Amazon Private CA template definitions
The following sections provide configuration details about supported Amazon Private CA certificate templates.
BlankEndEntityCertificate_APIPassthrough/V1 definition
With blank end-entity certificate templates, you can issue end-entity certificates with only X.509 Basic constraints present. This is the simplest end-entity certificate that Amazon Private CA can issue, but it can be customized using the API structure. The Basic constraints extension defines whether or not the certificate is a CA certificate. A blank end-entity certificate template enforces a value of FALSE for Basic constraints to ensure that an end-entity certificate is issued and not a CA certificate.
You can use blank passthrough templates to issue smart card certificates that require specific values for Key usage (KU) and Extended key usage (EKU). For example, Extended key usage may require Client Authentication and Smart Card Logon, and Key usage may require Digital Signature, Non Repudiation, and Key Encipherment. Unlike other passthrough templates, blank end-entity certificate templates allow the configuration of KU and EKU extensions, where KU can be any of the nine supported values (digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, and decipherOnly) and EKU can be any of the supported values (serverAuth, clientAuth, codesigning, emailProtection, timestamping, and OCSPSigning) plus custom extensions.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA:FALSE |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankEndEntityCertificate_APICSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA:FALSE |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankEndEntityCertificate_CriticalBasicConstraints_APICSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, CA:FALSE |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration, API, or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankEndEntityCertificate_CriticalBasicConstraints_APIPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, CA:FALSE |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or API] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankEndEntityCertificate_CriticalBasicConstraints_CSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, CA:FALSE |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankEndEntityCertificate_CSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
CA:FALSE |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen0_CSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen0_APICSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen0_APIPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration] |
BlankSubordinateCACertificate_PathLen1_APIPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen1_CSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen1_APICSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen2_APIPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen2_CSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen2_APICSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen3_APIPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen3_CSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
BlankSubordinateCACertificate_PathLen3_APICSRPassthrough/V1 definition
For general information about blank templates, see BlankEndEntityCertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
CodeSigningCertificate/V1 definition
This template is used to create certificates for code signing. You can use
code-signing certificates from Amazon Private CA with any code-signing solution that is
based on a private CA infrastructure. For example, customers using Code Signing
for Amazon IoT can generate a code-signing certificate with Amazon Private CA and import it to
Amazon Certificate Manager. For more information, see What Is Code Signing for Amazon IoT?
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, code signing |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
CodeSigningCertificate_APICSRPassthrough/V1 definition
This template extends CodeSigningCertificate/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, code signing |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
CodeSigningCertificate_APIPassthrough/V1 definition
This template is identical to the CodeSigningCertificate
template
with one difference: In this template, Amazon Private CA passes additional extensions
through the API to the certificate if the extensions are not specified in the
template. Extensions specified in the template always override extensions in the
API.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, code signing |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
CodeSigningCertificate_CSRPassthrough/V1 definition
This template is identical to the CodeSigningCertificate
template
with one difference: In this template, Amazon Private CA passes additional extensions
from the certificate signing request (CSR) into the certificate if the extensions
are not specified in the template. Extensions specified in the template always
override extensions in the CSR.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, code signing |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityCertificate/V1 definition
This template is used to create certificates for end entities such as operating systems or web servers.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication, TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityCertificate_APICSRPassthrough/V1 definition
This template extends EndEntityCertificate/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication, TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityCertificate_APIPassthrough/V1 definition
This template is identical to the EndEntityCertificate
template
with one difference: In this template, Amazon Private CA passes additional extensions
through the API to the certificate if the extensions are not specified in the
template. Extensions specified in the template always override extensions in the
API.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication, TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityCertificate_CSRPassthrough/V1 definition
This template is identical to the EndEntityCertificate
template
with one difference: In this template, Amazon Private CA passes additional extensions
from the certificate signing request (CSR) into the certificate if the extensions
are not specified in the template. Extensions specified in the template always
override extensions in the CSR.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication, TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityClientAuthCertificate/V1 definition
