Class DeleteCertificateAuthorityCommandProtected

Deletes a private certificate authority (CA). You must provide the Amazon Resource Name (ARN) of the private CA that you want to delete. You can find the ARN by calling the ListCertificateAuthorities action.

Deleting a CA will invalidate other CAs and certificates below it in your CA hierarchy.

Before you can delete a CA that you have created and activated, you must disable it. To do this, call the UpdateCertificateAuthority action and set the CertificateAuthorityStatus parameter to DISABLED.

Additionally, you can delete a CA if you are waiting for it to be created (that is, the status of the CA is CREATING). You can also delete it if the CA has been created but you haven't yet imported the signed certificate into Amazon Web Services Private CA (that is, the status of the CA is PENDING_CERTIFICATE).

When you successfully call DeleteCertificateAuthority, the CA's status changes to DELETED. However, the CA won't be permanently deleted until the restoration period has passed. By default, if you do not set the PermanentDeletionTimeInDays parameter, the CA remains restorable for 30 days. You can set the parameter from 7 to 30 days. The DescribeCertificateAuthority action returns the time remaining in the restoration window of a private CA in the DELETED state. To restore an eligible CA, call the RestoreCertificateAuthority action.

Example

Use a bare-bones client and the command you need to make an API call.

import { ACMPCAClient, DeleteCertificateAuthorityCommand } from "@aws-sdk/client-acm-pca"; // ES Modules import
// const { ACMPCAClient, DeleteCertificateAuthorityCommand } = require("@aws-sdk/client-acm-pca"); // CommonJS import
const client = new ACMPCAClient(config);
const input = { // DeleteCertificateAuthorityRequest
  CertificateAuthorityArn: "STRING_VALUE", // required
  PermanentDeletionTimeInDays: Number("int"),
};
const command = new DeleteCertificateAuthorityCommand(input);
const response = await client.send(command);
// {};

Param

DeleteCertificateAuthorityCommandInput

Returns

DeleteCertificateAuthorityCommandOutput

See

• DeleteCertificateAuthorityCommandInput for command's input shape.
• DeleteCertificateAuthorityCommandOutput for command's response shape.
• config for ACMPCAClient's config shape.

Throws

ConcurrentModificationException (client fault)

A previous update to your private CA is still ongoing.

Throws

InvalidArnException (client fault)

The requested Amazon Resource Name (ARN) does not refer to an existing resource.

Throws

InvalidStateException (client fault)

The state of the private CA does not allow this action to occur.

Throws

ResourceNotFoundException (client fault)

A resource such as a private CA, S3 bucket, certificate, audit report, or policy cannot be found.

Throws

ACMPCAServiceException

Base exception class for all service exceptions from ACMPCA service.