[ aws . acm-pca ]

describe-certificate-authority

Description

Lists information about your private certificate authority (CA). You specify the private CA on input by its ARN (Amazon Resource Name). The output contains the status of your CA. This can be any of the following:

• CREATING - ACM Private CA is creating your private certificate authority.

• PENDING_CERTIFICATE - The certificate is pending. You must use your ACM Private CA-hosted or on-premises root or subordinate CA to sign your private CA CSR and then import it into PCA.

• ACTIVE - Your private CA is active.

• DISABLED - Your private CA has been disabled.

• EXPIRED - Your private CA certificate has expired.

• FAILED - Your private CA has failed. Your CA can fail because of problems such a network outage or backend AWS failure or other errors. A failed CA can never return to the pending state. You must create a new CA.

• DELETED - Your private CA is within the restoration period, after which it is permanently deleted. The length of time remaining in the CA’s restoration period is also included in this action’s output.

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Synopsis

  describe-certificate-authority
--certificate-authority-arn <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--cli-auto-prompt <value>]

Options

--certificate-authority-arn (string)

The Amazon Resource Name (ARN) that was returned when you called CreateCertificateAuthority . This must be of the form:

``arn:aws:acm-pca:region :account :certificate-authority/12345678-1234-1234-1234-123456789012 `` .

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

--cli-auto-prompt (boolean) Automatically prompt for CLI input parameters.

See ‘aws help’ for descriptions of global parameters.

Examples

To describe a private certificate authority

The following describe-certificate-authority command lists information about the private CA identified by the ARN.

aws acm-pca describe-certificate-authority --certificate-authority-arn arn:aws:acm-pca:us-west-2:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012

Output

CertificateAuthority -> (structure)

A CertificateAuthority structure that contains information about your private CA.

Arn -> (string)

Amazon Resource Name (ARN) for your private certificate authority (CA). The format is `` 12345678-1234-1234-1234-123456789012 `` .

CreatedAt -> (timestamp)

Date and time at which your private CA was created.

LastStateChangeAt -> (timestamp)

Date and time at which your private CA was last updated.

Type -> (string)

Type of your private CA.

Serial -> (string)

Serial number of your private CA.

Status -> (string)

Status of your private CA.

NotBefore -> (timestamp)

Date and time before which your private CA certificate is not valid.

NotAfter -> (timestamp)

Date and time after which your private CA certificate is not valid.

FailureReason -> (string)

Reason the request to create your private CA failed.

CertificateAuthorityConfiguration -> (structure)

Your private CA configuration.

KeyAlgorithm -> (string)

Type of the public key algorithm and size, in bits, of the key pair that your CA creates when it issues a certificate. When you create a subordinate CA, you must use a key algorithm supported by the parent CA.

SigningAlgorithm -> (string)

Name of the algorithm your private CA uses to sign certificate requests.

Subject -> (structure)

Structure that contains X.500 distinguished name information for your private CA.

Country -> (string)

Two-digit code that specifies the country in which the certificate subject located.

Organization -> (string)

Legal name of the organization with which the certificate subject is affiliated.

OrganizationalUnit -> (string)

A subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated.

DistinguishedNameQualifier -> (string)

Disambiguating information for the certificate subject.

State -> (string)

State in which the subject of the certificate is located.

CommonName -> (string)

Fully qualified domain name (FQDN) associated with the certificate subject.

SerialNumber -> (string)

The certificate serial number.

Locality -> (string)

The locality (such as a city or town) in which the certificate subject is located.

Title -> (string)

A title such as Mr. or Ms., which is pre-pended to the name to refer formally to the certificate subject.

Surname -> (string)

Family name. In the US and the UK, for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first.

GivenName -> (string)

First name.

Initials -> (string)

Concatenation that typically contains the first letter of the GivenName , the first letter of the middle name if one exists, and the first letter of the SurName .

Pseudonym -> (string)

Typically a shortened version of a longer GivenName . For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza.

GenerationQualifier -> (string)

Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third.

RevocationConfiguration -> (structure)

Information about the certificate revocation list (CRL) created and maintained by your private CA.

CrlConfiguration -> (structure)

Configuration of the certificate revocation list (CRL), if any, maintained by your private CA.

Enabled -> (boolean)

Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. You can use this value to enable certificate revocation for a new CA when you call the CreateCertificateAuthority action or for an existing CA when you call the UpdateCertificateAuthority action.

ExpirationInDays -> (integer)

Number of days until a certificate expires.

CustomCname -> (string)

Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point. Use this value if you don’t want the name of your S3 bucket to be public.

S3BucketName -> (string)

Name of the S3 bucket that contains the CRL. If you do not provide a value for the CustomCname argument, the name of your S3 bucket is placed into the CRL Distribution Points extension of the issued certificate. You can change the name of your bucket by calling the UpdateCertificateAuthority action. You must specify a bucket policy that allows ACM Private CA to write the CRL to your bucket.

RestorableUntil -> (timestamp)

The period during which a deleted CA can be restored. For more information, see the PermanentDeletionTimeInDays parameter of the DeleteCertificateAuthorityRequest action.