Troubleshoot Amazon Private Certificate Authority exception messages - Amazon Private Certificate Authority
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Troubleshoot Amazon Private Certificate Authority exception messages

An Amazon Private CA command might fail for several reasons. For information on each exception and recommendations for resolving them, see the table below.

Amazon Private CA Exceptions

Exception Returned by Amazon Private CA

 Description Remediation

AccessDeniedException

 The permissions required to use the given command have not been delegated by a private CA to the calling account.

For information on delegating permissions in Amazon Private CA, see Assign certificate renewal permissions to ACM.

InvalidArgsException

 A certificate creation or renewal request was made with invalid parameters. Check the command's individual documentation to make sure that your input parameters are valid. If you are creating a new certificate, make sure that the requested signing algorithm can be used with the CA's key type.

InvalidStateException

 The associated private CA cannot renew the certificate because it is not in the ACTIVE state. Attempt to restore the private CA. If the private CA is outside of its restoration period, the CA cannot be restored and the certificate cannot be renewed.

LimitExceededException

 Each certificate authority (CA) has a quota of certificates that it can issue. The private CA that is associated with the designated certificate has reached its quota. For more information, see Service Quotas in the Amazon Web Services General Reference Guide. Contact the Amazon Web Services Support Center to request a quota increase.

MalformedCSRException

 The certificate signing request (CSR) that was submitted to Amazon Private CA cannot be verified or validated. Confirm that your CSR was properly generated and configured.

OtherException

 An internal error has caused the request to fail. Attempt to run the command again. If the problem persists, contact the Amazon Web Services Support Center.

RequestFailedException

A networking problem in your Amazon environment caused the request to fail.

Retry the request. If the failure persists, check your Amazon VPC (VPC) configuration.

ResourceNotFoundException

The private CA that issued the certificate was deleted and no longer exists.

Request a new certificate from another active CA.

ThrottlingException

 A requested API action failed because it exceeded a quota.

Confirm that you are not issuing more calls than allowed by Amazon Private CA.

A ThrottlingException error may also occur because you have encountered a transient condition rather than from an exceeded quota. If you encounter the error and you have not been making calls in excess of the quota, try your request again.

If you are running up against a quota, you may be able to request an increase. For more information, see Service Quotas in the Amazon Web Services General Reference Guide.

ValidationException

The request's input parameters were incorrectly formatted, or the validity period of the root certificate ends before the validity period of the requested certificate.

Check the syntax requirements of the command's input parameters as well as the validity period of your CA's root certificate. For information about changing the validity period, see Update a private CA in Amazon Private Certificate Authority.