AWS Certificate Manager Private Certificate Authority
User Guide (Version latest)


The following Java sample shows how to use the RevokeCertificate function.

This function revokes a certificate that you issued by calling the IssueCertificate function. If you enable a certificate revocation list (CRL) when you create or update your private CA, information about the revoked certificates will be included in the CRL. ACM PCA writes the CRL to an S3 bucket that you specify. For more information, see the CrlConfiguration structure.

package com.amazonaws.samples; import com.amazonaws.auth.AWSCredentials; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.client.builder.AwsClientBuilder; import com.amazonaws.client.builder.AwsClientBuilder.EndpointConfiguration; import com.amazonaws.AmazonClientException; import com.amazonaws.auth.AWSStaticCredentialsProvider; import; import; import; import; import; import; import; import; import; import; public class RevokeCertificate { public static void main(String[] args) { // Retrieve your credentials from the C:\Users\name\.aws\credentials file // in Windows or the .aws/credentials file in Linux. AWSCredentials credentials = null; try{ credentials = new ProfileCredentialsProvider("default").getCredentials(); } catch (Exception e) { throw new AmazonClientException("Cannot load your credentials from disk", e); } // Define the endpoint for your sample. String endpointProtocol = ""; String endpointRegion = "region"; EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(endpointProtocol, endpointRegion); // Create a client that you can use to make requests. AWSPrivateCA client = AWSPrivateCAClientBuilder.standard() .withEndpointConfiguration(endpoint) .withCredentials(new AWSStaticCredentialsProvider(credentials)) .build(); // Create a request object. RevokeCertificateRequest req = new RevokeCertificateRequest(); // Set the certificate authority ARN. req.setCertificateAuthorityArn("arn:aws:acm-pca:region:account:" + "certificate-authority/12345678-1234-1234-1234-12345678901212345678-1234-1234-1234-123456789012"); // Set the certificate serial number. req.setCertificateSerial("79:3f:0d:5b:6a:04:12:5e:2c:9c:fb:52:37:35:98:fe"); // Set the RevocationReason. req.setRevocationReason(RevocationReason.KEY_COMPROMISE); // Revoke the certificate. try{ client.revokeCertificate(req); } catch (InvalidArnException ex) { throw ex; } catch(InvalidStateException ex) { throw ex; } catch(ResourceNotFoundException ex) { throw ex; } catch (RequestAlreadyProcessedException ex) { throw ex; } catch (RequestInProgressException ex) { throw ex; } catch (RequestFailedException ex) { throw ex; } } }