Certificate Center
Certificate Center
Certificate Center
Document
Notifications
Announcement
SSL Certificate
Billing
Quick start
User guide
Certificate application
Download and install certificate
Certificate management
Free certificates
API Reference
Order management
Certificate Instance
Manage information templates
Tag management
Best practices
Private CA
Quick start
User Guide
API reference
Private Root CA
Private Sub CA
Private certificate
Tag management
Code Signing Certificate
Overview
- Documentation
Certificate CenterPrivate CAAPI referencePrivate certificateCreateLeafInstance - Creating a private certificate instance
Copy page
Download PDFPrivate certificate
CreateLeafInstance - Creating a private certificate instance
Copy pageDownload PDFCreateLeafInstance - Creating a private certificate instance
Call this API to issue a private certificate.
Request notes
- API name: CreateLeafInstance
- Request method: POST
- Request address:
- IPv4 network access: pca.volcengineapi.com
- Dual-stack network access (IPv4/IPv6): pca.volcengine-api.com
Debug
API Explorer
You can initiate calls online through API Explorer without paying attention to the signature generation process and quickly obtain the call results.
Request parameters
The following table lists only the request parameters specific to this API and some common parameters. More information can be found in Common parameters.
Query
Parameters | Type | Required | Example | Description |
Body
Parameters | Type | Required | Example | Description |
Response parameters
The following table lists only the response parameters specific to this API. More information, see Response structure.
Parameters | Type | Example | Description |
InstanceId | String | pca_leaf_M6gaihuZRcO**** | The ID of the private certificate instance. This ID is assigned by the Certificate Center to the private certificate instance and uniquely identifies the private certificate. |
PrivateKey | String | -----BEGIN RSA PRIVATE KEY----- MIIE……1Q== -----END RSA PRIVATE KEY----- | Private key of the private certificate. For SM algorithm certificates (key_alg is SM2), this parameter represents the private key of the certificate for signing. |
EncryptionPrivateKey | String | true | The private key of the certificate for encryption. This parameter is returned only when you create an SM algorithm certificate (key_alg is SM2). |
Certificate | String | -----BEGIN CERTIFICATE----- MIID……SI4= -----END CERTIFICATE----- | Content of the private certificate. For SM algorithm certificates (key_alg is SM2), this parameter represents the certificate for signing. |
EncryptionCertificate | String | null | The certificate for encryption. This parameter is returned only when you create an SM algorithm certificate (key_alg is SM2). |
ParentCertificate | String | -----BEGIN CERTIFICATE----- MIID……XWlZ -----END CERTIFICATE----- | Content of the corresponding sub CA certificate. |
RootCertificate | String | -----BEGIN CERTIFICATE----- MIID……l+o= -----END CERTIFICATE----- | Content of the corresponding root CA certificate. |
Chain | String | -----BEGIN CERTIFICATE----- MIID……SI4= -----END CERTIFICATE----- ,-----BEGIN CERTIFICATE----- MIID……XWlZ -----END CERTIFICATE----- ,-----BEGIN CERTIFICATE----- MIID……l+o= -----END CERTIFICATE----- | Content of the certificate chain. The certificate chain consists of the leaf certificate, intermediate CA certificate, and root CA certificate in PEM format. For SM algorithm certificates (key_alg is SM2), this parameter represents the certificate chain for signing. |
Request examples
POST /?Action=CreateLeafInstance&Version=2025-10-01 HTTP/1.1
Host: pca.volcengineapi.com
Content-Type: application/json; charset=UTF-8
X-Date: 20251030T062536Z
X-Content-Sha256: 287e874e******d653b44d21e
Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20251030/cn-beijing/pca/request, SignedHeaders=host;x-content-sha256;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f
{
"CsrCommon": {
"Subject": {
"Country": [
"CN"
],
"Organization": [
"Volcano\n"
],
"OrganizationalUnit": [
"ti"
],
"Locality": [
"北京"
],
"Province": [
"北京"
],
"StreetAddress": [
"某某路某某号"
],
"PostalCode": [
"100080"
],
"SerialNumber": "331D4CD014E4813AB8302E47DD9EB436DE2E7BDE",
"CommonName": "Volcengine CA"
},
"Email": "zhangsan@example.com",
"San": [
"www.example.com"
]
},
"Contact": {
"Name": "张三",
"Email": "zhangsan@example.com",
"PhoneNumber": "131****1111"
},
"KeyAlg": "RSA",
"KeyParam": "2048",
"HashAlg": "SHA256",
"Quantity": 10,
"DurationType": "day",
"NotBefore": "1678778206",
"NotAfter": "1681401599",
"Tag": "doc-test-RootCA",
"Csr": "`-----BEGIN CERTIFICATE REQUEST-----`",
"OmitCsrContent": true,
"IssuerId": "pca_sub_MlRaK****",
"IdempotenceToken": "123e4567-e89b-12d3-a456-426614174000",
"UseQuota": true,
"Extensions": {
"KeyUsages": {
"DigitalSignature": true,
"NonRepudiation": true,
"KeyEncipherment": true,
"DataEncipherment": true,
"KeyAgreement": true,
"KeyCertSign": true,
"CrlSign": true,
"EncipherOnly": true,
"DecipherOnly": true
},
"ExtendedKeyUsages": {
"ServerAuth": true,
"ClientAuth": true,
"CodeSigning": true,
"EmailProtection": true,
"TimeStamping": true,
"OCSPSigning": true
},
"CustomExtensions": {
"Critical": true,
"ObjectIdentifier": "1.3.6.1.4.1.55555.1.1",
"Value": "example_value"
}
},
"ProjectName": "default",
"Tags": [
{
"Key": "env",
"Value": "test"
}
]
}
Response examples
{
"ResponseMetadata": {
"RequestId": "20251030142541203240099254B59BA8",
"Action": "CreateLeafInstance",
"Version": "2025-10-01",
"Service": "pca",
"Region": "cn-beijing"
},
"Result": {
"InstanceId": "pca_leaf_M6gaihuZRcO****",
"PrivateKey": "`-----BEGIN RSA PRIVATE KEY----- MIIE……1Q== -----END RSA PRIVATE KEY-----`",
"EncryptionPrivateKey": "true",
"Certificate": "`-----BEGIN CERTIFICATE----- MIID……SI4= -----END CERTIFICATE-----`",
"EncryptionCertificate": "null",
"ParentCertificate": "`-----BEGIN CERTIFICATE----- MIID……XWlZ -----END CERTIFICATE-----`",
"RootCertificate": "`-----BEGIN CERTIFICATE----- MIID……l+o= -----END CERTIFICATE-----`",
"Chain": "`-----BEGIN CERTIFICATE----- MIID……SI4= -----END CERTIFICATE----- ,-----BEGIN CERTIFICATE----- MIID……XWlZ -----END CERTIFICATE----- ,-----BEGIN CERTIFICATE----- MIID……l+o= -----END CERTIFICATE-----`"
}
}
Error codes
The following table lists the error codes related to the business logic for this API. For details, see Common error codes.
Status code | Error codes | Error message | Notes |
200 | QuotaExceeded | %s has exceeded the quota. example: The memory size of the specified disk has exceeded the quota. | Resource exceeds quota limit. |
Last updated: 2026.04.01 10:55:25
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
