> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ACM Private CA

> ACM Private CA APIs with Cloud Adapter.

This page describes how ACM Private CA maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Akamai
* Azure
* DigitalOcean
* Google Cloud
* OCI
* Private Kubernetes
* Scaleway

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of ACM Private CA with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | ACM Private CA | Akamai, Azure, DigitalOcean, OCI, Private Kubernetes, and Scaleway · cert-manager Issuer | Google Cloud | OCI · OCI Certificate Authority |
| - | - | - | - | - |
| Private certificate authority | Yes | Yes - a cert-manager CA Issuer / ClusterIssuer backed by a CA Secret | Yes - a CA Service CA in a CA pool | Yes - an OCI Certificates CA in a compartment |
| Root + subordinate CA hierarchy | Yes | Partial - a CA Issuer plus an intermediate Certificate models a subordinate; deep multi-tier hierarchies are assembled by hand, not a managed ROOT / SUBORDINATE type | Yes - a SELF\_SIGNED root CA and SUBORDINATE CAs, the CA Service analog of ACM Private CA's ROOT / SUBORDINATE types | Yes - OCI root and subordinate CAs, the analog of ACM Private CA's ROOT / SUBORDINATE types |
| Certificate issuance from the private CA | Yes | Yes - cert-manager Certificate resources signed by the CA Issuer, chaining to the private root | Yes - google\_privateca\_certificate, issued from the pool and chaining to the private root | Yes - OCI Certificates issues leaf certificates from the CA, chaining to the private root |
| Managed CA + certificate rotation | Yes | Partial - cert-manager renews leaf certificates automatically; the operator manages CA certificate rotation | Yes - CA Service manages the CA lifecycle; certificates rotate by re-issuance from the pool | Yes - configured managed leaf certificates renew automatically; the customer initiates CA renewal and rotates the CA key |
| Issuance scoping | Yes - acm-pca:TemplateArn IAM condition | Partial - Kubernetes RBAC on the Certificate / Issuer objects plus the Issuer vs ClusterIssuer scope, not a template-ARN condition | Partial - the pool issuance\_policy (allowed key usage / identity constraints), not a 1:1 template-ARN condition | Partial - OCI IAM compartment policy on the CA plus its issuance configuration, not a 1:1 template-ARN condition |
| CRL distribution | Yes - customer-owned S3 bucket | No - the CA operator must provide CRL generation and publication | Partial - Google-managed or customer-managed Cloud Storage bucket; translate the S3 bucket policy and distribution point | Partial - configured Object Storage bucket; translate the S3 bucket policy and distribution point |
| Cloud-operated / managed CA | Yes | No - the platform team operates cert-manager and protects the CA Secret, including on AKS | Yes - Google operates CA Service end to end | Yes - Oracle operates OCI Certificates end to end |
| API coverage | full | partial | partial | partial |

## On Akamai, Azure, DigitalOcean, OCI, Private Kubernetes, and Scaleway

### cert-manager Issuer

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Issuance scoping (acm-pca:TemplateArn IAM condition) | Access control | Partial | Most usage | Kubernetes RBAC on the Certificate and Issuer objects plus the namespace-scoped Issuer vs cluster-wide ClusterIssuer choice, not an acm-pca:TemplateArn condition |
| CSR-signing activation split (aws\_acmpca\_certificate\_authority\_certificate) | CA activation | Adapter-served | Most usage | the CSR-sign-then-install resource pair is implicit in the CA Issuer, which holds the CA certificate and key; there is no separate signing resource |
| ACM Private CA control plane (CreateCertificateAuthority / issuance API / …) | Control plane | Out of scope | Full surface | CA provisioning happens through your infrastructure-as-code at apply, not runtime ACM Private CA API calls |
| CA hierarchy (ROOT / SUBORDINATE types) | Hierarchy | Partial | Most usage | a root CA Issuer plus an intermediate Certificate that becomes a second Issuer models a subordinate; a two-tier hierarchy maps directly, but deep multi-tier hierarchies are assembled by hand, not a managed ROOT / SUBORDINATE type |
| Certificate issuance (aws\_acmpca\_certificate / IssueCertificate) | Issuance | Supported | Common | cert-manager Certificate resources are signed by the CA Issuer and renewed automatically before they expire, with the subject / SANs / key usage / duration |
| Private CA provisioning (aws\_acmpca\_certificate\_authority) | Provisioning | Supported | Common | a cert-manager CA Issuer / ClusterIssuer backed by a CA certificate and key in a Kubernetes Secret: a private CA the cluster holds, issuing certificates that chain to its private root |
| CRL distribution (customer-owned S3 bucket) | Revocation | Out of scope | Full surface | cert-manager does not generate or publish CRLs; the CA operator must provide revocation services |

#### How it works

Your PKI keeps issuing X.509 certificates that chain to a private root. On the target cluster, a cert-manager CA `Issuer` or `ClusterIssuer` signs them with a CA certificate and key stored in a Kubernetes Secret. This is the mapping on Kubernetes and on Azure, which has no managed private CA.

No cloud provider runs this CA: your platform team operates cert-manager and protects the CA key, including on AKS. The CA is created from your infrastructure code when the deployment is applied. Calls to the ACM Private CA API at run time are not part of this mapping.

![On AWS, your PKI issues certificates from ACM Private CA, which AWS runs. On the target cluster, it issues them from a cert-manager CA issuer that your platform team runs.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgUEtJIGlzc3VlcyBjZXJ0aWZpY2F0ZXMgZnJvbSBBQ00gUHJpdmF0ZSBDQSwgd2hpY2ggQVdTIHJ1bnMuIE9uIHRoZSB0YXJnZXQgY2x1c3RlciwgaXQgaXNzdWVzIHRoZW0gZnJvbSBhIGNlcnQtbWFuYWdlciBDQSBpc3N1ZXIgdGhhdCB5b3VyIHBsYXRmb3JtIHRlYW0gcnVucy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iYXBjbTFoIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzIiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzNiIgeT0iODIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTExIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Zb3VyIFBLSTwvdGV4dD4KPHRleHQgeD0iMTExIiB5PSIxMjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5pc3N1ZXMgWC41MDkgY2VydHM8L3RleHQ+CjxsaW5lIHgxPSIxODYiIHkxPSIxMTMiIHgyPSIyMjQiIHkyPSIxMTMiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2FwY20xaCkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIyMDUiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWU8L3RleHQ+CjxyZWN0IHg9IjIyNCIgeT0iODIiIHdpZHRoPSIxNTgiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAzIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+QUNNIFByaXZhdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjMwMyIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+bWFuYWdlZCBieSBBV1M8L3RleHQ+CjxyZWN0IHg9IjQzNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDUyIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+T04gVEhFIFRBUkdFVCBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NTYiIHk9IjgyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUzMSIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+WW91ciBQS0k8L3RleHQ+Cjx0ZXh0IHg9IjUzMSIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmNlcnRpZmljYXRlIGlzc3VhbmNlPC90ZXh0Pgo8bGluZSB4MT0iNjA2IiB5MT0iMTEzIiB4Mj0iNjQ0IiB5Mj0iMTEzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNhcGNtMWgpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNjI1IiB5PSIxMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPmlzc3VlPC90ZXh0Pgo8cmVjdCB4PSI2NDQiIHk9IjgyIiB3aWR0aD0iMTU4IiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjcyMyIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPmNlcnQtbWFuYWdlciBDQTwvdGV4dD4KPHRleHQgeD0iNzIzIiB5PSIxMjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPklzc3VlciDCtyB5b3Ugb3BlcmF0ZSBpdDwvdGV4dD4KPC9zdmc+)

![On AWS, your PKI issues certificates from ACM Private CA, which AWS runs. On the target cluster, it issues them from a cert-manager CA issuer that your platform team runs.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgUEtJIGlzc3VlcyBjZXJ0aWZpY2F0ZXMgZnJvbSBBQ00gUHJpdmF0ZSBDQSwgd2hpY2ggQVdTIHJ1bnMuIE9uIHRoZSB0YXJnZXQgY2x1c3RlciwgaXQgaXNzdWVzIHRoZW0gZnJvbSBhIGNlcnQtbWFuYWdlciBDQSBpc3N1ZXIgdGhhdCB5b3VyIHBsYXRmb3JtIHRlYW0gcnVucy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iYXBjbTFoIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2LjUiIG1hcmtlckhlaWdodD0iNi41IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzIiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzNiIgeT0iODIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTExIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Zb3VyIFBLSTwvdGV4dD4KPHRleHQgeD0iMTExIiB5PSIxMjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5pc3N1ZXMgWC41MDkgY2VydHM8L3RleHQ+CjxsaW5lIHgxPSIxODYiIHkxPSIxMTMiIHgyPSIyMjQiIHkyPSIxMTMiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2FwY20xaCkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIyMDUiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWU8L3RleHQ+CjxyZWN0IHg9IjIyNCIgeT0iODIiIHdpZHRoPSIxNTgiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAzIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+QUNNIFByaXZhdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjMwMyIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+bWFuYWdlZCBieSBBV1M8L3RleHQ+CjxyZWN0IHg9IjQzNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDUyIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+T04gVEhFIFRBUkdFVCBDTFVTVEVSPC90ZXh0Pgo8cmVjdCB4PSI0NTYiIHk9IjgyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUzMSIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+WW91ciBQS0k8L3RleHQ+Cjx0ZXh0IHg9IjUzMSIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmNlcnRpZmljYXRlIGlzc3VhbmNlPC90ZXh0Pgo8bGluZSB4MT0iNjA2IiB5MT0iMTEzIiB4Mj0iNjQ0IiB5Mj0iMTEzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNhcGNtMWgpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNjI1IiB5PSIxMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPmlzc3VlPC90ZXh0Pgo8cmVjdCB4PSI2NDQiIHk9IjgyIiB3aWR0aD0iMTU4IiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjcyMyIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPmNlcnQtbWFuYWdlciBDQTwvdGV4dD4KPHRleHQgeD0iNzIzIiB5PSIxMjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPklzc3VlciDCtyB5b3Ugb3BlcmF0ZSBpdDwvdGV4dD4KPC9zdmc+)

Certificates chain to a new private root kept in a Kubernetes Secret, and your platform team runs the CA.

#### Architecture

The cert-manager controller watches `Certificate` resources, has the referenced CA issuer sign each one, and writes the certificate and its private key to the application's Secret. An `Issuer` works within one namespace; a `ClusterIssuer` works across namespaces. You protect the CA Secret with access control, encryption and backups.

![A CA issuer reads the CA certificate and key from a Kubernetes Secret and signs Certificate resources. Each issued certificate and key is written to its own Secret and chains to the private root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIENBIGlzc3VlciByZWFkcyB0aGUgQ0EgY2VydGlmaWNhdGUgYW5kIGtleSBmcm9tIGEgS3ViZXJuZXRlcyBTZWNyZXQgYW5kIHNpZ25zIENlcnRpZmljYXRlIHJlc291cmNlcy4gRWFjaCBpc3N1ZWQgY2VydGlmaWNhdGUgYW5kIGtleSBpcyB3cml0dGVuIHRvIGl0cyBvd24gU2VjcmV0IGFuZCBjaGFpbnMgdG8gdGhlIHByaXZhdGUgcm9vdC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHJlY3QgeD0iMTgiIHk9IjM0IiB3aWR0aD0iODAwIiBoZWlnaHQ9IjE2NCIgcng9IjE2IiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzNiIgeT0iNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkNFUlQtTUFOQUdFUiDCtyBvbiBhIEt1YmVybmV0ZXMgY2x1c3RlcjwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjcyIiB3aWR0aD0iMTk2IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSIxMzgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPkNBIFNlY3JldDwvdGV4dD4KPHRleHQgeD0iMTM4IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHgiPnRscy5jcnQgKyB0bHMua2V5PC90ZXh0Pgo8dGV4dCB4PSIxMzgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnRoZSBwcml2YXRlIHJvb3Q8L3RleHQ+Cjx0ZXh0IHg9IjEzOCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+YW5kIGl0cyBrZXk8L3RleHQ+CjxsaW5lIHgxPSIyMzYiIHkxPSIxMjUiIHgyPSIyODIiIHkyPSIxMjUiIHN0cm9rZS13aWR0aD0iMS44IiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMjU5IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPmJhY2tzPC90ZXh0Pgo8cmVjdCB4PSIyODQiIHk9IjcyIiB3aWR0aD0iMTk2IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSIzODIiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPkNsdXN0ZXJJc3N1ZXI8L3RleHQ+Cjx0ZXh0IHg9IjM4MiIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPmNhOiAmIzEyMzsgc2VjcmV0TmFtZSAmIzEyNTs8L3RleHQ+Cjx0ZXh0IHg9IjM4MiIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+c2lnbnMgY2VydGlmaWNhdGVzPC90ZXh0Pgo8dGV4dCB4PSIzODIiIHk9IjE2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmZyb20gdGhlIENBPC90ZXh0Pgo8bGluZSB4MT0iNDgwIiB5MT0iMTI1IiB4Mj0iNTI2IiB5Mj0iMTI1IiBzdHJva2Utd2lkdGg9IjEuOCIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjUwMyIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5pc3N1ZXM8L3RleHQ+CjxyZWN0IHg9IjUyOCIgeT0iNzIiIHdpZHRoPSIyNzIiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjY2NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+Q2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjY2NCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPndyaXR0ZW4gdG8gaXRzIG93biBTZWNyZXQ8L3RleHQ+Cjx0ZXh0IHg9IjY2NCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+Y2hhaW5zIHRvIHRoZSBwcml2YXRlIHJvb3Q8L3RleHQ+Cjx0ZXh0IHg9IjY2NCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dGhlIENBIFNlY3JldCBob2xkczwvdGV4dD4KPC9zdmc+)

