AWS Certificate Manager Private Certificate Authority
User Guide (Version latest)


The following Java sample shows how to use the GetCertificateAuthorityCertificate function.

This function retrieves the certificate and certificate chain for your private certificate authority (CA). Both the certificate and the chain are base64 PEM-encoded. The chain does not include the CA certificate. Each certificate in the chain signs the one before it.

package com.amazonaws.samples; import com.amazonaws.auth.AWSCredentials; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.client.builder.AwsClientBuilder; import com.amazonaws.client.builder.AwsClientBuilder.EndpointConfiguration; import com.amazonaws.AmazonClientException; import com.amazonaws.auth.AWSStaticCredentialsProvider; import; import; import; import; import; import; import; public class GetCAcert { public static void main(String[] args) throws Exception { // Retrieve your credentials from the C:\Users\name\.aws\credentials file // in Windows or the .aws/credentials file in Linux. AWSCredentials credentials = null; try{ credentials = new ProfileCredentialsProvider("default").getCredentials(); } catch (Exception e) { throw new AmazonClientException("Cannot load your credentials from disk", e); } // Define the endpoint for your sample. String endpointProtocol = ""; String endpointRegion = "region"; EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(endpointProtocol, endpointRegion); // Create a client that you can use to make requests. AWSPrivateCA client = AWSPrivateCAClientBuilder.standard() .withEndpointConfiguration(endpoint) .withCredentials(new AWSStaticCredentialsProvider(credentials)) .build(); // Create a request object and set the certificate authority ARN, GetCertificateAuthorityCertificateRequest req = new GetCertificateAuthorityCertificateRequest(); req.setCertificateAuthorityArn("arn:aws:acm-pca:region:account:" + "certificate-authority/12345678-1234-1234-1234-123456789012"); // Create a result object. GetCertificateAuthorityCertificateResult result = null; try{ result = client.getCertificateAuthorityCertificate(req); } catch(ResourceNotFoundException ex) { throw ex; } catch(InvalidStateException ex) { throw ex; } catch(InvalidArnException ex) { throw ex; } // Retrieve and display the certificate information. String strPcaCert = result.getCertificate(); System.out.println(strPcaCert); String strPCACChain = result.getCertificateChain(); System.out.println(strPCACChain); } }

Your output should be a certificate and chain similar to the following for the certificate authority (CA) that you specified.

-----BEGIN CERTIFICATE----- base64-encoded certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- base64-encoded certificate -----END CERTIFICATE-----