# Troubleshoot Amazon Private Certificate Authority exception messages
<a name="PCATsExceptions"></a>

An Amazon Private CA command might fail for several reasons. For information on each exception and recommendations for resolving them, see the table below.


**Amazon Private CA Exceptions**  

|  Exception Returned by Amazon Private CA  | Description | Remediation | 
| --- | --- | --- | 
| <a name="AccessDeniedException"></a>`AccessDeniedException` | The permissions required to use the given command have not been delegated by a private CA to the calling account. | For information on delegating permissions in Amazon Private CA, see [Assign certificate renewal permissions to ACM](assign-permissions.md#PcaPermissions). | 
| <a name="InvalidArgsException"></a>`InvalidArgsException` | A certificate creation or renewal request was made with invalid parameters. | Check the command's individual documentation to make sure that your input parameters are valid. If you are creating a new certificate, make sure that the requested signing algorithm can be used with the CA's key type. | 
| <a name="InvalidStateException"></a>`InvalidStateException` | The associated private CA cannot renew the certificate because it is not in the ACTIVE state. | Attempt to [restore the private CA](PCARestoreCA.md). If the private CA is outside of its restoration period, the CA cannot be restored and the certificate cannot be renewed. | 
| <a name="LimitExceededException"></a>`LimitExceededException` | Each certificate authority (CA) has a quota of certificates that it can issue. The private CA that is associated with the designated certificate has reached its quota. For more information, see [Service Quotas](https://docs.amazonaws.cn/general/latest/gr/pca.html#limits_pca) in the Amazon Web Services General Reference Guide. | Contact the [Amazon Web Services Support Center](http://www.amazonaws.cn/support-plans/) to request a quota increase. | 
| <a name="MalformedCSRException"></a>`MalformedCSRException` | The certificate signing request (CSR) that was submitted to Amazon Private CA cannot be verified or validated. | Confirm that your CSR was properly generated and configured.  | 
| `OtherException` | An internal error has caused the request to fail. | Attempt to run the command again. If the problem persists, contact the [Amazon Web Services Support Center](http://www.amazonaws.cn/support-plans/). | 
| <a name="RequestFailedException"></a>`RequestFailedException` | A networking problem in your Amazon environment caused the request to fail. | Retry the request. If the failure persists, check your [Amazon VPC (VPC) configuration](https://docs.amazonaws.cn/vpc/latest/userguide/what-is-amazon-vpc.html). | 
| <a name="ResourceNotFoundException"></a>`ResourceNotFoundException` | The private CA that issued the certificate was deleted and no longer exists. | Request a new certificate from another active CA. | 
| <a name="ThrottlingException"></a>`ThrottlingException` | A requested API action failed because it exceeded a quota. | Confirm that you are not issuing more calls than allowed by Amazon Private CA.<br />A `ThrottlingException` error may also occur because you have encountered a transient condition rather than from an exceeded quota. If you encounter the error and you have not been making calls in excess of the quota, try your request again.<br />If you are running up against a quota, you may be able to request an increase. For more information, see [Service Quotas](https://docs.amazonaws.cn/general/latest/gr/pca.html#limits_pca) in the Amazon Web Services General Reference Guide. | 
| <a name="ValidationException"></a>`ValidationException` | The request's input parameters were incorrectly formatted, or the validity period of the root certificate ends before the validity period of the requested certificate. | Check the syntax requirements of the command's input parameters as well as the validity period of your CA's root certificate. For information about changing the validity period, see [Update a private CA in Amazon Private Certificate Authority](PCAUpdateCA.md). |