![A CA issuer reads the CA certificate and key from a Kubernetes Secret and signs Certificate resources. Each issued certificate and key is written to its own Secret and chains to the private root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIENBIGlzc3VlciByZWFkcyB0aGUgQ0EgY2VydGlmaWNhdGUgYW5kIGtleSBmcm9tIGEgS3ViZXJuZXRlcyBTZWNyZXQgYW5kIHNpZ25zIENlcnRpZmljYXRlIHJlc291cmNlcy4gRWFjaCBpc3N1ZWQgY2VydGlmaWNhdGUgYW5kIGtleSBpcyB3cml0dGVuIHRvIGl0cyBvd24gU2VjcmV0IGFuZCBjaGFpbnMgdG8gdGhlIHByaXZhdGUgcm9vdC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHJlY3QgeD0iMTgiIHk9IjM0IiB3aWR0aD0iODAwIiBoZWlnaHQ9IjE2NCIgcng9IjE2IiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIzNiIgeT0iNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkNFUlQtTUFOQUdFUiDCtyBvbiBhIEt1YmVybmV0ZXMgY2x1c3RlcjwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjcyIiB3aWR0aD0iMTk2IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIxMzgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPkNBIFNlY3JldDwvdGV4dD4KPHRleHQgeD0iMTM4IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHgiPnRscy5jcnQgKyB0bHMua2V5PC90ZXh0Pgo8dGV4dCB4PSIxMzgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnRoZSBwcml2YXRlIHJvb3Q8L3RleHQ+Cjx0ZXh0IHg9IjEzOCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+YW5kIGl0cyBrZXk8L3RleHQ+CjxsaW5lIHgxPSIyMzYiIHkxPSIxMjUiIHgyPSIyODIiIHkyPSIxMjUiIHN0cm9rZS13aWR0aD0iMS44IiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMjU5IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPmJhY2tzPC90ZXh0Pgo8cmVjdCB4PSIyODQiIHk9IjcyIiB3aWR0aD0iMTk2IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzODIiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPkNsdXN0ZXJJc3N1ZXI8L3RleHQ+Cjx0ZXh0IHg9IjM4MiIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPmNhOiAmIzEyMzsgc2VjcmV0TmFtZSAmIzEyNTs8L3RleHQ+Cjx0ZXh0IHg9IjM4MiIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+c2lnbnMgY2VydGlmaWNhdGVzPC90ZXh0Pgo8dGV4dCB4PSIzODIiIHk9IjE2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmZyb20gdGhlIENBPC90ZXh0Pgo8bGluZSB4MT0iNDgwIiB5MT0iMTI1IiB4Mj0iNTI2IiB5Mj0iMTI1IiBzdHJva2Utd2lkdGg9IjEuOCIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjUwMyIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5pc3N1ZXM8L3RleHQ+CjxyZWN0IHg9IjUyOCIgeT0iNzIiIHdpZHRoPSIyNzIiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjY2NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+Q2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjY2NCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPndyaXR0ZW4gdG8gaXRzIG93biBTZWNyZXQ8L3RleHQ+Cjx0ZXh0IHg9IjY2NCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+Y2hhaW5zIHRvIHRoZSBwcml2YXRlIHJvb3Q8L3RleHQ+Cjx0ZXh0IHg9IjY2NCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dGhlIENBIFNlY3JldCBob2xkczwvdGV4dD4KPC9zdmc+)

The issuer signs with the key in the CA Secret, and each certificate lands in its own Secret.

#### The CA hierarchy

A root CA issuer can sign an intermediate CA certificate, and a second issuer then uses that intermediate CA to issue application certificates. A two-tier hierarchy maps directly. Each further tier needs its own issuer and CA certificate, with its own validity and rotation procedure, set up by hand.

![An ACM Private CA root becomes a CA issuer backed by the CA Secret. A subordinate becomes an intermediate certificate that backs a second issuer. Deeper hierarchies are built by hand.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBQ00gUHJpdmF0ZSBDQSByb290IGJlY29tZXMgYSBDQSBpc3N1ZXIgYmFja2VkIGJ5IHRoZSBDQSBTZWNyZXQuIEEgc3Vib3JkaW5hdGUgYmVjb21lcyBhbiBpbnRlcm1lZGlhdGUgY2VydGlmaWNhdGUgdGhhdCBiYWNrcyBhIHNlY29uZCBpc3N1ZXIuIERlZXBlciBoaWVyYXJjaGllcyBhcmUgYnVpbHQgYnkgaGFuZC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPkFDTSBQUklWQVRFIENBPC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iNDIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2MCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPnR5cGUgPSBST09UPC90ZXh0Pgo8dGV4dCB4PSIyMDAiIHk9IjY2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjAiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+dHlwZSA9IFNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSIyMDUiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmlzc3VlcyB0byB0aGUgd29ya2xvYWQ8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI4NyIgeDI9IjQ3MCIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+Cjx0ZXh0IHg9IjYzNiIgeT0iMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkNFUlQtTUFOQUdFUjwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI0MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+Q0EgaXNzdWVyICsgQ0EgU2VjcmV0PC90ZXh0Pgo8dGV4dCB4PSI3MDAiIHk9IjY2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij50aGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI5MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPmludGVybWVkaWF0ZSBjZXJ0ICsgMm5kIGlzc3VlcjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2I0NTMwOSI+RWFjaCBleHRyYSB0aWVyIGlzIGNvbmZpZ3VyZWQgYnkgaGFuZC48L3RleHQ+Cjwvc3ZnPg==)

![An ACM Private CA root becomes a CA issuer backed by the CA Secret. A subordinate becomes an intermediate certificate that backs a second issuer. Deeper hierarchies are built by hand.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBQ00gUHJpdmF0ZSBDQSByb290IGJlY29tZXMgYSBDQSBpc3N1ZXIgYmFja2VkIGJ5IHRoZSBDQSBTZWNyZXQuIEEgc3Vib3JkaW5hdGUgYmVjb21lcyBhbiBpbnRlcm1lZGlhdGUgY2VydGlmaWNhdGUgdGhhdCBiYWNrcyBhIHNlY29uZCBpc3N1ZXIuIERlZXBlciBoaWVyYXJjaGllcyBhcmUgYnVpbHQgYnkgaGFuZC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPkFDTSBQUklWQVRFIENBPC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iNDIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2MCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPnR5cGUgPSBST09UPC90ZXh0Pgo8dGV4dCB4PSIyMDAiIHk9IjY2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjAiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+dHlwZSA9IFNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSIyMDUiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmlzc3VlcyB0byB0aGUgd29ya2xvYWQ8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI4NyIgeDI9IjQ3MCIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+Cjx0ZXh0IHg9IjYzNiIgeT0iMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkNFUlQtTUFOQUdFUjwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI0MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+Q0EgaXNzdWVyICsgQ0EgU2VjcmV0PC90ZXh0Pgo8dGV4dCB4PSI3MDAiIHk9IjY2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij50aGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI5MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPmludGVybWVkaWF0ZSBjZXJ0ICsgMm5kIGlzc3VlcjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2ZiYmYyNCI+RWFjaCBleHRyYSB0aWVyIGlzIGNvbmZpZ3VyZWQgYnkgaGFuZC48L3RleHQ+Cjwvc3ZnPg==)

A subordinate CA becomes an intermediate certificate behind a second issuer; there is no managed ROOT or SUBORDINATE type.

#### Issuing certificates

Each `Certificate` sets its subject, subject alternative names (SANs), key usages and duration, and cert-manager renews it before it expires. The CA certificate in the issuer's Secret is not renewed this way. Your operator must rotate it and distribute any changed trust chain to clients.

![ACM Private CA uses two Terraform resources to sign and install a CA certificate. In cert-manager, the issuer already holds the CA, so there is no signing resource. It signs Certificate resources and cert-manager renews them automatically.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg2IiB2aWV3Qm94PSIwIDAgODM2IDE4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSB1c2VzIHR3byBUZXJyYWZvcm0gcmVzb3VyY2VzIHRvIHNpZ24gYW5kIGluc3RhbGwgYSBDQSBjZXJ0aWZpY2F0ZS4gSW4gY2VydC1tYW5hZ2VyLCB0aGUgaXNzdWVyIGFscmVhZHkgaG9sZHMgdGhlIENBLCBzbyB0aGVyZSBpcyBubyBzaWduaW5nIHJlc291cmNlLiBJdCBzaWducyBDZXJ0aWZpY2F0ZSByZXNvdXJjZXMgYW5kIGNlcnQtbWFuYWdlciByZW5ld3MgdGhlbSBhdXRvbWF0aWNhbGx5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8dGV4dCB4PSIyMDAiIHk9IjI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiOCI+QUNNIFBSSVZBVEUgQ0EgwrcgdHdvIHJlc291cmNlczwvdGV4dD4KPHJlY3QgeD0iMzQiIHk9IjQwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUyIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+YXdzX2FjbXBjYV9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNTIiIHk9Ijc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+c2lnbnMgdGhlIENTUjwvdGV4dD4KPHJlY3QgeD0iMzQiIHk9IjkyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUyIiB5PSIxMTIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPi4uLl9jZXJ0aWZpY2F0ZV9hdXRob3JpdHlfY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUyIiB5PSIxMjciIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5pbnN0YWxscyAvIGFjdGl2YXRlcyB0aGUgQ0E8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI4NyIgeDI9IjQ3MCIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPmhhbmRsZWQgYnk8L3RleHQ+Cjx0ZXh0IHg9IjYzNiIgeT0iMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkNFUlQtTUFOQUdFUjwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI0MCIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTQiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+SXNzdWVyIGhvbGRzIHRoZSBDQTwvdGV4dD4KPHRleHQgeD0iNDk0IiB5PSI3NSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+bm8gc2lnbmluZyByZXNvdXJjZTwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI5MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSI0OTQiIHk9IjExMiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1NyI+a2luZDogQ2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTI3IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5zaWduZWQgYnkgdGhlIENBIElzc3VlcjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5jZXJ0LW1hbmFnZXIgcmVuZXdzIGVhY2ggQ2VydGlmaWNhdGUgYmVmb3JlIGl0IGV4cGlyZXMuPC90ZXh0Pgo8L3N2Zz4=)

![ACM Private CA uses two Terraform resources to sign and install a CA certificate. In cert-manager, the issuer already holds the CA, so there is no signing resource. It signs Certificate resources and cert-manager renews them automatically.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg2IiB2aWV3Qm94PSIwIDAgODM2IDE4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSB1c2VzIHR3byBUZXJyYWZvcm0gcmVzb3VyY2VzIHRvIHNpZ24gYW5kIGluc3RhbGwgYSBDQSBjZXJ0aWZpY2F0ZS4gSW4gY2VydC1tYW5hZ2VyLCB0aGUgaXNzdWVyIGFscmVhZHkgaG9sZHMgdGhlIENBLCBzbyB0aGVyZSBpcyBubyBzaWduaW5nIHJlc291cmNlLiBJdCBzaWducyBDZXJ0aWZpY2F0ZSByZXNvdXJjZXMgYW5kIGNlcnQtbWFuYWdlciByZW5ld3MgdGhlbSBhdXRvbWF0aWNhbGx5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8dGV4dCB4PSIyMDAiIHk9IjI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YiI+QUNNIFBSSVZBVEUgQ0EgwrcgdHdvIHJlc291cmNlczwvdGV4dD4KPHJlY3QgeD0iMzQiIHk9IjQwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUyIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+YXdzX2FjbXBjYV9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNTIiIHk9Ijc1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+c2lnbnMgdGhlIENTUjwvdGV4dD4KPHJlY3QgeD0iMzQiIHk9IjkyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUyIiB5PSIxMTIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPi4uLl9jZXJ0aWZpY2F0ZV9hdXRob3JpdHlfY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUyIiB5PSIxMjciIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5pbnN0YWxscyAvIGFjdGl2YXRlcyB0aGUgQ0E8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI4NyIgeDI9IjQ3MCIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPmhhbmRsZWQgYnk8L3RleHQ+Cjx0ZXh0IHg9IjYzNiIgeT0iMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkNFUlQtTUFOQUdFUjwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI0MCIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0OTQiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+SXNzdWVyIGhvbGRzIHRoZSBDQTwvdGV4dD4KPHRleHQgeD0iNDk0IiB5PSI3NSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+bm8gc2lnbmluZyByZXNvdXJjZTwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI5MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTQiIHk9IjExMiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNyI+a2luZDogQ2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTI3IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5zaWduZWQgYnkgdGhlIENBIElzc3VlcjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5jZXJ0LW1hbmFnZXIgcmVuZXdzIGVhY2ggQ2VydGlmaWNhdGUgYmVmb3JlIGl0IGV4cGlyZXMuPC90ZXh0Pgo8L3N2Zz4=)

The issuer already holds the CA, so there is no separate signing step; cert-manager renews certificates automatically.

#### Issuance scoping

Kubernetes RBAC controls who can create `Certificate` resources and use each issuer, along with the namespace an `Issuer` lives in. It does not reproduce the AWS `acm-pca:TemplateArn` IAM condition. When you translate issuance restrictions, review which callers can request certificates and which issuers they can reference.

![On AWS, the acm-pca:TemplateArn IAM condition limits issuance. cert-manager limits it with Kubernetes RBAC on Certificate and Issuer objects, and has no template condition.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY2IiB2aWV3Qm94PSIwIDAgODM2IDE2NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHRoZSBhY20tcGNhOlRlbXBsYXRlQXJuIElBTSBjb25kaXRpb24gbGltaXRzIGlzc3VhbmNlLiBjZXJ0LW1hbmFnZXIgbGltaXRzIGl0IHdpdGggS3ViZXJuZXRlcyBSQkFDIG9uIENlcnRpZmljYXRlIGFuZCBJc3N1ZXIgb2JqZWN0cywgYW5kIGhhcyBubyB0ZW1wbGF0ZSBjb25kaXRpb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjA0IiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4Ij5hY20tcGNhOlRlbXBsYXRlQXJuPC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmFuIElBTSBjb25kaXRpb24gb24gd2hvIG1heTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5pc3N1ZSB3aGljaCB0ZW1wbGF0ZTwvdGV4dD4KPGxpbmUgeDE9IjM5MCIgeTE9Ijg2IiB4Mj0iNDQ2IiB5Mj0iODYiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+YmVjb21lczwvdGV4dD4KPHJlY3QgeD0iNDUyIiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjMyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5jZXJ0LW1hbmFnZXI8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPkt1YmVybmV0ZXMgUkJBQyBvbjwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPkNlcnRpZmljYXRlICsgSXNzdWVyIG9iamVjdHM8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNiNDUzMDkiPm5vIHRlbXBsYXRlIGNvbmRpdGlvbjwvdGV4dD4KPC9zdmc+)

![On AWS, the acm-pca:TemplateArn IAM condition limits issuance. cert-manager limits it with Kubernetes RBAC on Certificate and Issuer objects, and has no template condition.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY2IiB2aWV3Qm94PSIwIDAgODM2IDE2NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHRoZSBhY20tcGNhOlRlbXBsYXRlQXJuIElBTSBjb25kaXRpb24gbGltaXRzIGlzc3VhbmNlLiBjZXJ0LW1hbmFnZXIgbGltaXRzIGl0IHdpdGggS3ViZXJuZXRlcyBSQkFDIG9uIENlcnRpZmljYXRlIGFuZCBJc3N1ZXIgb2JqZWN0cywgYW5kIGhhcyBubyB0ZW1wbGF0ZSBjb25kaXRpb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjA0IiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4Ij5hY20tcGNhOlRlbXBsYXRlQXJuPC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmFuIElBTSBjb25kaXRpb24gb24gd2hvIG1heTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5pc3N1ZSB3aGljaCB0ZW1wbGF0ZTwvdGV4dD4KPGxpbmUgeDE9IjM5MCIgeTE9Ijg2IiB4Mj0iNDQ2IiB5Mj0iODYiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+YmVjb21lczwvdGV4dD4KPHJlY3QgeD0iNDUyIiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjMyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5jZXJ0LW1hbmFnZXI8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPkt1YmVybmV0ZXMgUkJBQyBvbjwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPkNlcnRpZmljYXRlICsgSXNzdWVyIG9iamVjdHM8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmYmJmMjQiPm5vIHRlbXBsYXRlIGNvbmRpdGlvbjwvdGV4dD4KPC9zdmc+)

Kubernetes RBAC decides who may request certificates; nothing matches the acm-pca:TemplateArn condition.

#### Revocation and CRLs

cert-manager does not generate or publish certificate revocation lists (CRLs) or Online Certificate Status Protocol (OCSP) responses. If your clients check revocation, the CA operator must provide these services. Short certificate lifetimes limit how long a compromised certificate stays valid, but they do not revoke it before it expires.

![ACM Private CA publishes CRLs to your S3 bucket. cert-manager has no built-in CRL, so the CA operator must provide revocation separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSBwdWJsaXNoZXMgQ1JMcyB0byB5b3VyIFMzIGJ1Y2tldC4gY2VydC1tYW5hZ2VyIGhhcyBubyBidWlsdC1pbiBDUkwsIHNvIHRoZSBDQSBvcGVyYXRvciBtdXN0IHByb3ZpZGUgcmV2b2NhdGlvbiBzZXBhcmF0ZWx5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8cmVjdCB4PSIyNCIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA2IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjIwNCIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+QUNNIFByaXZhdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweCI+Q1JMIOKGkiB5b3VyIFMzIGJ1Y2tldDwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5hIGN1c3RvbWVyLW93bmVkIGJ1Y2tldDwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5wbHVzIGl0cyBidWNrZXQgcG9saWN5PC90ZXh0Pgo8bGluZSB4MT0iMzkwIiB5MT0iODciIHgyPSI0NDYiIHkyPSI4NyIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNDE4IiB5PSI3OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwIj5ubyBlcXVpdmFsZW50PC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjM0IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjEwNiIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSI2MzIiIHk9IjU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPmNlcnQtbWFuYWdlcjwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjYjQ1MzA5Ij5ubyBidWlsdC1pbiBDUkw8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTAyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+c2hvcnQgbGlmZXRpbWVzICsgcm90YXRpb248L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+c2VwYXJhdGUgcmV2b2NhdGlvbiByZXF1aXJlZDwvdGV4dD4KPC9zdmc+)

![ACM Private CA publishes CRLs to your S3 bucket. cert-manager has no built-in CRL, so the CA operator must provide revocation separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSBwdWJsaXNoZXMgQ1JMcyB0byB5b3VyIFMzIGJ1Y2tldC4gY2VydC1tYW5hZ2VyIGhhcyBubyBidWlsdC1pbiBDUkwsIHNvIHRoZSBDQSBvcGVyYXRvciBtdXN0IHByb3ZpZGUgcmV2b2NhdGlvbiBzZXBhcmF0ZWx5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8cmVjdCB4PSIyNCIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA2IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjIwNCIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+QUNNIFByaXZhdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweCI+Q1JMIOKGkiB5b3VyIFMzIGJ1Y2tldDwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5hIGN1c3RvbWVyLW93bmVkIGJ1Y2tldDwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5wbHVzIGl0cyBidWNrZXQgcG9saWN5PC90ZXh0Pgo8bGluZSB4MT0iMzkwIiB5MT0iODciIHgyPSI0NDYiIHkyPSI4NyIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNDE4IiB5PSI3OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwIj5ubyBlcXVpdmFsZW50PC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjM0IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjEwNiIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSI2MzIiIHk9IjU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPmNlcnQtbWFuYWdlcjwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZmJiZjI0Ij5ubyBidWlsdC1pbiBDUkw8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTAyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+c2hvcnQgbGlmZXRpbWVzICsgcm90YXRpb248L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+c2VwYXJhdGUgcmV2b2NhdGlvbiByZXF1aXJlZDwvdGV4dD4KPC9zdmc+)

The CA operator must provide CRL generation and publication; cert-manager does not manage them.

#### Limitations

Limitations

* **You must operate the CA.** No cloud provider runs it. Your platform team runs cert-manager, protects the CA key in its Kubernetes Secret, and rotates the CA certificate.
* **Moving the AWS private key and certificate history is not supported:** cert-manager issues from a new private root with its own key. Certificates already issued on AWS keep chaining to the AWS root until they expire or are replaced.
* **CRLs and OCSP are not supported:** cert-manager publishes neither. ACM Private CA's S3 CRL bucket has no counterpart; if clients check revocation, the CA operator must provide it.
* **Issuance scoping behaves differently: there is no template condition.** An `acm-pca:TemplateArn` condition becomes Kubernetes RBAC on `Certificate` and issuer objects, plus the choice of `Issuer` or `ClusterIssuer`.
* **Hierarchies deeper than two tiers behave differently: you build them by hand.** There is no managed ROOT or SUBORDINATE type. Each extra tier needs its own issuer and CA certificate.
* **An organizational unit or country in the CA subject is not supported.** Only the common name and organization are copied to the CA certificate. Set the full distinguished name yourself if your certificate chain depends on it.
* **AWS-only CA settings are not supported.** A `usage_mode` other than `GENERAL_PURPOSE`, an `aws_acmpca_permission` grant to ACM, and `permanent_deletion_time_in_days` have no cert-manager equivalent; the deployment warns.

#### Other considerations

* **Before switching certificates.** Distribute the new root to client trust stores, and keep trusting the old root during the transition.
* **What to monitor.** Watch cert-manager and certificate renewal failures. Back up the CA Secret and rehearse CA rotation.
* **Hardware key protection.** If the CA key must be in hardware, choose and configure an external signer or HSM-backed issuer instead of storing the key in a Kubernetes Secret.

## On Google Cloud

### Certificate Authority Service

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Issuance scoping (acm-pca:TemplateArn IAM condition) | Access control | Partial | Most usage | the CA pool issuance\_policy (allowed key usages, identity constraints) plus IAM on the CA Service resources, not a one-to-one template-ARN principal condition |
| CSR-signing activation split (aws\_acmpca\_certificate\_authority\_certificate) | CA activation | Adapter-served | Most usage | the mapped infrastructure configures parent signing, CA activation, and the ENABLED state; native CA creation alone does not make a CA ready for pool issuance |
| ACM Private CA control plane (CreateCertificateAuthority / issuance API / …) | Control plane | Out of scope | Full surface | CA provisioning happens through your infrastructure-as-code at apply, not runtime ACM Private CA API calls |
| CA hierarchy (ROOT / SUBORDINATE types) | Hierarchy | Supported | Most usage | a SELF\_SIGNED root CA plus SUBORDINATE CAs mirror ACM Private CA's ROOT / SUBORDINATE types; a two-tier hierarchy maps directly, deeper trees add more subordinate CAs |
| Certificate issuance (aws\_acmpca\_certificate / IssueCertificate) | Issuance | Supported | Common | google\_privateca\_certificate leaves are issued from the pool and chain through a subordinate to the private root, with the subject / SANs / key usage / validity |
| Private CA provisioning (aws\_acmpca\_certificate\_authority) | Provisioning | Supported | Common | a google\_privateca\_ca\_pool with a SELF\_SIGNED root CA and SUBORDINATE CAs: a managed private CA that chains issued certificates to its own private root |
| CRL distribution (customer-owned S3 bucket) | Revocation | Partial | Full surface | CA Service publishes CRLs to a Google-managed or customer-managed Cloud Storage bucket; AWS S3 bucket policies require translation |

#### How it works

Your PKI keeps issuing X.509 certificates from a managed private certificate authority (CA). Tensor9 deploys the CA hierarchy on Google Certificate Authority Service: a CA pool that holds a root CA and subordinate CAs. Application certificates chain through a subordinate CA to that private root.

The CAs are created from your infrastructure code when the deployment is applied. Calls to the ACM Private CA API at run time are not part of this mapping. The root is new and has its own key, so clients must trust it before they receive certificates issued from it.

![On AWS, your PKI issues certificates from ACM Private CA. On Google Cloud, it issues them from a Certificate Authority Service CA pool that holds its own private root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgUEtJIGlzc3VlcyBjZXJ0aWZpY2F0ZXMgZnJvbSBBQ00gUHJpdmF0ZSBDQS4gT24gR29vZ2xlIENsb3VkLCBpdCBpc3N1ZXMgdGhlbSBmcm9tIGEgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IFNlcnZpY2UgQ0EgcG9vbCB0aGF0IGhvbGRzIGl0cyBvd24gcHJpdmF0ZSByb290LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhcGdjMWgiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzMiIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjM2IiB5PSI4MiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMTEiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPllvdXIgUEtJPC90ZXh0Pgo8dGV4dCB4PSIxMTEiIHk9IjEyNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmlzc3VlcyBYLjUwOSBjZXJ0czwvdGV4dD4KPGxpbmUgeDE9IjE4NiIgeTE9IjExMyIgeDI9IjIyNCIgeTI9IjExMyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjYXBnYzFoKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjIwNSIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5pc3N1ZTwvdGV4dD4KPHJlY3QgeD0iMjI0IiB5PSI4MiIgd2lkdGg9IjE1OCIgaGVpZ2h0PSI2MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzMDMiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMzAzIiB5PSIxMjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5wcml2YXRlIHJvb3Q8L3RleHQ+CjxyZWN0IHg9IjQzNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDUyIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+T04gR0NQPC90ZXh0Pgo8cmVjdCB4PSI0NTYiIHk9IjgyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUzMSIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+WW91ciBQS0k8L3RleHQ+Cjx0ZXh0IHg9IjUzMSIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmNlcnRpZmljYXRlIGlzc3VhbmNlPC90ZXh0Pgo8bGluZSB4MT0iNjA2IiB5MT0iMTEzIiB4Mj0iNjQ0IiB5Mj0iMTEzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNhcGdjMWgpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNjI1IiB5PSIxMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPmlzc3VlPC90ZXh0Pgo8cmVjdCB4PSI2NDQiIHk9IjgyIiB3aWR0aD0iMTU4IiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjcyMyIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPkNBIFNlcnZpY2U8L3RleHQ+Cjx0ZXh0IHg9IjcyMyIgeT0iMTI0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5DQSBwb29sIMK3IHByaXZhdGUgcm9vdDwvdGV4dD4KPC9zdmc+)

![On AWS, your PKI issues certificates from ACM Private CA. On Google Cloud, it issues them from a Certificate Authority Service CA pool that holds its own private root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgUEtJIGlzc3VlcyBjZXJ0aWZpY2F0ZXMgZnJvbSBBQ00gUHJpdmF0ZSBDQS4gT24gR29vZ2xlIENsb3VkLCBpdCBpc3N1ZXMgdGhlbSBmcm9tIGEgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IFNlcnZpY2UgQ0EgcG9vbCB0aGF0IGhvbGRzIGl0cyBvd24gcHJpdmF0ZSByb290LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhcGdjMWgiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjYuNSIgbWFya2VySGVpZ2h0PSI2LjUiIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzMiIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjM2IiB5PSI4MiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMTEiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPllvdXIgUEtJPC90ZXh0Pgo8dGV4dCB4PSIxMTEiIHk9IjEyNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmlzc3VlcyBYLjUwOSBjZXJ0czwvdGV4dD4KPGxpbmUgeDE9IjE4NiIgeTE9IjExMyIgeDI9IjIyNCIgeTI9IjExMyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjYXBnYzFoKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjIwNSIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5pc3N1ZTwvdGV4dD4KPHJlY3QgeD0iMjI0IiB5PSI4MiIgd2lkdGg9IjE1OCIgaGVpZ2h0PSI2MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzMDMiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMzAzIiB5PSIxMjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5wcml2YXRlIHJvb3Q8L3RleHQ+CjxyZWN0IHg9IjQzNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTIwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDUyIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+T04gR0NQPC90ZXh0Pgo8cmVjdCB4PSI0NTYiIHk9IjgyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUzMSIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+WW91ciBQS0k8L3RleHQ+Cjx0ZXh0IHg9IjUzMSIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmNlcnRpZmljYXRlIGlzc3VhbmNlPC90ZXh0Pgo8bGluZSB4MT0iNjA2IiB5MT0iMTEzIiB4Mj0iNjQ0IiB5Mj0iMTEzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNhcGdjMWgpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNjI1IiB5PSIxMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPmlzc3VlPC90ZXh0Pgo8cmVjdCB4PSI2NDQiIHk9IjgyIiB3aWR0aD0iMTU4IiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjcyMyIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPkNBIFNlcnZpY2U8L3RleHQ+Cjx0ZXh0IHg9IjcyMyIgeT0iMTI0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5DQSBwb29sIMK3IHByaXZhdGUgcm9vdDwvdGV4dD4KPC9zdmc+)

Your certificates still chain to a private root you control, but it is a new root held by CA Service.

#### Architecture

Google runs Certificate Authority Service and protects the CA keys. In Terraform, the `google_privateca_ca_pool` holds the issuance policy, `google_privateca_certificate_authority` resources define the root and subordinate CAs, and each `google_privateca_certificate` is one issued certificate. The trust stores on your clients still decide which private roots your application trusts.

![One CA pool holds a self-signed root CA and subordinate CAs. A subordinate CA issues your certificates, which chain to the root. The pool's issuance policy limits what may be issued.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbmUgQ0EgcG9vbCBob2xkcyBhIHNlbGYtc2lnbmVkIHJvb3QgQ0EgYW5kIHN1Ym9yZGluYXRlIENBcy4gQSBzdWJvcmRpbmF0ZSBDQSBpc3N1ZXMgeW91ciBjZXJ0aWZpY2F0ZXMsIHdoaWNoIGNoYWluIHRvIHRoZSByb290LiBUaGUgcG9vbCdzIGlzc3VhbmNlIHBvbGljeSBsaW1pdHMgd2hhdCBtYXkgYmUgaXNzdWVkLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8cmVjdCB4PSIxOCIgeT0iMzQiIHdpZHRoPSI4MDAiIGhlaWdodD0iMTY0IiByeD0iMTYiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjM2IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+R0NQIENFUlRJRklDQVRFIEFVVEhPUklUWSBTRVJWSUNFIMK3IG9uZSBDQSBwb29sPC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iNzIiIHdpZHRoPSIxODAiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjEzMCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+Um9vdCBDQTwvdGV4dD4KPHRleHQgeD0iMTMwIiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweCI+U0VMRl9TSUdORUQ8L3RleHQ+Cjx0ZXh0IHg9IjEzMCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHRleHQgeD0iMTMwIiB5PSIxNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5vZiB0cnVzdDwvdGV4dD4KPGxpbmUgeDE9IjIyMCIgeTE9IjEyNSIgeDI9IjI2NiIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIyNDMiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+c2lnbnM8L3RleHQ+CjxyZWN0IHg9IjI2OCIgeT0iNzIiIHdpZHRoPSIxODAiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjM1OCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+U3Vib3JkaW5hdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPlNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSIzNTgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmlzc3VlcyBjZXJ0aWZpY2F0ZXM8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+Zm9yIHRoZSB3b3JrbG9hZDwvdGV4dD4KPGxpbmUgeDE9IjQ0OCIgeTE9IjEyNSIgeDI9IjQ5NCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI0NzEiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWVzPC90ZXh0Pgo8cmVjdCB4PSI0OTYiIHk9IjcyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1ODYiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPllvdXIgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPnByaXZhdGVjYV9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNTg2IiB5PSIxNTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5jaGFpbnMgdG88L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNjk2IiB5PSI3MiIgd2lkdGg9IjEwNCIgaGVpZ2h0PSIxMDYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzQ4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMDtmaWxsOiMzMzQxNTUiPmlzc3VhbmNlPC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjEyNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwO2ZpbGw6IzMzNDE1NSI+cG9saWN5PC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPm9uIHRoZSBwb29sPC90ZXh0Pgo8L3N2Zz4=)

![One CA pool holds a self-signed root CA and subordinate CAs. A subordinate CA issues your certificates, which chain to the root. The pool's issuance policy limits what may be issued.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbmUgQ0EgcG9vbCBob2xkcyBhIHNlbGYtc2lnbmVkIHJvb3QgQ0EgYW5kIHN1Ym9yZGluYXRlIENBcy4gQSBzdWJvcmRpbmF0ZSBDQSBpc3N1ZXMgeW91ciBjZXJ0aWZpY2F0ZXMsIHdoaWNoIGNoYWluIHRvIHRoZSByb290LiBUaGUgcG9vbCdzIGlzc3VhbmNlIHBvbGljeSBsaW1pdHMgd2hhdCBtYXkgYmUgaXNzdWVkLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8cmVjdCB4PSIxOCIgeT0iMzQiIHdpZHRoPSI4MDAiIGhlaWdodD0iMTY0IiByeD0iMTYiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjM2IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+R0NQIENFUlRJRklDQVRFIEFVVEhPUklUWSBTRVJWSUNFIMK3IG9uZSBDQSBwb29sPC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iNzIiIHdpZHRoPSIxODAiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjEzMCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+Um9vdCBDQTwvdGV4dD4KPHRleHQgeD0iMTMwIiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweCI+U0VMRl9TSUdORUQ8L3RleHQ+Cjx0ZXh0IHg9IjEzMCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHRleHQgeD0iMTMwIiB5PSIxNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5vZiB0cnVzdDwvdGV4dD4KPGxpbmUgeDE9IjIyMCIgeTE9IjEyNSIgeDI9IjI2NiIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIyNDMiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+c2lnbnM8L3RleHQ+CjxyZWN0IHg9IjI2OCIgeT0iNzIiIHdpZHRoPSIxODAiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjM1OCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+U3Vib3JkaW5hdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPlNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSIzNTgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmlzc3VlcyBjZXJ0aWZpY2F0ZXM8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+Zm9yIHRoZSB3b3JrbG9hZDwvdGV4dD4KPGxpbmUgeDE9IjQ0OCIgeTE9IjEyNSIgeDI9IjQ5NCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI0NzEiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWVzPC90ZXh0Pgo8cmVjdCB4PSI0OTYiIHk9IjcyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1ODYiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPllvdXIgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPnByaXZhdGVjYV9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNTg2IiB5PSIxNTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5jaGFpbnMgdG88L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNjk2IiB5PSI3MiIgd2lkdGg9IjEwNCIgaGVpZ2h0PSIxMDYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzQ4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMDtmaWxsOiNjYmQ1ZTEiPmlzc3VhbmNlPC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjEyNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwO2ZpbGw6I2NiZDVlMSI+cG9saWN5PC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPm9uIHRoZSBwb29sPC90ZXh0Pgo8L3N2Zz4=)

The root signs subordinate CAs, which issue your certificates; the pool's issuance policy limits what they issue.

#### The CA hierarchy

The `SELF_SIGNED` root signs subordinate CAs, and the subordinates issue application certificates. A two-tier hierarchy maps directly; a deeper tree adds more subordinate CAs. The root is new and has a new key. Certificates already issued on AWS keep chaining to the AWS root until they expire or are reissued, so distribute the new root to clients before you switch issuance.

![An ACM Private CA of type ROOT becomes a SELF\_SIGNED root CA in the pool, and a SUBORDINATE CA becomes a SUBORDINATE CA.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBQ00gUHJpdmF0ZSBDQSBvZiB0eXBlIFJPT1QgYmVjb21lcyBhIFNFTEZfU0lHTkVEIHJvb3QgQ0EgaW4gdGhlIHBvb2wsIGFuZCBhIFNVQk9SRElOQVRFIENBIGJlY29tZXMgYSBTVUJPUkRJTkFURSBDQS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPkFDTSBQUklWQVRFIENBPC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iNDIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2MCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPnR5cGUgPSBST09UPC90ZXh0Pgo8dGV4dCB4PSIyMDAiIHk9IjY2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjAiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+dHlwZSA9IFNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSIyMDUiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmlzc3VlcyB0byB0aGUgd29ya2xvYWQ8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI4NyIgeDI9IjQ3MCIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+Cjx0ZXh0IHg9IjYzNiIgeT0iMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkNBIFNFUlZJQ0UgwrcgaW4gdGhlIHBvb2w8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iNDIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTQiIHk9IjY2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij50eXBlID0gU0VMRl9TSUdORUQ8L3RleHQ+Cjx0ZXh0IHg9IjY0OCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPnJvb3QgQ0E8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iOTIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTQiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1NyI+dHlwZSA9IFNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSI2NDgiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+c3Vib3JkaW5hdGUgQ0E8L3RleHQ+Cjwvc3ZnPg==)

![An ACM Private CA of type ROOT becomes a SELF\_SIGNED root CA in the pool, and a SUBORDINATE CA becomes a SUBORDINATE CA.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBQ00gUHJpdmF0ZSBDQSBvZiB0eXBlIFJPT1QgYmVjb21lcyBhIFNFTEZfU0lHTkVEIHJvb3QgQ0EgaW4gdGhlIHBvb2wsIGFuZCBhIFNVQk9SRElOQVRFIENBIGJlY29tZXMgYSBTVUJPUkRJTkFURSBDQS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPkFDTSBQUklWQVRFIENBPC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iNDIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2MCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPnR5cGUgPSBST09UPC90ZXh0Pgo8dGV4dCB4PSIyMDAiIHk9IjY2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjAiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+dHlwZSA9IFNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSIyMDUiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmlzc3VlcyB0byB0aGUgd29ya2xvYWQ8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI4NyIgeDI9IjQ3MCIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+Cjx0ZXh0IHg9IjYzNiIgeT0iMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkNBIFNFUlZJQ0UgwrcgaW4gdGhlIHBvb2w8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iNDIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0OTQiIHk9IjY2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij50eXBlID0gU0VMRl9TSUdORUQ8L3RleHQ+Cjx0ZXh0IHg9IjY0OCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPnJvb3QgQ0E8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iOTIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0OTQiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNyI+dHlwZSA9IFNVQk9SRElOQVRFPC90ZXh0Pgo8dGV4dCB4PSI2NDgiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+c3Vib3JkaW5hdGUgQ0E8L3RleHQ+Cjwvc3ZnPg==)

A ROOT CA becomes a SELF\_SIGNED CA in the pool; a SUBORDINATE CA stays SUBORDINATE.

#### Issuing certificates

ACM Private CA splits signing a CA's certificate-signing request (CSR) from installing the signed CA certificate, as two Terraform resources. On Google Cloud the deployment does both: the parent CA signs each subordinate, the subordinate is activated, and each CA is enabled. A newly created Google CA cannot issue until it is enabled, a subordinate CA must be activated first, and a pool issues only from an enabled CA.

Each application certificate sets its subject, subject alternative names (SANs), key usages and validity. The pool's issuance policy limits what can be issued.

![ACM Private CA uses two Terraform resources to sign and install a CA certificate. On Google Cloud, the deployment signs, activates and enables each CA, and the pool then issues your certificates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg2IiB2aWV3Qm94PSIwIDAgODM2IDE4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSB1c2VzIHR3byBUZXJyYWZvcm0gcmVzb3VyY2VzIHRvIHNpZ24gYW5kIGluc3RhbGwgYSBDQSBjZXJ0aWZpY2F0ZS4gT24gR29vZ2xlIENsb3VkLCB0aGUgZGVwbG95bWVudCBzaWducywgYWN0aXZhdGVzIGFuZCBlbmFibGVzIGVhY2ggQ0EsIGFuZCB0aGUgcG9vbCB0aGVuIGlzc3VlcyB5b3VyIGNlcnRpZmljYXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPkFDTSBQUklWQVRFIENBIMK3IHR3byByZXNvdXJjZXM8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI0MCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1MiIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmF3c19hY21wY2FfY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUyIiB5PSI3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnNpZ25zIHRoZSBDU1I8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI5MiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1MiIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij4uLi5fY2VydGlmaWNhdGVfYXV0aG9yaXR5X2NlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI1MiIgeT0iMTI3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+aW5zdGFsbHMgLyBhY3RpdmF0ZXMgdGhlIENBPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iODciIHgyPSI0NzAiIHkyPSI4NyIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNDE4IiB5PSI3OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwIj5oYW5kbGVkIGJ5PC90ZXh0Pgo8dGV4dCB4PSI2MzYiIHk9IjI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5DQSBTRVJWSUNFIMK3IGRvbmUgYXQgZGVwbG95PC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9IjQwIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5EZXBsb3ltZW50IHJlYWRpZXMgdGhlIENBPC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9Ijc1IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5zaWducywgYWN0aXZhdGVzLCBlbmFibGVzPC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij5nb29nbGVfcHJpdmF0ZWNhX2NlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9IjEyNyIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+aXNzdWVkIGZyb20gdGhlIHBvb2w8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMTY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+RXZlcnkgY2VydGlmaWNhdGUgY2hhaW5zIHRocm91Z2ggYSBzdWJvcmRpbmF0ZSBDQSB0byB0aGUgcm9vdC48L3RleHQ+Cjwvc3ZnPg==)

![ACM Private CA uses two Terraform resources to sign and install a CA certificate. On Google Cloud, the deployment signs, activates and enables each CA, and the pool then issues your certificates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg2IiB2aWV3Qm94PSIwIDAgODM2IDE4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSB1c2VzIHR3byBUZXJyYWZvcm0gcmVzb3VyY2VzIHRvIHNpZ24gYW5kIGluc3RhbGwgYSBDQSBjZXJ0aWZpY2F0ZS4gT24gR29vZ2xlIENsb3VkLCB0aGUgZGVwbG95bWVudCBzaWducywgYWN0aXZhdGVzIGFuZCBlbmFibGVzIGVhY2ggQ0EsIGFuZCB0aGUgcG9vbCB0aGVuIGlzc3VlcyB5b3VyIGNlcnRpZmljYXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPkFDTSBQUklWQVRFIENBIMK3IHR3byByZXNvdXJjZXM8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI0MCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1MiIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmF3c19hY21wY2FfY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUyIiB5PSI3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnNpZ25zIHRoZSBDU1I8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI5MiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1MiIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj4uLi5fY2VydGlmaWNhdGVfYXV0aG9yaXR5X2NlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI1MiIgeT0iMTI3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+aW5zdGFsbHMgLyBhY3RpdmF0ZXMgdGhlIENBPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iODciIHgyPSI0NzAiIHkyPSI4NyIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNDE4IiB5PSI3OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwIj5oYW5kbGVkIGJ5PC90ZXh0Pgo8dGV4dCB4PSI2MzYiIHk9IjI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5DQSBTRVJWSUNFIMK3IGRvbmUgYXQgZGVwbG95PC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9IjQwIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5EZXBsb3ltZW50IHJlYWRpZXMgdGhlIENBPC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9Ijc1IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5zaWducywgYWN0aXZhdGVzLCBlbmFibGVzPC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij5nb29nbGVfcHJpdmF0ZWNhX2NlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9IjEyNyIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+aXNzdWVkIGZyb20gdGhlIHBvb2w8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMTY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+RXZlcnkgY2VydGlmaWNhdGUgY2hhaW5zIHRocm91Z2ggYSBzdWJvcmRpbmF0ZSBDQSB0byB0aGUgcm9vdC48L3RleHQ+Cjwvc3ZnPg==)

The deployment signs, activates and enables each CA before the pool issues certificates.

#### Issuance scoping

On AWS, the `acm-pca:TemplateArn` IAM condition limits which certificate templates a principal can request. Google splits this in two: Google IAM permissions decide who can use the CA resources, and the pool's `issuance_policy` limits certificate identities and key usages. Review both when you translate a policy that varies by principal and template.

![The acm-pca:TemplateArn IAM condition on AWS is covered by the CA pool's issuance policy together with Google IAM. Neither is a one-to-one template condition.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY2IiB2aWV3Qm94PSIwIDAgODM2IDE2NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYWNtLXBjYTpUZW1wbGF0ZUFybiBJQU0gY29uZGl0aW9uIG9uIEFXUyBpcyBjb3ZlcmVkIGJ5IHRoZSBDQSBwb29sJ3MgaXNzdWFuY2UgcG9saWN5IHRvZ2V0aGVyIHdpdGggR29vZ2xlIElBTS4gTmVpdGhlciBpcyBhIG9uZS10by1vbmUgdGVtcGxhdGUgY29uZGl0aW9uLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8cmVjdCB4PSIyNCIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA0IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjIwNCIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+QUNNIFByaXZhdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweCI+YWNtLXBjYTpUZW1wbGF0ZUFybjwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5hbiBJQU0gY29uZGl0aW9uIG9uIHdobyBtYXk8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+aXNzdWUgd2hpY2ggdGVtcGxhdGU8L3RleHQ+CjxsaW5lIHgxPSIzOTAiIHkxPSI4NiIgeDI9IjQ0NiIgeTI9Ijg2IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA0IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjYzMiIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+Q0EgU2VydmljZSBwb29sPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPmlzc3VhbmNlX3BvbGljeTwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmFsbG93ZWQga2V5IHVzYWdlcyArPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjEyMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+aWRlbnRpdHkgY29uc3RyYWludHM8L3RleHQ+Cjwvc3ZnPg==)

![The acm-pca:TemplateArn IAM condition on AWS is covered by the CA pool's issuance policy together with Google IAM. Neither is a one-to-one template condition.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY2IiB2aWV3Qm94PSIwIDAgODM2IDE2NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYWNtLXBjYTpUZW1wbGF0ZUFybiBJQU0gY29uZGl0aW9uIG9uIEFXUyBpcyBjb3ZlcmVkIGJ5IHRoZSBDQSBwb29sJ3MgaXNzdWFuY2UgcG9saWN5IHRvZ2V0aGVyIHdpdGggR29vZ2xlIElBTS4gTmVpdGhlciBpcyBhIG9uZS10by1vbmUgdGVtcGxhdGUgY29uZGl0aW9uLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8cmVjdCB4PSIyNCIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA0IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjIwNCIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+QUNNIFByaXZhdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweCI+YWNtLXBjYTpUZW1wbGF0ZUFybjwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5hbiBJQU0gY29uZGl0aW9uIG9uIHdobyBtYXk8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+aXNzdWUgd2hpY2ggdGVtcGxhdGU8L3RleHQ+CjxsaW5lIHgxPSIzOTAiIHkxPSI4NiIgeDI9IjQ0NiIgeTI9Ijg2IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA0IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjYzMiIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+Q0EgU2VydmljZSBwb29sPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPmlzc3VhbmNlX3BvbGljeTwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmFsbG93ZWQga2V5IHVzYWdlcyArPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjEyMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+aWRlbnRpdHkgY29uc3RyYWludHM8L3RleHQ+Cjwvc3ZnPg==)

The pool's issuance policy and Google IAM together replace the template condition; neither matches it one to one.

#### Revocation and CRLs

A certificate revocation list (CRL) names certificates that clients should no longer trust. CA Service publishes CRLs itself, to a Cloud Storage bucket that either Google or you manage. The S3 bucket, its bucket policy and any custom CRL CNAME from ACM Private CA have no counterpart. You configure publication, bucket permissions and the distribution point clients use, and point any automation that reads or copies the old S3 CRL at the new location.