This template differs from the EndEntityCertificate
only in the
Extended key usage value, which restricts it to TLS web client
authentication.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityClientAuthCertificate_APICSRPassthrough/V1 definition
This template extends EndEntityClientAuthCertificate/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityClientAuthCertificate_APIPassthrough/V1 definition
This template is identical to the EndEntityClientAuthCertificate
template with one difference. In this template, Amazon Private CA passes additional
extensions through the API into the certificate if the extensions are not
specified in the template. Extensions specified in the template always override
extensions in the API.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityClientAuthCertificate_CSRPassthrough/V1 definition
This template is identical to the EndEntityClientAuthCertificate
template with one difference. In this template, Amazon Private CA passes additional
extensions from the certificate signing request (CSR) into the certificate if the
extensions are not specified in the template. Extensions specified in the template
always override extensions in the CSR.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web client authentication |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityServerAuthCertificate/V1 definition
This template differs from the EndEntityCertificate
only in the
Extended key usage value, which restricts it to TLS web server
authentication.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityServerAuthCertificate_APICSRPassthrough/V1 definition
This template extends EndEntityServerAuthCertificate/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityServerAuthCertificate_APIPassthrough/V1 definition
This template is identical to the EndEntityServerAuthCertificate
template with one difference. In this template, Amazon Private CA passes additional
extensions through the API into the certificate if the extensions are not
specified in the template. Extensions specified in the template always override
extensions in the API.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
EndEntityServerAuthCertificate_CSRPassthrough/V1 definition
This template is identical to the EndEntityServerAuthCertificate
template with one difference. In this template, Amazon Private CA passes additional
extensions from the certificate signing request (CSR) into the certificate if the
extensions are not specified in the template. Extensions specified in the template
always override extensions in the CSR.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
CA: |
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, key encipherment |
Extended key usage |
TLS web server authentication |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
OCSPSigningCertificate/V1 definition
This template is used to create certificates for signing OCSP responses. The
template is identical to the CodeSigningCertificate
template, except
that the Extended key usage value specifies OCSP signing instead of code
signing.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, OCSP signing |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
OCSPSigningCertificate_APICSRPassthrough/V1 definition
This template extends the OCSPSigningCertificate/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, OCSP signing |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
OCSPSigningCertificate_APIPassthrough/V1 definition
This template is identical to the OCSPSigningCertificate
template
with one difference. In this template, Amazon Private CA passes additional extensions
through the API into the certificate if the extensions are not specified in the
template. Extensions specified in the template always override extensions in the
API.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, OCSP signing |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
OCSPSigningCertificate_CSRPassthrough/V1 definition
This template is identical to the OCSPSigningCertificate
template
with one difference. In this template, Amazon Private CA passes additional extensions
from the certificate signing request (CSR) into the certificate if the extensions
are not specified in the template. Extensions specified in the template always
override extensions in the CSR.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
|
Authority key identifier |
[SKI from CA certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature |
Extended key usage |
Critical, OCSP signing |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
RootCACertificate/V1 definition
This template is used to issue self-signed root CA certificates. CA
certificates include a critical basic constraints extension with the CA field set
to TRUE
to designate that the certificate can be used to issue CA
certificates. The template does not specify a path length (pathLenConstraint) because this could inhibit
future expansion of the hierarchy. Extended key usage is excluded to prevent use
of the CA certificate as a TLS client or server certificate. No CRL information is
specified because a self-signed certificate cannot be revoked.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, keyCertSign, CRL sign |
CRL distribution points |
N/A |
RootCACertificate_APIPassthrough/V1 definition
This template extends RootCACertificate/V1 to support API passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[Passthrough from API] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, keyCertSign, CRL sign |
CRL distribution points* |
N/A |
BlankRootCACertificate_APIPassthrough/V1 definition
With blank root certificate templates, you can issue root certificates with
only X.509 basic constraints present. This is the simplest root certificate that
Amazon Private CA can issue, but it can be customized using the API structure. The basic
constraints extension defines whether or not the certificate is a CA certificate.
A blank root certificate template enforces a value of TRUE
for basic
constraints to ensure that a root CA certificate is issued.
You can use blank passthrough root templates to issue root certificates that
require specific values for key usage (KU). For example, key usage might require
keyCertSign
and cRLSign
, but not
digitalSignature
. Unlike the other non-blank root passthrough
certificate template, blank root certificate templates allow the configuration of
the KU extension, where KU can be any of the nine supported values
(digitalSignature
, nonRepudiation
,
keyEncipherment
, dataEncipherment
,
keyAgreement
, keyCertSign
, cRLSign
,
encipherOnly
, and decipherOnly
).
