Creates a root certificate authority (CA) certificate.
Usage notes
You can call the CreateRootCACertificate operation to create a self-signed root CA certificate. A root CA certificate is the trust anchor in a chain of trust for private certificates that are used within an enterprise. You must create a root CA certificate before you can use the root CA certificate to issue intermediate CA certificates. Then, you can use the intermediate CA certificates to issue client certificates and server certificates.
Before you call this operation, make sure that you have purchased a private root CA instance by using the Certificate Management Service console. For more information, see Create a private CA.
Limits
You can call this operation up to 10 times per second per account. If the number of the calls per second exceeds the limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limit when you call this operation.
Debugging
Request parameters
Parameter | Type | Required | Example | Description |
---|---|---|---|---|
Action | String | Yes | CreateRootCACertificate |
The operation that you want to perform. Set the value to CreateRootCACertificate. |
Organization | String | Yes | Alibaba |
The name of the organization that is associated with the root CA certificate. You can enter the name of your enterprise or company. The value can contain letters. |
OrganizationUnit | String | Yes | Security |
The name of the department or branch in the organization. The value can contain letters. |
CountryCode | String | Yes | CN |
The code of the country or region in which the organization is located. You can enter an alpha-2 code. For example, you can use CN to indicate China and use US to indicate the United States. For more information about country codes, see the "Country codes" section in Manage company profiles. |
State | String | Yes | Zhejiang |
The name of the province or state in which the organization is located. The value can contain letters. |
Locality | String | Yes | Hangzhou |
The name of the city in which the organization is located. The value can contain letters. |
CommonName | String | Yes | Alibaba |
The common name or abbreviation of the organization. The value can contain letters. |
Algorithm | String | Yes | RSA_2048 |
The type of the key algorithm of the root CA certificate. The key algorithm is in
the
The encryption algorithm of the root CA certificate must be consistent with the encryption algorithm of the private root CA instance that you purchase. For example, if the encryption algorithm of the private root CA instance that you purchase is RSA, the key algorithm of the root CA certificate must be RSA_1024, RSA_2048, or RSA_4096. |
Years | Integer | Yes | 10 |
The validity period of the root CA certificate. Unit: years. Note We recommend that you set this parameter to 5 to 10.
|
All Alibaba Cloud API operations must include common request parameters. For more information about common request parameters, see Common parameters.
For more information about sample requests, see the "Examples" section of this topic.
Response parameters
Parameter | Type | Example | Description |
---|---|---|---|
Identifier | String | 1a83bcbb89e562885e40aa0108f5**** |
The unique identifier of the root CA certificate. |
RequestId | String | 6D9B4C5F-7140-5B41-924C-329181DC00C1 |
The ID of the request, which is used to locate and troubleshoot issues. |
Certificate | String | -----BEGIN CERTIFICATE-----\n......\n-----END CERTIFICATE----- |
The root CA certificate in the PEM format. |
CertificateChain | String | -----BEGIN CERTIFICATE-----\n......\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n......\n-----END CERTIFICATE-----\n |
The certificate chain of the root CA certificate. |
Examples
Sample requests
http(s)://[Endpoint]/?Action=CreateRootCACertificate
&Organization=Alibaba
&OrganizationUnit=Security
&CountryCode=CN
&State=Zhejiang
&Locality=Hangzhou
&CommonName=Alibaba
&Algorithm=RSA_2048
&Years=10
&<Common request parameters>
Sample success responses
XML
format
HTTP/1.1 200 OK
Content-Type:application/xml
<CreateRootCACertificateResponse>
<Identifier>1a83bcbb89e562885e40aa0108f5****</Identifier>
<RequestId>6D9B4C5F-7140-5B41-924C-329181DC00C1</RequestId>
<Certificate>-----BEGIN CERTIFICATE-----
......
-----END CERTIFICATE-----
</Certificate>
<CertificateChain>-----BEGIN CERTIFICATE-----
......
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
......
-----END CERTIFICATE-----
</CertificateChain>
</CreateRootCACertificateResponse>
JSON
format
HTTP/1.1 200 OK
Content-Type:application/json
{
"Identifier" : "1a83bcbb89e562885e40aa0108f5****",
"RequestId" : "6D9B4C5F-7140-5B41-924C-329181DC00C1",
"Certificate" : "-----BEGIN CERTIFICATE-----\n......\n-----END CERTIFICATE-----",
"CertificateChain" : "-----BEGIN CERTIFICATE-----\n......\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n......\n-----END CERTIFICATE-----\n"
}
Error codes
For a list of error codes, visit the API Error Center.