends CfnResource implements IInspectable, ICertificateAuthorityRef, ITaggable
Use the AWS::ACMPCA::CertificateAuthority resource to create a private CA.

Once the CA exists, you can use the AWS::ACMPCA::Certificate resource to issue a new CA certificate. Alternatively, you can issue a CA certificate using an on-premises CA, and then use the AWS::ACMPCA::CertificateAuthorityActivation resource to import the new CA certificate and activate the CA.

Before removing a AWS::ACMPCA::CertificateAuthority resource from the CloudFormation stack, disable the affected CA. Otherwise, the action will fail. You can disable the CA by removing its associated AWS::ACMPCA::CertificateAuthorityActivation resource from CloudFormation.

Example: 

 CfnCertificateAuthority cfnCertificateAuthority = CfnCertificateAuthority.Builder.create(this, "CA")
         .type("ROOT")
         .keyAlgorithm("RSA_2048")
         .signingAlgorithm("SHA256WITHRSA")
         .subject(SubjectProperty.builder()
                 .country("US")
                 .organization("string")
                 .organizationalUnit("string")
                 .distinguishedNameQualifier("string")
                 .state("string")
                 .commonName("123")
                 .serialNumber("string")
                 .locality("string")
                 .title("string")
                 .surname("string")
                 .givenName("string")
                 .initials("DG")
                 .pseudonym("string")
                 .generationQualifier("DBG")
                 .build())
         .build();

See Also:

  • Field Details

    • CFN_RESOURCE_TYPE_NAME

      @Stability(Stable) public static final String CFN_RESOURCE_TYPE_NAME
      The CloudFormation resource type name for this resource class.

  • Constructor Details

    • CfnCertificateAuthority

      protected CfnCertificateAuthority(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnCertificateAuthority

      protected CfnCertificateAuthority(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnCertificateAuthority

      @Stability(Stable) public CfnCertificateAuthority(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull CfnCertificateAuthorityProps props)
      Parameters:
      scope - Scope in which this resource is defined. This parameter is required.
      id - Construct identifier for this resource (unique in its scope). This parameter is required.
      props - Resource properties. This parameter is required.

  • Method Details

    • inspect

      @Stability(Stable) public void inspect(@NotNull TreeInspector inspector)
      Examines the CloudFormation resource and discloses attributes.

      Specified by:
      inspect in interface IInspectable
      Parameters:
      inspector - tree inspector to collect and process attributes. This parameter is required.

    • renderProperties

      @Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String,Object> props)
      Overrides:
      renderProperties in class CfnResource
      Parameters:
      props - This parameter is required.

    • getAttrArn

      @Stability(Stable) @NotNull public String getAttrArn()
      The Amazon Resource Name (ARN) for the private CA that issued the certificate.

    • getAttrCertificateSigningRequest

      @Stability(Stable) @NotNull public String getAttrCertificateSigningRequest()
      The Base64 PEM-encoded certificate signing request (CSR) for your certificate authority certificate.

    • getCertificateAuthorityRef

      @Stability(Stable) @NotNull public CertificateAuthorityReference getCertificateAuthorityRef()
      A reference to a CertificateAuthority resource.
      Specified by:
      getCertificateAuthorityRef in interface ICertificateAuthorityRef

    • getCfnProperties

      @Stability(Stable) @NotNull protected Map<String,Object> getCfnProperties()
      Overrides:
      getCfnProperties in class CfnResource

    • getTags

      @Stability(Stable) @NotNull public TagManager getTags()
      Tag Manager which manages the tags for this resource.
      Specified by:
      getTags in interface ITaggable

    • getKeyAlgorithm

      @Stability(Stable) @NotNull public String getKeyAlgorithm()
      Type of the public key algorithm and size, in bits, of the key pair that your CA creates when it issues a certificate.

    • setKeyAlgorithm

      @Stability(Stable) public void setKeyAlgorithm(@NotNull String value)
      Type of the public key algorithm and size, in bits, of the key pair that your CA creates when it issues a certificate.

    • getSigningAlgorithm

      @Stability(Stable) @NotNull public String getSigningAlgorithm()
      Name of the algorithm your private CA uses to sign certificate requests.

    • setSigningAlgorithm

      @Stability(Stable) public void setSigningAlgorithm(@NotNull String value)
      Name of the algorithm your private CA uses to sign certificate requests.

    • getSubject

      @Stability(Stable) @NotNull public Object getSubject()
      Structure that contains X.500 distinguished name information for your private CA.

      Returns union: either IResolvable or CfnCertificateAuthority.SubjectProperty

    • setSubject

      @Stability(Stable) public void setSubject(@NotNull IResolvable value)
      Structure that contains X.500 distinguished name information for your private CA.

    • setSubject

      @Stability(Stable) public void setSubject(@NotNull CfnCertificateAuthority.SubjectProperty value)
      Structure that contains X.500 distinguished name information for your private CA.

    • getType

      @Stability(Stable) @NotNull public String getType()
      Type of your private CA.

    • setType

      @Stability(Stable) public void setType(@NotNull String value)
      Type of your private CA.

    • getCsrExtensions

      @Stability(Stable) @Nullable public Object getCsrExtensions()
      Specifies information to be added to the extension section of the certificate signing request (CSR).

      Returns union: either IResolvable or CfnCertificateAuthority.CsrExtensionsProperty

    • setCsrExtensions

      @Stability(Stable) public void setCsrExtensions(@Nullable IResolvable value)
      Specifies information to be added to the extension section of the certificate signing request (CSR).

    • setCsrExtensions

      @Stability(Stable) public void setCsrExtensions(@Nullable CfnCertificateAuthority.CsrExtensionsProperty value)
      Specifies information to be added to the extension section of the certificate signing request (CSR).

    • getKeyStorageSecurityStandard

      @Stability(Stable) @Nullable public String getKeyStorageSecurityStandard()
      Specifies a cryptographic key management compliance standard for handling and protecting CA keys.

    • setKeyStorageSecurityStandard

      @Stability(Stable) public void setKeyStorageSecurityStandard(@Nullable String value)
      Specifies a cryptographic key management compliance standard for handling and protecting CA keys.

    • getRevocationConfiguration

      @Stability(Stable) @Nullable public Object getRevocationConfiguration()
      Information about the Online Certificate Status Protocol (OCSP) configuration or certificate revocation list (CRL) created and maintained by your private CA.

      Returns union: either IResolvable or CfnCertificateAuthority.RevocationConfigurationProperty

    • setRevocationConfiguration

      @Stability(Stable) public void setRevocationConfiguration(@Nullable IResolvable value)
      Information about the Online Certificate Status Protocol (OCSP) configuration or certificate revocation list (CRL) created and maintained by your private CA.

    • setRevocationConfiguration

      @Stability(Stable) public void setRevocationConfiguration(@Nullable CfnCertificateAuthority.RevocationConfigurationProperty value)
      Information about the Online Certificate Status Protocol (OCSP) configuration or certificate revocation list (CRL) created and maintained by your private CA.

    • getTagsRaw

      @Stability(Stable) @Nullable public List<CfnTag> getTagsRaw()
      Key-value pairs that will be attached to the new private CA.

    • setTagsRaw

      @Stability(Stable) public void setTagsRaw(@Nullable List<CfnTag> value)
      Key-value pairs that will be attached to the new private CA.

    • getUsageMode

      @Stability(Stable) @Nullable public String getUsageMode()
      Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly.

    • setUsageMode

      @Stability(Stable) public void setUsageMode(@Nullable String value)
      Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly.