Class RevokeCertificateCommandProtected

Revokes a certificate that was issued inside Amazon Web Services Private CA. If you enable a certificate revocation list (CRL) when you create or update your private CA, information about the revoked certificates will be included in the CRL. Amazon Web Services Private CA writes the CRL to an S3 bucket that you specify. A CRL is typically updated approximately 30 minutes after a certificate is revoked. If for any reason the CRL update fails, Amazon Web Services Private CA attempts makes further attempts every 15 minutes. With Amazon CloudWatch, you can create alarms for the metrics CRLGenerated and MisconfiguredCRLBucket. For more information, see Supported CloudWatch Metrics.

Both Amazon Web Services Private CA and the IAM principal must have permission to write to the S3 bucket that you specify. If the IAM principal making the call does not have permission to write to the bucket, then an exception is thrown. For more information, see Access policies for CRLs in Amazon S3.

Amazon Web Services Private CA also writes revocation information to the audit report. For more information, see CreateCertificateAuthorityAuditReport.

You cannot revoke a root CA self-signed certificate.

Example

Use a bare-bones client and the command you need to make an API call.

import { ACMPCAClient, RevokeCertificateCommand } from "@aws-sdk/client-acm-pca"; // ES Modules import
// const { ACMPCAClient, RevokeCertificateCommand } = require("@aws-sdk/client-acm-pca"); // CommonJS import
const client = new ACMPCAClient(config);
const input = { // RevokeCertificateRequest
  CertificateAuthorityArn: "STRING_VALUE", // required
  CertificateSerial: "STRING_VALUE", // required
  RevocationReason: "UNSPECIFIED" || "KEY_COMPROMISE" || "CERTIFICATE_AUTHORITY_COMPROMISE" || "AFFILIATION_CHANGED" || "SUPERSEDED" || "CESSATION_OF_OPERATION" || "PRIVILEGE_WITHDRAWN" || "A_A_COMPROMISE", // required
};
const command = new RevokeCertificateCommand(input);
const response = await client.send(command);

Param

RevokeCertificateCommandInput

Returns

RevokeCertificateCommandOutput

See

• RevokeCertificateCommandInput for command's input shape.
• RevokeCertificateCommandOutput for command's response shape.
• config for ACMPCAClient's config shape.

Throws

ConcurrentModificationException (client fault)

A previous update to your private CA is still ongoing.

Throws

InvalidArnException (client fault)

The requested Amazon Resource Name (ARN) does not refer to an existing resource.

Throws

InvalidRequestException (client fault)

The request action cannot be performed or is prohibited.

Throws

InvalidStateException (client fault)

The state of the private CA does not allow this action to occur.

Throws

LimitExceededException (client fault)

An Amazon Web Services Private CA quota has been exceeded. See the exception message returned to determine the quota that was exceeded.

Throws

RequestAlreadyProcessedException (client fault)

Your request has already been completed.

Throws

RequestFailedException (client fault)

The request has failed for an unspecified reason.

Throws

RequestInProgressException (client fault)

Your request is already in progress.

Throws

ResourceNotFoundException (client fault)

A resource such as a private CA, S3 bucket, certificate, audit report, or policy cannot be found.