Deletes a private certificate authority (CA). You must provide the Amazon Resource
Name (ARN) of the private CA that you want to delete. You can find the ARN by calling
the ListCertificateAuthorities action.
Deleting a CA will invalidate other CAs and certificates below it in your CA
hierarchy.
Before you can delete a CA that you have created and activated, you must disable it.
To do this, call the UpdateCertificateAuthority action and set the CertificateAuthorityStatus parameter to DISABLED.
Additionally, you can delete a CA if you are waiting for it to be created (that is,
the status of the CA is CREATING). You can also delete it if the CA has
been created but you haven't yet imported the signed certificate into Amazon Web Services Private CA (that
is, the status of the CA is PENDING_CERTIFICATE).
When you successfully call DeleteCertificateAuthority, the CA's status changes to
DELETED. However, the CA won't be permanently deleted until the restoration
period has passed. By default, if you do not set the
PermanentDeletionTimeInDays parameter, the CA remains restorable for 30
days. You can set the parameter from 7 to 30 days. The DescribeCertificateAuthority action returns the time remaining in the
restoration window of a private CA in the DELETED state. To restore an
eligible CA, call the RestoreCertificateAuthority action.
Example
Use a bare-bones client and the command you need to make an API call.
Deletes a private certificate authority (CA). You must provide the Amazon Resource Name (ARN) of the private CA that you want to delete. You can find the ARN by calling the ListCertificateAuthorities action.
Deleting a CA will invalidate other CAs and certificates below it in your CA hierarchy.
Before you can delete a CA that you have created and activated, you must disable it. To do this, call the UpdateCertificateAuthority action and set the CertificateAuthorityStatus parameter to
DISABLED
.Additionally, you can delete a CA if you are waiting for it to be created (that is, the status of the CA is
CREATING
). You can also delete it if the CA has been created but you haven't yet imported the signed certificate into Amazon Web Services Private CA (that is, the status of the CA isPENDING_CERTIFICATE
).When you successfully call DeleteCertificateAuthority, the CA's status changes to
DELETED
. However, the CA won't be permanently deleted until the restoration period has passed. By default, if you do not set thePermanentDeletionTimeInDays
parameter, the CA remains restorable for 30 days. You can set the parameter from 7 to 30 days. The DescribeCertificateAuthority action returns the time remaining in the restoration window of a private CA in theDELETED
state. To restore an eligible CA, call the RestoreCertificateAuthority action.Example
Use a bare-bones client and the command you need to make an API call.
Param
DeleteCertificateAuthorityCommandInput
Returns
DeleteCertificateAuthorityCommandOutput
See
input
shape.response
shape.config
shape.Throws
ConcurrentModificationException (client fault)
A previous update to your private CA is still ongoing.
Throws
InvalidArnException (client fault)
The requested Amazon Resource Name (ARN) does not refer to an existing resource.
Throws
InvalidStateException (client fault)
The state of the private CA does not allow this action to occur.
Throws
ResourceNotFoundException (client fault)
A resource such as a private CA, S3 bucket, certificate, audit report, or policy cannot be found.
Throws
ACMPCAServiceException
Base exception class for all service exceptions from ACMPCA service.