When you purchase a private certificate authority (CA), you receive a private root CA and a private intermediate CA. By default, the root CA grants the intermediate CA a quota of 10 free private certificates. When you need more, purchase an additional quota for the root CA and distribute it to the intermediate CA.
Prerequisites
Before you begin, ensure that you have:
A private CA that is purchased and enabled. For more information, see Purchase and enable a private CA.
How it works
Certificate quotas flow from the root CA down to intermediate CAs. The root CA holds the total quota pool — intermediate CAs draw from it to issue server certificates or client certificates. This two-level design keeps the root CA tightly controlled while letting intermediate CAs handle day-to-day certificate issuance.
Purchase a quota
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose Certificate Management > Private Certificate Management. Select the region where the PCA service is located.
On the Private CAs tab, find the private root CA for which you want to purchase a quota and click Purchase Certificate in the Actions column.
In the Purchase Certificate panel, enter the number of certificates you need, click Purchased, and complete the payment.
If the quota you purchase exceeds a specific threshold, the excess certificates are not charged. Contact your account manager for threshold details.
Assign the quota
After purchasing a quota for the root CA, assign it to a private intermediate CA that is subordinate to the private root CA and is in the Enabled state. Only intermediate CAs in the Enabled state can receive quota assignments and issue certificates.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose Certificate Management > Private Certificate Management. Select the region where the PCA service is located.
On the Private CAs tab, find the private root CA whose quota you want to assign and click Assign Certificate in the Remaining Certificates column.
In the Assign Certificate panel, set the Select Intermediate CA and Remaining Certificate Quota parameters and click OK.
Remaining Certificate Quota shows the quota already assigned to the selected intermediate CA.
What's next
With the quota assigned, the intermediate CA can issue server certificates or client certificates.
For steps, see Apply for a private certificate.