![CA Service publishes CRLs to a Google-managed or customer-managed Cloud Storage bucket.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJDQSBTZXJ2aWNlIHB1Ymxpc2hlcyBDUkxzIHRvIGEgR29vZ2xlLW1hbmFnZWQgb3IgY3VzdG9tZXItbWFuYWdlZCBDbG91ZCBTdG9yYWdlIGJ1Y2tldC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHJlY3QgeD0iMjQiIHk9IjM0IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjEwNiIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyMDQiIHk9IjU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPkFDTSBQcml2YXRlIENBPC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPkNSTCDihpIgeW91ciBTMyBidWNrZXQ8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+YSBjdXN0b21lci1vd25lZCBidWNrZXQ8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cGx1cyBpdHMgYnVja2V0IHBvbGljeTwvdGV4dD4KPGxpbmUgeDE9IjM5MCIgeTE9Ijg3IiB4Mj0iNDQ2IiB5Mj0iODciIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+bWFwcyB0bzwvdGV4dD4KPHJlY3QgeD0iNDUyIiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDYiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjMyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5DQSBTZXJ2aWNlPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5wdWJsaXNoZXMgQ1JMczwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2I0NTMwOSI+Y29uZmlndXJlZDwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2I0NTMwOSI+Q2xvdWQgU3RvcmFnZSBidWNrZXQ8L3RleHQ+Cjwvc3ZnPg==)

![CA Service publishes CRLs to a Google-managed or customer-managed Cloud Storage bucket.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJDQSBTZXJ2aWNlIHB1Ymxpc2hlcyBDUkxzIHRvIGEgR29vZ2xlLW1hbmFnZWQgb3IgY3VzdG9tZXItbWFuYWdlZCBDbG91ZCBTdG9yYWdlIGJ1Y2tldC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHJlY3QgeD0iMjQiIHk9IjM0IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjEwNiIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyMDQiIHk9IjU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPkFDTSBQcml2YXRlIENBPC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPkNSTCDihpIgeW91ciBTMyBidWNrZXQ8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+YSBjdXN0b21lci1vd25lZCBidWNrZXQ8L3RleHQ+Cjx0ZXh0IHg9IjIwNCIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cGx1cyBpdHMgYnVja2V0IHBvbGljeTwvdGV4dD4KPGxpbmUgeDE9IjM5MCIgeTE9Ijg3IiB4Mj0iNDQ2IiB5Mj0iODciIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+bWFwcyB0bzwvdGV4dD4KPHJlY3QgeD0iNDUyIiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDYiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjMyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5DQSBTZXJ2aWNlPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5wdWJsaXNoZXMgQ1JMczwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2ZiYmYyNCI+Y29uZmlndXJlZDwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2ZiYmYyNCI+Q2xvdWQgU3RvcmFnZSBidWNrZXQ8L3RleHQ+Cjwvc3ZnPg==)

CA Service publishes CRLs to a Google-managed or customer-managed Cloud Storage bucket.

#### Limitations

Limitations

* **Moving the AWS private key and certificate history is not supported.** CA Service issues from a new root with its own key. Certificates already issued on AWS keep chaining to the AWS root until they expire or are replaced.
* **Issuance scoping behaves differently: there is no template condition.** An `acm-pca:TemplateArn` condition becomes the pool's `issuance_policy` plus Google IAM. Translate both who may request certificates and what they may contain.
* **CRLs in your S3 bucket are not supported.** CA Service publishes CRLs to Cloud Storage. The S3 bucket, its bucket policy, its expiration setting and any custom CNAME are not kept; you set up the bucket and distribution point.
* **An OCSP responder is not supported.** If the AWS CA runs OCSP, CA Service offers no matching endpoint. Clients check revocation with CRLs or rely on short certificate lifetimes, and the deployment reports a warning.
* **An organizational unit or country in the CA subject is not supported.** Only the common name and organization are kept; the deployment warns about any other part it drops. Set the full distinguished name on the CA yourself if your certificate chain depends on it.
* **AWS-only CA settings are not supported.** A `usage_mode` other than `GENERAL_PURPOSE`, an `aws_acmpca_permission` grant to ACM, and `permanent_deletion_time_in_days` have no Google equivalent. The deployment warns, and Google's own settings apply.
* **Runtime ACM Private CA API calls are not supported.** CAs are created from your infrastructure code when the deployment is applied, not by calls to the ACM Private CA API.

#### Other considerations

* **Before switching issuance.** Distribute the new root to clients before you issue replacement certificates, and keep trusting the old root while certificates it issued are still in use.
* **CA settings.** Confirm key algorithms and key protection when the CA is created. Set CA and certificate validity periods, and plan renewal before they expire.
* **Before going live.** Test issuance and client revocation checks from the target environment.

## On OCI

### OCI Certificate Authority

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Issuance scoping (acm-pca:TemplateArn IAM condition) | Access control | Partial | Most usage | OCI IAM compartment policy on the CA plus the CA's issuance configuration, not a one-to-one template-ARN principal condition |
| CSR-signing activation split (aws\_acmpca\_certificate\_authority\_certificate) | CA activation | Adapter-served | Most usage | the CSR-sign-then-install resource pair is implicit in OCI CA creation; there is no separate signing resource to reference |
| ACM Private CA control plane (CreateCertificateAuthority / issuance API / …) | Control plane | Out of scope | Full surface | CA provisioning happens through your infrastructure-as-code at apply, not runtime ACM Private CA API calls |
| CA hierarchy (ROOT / SUBORDINATE types) | Hierarchy | Supported | Most usage | a root CA plus subordinate CAs mirror ACM Private CA's ROOT / SUBORDINATE types; a two-tier hierarchy maps directly, deeper trees add more subordinate CAs to the compartment |
| Certificate issuance (aws\_acmpca\_certificate / IssueCertificate) | Issuance | Supported | Common | leaf certificates are issued from the CA and chain to the private root, with the subject / SANs / key usage / validity; OCI Certificates rotates managed certificates natively |
| Private CA provisioning (aws\_acmpca\_certificate\_authority) | Provisioning | Supported | Common | an oci\_certificates\_management\_certificate\_authority root or subordinate CA in a compartment: a managed private CA that chains issued certificates to its own private root |
| CRL distribution (customer-owned S3 bucket) | Revocation | Partial | Full surface | OCI Certificates publishes CRLs to a configured Object Storage bucket; translate bucket permissions and the distribution point |

#### How it works

Your PKI keeps issuing X.509 certificates from a managed private certificate authority (CA). Tensor9 deploys root and subordinate CAs in OCI Certificates, in a compartment. They issue application certificates that chain to a private root you control.

The CAs are created from your infrastructure code when the deployment is applied. Calls to the ACM Private CA API at run time are not part of this mapping. The root is new and has its own key, so clients must trust it before they receive certificates issued from it.

![On AWS, your PKI issues certificates from ACM Private CA. On OCI, it issues them from an OCI Certificates CA in a compartment, which holds its own private root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgUEtJIGlzc3VlcyBjZXJ0aWZpY2F0ZXMgZnJvbSBBQ00gUHJpdmF0ZSBDQS4gT24gT0NJLCBpdCBpc3N1ZXMgdGhlbSBmcm9tIGFuIE9DSSBDZXJ0aWZpY2F0ZXMgQ0EgaW4gYSBjb21wYXJ0bWVudCwgd2hpY2ggaG9sZHMgaXRzIG93biBwcml2YXRlIHJvb3QuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImFwb2MxaCIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNi41IiBtYXJrZXJIZWlnaHQ9IjYuNSIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMyIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzYiIHk9IjgyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExMSIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+WW91ciBQS0k8L3RleHQ+Cjx0ZXh0IHg9IjExMSIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+aXNzdWVzIFguNTA5IGNlcnRzPC90ZXh0Pgo8bGluZSB4MT0iMTg2IiB5MT0iMTEzIiB4Mj0iMjI0IiB5Mj0iMTEzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNhcG9jMWgpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMjA1IiB5PSIxMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPmlzc3VlPC90ZXh0Pgo8cmVjdCB4PSIyMjQiIHk9IjgyIiB3aWR0aD0iMTU4IiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwMyIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPkFDTSBQcml2YXRlIENBPC90ZXh0Pgo8dGV4dCB4PSIzMDMiIHk9IjEyNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NTIiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBPQ0k8L3RleHQ+CjxyZWN0IHg9IjQ1NiIgeT0iODIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNTMxIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Zb3VyIFBLSTwvdGV4dD4KPHRleHQgeD0iNTMxIiB5PSIxMjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+Y2VydGlmaWNhdGUgaXNzdWFuY2U8L3RleHQ+CjxsaW5lIHgxPSI2MDYiIHkxPSIxMTMiIHgyPSI2NDQiIHkyPSIxMTMiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2Fwb2MxaCkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI2MjUiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWU8L3RleHQ+CjxyZWN0IHg9IjY0NCIgeT0iODIiIHdpZHRoPSIxNTgiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNzIzIiB5PSIxMDciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+T0NJIENlcnRpZmljYXRlczwvdGV4dD4KPHRleHQgeD0iNzIzIiB5PSIxMjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPkNBIMK3IHByaXZhdGUgcm9vdDwvdGV4dD4KPC9zdmc+)

![On AWS, your PKI issues certificates from ACM Private CA. On OCI, it issues them from an OCI Certificates CA in a compartment, which holds its own private root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgUEtJIGlzc3VlcyBjZXJ0aWZpY2F0ZXMgZnJvbSBBQ00gUHJpdmF0ZSBDQS4gT24gT0NJLCBpdCBpc3N1ZXMgdGhlbSBmcm9tIGFuIE9DSSBDZXJ0aWZpY2F0ZXMgQ0EgaW4gYSBjb21wYXJ0bWVudCwgd2hpY2ggaG9sZHMgaXRzIG93biBwcml2YXRlIHJvb3QuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImFwb2MxaCIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNi41IiBtYXJrZXJIZWlnaHQ9IjYuNSIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEyMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMyIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzYiIHk9IjgyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExMSIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+WW91ciBQS0k8L3RleHQ+Cjx0ZXh0IHg9IjExMSIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+aXNzdWVzIFguNTA5IGNlcnRzPC90ZXh0Pgo8bGluZSB4MT0iMTg2IiB5MT0iMTEzIiB4Mj0iMjI0IiB5Mj0iMTEzIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNhcG9jMWgpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMjA1IiB5PSIxMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPmlzc3VlPC90ZXh0Pgo8cmVjdCB4PSIyMjQiIHk9IjgyIiB3aWR0aD0iMTU4IiBoZWlnaHQ9IjYyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwMyIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPkFDTSBQcml2YXRlIENBPC90ZXh0Pgo8dGV4dCB4PSIzMDMiIHk9IjEyNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnByaXZhdGUgcm9vdDwvdGV4dD4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxMjAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NTIiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBPQ0k8L3RleHQ+CjxyZWN0IHg9IjQ1NiIgeT0iODIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNTMxIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Zb3VyIFBLSTwvdGV4dD4KPHRleHQgeD0iNTMxIiB5PSIxMjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+Y2VydGlmaWNhdGUgaXNzdWFuY2U8L3RleHQ+CjxsaW5lIHgxPSI2MDYiIHkxPSIxMTMiIHgyPSI2NDQiIHkyPSIxMTMiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2Fwb2MxaCkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI2MjUiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWU8L3RleHQ+CjxyZWN0IHg9IjY0NCIgeT0iODIiIHdpZHRoPSIxNTgiIGhlaWdodD0iNjIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNzIzIiB5PSIxMDciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+T0NJIENlcnRpZmljYXRlczwvdGV4dD4KPHRleHQgeD0iNzIzIiB5PSIxMjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPkNBIMK3IHByaXZhdGUgcm9vdDwvdGV4dD4KPC9zdmc+)

Your certificates still chain to a private root you control, but it is a new root held by OCI Certificates.

#### Architecture

Oracle runs OCI Certificates, and the CA hierarchy lives in a compartment. OCI IAM decides who may manage a CA or request certificates. Managed leaf certificate renewal follows configured rules: certificates that OCI manages renew automatically, by the renewal rules you set. CA renewal is initiated by the customer: you start it, and you rotate the CA vault key before creating the renewed CA version. The trust stores on your clients still decide which private roots your application trusts.

