Docs

Certificate Center

Private sub CA

Managing a private sub CA

This topic describes how to manage private sub CAs (referred to as "sub CAs") in the Certificate Center console, including: downloading sub CA certificates, enabling/disabling sub CAs, revoking sub CAs, and deleting sub CAs.

Background

Sub CAs are of two types: sub CAs created in Certificate Center, and sub CAs uploaded to Certificate Center for management. Different types support different operations.

Sub CAs created in the Certificate Center

After creation, the sub CA is in the Issued state by default and starts incurring fees. All supported states of a sub CA are shown in the table below.

Status	Explain	Whether fees are incurred in the current state	Actions allowed in the current status
Issued	Upon creation, the sub CA is by default in the Issued state.	Yes	Download, disable, revoke
Disabled	When you manually disable the sub CA, its status changes to Disabled. If you manually enable the sub CA, it can return to the Issued state.	No	Enable
Frozen	When your VolcanoEngine account becomes overdue, the sub CA status changes to Frozen. If you repay the overdue amount, the sub CA can return to the Issued state.	No	None
Expired	When the sub CA expires, its status changes to Expired.	No	Delete
Revoked	When you manually revoke the sub CA, its status changes to Revoked.	No	Delete

Uploaded sub CA

An uploaded sub CA has a default state of Issued (no fees incurred). The only supported operation is Download.

tip

To delete an uploaded sub CA, submit Ticket.

Access private sub CA page

Log in to the Certificate Center console, then select Private CA > Private sub CA in the left navigation pane. Then you can manage the sub CA on the Private sub CA page.

View sub CA certificate details

On the Private sub CA page, find the target sub CA and click its name.

On the certificate details page, you can view the following information about the sub CA certificate: Basic information, Associated cloud resources, Subject information, Contact information, and Certificate information.

Basic information includes the following information about the sub CA certificate: Name (CN), ID, (Affiliated) Private Root CA, (Issued) Private Certificates, Validity Period, Serial Number, Certificate Source (from Certificate purchase or Upload hosting), Key Algorithm, Signature Hash Algorithm, Creation Time, Expiration Time, Associated Project, Tags, Remarks.

Associated cloud resources shows the deployment status of the sub CA certificate on VolcanoEngine cloud products.

Subject information includes the following details of the sub CA certificate: Organization (O), Organization Unit (OU), Country (C), State (ST), and Locality (L).

Contact information includes the following details of the sub CA certificate: Contact name, contact phone number, contact e-mail.

If Certificate source is Upload hosting, contact information is not supported.

Certificate information displays the certificate content in PEM format.

Download sub CA certificate

You can download the sub CA certificate to your local computer.

Prerequisites

The status of the sub CA is Issued.

Procedures

On the Private sub CA page, find the target sub CA and click Download in the Actions column.

The sub CA certificate package will be downloaded to your browser's default download location.

Decompress the certificate package.

After decompression, you will obtain the certificate file. The certificate file is in .pem format.

Enable sub CA

If you want to use a sub CA that has been disabled, you need to enable it first.

Prerequisites

The sub CA was created in Certificate Center (Certificate source is Certificate purchase) and its status is Disabled.

The root CA to which the sub CA belongs is in the Issued state.

tip

If the root CA is currently in the Disabled state, you must enable the root CA before you can enable the sub CA.

Procedures

On the Private sub CA page, find the target sub CA and click Enable in the Actions column.

Disable sub CA

If you want to temporarily stop using a sub CA, you can disable it. A disabled sub CA does not incur fees. You can re-enable a disabled sub CA when needed.

Possible impact

Disabling a sub CA has the following impacts:

You will no longer be able to use this sub CA to issue certificates.

Private certificates issued through this sub CA will no longer work properly, meaning that services or clients will no longer trust these certificates, which may affect business operations. This is because the CRL and OCSP services are turned off, so the revocation status of issued certificates cannot be queried, and services or clients cannot verify the validity of the certificates.

Prerequisites

The sub CA was created in Certificate Center (Certificate source is Certificate purchase) and its status is Issued.

Procedures

On the Private sub CA page, find the target sub CA, then click Disable under the Actions column.

In the pop-up dialog box, check Confirm, then click Disable.

Revoke sub CA

If you find that a sub CA has a security risk (e.g., the private key has been leaked), it is recommended that you revoke it promptly. Once a sub CA is revoked, it no longer incurs fees. After revocation, you cannot restore it. If you want to continue using a sub CA, you must create a new one.

Possible impact

Revoking a sub CA has the following impacts:

The corresponding private CA certificate is no longer trusted within the organization.

Private certificates issued through this sub CA can no longer be used.

warning

Before performing a revocation, you should carefully plan the revocation process and assess the potential impact on your business. For assistance in assessing revocation risks, you can submit a Ticket to contact Certificate Center technical support.

Prerequisites

The sub CA was created in Certificate Center (Certificate source is Certificate purchase) and its status is Issued.

Procedures

On the Private sub CA page, find the target sub CA to revoke, then click Revoke in the Actions column.

In the pop-up dialog, enter the reason for revoking the current certificate, then click Revoke.

Delete sub CA

If the sub CA has become invalid (e.g., revoked or expired), you can delete it from the Certificate Center console.

Prerequisites

The sub CA was created in Certificate Center (Certificate source is Certificate purchase) and is in one of the following states: Revoked, Expired.

Procedures

On the Private sub CA page, find the target sub CA, then click Delete in the Actions column.

In the pop-up dialog box, check Confirm, then click Delete.

Last updated: 2026.04.01 10:55:25