All Products
Search

This Product

    Certificate Management Service:What is Private Certificate Authority (PCA)?

    Document Center

    Certificate Management Service:What is Private Certificate Authority (PCA)?

    Last Updated:Jun 16, 2026

    Alibaba Cloud Private Certificate Authority (PCA) lets your organization build a private Public Key Infrastructure (PKI) without maintaining CA hardware, providing full-lifecycle certificate management for identity authentication and data encryption across internal applications, IoT devices, and mobile clients.

    Key concepts

    PCA uses a three-tier hierarchy: root CA, intermediate CA, and end-entity certificate.

    • Root CA: The trust anchor of the certificate chain. It is used only to issue intermediate CA certificates. We recommend that you strictly control its usage and permissions.

    • Intermediate CA: Issues end-entity certificates. We recommend that you create separate intermediate CAs for different organizational units or business lines to enable isolated management.

    • End-entity certificate: Issued by an intermediate CA and deployed on servers, clients, and devices.

    Use cases

    A private CA is suitable for identity authentication and secure communication within enterprises or IoT environments without external regulatory compliance requirements.

    Typical scenarios:

    • IoT device authentication: Authenticate vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications in Internet of Vehicles (IoV) applications. For example, a single vehicle may require five or more certificates.

    • Internal enterprise systems: Enable mutual authentication (mTLS) between internal systems, such as Office Automation (OA) and Human Resources (HR) systems.

    • Microservices architecture: Authenticate and encrypt communications between services.

    Key advantages: Automated certificate issuance, revocation, and renewal for large-scale device deployments.

    Procedure

    Build a private certificate platform for your organization by completing the following steps. Under a single root CA, you can purchase multiple intermediate CAs based on your organizational structure to manage certificates for different departments separately.

    1. Purchase a private CA

      When you create a private CA for the first time, you must purchase a private root CA. For more information, see Purchase a private root CA. For information about refunds, see Refund policies for PCA. After a refund is processed, you can manually delete the CA instance from the CA list.

      Note

      Each root CA instance includes: 1 root CA, 1 intermediate CA, and a complimentary quota of 10 private certificates. The complimentary quota is subject to the following rules:

      • Quota usage period: You must use the complimentary quota to issue certificates within 30 days of purchase. Unused quota expires and is cleared after this period.

      • Certificate validity: Certificates issued by using the complimentary quota are valid for 30 days from the date of issuance and are not extended when the root CA is renewed. The validity of separately purchased certificates can be customized.

    2. Enable the root CA and intermediate CA

      After purchase, enable the root CA first, and then the intermediate CA. For more information, see Enable a private CA.

      Note

      To modify the information of an enabled private CA, reset the target root CA or intermediate CA and re-enable it. For more information, see Reset a private CA.

    3. Assign a private certificate quota

      Assign a certificate issuance quota to an intermediate CA. The intermediate CA uses this quota to issue private certificates. For more information, see Assign a private certificate quota.

      Note

      By default, each root CA includes a complimentary quota of 10 private certificates. You can purchase additional quota as needed. For more information, see Purchase a private certificate quota.

    4. Issue a private certificate

      Use an enabled intermediate CA to issue private certificates. For more information, see Issue a private certificate.

      Note

      Issuing a private certificate consumes the corresponding certificate quota. The consumed quota cannot be refunded.

    5. Download and install the private certificate

      Download the issued private certificate and deploy it to the intended entity. For more information, see Download a private certificate.

    Billing

    • PCA uses a prepaid model. You are billed separately for CA instances and certificate quotas. For detailed billing rules, see Billing of PCA.

    • For information about refunds, see Refund policies for PCA. After a refund is processed, you can manually delete the corresponding CA instance from the CA list.

    FAQ

    What are the limitations of the complimentary quota?

    • You must use the complimentary quota within 30 days of purchasing the root CA. Unused quota expires after this period.

    • Certificates issued by using the complimentary quota are valid for 30 days and are not extended when the root CA is renewed.

    • The validity period of separately purchased certificates can be customized.

    How do I modify the information of an enabled CA?

    Reset the CA and then re-enable it. For more information, see Reset a private CA.

    How do I delete an unused CA?

    After a refund for a CA is processed, you can manually delete the CA instance from the CA list. For information about refunds, see Refund policies for PCA.