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Subject key identifier |
[Derived from CSR] |
BlankRootCACertificate_PathLen0_APIPassthrough/V1 definition
For general information about blank root CA templates, see BlankRootCACertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Subject key identifier |
[Derived from CSR] |
BlankRootCACertificate_PathLen1_APIPassthrough/V1 definition
For general information about blank root CA templates, see BlankRootCACertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Subject key identifier |
[Derived from CSR] |
BlankRootCACertificate_PathLen2_APIPassthrough/V1 definition
For general information about blank root CA templates, see BlankRootCACertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Subject key identifier |
[Derived from CSR] |
BlankRootCACertificate_PathLen3_APIPassthrough/V1 definition
For general information about blank root CA templates, see BlankRootCACertificate_APIPassthrough/V1 definition.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Subject key identifier |
[Derived from CSR] |
SubordinateCACertificate_PathLen0/V1 definition
This template is used to issue subordinate CA certificates with a path length
of 0
. CA certificates include a critical basic constraints extension with the CA
field set to TRUE
to designate that the certificate can be used to
issue CA certificates. Extended key usage is not included, which prevents the CA
certificate from being used as a TLS client or server certificate.
For more information about certification paths, see Setting Length Constraints on the Certification Path.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in certificates that are issued with this template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen0_APICSRPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen0/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen0_APIPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen0/V1 to support API passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen0_CSRPassthrough/V1 definition
This template is identical to the
SubordinateCACertificate_PathLen0
template with one difference: In
this template, Amazon Private CA passes additional extensions from the certificate
signing request (CSR) into the certificate if the extensions are not specified in
the template. Extensions specified in the template always override extensions in
the CSR.
Note
A CSR that contains custom additional extensions must be created outside of Amazon Private CA.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen1/V1 definition
This template is used to issue subordinate CA certificates with a path length
of 1
. CA certificates include a critical Basic constraints extension with the CA
field set to TRUE
to designate that the certificate can be used to
issue CA certificates. Extended key usage is not included, which prevents the CA
certificate from being used as a TLS client or server certificate.
For more information about certification paths, see Setting Length Constraints on the Certification Path.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen1_APICSRPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen1/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen1_APIPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen0/V1 to support API passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen1_CSRPassthrough/V1 definition
This template is identical to the
SubordinateCACertificate_PathLen1
template with one difference: In
this template, Amazon Private CA passes additional extensions from the certificate
signing request (CSR) into the certificate if the extensions are not specified in
the template. Extensions specified in the template always override extensions in
the CSR.
Note
A CSR that contains custom additional extensions must be created outside of Amazon Private CA.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen2/V1 definition
This template is used to issue subordinate CA certificates with a path length
of 2. CA certificates include a critical Basic constraints extension with the CA
field set to TRUE
to designate that the certificate can be used to
issue CA certificates. Extended key usage is not included, which prevents the CA
certificate from being used as a TLS client or server certificate.
For more information about certification paths, see Setting Length Constraints on the Certification Path.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen2_APICSRPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen2/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen2_APIPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen2/V1 to support API passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen2_CSRPassthrough/V1 definition
This template is identical to the
SubordinateCACertificate_PathLen2
template with one difference: In
this template, Amazon Private CA passes additional extensions from the certificate
signing request (CSR) into the certificate if the extensions are not specified in
the template. Extensions specified in the template always override extensions in
the CSR.
Note
A CSR that contains custom additional extensions must be created outside of Amazon Private CA.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen3/V1 definition
This template is used to issue subordinate CA certificates with a path length
of 3. CA certificates include a critical Basic constraints extension with the CA
field set to TRUE
to designate that the certificate can be used to
issue CA certificates. Extended key usage is not included, which prevents the CA
certificate from being used as a TLS client or server certificate.
For more information about certification paths, see Setting Length Constraints on the Certification Path.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
*CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen3_APICSRPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen3/V1 to support API and CSR passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen3_APIPassthrough/V1 definition
This template extends SubordinateCACertificate_PathLen3/V1 to support API passthrough values.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from API or CSR] |
Subject |
[Passthrough from API or CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration] |
* CRL distribution points are included in the template only if the CA is configured with CRL generation enabled.
SubordinateCACertificate_PathLen3_CSRPassthrough/V1 definition
This template is identical to the
SubordinateCACertificate_PathLen3
template with one difference: In
this template, Amazon Private CA passes additional extensions from the certificate
signing request (CSR) into the certificate if the extensions are not specified in
the template. Extensions specified in the template always override extensions in
the CSR.
Note
A CSR that contains custom additional extensions must be created outside of Amazon Private CA.
X509v3 Parameter |
Value |
---|---|
Subject alternative name |
[Passthrough from CSR] |
Subject |
[Passthrough from CSR] |
Basic constraints |
Critical, |
Authority key identifier |
[SKI from CA Certificate] |
Subject key identifier |
[Derived from CSR] |
Key usage |
Critical, digital signature, |
CRL distribution points* |
[Passthrough from CA configuration or CSR] |
*CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.