AWS Certificate Manager Private Certificate Authority
User Guide (Version latest)


The following Java sample shows how to use the UpdateCertificateAuthority function.

The function updates the status or configuration of a private certificate authority (CA). Your private CA must be in the ACTIVE or DISABLED state before you can update it. You can disable a private CA that is in the ACTIVE state or make a CA that is in the DISABLED state active again.

package com.amazonaws.samples; import com.amazonaws.auth.AWSCredentials; import com.amazonaws.auth.profile.ProfileCredentialsProvider; import com.amazonaws.client.builder.AwsClientBuilder; import com.amazonaws.client.builder.AwsClientBuilder.EndpointConfiguration; import com.amazonaws.AmazonClientException; import com.amazonaws.auth.AWSStaticCredentialsProvider; import; import; import; import; import; import; import; import; import; import; import; import; public class UpdatePCA { public static void main(String[] args) { // Retrieve your credentials from the C:\Users\name\.aws\credentials file // in Windows or the .aws/credentials file in Linux. AWSCredentials credentials = null; try{ credentials = new ProfileCredentialsProvider("default").getCredentials(); } catch (Exception e) { throw new AmazonClientException("Cannot load your credentials from file.", e); } // Define the endpoint for your sample. String endpointProtocol = ""; String endpointRegion = "region"; EndpointConfiguration endpoint = new AwsClientBuilder.EndpointConfiguration(endpointProtocol, endpointRegion); // Create a client that you can use to make requests. AWSPrivateCA client = AWSPrivateCAClientBuilder.standard() .withEndpointConfiguration(endpoint) .withCredentials(new AWSStaticCredentialsProvider(credentials)) .build(); // Create the request object. UpdateCertificateAuthorityRequest req = new UpdateCertificateAuthorityRequest(); // Set the ARN of the private CA that you want to update. req.setCertificateAuthorityArn("arn:aws:acm-pca:us-east-1:account:" + "certificate-authority/12345678-1234-1234-1234-123456789012"); // Define the certificate revocation list configuration. If you do not want to // update the CRL configuration, leave the CrlConfiguration structure alone and // do not set it on your UpdateCertificateAuthorityRequest object. CrlConfiguration crlConfigure = new CrlConfiguration(); crlConfigure.setEnabled(true); crlConfigure.setExpirationInDays(365); crlConfigure.setCustomCname("your-custom-name"); crlConfigure.setS3BucketName("your-bucket-name"); // Set the CRL configuration onto your UpdateCertificateAuthorityRequest object. // If you do not want to change your CRL configuration, do not use the // setCrlConfiguration method. RevocationConfiguration revokeConfig = new RevocationConfiguration(); revokeConfig.setCrlConfiguration(crlConfigure); // Set the status. req.setStatus(CertificateAuthorityStatus.ACTIVE); // Create the result object. try { client.updateCertificateAuthority(req); } catch(ConcurrentModificationException ex) { throw ex; } catch(ResourceNotFoundException ex) { throw ex; } catch(InvalidArgsException ex) { throw ex; } catch(InvalidArnException ex) { throw ex; } catch(InvalidStateException ex) { throw ex; } catch(InvalidPolicyException ex) { throw ex; } } }