![One compartment holds a root CA and subordinate CAs. A subordinate CA issues your certificates, which chain to the root. OCI IAM policy on the compartment controls who may issue.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbmUgY29tcGFydG1lbnQgaG9sZHMgYSByb290IENBIGFuZCBzdWJvcmRpbmF0ZSBDQXMuIEEgc3Vib3JkaW5hdGUgQ0EgaXNzdWVzIHlvdXIgY2VydGlmaWNhdGVzLCB3aGljaCBjaGFpbiB0byB0aGUgcm9vdC4gT0NJIElBTSBwb2xpY3kgb24gdGhlIGNvbXBhcnRtZW50IGNvbnRyb2xzIHdobyBtYXkgaXNzdWUuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxyZWN0IHg9IjE4IiB5PSIzNCIgd2lkdGg9IjgwMCIgaGVpZ2h0PSIxNjQiIHJ4PSIxNiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzYiIHk9IjU2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PQ0kgQ0VSVElGSUNBVEVTIMK3IG9uZSBjb21wYXJ0bWVudDwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjcyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSIxMzAiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlJvb3QgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjEzMCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPlJPT1RfQ0E8L3RleHQ+Cjx0ZXh0IHg9IjEzMCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHRleHQgeD0iMTMwIiB5PSIxNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5vZiB0cnVzdDwvdGV4dD4KPGxpbmUgeDE9IjIyMCIgeTE9IjEyNSIgeDI9IjI2NiIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIyNDMiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+c2lnbnM8L3RleHQ+CjxyZWN0IHg9IjI2OCIgeT0iNzIiIHdpZHRoPSIxODAiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjM1OCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+U3Vib3JkaW5hdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPlNVQk9SRElOQVRFX0NBPC90ZXh0Pgo8dGV4dCB4PSIzNTgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmlzc3VlcyBjZXJ0aWZpY2F0ZXM8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+Zm9yIHRoZSB3b3JrbG9hZDwvdGV4dD4KPGxpbmUgeDE9IjQ0OCIgeTE9IjEyNSIgeDI9IjQ5NCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI0NzEiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWVzPC90ZXh0Pgo8cmVjdCB4PSI0OTYiIHk9IjcyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1ODYiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPllvdXIgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+Y2hhaW5zIHRvPC90ZXh0Pgo8dGV4dCB4PSI1ODYiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnRoZSBwcml2YXRlIHJvb3Q8L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmaWxsOiMzMzQxNTUiPnJlbmV3ZWQgYnkgT0NJPC90ZXh0Pgo8cmVjdCB4PSI2OTYiIHk9IjcyIiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3NDgiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwO2ZpbGw6IzMzNDE1NSI+SUFNPC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjEyNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwO2ZpbGw6IzMzNDE1NSI+cG9saWN5PC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPm9uIHRoZTwvdGV4dD4KPHRleHQgeD0iNzQ4IiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5jb21wYXJ0bWVudDwvdGV4dD4KPC9zdmc+)

![One compartment holds a root CA and subordinate CAs. A subordinate CA issues your certificates, which chain to the root. OCI IAM policy on the compartment controls who may issue.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbmUgY29tcGFydG1lbnQgaG9sZHMgYSByb290IENBIGFuZCBzdWJvcmRpbmF0ZSBDQXMuIEEgc3Vib3JkaW5hdGUgQ0EgaXNzdWVzIHlvdXIgY2VydGlmaWNhdGVzLCB3aGljaCBjaGFpbiB0byB0aGUgcm9vdC4gT0NJIElBTSBwb2xpY3kgb24gdGhlIGNvbXBhcnRtZW50IGNvbnRyb2xzIHdobyBtYXkgaXNzdWUuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxyZWN0IHg9IjE4IiB5PSIzNCIgd2lkdGg9IjgwMCIgaGVpZ2h0PSIxNjQiIHJ4PSIxNiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzYiIHk9IjU2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PQ0kgQ0VSVElGSUNBVEVTIMK3IG9uZSBjb21wYXJ0bWVudDwvdGV4dD4KPHJlY3QgeD0iNDAiIHk9IjcyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIxMzAiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlJvb3QgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjEzMCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPlJPT1RfQ0E8L3RleHQ+Cjx0ZXh0IHg9IjEzMCIgeT0iMTUwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dGhlIHByaXZhdGUgcm9vdDwvdGV4dD4KPHRleHQgeD0iMTMwIiB5PSIxNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5vZiB0cnVzdDwvdGV4dD4KPGxpbmUgeDE9IjIyMCIgeTE9IjEyNSIgeDI9IjI2NiIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIyNDMiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+c2lnbnM8L3RleHQ+CjxyZWN0IHg9IjI2OCIgeT0iNzIiIHdpZHRoPSIxODAiIGhlaWdodD0iMTA2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjM1OCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+U3Vib3JkaW5hdGUgQ0E8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPlNVQk9SRElOQVRFX0NBPC90ZXh0Pgo8dGV4dCB4PSIzNTgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmlzc3VlcyBjZXJ0aWZpY2F0ZXM8L3RleHQ+Cjx0ZXh0IHg9IjM1OCIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+Zm9yIHRoZSB3b3JrbG9hZDwvdGV4dD4KPGxpbmUgeDE9IjQ0OCIgeTE9IjEyNSIgeDI9IjQ5NCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI0NzEiIHk9IjExNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+aXNzdWVzPC90ZXh0Pgo8cmVjdCB4PSI0OTYiIHk9IjcyIiB3aWR0aD0iMTgwIiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1ODYiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPllvdXIgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTE1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+Y2hhaW5zIHRvPC90ZXh0Pgo8dGV4dCB4PSI1ODYiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnRoZSBwcml2YXRlIHJvb3Q8L3RleHQ+Cjx0ZXh0IHg9IjU4NiIgeT0iMTY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmaWxsOiNjYmQ1ZTEiPnJlbmV3ZWQgYnkgT0NJPC90ZXh0Pgo8cmVjdCB4PSI2OTYiIHk9IjcyIiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3NDgiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwO2ZpbGw6I2NiZDVlMSI+SUFNPC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjEyNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwO2ZpbGw6I2NiZDVlMSI+cG9saWN5PC90ZXh0Pgo8dGV4dCB4PSI3NDgiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPm9uIHRoZTwvdGV4dD4KPHRleHQgeD0iNzQ4IiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5jb21wYXJ0bWVudDwvdGV4dD4KPC9zdmc+)

The root signs subordinate CAs, which issue your certificates; IAM policy on the compartment controls who may issue.

#### The CA hierarchy

The root CA signs subordinate CAs, and the subordinates issue application certificates. A two-tier hierarchy maps directly; a deeper tree adds more subordinate CAs to the compartment, each with its own CA configuration. The root is new and has a new key. Certificates already issued on AWS keep chaining to the AWS root until they expire or are reissued.

![An ACM Private CA of type ROOT becomes an OCI root CA, and a SUBORDINATE CA becomes an OCI subordinate CA, in the same compartment.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBQ00gUHJpdmF0ZSBDQSBvZiB0eXBlIFJPT1QgYmVjb21lcyBhbiBPQ0kgcm9vdCBDQSwgYW5kIGEgU1VCT1JESU5BVEUgQ0EgYmVjb21lcyBhbiBPQ0kgc3Vib3JkaW5hdGUgQ0EsIGluIHRoZSBzYW1lIGNvbXBhcnRtZW50LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8dGV4dCB4PSIyMDAiIHk9IjI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiOCI+QUNNIFBSSVZBVEUgQ0E8L3RleHQ+CjxyZWN0IHg9IjQwIiB5PSI0MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjYwIiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+dHlwZSA9IFJPT1Q8L3RleHQ+Cjx0ZXh0IHg9IjIwMCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj50aGUgcHJpdmF0ZSByb290PC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iOTIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2MCIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij50eXBlID0gU1VCT1JESU5BVEU8L3RleHQ+Cjx0ZXh0IHg9IjIwNSIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+aXNzdWVzIHRvIHRoZSB3b3JrbG9hZDwvdGV4dD4KPGxpbmUgeDE9IjM2NiIgeTE9Ijg3IiB4Mj0iNDcwIiB5Mj0iODciIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+bWFwcyB0bzwvdGV4dD4KPHRleHQgeD0iNjM2IiB5PSIyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+T0NJIMK3IGluIHRoZSBjb21wYXJ0bWVudDwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI0MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTciPlJPT1RfQ0E8L3RleHQ+Cjx0ZXh0IHg9IjYyMCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPnJvb3QgQ0E8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iOTIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0OTQiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1NyI+U1VCT1JESU5BVEVfQ0E8L3RleHQ+Cjx0ZXh0IHg9IjY0OCIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5zdWJvcmRpbmF0ZSBDQTwvdGV4dD4KPC9zdmc+)

![An ACM Private CA of type ROOT becomes an OCI root CA, and a SUBORDINATE CA becomes an OCI subordinate CA, in the same compartment.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBQ00gUHJpdmF0ZSBDQSBvZiB0eXBlIFJPT1QgYmVjb21lcyBhbiBPQ0kgcm9vdCBDQSwgYW5kIGEgU1VCT1JESU5BVEUgQ0EgYmVjb21lcyBhbiBPQ0kgc3Vib3JkaW5hdGUgQ0EsIGluIHRoZSBzYW1lIGNvbXBhcnRtZW50LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8dGV4dCB4PSIyMDAiIHk9IjI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YiI+QUNNIFBSSVZBVEUgQ0E8L3RleHQ+CjxyZWN0IHg9IjQwIiB5PSI0MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjYwIiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+dHlwZSA9IFJPT1Q8L3RleHQ+Cjx0ZXh0IHg9IjIwMCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij50aGUgcHJpdmF0ZSByb290PC90ZXh0Pgo8cmVjdCB4PSI0MCIgeT0iOTIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2MCIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj50eXBlID0gU1VCT1JESU5BVEU8L3RleHQ+Cjx0ZXh0IHg9IjIwNSIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+aXNzdWVzIHRvIHRoZSB3b3JrbG9hZDwvdGV4dD4KPGxpbmUgeDE9IjM2NiIgeTE9Ijg3IiB4Mj0iNDcwIiB5Mj0iODciIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+bWFwcyB0bzwvdGV4dD4KPHRleHQgeD0iNjM2IiB5PSIyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+T0NJIMK3IGluIHRoZSBjb21wYXJ0bWVudDwvdGV4dD4KPHJlY3QgeD0iNDc0IiB5PSI0MiIgd2lkdGg9IjMyMiIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3YjciPlJPT1RfQ0E8L3RleHQ+Cjx0ZXh0IHg9IjYyMCIgeT0iNjYiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPnJvb3QgQ0E8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iOTIiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0OTQiIHk9IjExNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNyI+U1VCT1JESU5BVEVfQ0E8L3RleHQ+Cjx0ZXh0IHg9IjY0OCIgeT0iMTE2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5zdWJvcmRpbmF0ZSBDQTwvdGV4dD4KPC9zdmc+)

A ROOT CA becomes an OCI root CA and a SUBORDINATE CA an OCI subordinate CA.

#### Issuing certificates

ACM Private CA splits signing a CA's certificate-signing request (CSR) from installing the signed CA certificate, as two Terraform resources. On OCI, creating the CA includes signing it, so there is no separate signing resource to reference. Each application certificate sets its subject, subject alternative names (SANs), key usages and validity. You configure renewal for the certificates OCI manages.

