调用本接口创建一个私有子CA（以下简称“子CA”）。子CA创建后默认启用并开始计费。

使用说明 #

• 子CA是企业内部信任链的中间环节。子CA的上一级是根CA，下一级是私有证书。您可以根据组织架构来定义子CA。
• 您调用本接口创建的是一个子CA实例。子CA实例创建后默认启用并开始计费。
• 子CA实例包含一个由指定的根CA签发的子CA证书。您可以使用子CA签发私有证书。

请求说明 #

• 接口名称：CreateSubInstance
• 请求方式：POST
• 请求地址：
  • IPv4网络接入：pca.volcengineapi.com
  • 双栈网络接入（IPv4/IPv6）：pca.volcengine-api.com

调试 #

请求参数 #

下表仅列出该接口特有的请求参数和部分公共参数。更多信息请见公共参数。

Query #

Body #

返回参数 #

下表仅列出本接口特有的返回参数。更多信息请参见返回结构。

请求示例 #

POST /?Action=CreateSubInstance&Version=2025-10-01 HTTP/1.1
Host: pca.volcengineapi.com
Content-Type: application/json; charset=UTF-8
X-Date: 20251030T060130Z
X-Content-Sha256: 287e874e******d653b44d21e
Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20251030/cn-beijing/pca/request, SignedHeaders=host;x-content-sha256;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f

{
  "CsrCommon": {
    "Subject": {
      "Country": [
        "CN"
      ],
      "Organization": [
        "Volcano\n"
      ],
      "OrganizationalUnit": [
        "ti"
      ],
      "Locality": [
        "海淀"
      ],
      "Province": [
        "北京"
      ],
      "StreetAddress": [
        "某某路某某号"
      ],
      "PostalCode": [
        "100080"
      ],
      "SerialNumber": "331D4CD014E4813AB8302E47DD9EB436DE2E7BDE",
      "CommonName": "Volcengine CA"
    },
    "Email": "zhangsan@example.com",
    "San": [
      "Volcengine CA"
    ]
  },
  "Contact": {
    "Name": "张三",
    "Email": "zhangsan@example.com",
    "PhoneNumber": "131****1111"
  },
  "KeyAlg": "RSA",
  "KeyParam": "2048",
  "HashAlg": "SHA256",
  "Quantity": 20,
  "DurationType": "day",
  "NotBefore": "1678778206",
  "NotAfter": "1681401599",
  "Tag": "doc-test-RootCA",
  "Csr": "`-----BEGIN CERTIFICATE REQUEST-----`",
  "OmitCsrContent": true,
  "IssuerId": "pca_root_aXPEF****",
  "IdempotenceToken": "123e4567-e89b-12d3-a456-426614174000",
  "Extensions": {
    "KeyUsages": {
      "DigitalSignature": true,
      "NonRepudiation": true,
      "KeyEncipherment": true,
      "DataEncipherment": true,
      "KeyAgreement": true,
      "KeyCertSign": true,
      "CrlSign": true,
      "EncipherOnly": true,
      "DecipherOnly": true
    },
    "ExtendedKeyUsages": {
      "ServerAuth": true,
      "ClientAuth": true,
      "CodeSigning": true,
      "EmailProtection": true,
      "TimeStamping": true,
      "OCSPSigning": true
    },
    "CustomExtensions": {
      "Critical": true,
      "ObjectIdentifier": "1.3.6.1.4.1.55555.1.1",
      "Value": "example_value"
    }
  },
  "ProjectName": "default",
  "Tags": [
    {
      "Key": "env",
      "Value": "test"
    }
  ]
}

返回示例 #

{
  "ResponseMetadata": {
    "RequestId": "202510301401351920681080449CE738",
    "Action": "CreateSubInstance",
    "Version": "2025-10-01",
    "Service": "pca",
    "Region": "cn-beijing"
  },
  "Result": {
    "Certificate": "`-----BEGIN CERTIFICATE----- MIID……XWlZ -----END CERTIFICATE-----`",
    "RootCertificate": "`-----BEGIN CERTIFICATE----- MIID……+o= -----END CERTIFICATE-----`",
    "InstanceId": "pca_sub_MlRaK****"
  }
}

错误码 #

下表为您列举了该接口与业务逻辑相关的错误码。公共错误码请参见公共错误码文档。