AWS Certificate Manager Private Certificate Authority
User Guide (Version latest)


The following Java sample shows how to use the DescribeCertificateAuthority operation.

The operation lists information about your private certificate authority (CA). You must specify the ARN (Amazon Resource Name) of the private CA. The output contains the status of your CA. This can be any of the following:

  • CREATING – ACM PCA is creating your private certificate authority.

  • PENDING_CERTIFICATE – The certificate is pending. You must use your on-premises root or subordinate CA to sign your private CA CSR and then import it into PCA.

  • ACTIVE – Your private CA is active.

  • DISABLED – Your private CA has been disabled.

  • EXPIRED – Your private CA certificate has expired.

  • FAILED – Your private CA cannot be created.

  • DELETED – Your private CA is within the restoration period, after which it will be permanently deleted.

package com.amazonaws.samples; import com.amazonaws.auth.AWSCredentials; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.client.builder.AwsClientBuilder; import com.amazonaws.client.builder.AwsClientBuilder.EndpointConfiguration; import com.amazonaws.auth.AWSStaticCredentialsProvider; import; import; import; import; import; import com.amazonaws.AmazonClientException; import; import; public class DescribeCertificateAuthority { public static void main(String[] args) throws Exception { // Retrieve your credentials from the C:\Users\name\.aws\credentials file // in Windows or the .aws/credentials file in Linux. AWSCredentials credentials = null; try{ credentials = new ProfileCredentialsProvider("default").getCredentials(); } catch (Exception e) { throw new AmazonClientException("Cannot load your credentials from disk", e); } // Define the endpoint for your sample. String endpointProtocol = ""; String endpointRegion = "region"; EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(endpointProtocol, endpointRegion); // Create a client that you can use to make requests. AWSACMPCA client = AWSACMPCAClientBuilder.standard() .withEndpointConfiguration(endpoint) .withCredentials(new AWSStaticCredentialsProvider(credentials)) .build(); // Create a request object and set the certificate authority ARN. DescribeCertificateAuthorityRequest req = new DescribeCertificateAuthorityRequest(); req.withCertificateAuthorityArn("arn:aws:acm-pca:region:account:"+ "certificate-authority/12345678-1234-1234-1234-123456789012"); // Create a result object. DescribeCertificateAuthorityResult result = null; try { result = client.describeCertificateAuthority(req); } catch(ResourceNotFoundException ex) { throw ex; } catch(InvalidArnException ex) { throw ex; } // Retrieve and display information about the CA. CertificateAuthority PCA = result.getCertificateAuthority(); String strPCA = PCA.toString(); System.out.println(strPCA); } }