![ACM Private CA uses two Terraform resources to sign and install a CA certificate. On OCI, creating the CA signs and activates it, and the CA then issues your certificates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg2IiB2aWV3Qm94PSIwIDAgODM2IDE4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSB1c2VzIHR3byBUZXJyYWZvcm0gcmVzb3VyY2VzIHRvIHNpZ24gYW5kIGluc3RhbGwgYSBDQSBjZXJ0aWZpY2F0ZS4gT24gT0NJLCBjcmVhdGluZyB0aGUgQ0Egc2lnbnMgYW5kIGFjdGl2YXRlcyBpdCwgYW5kIHRoZSBDQSB0aGVuIGlzc3VlcyB5b3VyIGNlcnRpZmljYXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPkFDTSBQUklWQVRFIENBIMK3IHR3byByZXNvdXJjZXM8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI0MCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1MiIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmF3c19hY21wY2FfY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUyIiB5PSI3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnNpZ25zIHRoZSBDU1I8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI5MiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1MiIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij4uLi5fY2VydGlmaWNhdGVfYXV0aG9yaXR5X2NlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI1MiIgeT0iMTI3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+aW5zdGFsbHMgLyBhY3RpdmF0ZXMgdGhlIENBPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iODciIHgyPSI0NzAiIHkyPSI4NyIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNDE4IiB5PSI3OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwIj5oYW5kbGVkIGJ5PC90ZXh0Pgo8dGV4dCB4PSI2MzYiIHk9IjI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PQ0kgwrcgb25lIHN0ZXA8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iNDAiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDk0IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkNBIGNyZWF0aW9uIHNpZ25zICsgYWN0aXZhdGVzPC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9Ijc1IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5ubyBzaWduaW5nIHJlc291cmNlPC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTEyIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+WW91ciBjZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNDk0IiB5PSIxMjciIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmNoYWlucyB0byB0aGUgcHJpdmF0ZSByb290PC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjE2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPk9DSSByZW5ld3MgdGhlIGNlcnRpZmljYXRlcyBpdCBtYW5hZ2VzLCBieSB0aGUgcnVsZXMgeW91IHNldC48L3RleHQ+Cjwvc3ZnPg==)

![ACM Private CA uses two Terraform resources to sign and install a CA certificate. On OCI, creating the CA signs and activates it, and the CA then issues your certificates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTg2IiB2aWV3Qm94PSIwIDAgODM2IDE4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gUHJpdmF0ZSBDQSB1c2VzIHR3byBUZXJyYWZvcm0gcmVzb3VyY2VzIHRvIHNpZ24gYW5kIGluc3RhbGwgYSBDQSBjZXJ0aWZpY2F0ZS4gT24gT0NJLCBjcmVhdGluZyB0aGUgQ0Egc2lnbnMgYW5kIGFjdGl2YXRlcyBpdCwgYW5kIHRoZSBDQSB0aGVuIGlzc3VlcyB5b3VyIGNlcnRpZmljYXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjAwIiB5PSIyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPkFDTSBQUklWQVRFIENBIMK3IHR3byByZXNvdXJjZXM8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI0MCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1MiIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmF3c19hY21wY2FfY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUyIiB5PSI3NSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnNpZ25zIHRoZSBDU1I8L3RleHQ+CjxyZWN0IHg9IjM0IiB5PSI5MiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI0MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1MiIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj4uLi5fY2VydGlmaWNhdGVfYXV0aG9yaXR5X2NlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI1MiIgeT0iMTI3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+aW5zdGFsbHMgLyBhY3RpdmF0ZXMgdGhlIENBPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iODciIHgyPSI0NzAiIHkyPSI4NyIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNDE4IiB5PSI3OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwIj5oYW5kbGVkIGJ5PC90ZXh0Pgo8dGV4dCB4PSI2MzYiIHk9IjI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PQ0kgwrcgb25lIHN0ZXA8L3RleHQ+CjxyZWN0IHg9IjQ3NCIgeT0iNDAiIHdpZHRoPSIzMjIiIGhlaWdodD0iNDIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDk0IiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkNBIGNyZWF0aW9uIHNpZ25zICsgYWN0aXZhdGVzPC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9Ijc1IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5ubyBzaWduaW5nIHJlc291cmNlPC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9IjkyIiB3aWR0aD0iMzIyIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTEyIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+WW91ciBjZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNDk0IiB5PSIxMjciIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmNoYWlucyB0byB0aGUgcHJpdmF0ZSByb290PC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjE2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPk9DSSByZW5ld3MgdGhlIGNlcnRpZmljYXRlcyBpdCBtYW5hZ2VzLCBieSB0aGUgcnVsZXMgeW91IHNldC48L3RleHQ+Cjwvc3ZnPg==)

Creating an OCI CA also signs and activates it; there is no separate signing step.

#### Issuance scoping

On AWS, the `acm-pca:TemplateArn` IAM condition limits which certificate templates a principal can request. OCI combines IAM permissions on the CA with the CA's issuance settings. Translate both who may call and what the certificates may contain; access to the compartment alone does not express a template condition.

![The acm-pca:TemplateArn IAM condition on AWS is covered by OCI IAM policy on the compartment together with the CA's issuance settings. Neither is a one-to-one template condition.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY2IiB2aWV3Qm94PSIwIDAgODM2IDE2NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYWNtLXBjYTpUZW1wbGF0ZUFybiBJQU0gY29uZGl0aW9uIG9uIEFXUyBpcyBjb3ZlcmVkIGJ5IE9DSSBJQU0gcG9saWN5IG9uIHRoZSBjb21wYXJ0bWVudCB0b2dldGhlciB3aXRoIHRoZSBDQSdzIGlzc3VhbmNlIHNldHRpbmdzLiBOZWl0aGVyIGlzIGEgb25lLXRvLW9uZSB0ZW1wbGF0ZSBjb25kaXRpb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjA0IiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4Ij5hY20tcGNhOlRlbXBsYXRlQXJuPC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmFuIElBTSBjb25kaXRpb24gb24gd2hvIG1heTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5pc3N1ZSB3aGljaCB0ZW1wbGF0ZTwvdGV4dD4KPGxpbmUgeDE9IjM5MCIgeTE9Ijg2IiB4Mj0iNDQ2IiB5Mj0iODYiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+bWFwcyB0bzwvdGV4dD4KPHJlY3QgeD0iNDUyIiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjMyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5PQ0kgQ2VydGlmaWNhdGVzPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHgiPklBTSBjb21wYXJ0bWVudCBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij53aG8gbWF5IG1hbmFnZSBhbmQgaXNzdWU8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5mcm9tIHRoZSBDQTwvdGV4dD4KPC9zdmc+)

![The acm-pca:TemplateArn IAM condition on AWS is covered by OCI IAM policy on the compartment together with the CA's issuance settings. Neither is a one-to-one template condition.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY2IiB2aWV3Qm94PSIwIDAgODM2IDE2NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgYWNtLXBjYTpUZW1wbGF0ZUFybiBJQU0gY29uZGl0aW9uIG9uIEFXUyBpcyBjb3ZlcmVkIGJ5IE9DSSBJQU0gcG9saWN5IG9uIHRoZSBjb21wYXJ0bWVudCB0b2dldGhlciB3aXRoIHRoZSBDQSdzIGlzc3VhbmNlIHNldHRpbmdzLiBOZWl0aGVyIGlzIGEgb25lLXRvLW9uZSB0ZW1wbGF0ZSBjb25kaXRpb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjA0IiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4Ij5hY20tcGNhOlRlbXBsYXRlQXJuPC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmFuIElBTSBjb25kaXRpb24gb24gd2hvIG1heTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5pc3N1ZSB3aGljaCB0ZW1wbGF0ZTwvdGV4dD4KPGxpbmUgeDE9IjM5MCIgeTE9Ijg2IiB4Mj0iNDQ2IiB5Mj0iODYiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+bWFwcyB0bzwvdGV4dD4KPHJlY3QgeD0iNDUyIiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDQiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjMyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5PQ0kgQ2VydGlmaWNhdGVzPC90ZXh0Pgo8dGV4dCB4PSI2MzIiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHgiPklBTSBjb21wYXJ0bWVudCBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTA0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij53aG8gbWF5IG1hbmFnZSBhbmQgaXNzdWU8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5mcm9tIHRoZSBDQTwvdGV4dD4KPC9zdmc+)

OCI IAM policy and the CA's issuance settings together replace the template condition; neither matches it one to one.

#### Revocation and CRLs

A certificate revocation list (CRL) names certificates that clients should no longer trust. OCI Certificates produces the CRL and publishes it to an Object Storage bucket you configure. You set up the bucket, object naming, the CA's write permission and the distribution-point URL clients use. The S3 bucket, its bucket policy and any custom CRL CNAME from ACM Private CA have no counterpart, so point any automation that reads or copies the old S3 CRL at the OCI bucket.

![OCI Certificates publishes CRLs to a configured Object Storage bucket.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPQ0kgQ2VydGlmaWNhdGVzIHB1Ymxpc2hlcyBDUkxzIHRvIGEgY29uZmlndXJlZCBPYmplY3QgU3RvcmFnZSBidWNrZXQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDYiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjA0IiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4Ij5DUkwg4oaSIHlvdXIgUzMgYnVja2V0PC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmEgY3VzdG9tZXItb3duZWQgYnVja2V0PC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnBsdXMgaXRzIGJ1Y2tldCBwb2xpY3k8L3RleHQ+CjxsaW5lIHgxPSIzOTAiIHkxPSI4NyIgeDI9IjQ0NiIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA2IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjYzMiIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+T0NJIENlcnRpZmljYXRlczwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+cHVibGlzaGVzIENSTHM8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNiNDUzMDkiPmNvbmZpZ3VyZWQ8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNiNDUzMDkiPk9iamVjdCBTdG9yYWdlIGJ1Y2tldDwvdGV4dD4KPC9zdmc+)

![OCI Certificates publishes CRLs to a configured Object Storage bucket.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPQ0kgQ2VydGlmaWNhdGVzIHB1Ymxpc2hlcyBDUkxzIHRvIGEgY29uZmlndXJlZCBPYmplY3QgU3RvcmFnZSBidWNrZXQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIzNCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMDYiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjA0IiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BQ00gUHJpdmF0ZSBDQTwvdGV4dD4KPHRleHQgeD0iMjA0IiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4Ij5DUkwg4oaSIHlvdXIgUzMgYnVja2V0PC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmEgY3VzdG9tZXItb3duZWQgYnVja2V0PC90ZXh0Pgo8dGV4dCB4PSIyMDQiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnBsdXMgaXRzIGJ1Y2tldCBwb2xpY3k8L3RleHQ+CjxsaW5lIHgxPSIzOTAiIHkxPSI4NyIgeDI9IjQ0NiIgeTI9Ijg3IiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI0MTgiIHk9Ijc5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPm1hcHMgdG88L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iMzQiIHdpZHRoPSIzNjAiIGhlaWdodD0iMTA2IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjYzMiIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+T0NJIENlcnRpZmljYXRlczwvdGV4dD4KPHRleHQgeD0iNjMyIiB5PSI4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+cHVibGlzaGVzIENSTHM8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmYmJmMjQiPmNvbmZpZ3VyZWQ8L3RleHQ+Cjx0ZXh0IHg9IjYzMiIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmYmJmMjQiPk9iamVjdCBTdG9yYWdlIGJ1Y2tldDwvdGV4dD4KPC9zdmc+)

OCI Certificates publishes CRLs to a configured Object Storage bucket.

#### Limitations

Limitations

* **Moving the AWS private key and certificate history is not supported.** OCI Certificates issues from a new root with its own key. Certificates already issued on AWS depend on the AWS root and its revocation information until they expire or are replaced.
* **Issuance scoping behaves differently: there is no template condition.** An `acm-pca:TemplateArn` condition becomes OCI IAM policy on the CA plus its issuance settings. Translate both who may request certificates and what they may contain.
* **CRLs in your S3 bucket are not supported.** OCI publishes CRLs to an Object Storage bucket. The S3 bucket, its bucket policy, its expiration setting and any custom CNAME are not kept; you set up the bucket and distribution point.
* **An OCSP responder is not supported.** If the AWS CA runs OCSP, there is no matching endpoint on OCI. Clients check revocation with CRLs or rely on short certificate lifetimes, and the deployment reports a warning.
* **An organization, organizational unit or country in the CA subject is not supported.** Only the common name is kept; the deployment warns about each part it drops. Set the full distinguished name on the CA yourself if your certificate chain depends on it.
* **You must set the CA validity period yourself.** The deployed CA uses a fixed placeholder expiry, not the validity from ACM Private CA, and the deployment warns about it. Set the validity on the OCI CA and renew it well before that date.
* **AWS-only CA settings are not supported.** A `usage_mode` other than `GENERAL_PURPOSE`, an `aws_acmpca_permission` grant to ACM, and `permanent_deletion_time_in_days` have no OCI equivalent. The deployment warns, and OCI's own settings apply.
* **Runtime ACM Private CA API calls are not supported.** CAs are created from your infrastructure code when the deployment is applied, not by calls to the ACM Private CA API.

#### Other considerations

* **Before switching issuance.** Distribute the new root before you issue replacement certificates, and keep trusting the old root during the transition.
* **CA settings and renewal.** Confirm key protection and certificate validity settings. Configure renewal for managed certificates, and schedule CA renewal and key rotation, which you start.
* **Revocation.** Test CRL publication and retrieval by clients. Keep the CRL bucket and its access policy available for as long as clients rely on certificates issued by that CA.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::acm::pca
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.