Stay organized with collectionsSave and categorize content based on your preferences.
Enable, disable, and restore certificate authorities
This document explains how you can manage the state of your certificate authority
(CA).
Enable a CA
All subordinate CAs are created in theAWAITING_USER_ACTIVATIONstate, and
they are set to theSTAGEDstate after activation. All root CAs are created in
theSTAGEDstate by default. You must change the CA state toENABLEDto
include it in a CA pool's certificate issuance rotation. For more information
about the operational states of a CA, seeCertificate authority
states.
To enable a CA that is in theSTAGEDorDISABLEDstate, use the following
instructions:
Console
In the Google Cloud console, go to theCertificate authoritiespage.
import("context""fmt""io"privateca"cloud.google.com/go/security/privateca/apiv1""cloud.google.com/go/security/privateca/apiv1/privatecapb")// Enable the Certificate Authority present in the given ca pool.// CA cannot be enabled if it has been already deleted.funcenableCa(wio.Writer,projectIdstring,locationstring,caPoolIdstring,caIdstring)error{// projectId := "your_project_id"// location := "us-central1" // For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.// caPoolId := "ca-pool-id" // The id of the CA pool under which the CA is present.// caId := "ca-id" // The id of the CA to be enabled.ctx:=context.Background()caClient,err:=privateca.NewCertificateAuthorityClient(ctx)iferr!=nil{returnfmt.Errorf("NewCertificateAuthorityClient creation failed: %w",err)}defercaClient.Close()fullCaName:=fmt.Sprintf("projects/%s/locations/%s/caPools/%s/certificateAuthorities/%s",projectId,location,caPoolId,caId)// Create the EnableCertificateAuthorityRequest.// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#EnableCertificateAuthorityRequest.req:=&privatecapb.EnableCertificateAuthorityRequest{Name:fullCaName}op,err:=caClient.EnableCertificateAuthority(ctx,req)iferr!=nil{returnfmt.Errorf("EnableCertificateAuthority failed: %w",err)}varcaResp*privatecapb.CertificateAuthorityifcaResp,err=op.Wait(ctx);err!=nil{returnfmt.Errorf("EnableCertificateAuthority failed during wait: %w",err)}ifcaResp.State!=privatecapb.CertificateAuthority_ENABLED{returnfmt.Errorf("unable to enable Certificate Authority. Current state: %s",caResp.State.String())}fmt.Fprintf(w,"Successfully enabled Certificate Authority: %s.",caId)returnnil}
importcom.google.api.core.ApiFuture;importcom.google.cloud.security.privateca.v1.CertificateAuthority.State;importcom.google.cloud.security.privateca.v1.CertificateAuthorityName;importcom.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;importcom.google.cloud.security.privateca.v1.EnableCertificateAuthorityRequest;importcom.google.longrunning.Operation;importjava.io.IOException;importjava.util.concurrent.ExecutionException;publicclassEnableCertificateAuthority{publicstaticvoidmain(String[]args)throwsInterruptedException,ExecutionException,IOException{// TODO(developer): Replace these variables before running the sample.// location: For a list of locations, see:// https://cloud.google.com/certificate-authority-service/docs/locations// poolId: The id of the CA pool under which the CA is present.// certificateAuthorityName: The name of the CA to be enabled.Stringproject="your-project-id";Stringlocation="ca-location";StringpoolId="ca-pool-id";StringcertificateAuthorityName="certificate-authority-name";enableCertificateAuthority(project,location,poolId,certificateAuthorityName);}// Enable the Certificate Authority present in the given ca pool.// CA cannot be enabled if it has been already deleted.publicstaticvoidenableCertificateAuthority(Stringproject,Stringlocation,StringpoolId,StringcertificateAuthorityName)throwsIOException,ExecutionException,InterruptedException{try(CertificateAuthorityServiceClientcertificateAuthorityServiceClient=CertificateAuthorityServiceClient.create()){// Create the Certificate Authority Name.CertificateAuthorityNamecertificateAuthorityParent=CertificateAuthorityName.newBuilder().setProject(project).setLocation(location).setCaPool(poolId).setCertificateAuthority(certificateAuthorityName).build();// Create the Enable Certificate Authority Request.EnableCertificateAuthorityRequestenableCertificateAuthorityRequest=EnableCertificateAuthorityRequest.newBuilder().setName(certificateAuthorityParent.toString()).build();// Enable the Certificate Authority.ApiFuture<Operation>futureCall=certificateAuthorityServiceClient.enableCertificateAuthorityCallable().futureCall(enableCertificateAuthorityRequest);Operationresponse=futureCall.get();if(response.hasError()){System.out.println("Error while enabling Certificate Authority !"+response.getError());return;}// Get the current CA state.StatecaState=certificateAuthorityServiceClient.getCertificateAuthority(certificateAuthorityParent).getState();// Check if the CA is enabled.if(caState==State.ENABLED){System.out.println("Enabled Certificate Authority : "+certificateAuthorityName);}else{System.out.println("Cannot enable the Certificate Authority ! Current CA State: "+caState);}}}}
importgoogle.cloud.security.privateca_v1asprivateca_v1defenable_certificate_authority(project_id:str,location:str,ca_pool_name:str,ca_name:str)->None:"""Enable the Certificate Authority present in the given ca pool.CA cannot be enabled if it has been already deleted.Args:project_id: project ID or project number of the Cloud project you want to use.location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.ca_pool_name: the name of the CA pool under which the CA is present.ca_name: the name of the CA to be enabled."""caServiceClient=privateca_v1.CertificateAuthorityServiceClient()ca_path=caServiceClient.certificate_authority_path(project_id,location,ca_pool_name,ca_name)# Create the Enable Certificate Authority Request.request=privateca_v1.EnableCertificateAuthorityRequest(name=ca_path,)# Enable the Certificate Authority.operation=caServiceClient.enable_certificate_authority(request=request)operation.result()# Get the current CA state.ca_state=caServiceClient.get_certificate_authority(name=ca_path).state# Check if the CA is enabled.ifca_state==privateca_v1.CertificateAuthority.State.ENABLED:print("Enabled Certificate Authority:",ca_name)else:print("Cannot enable the Certificate Authority ! Current CA State:",ca_state)
Disable a CA
Disabling a CA prevents it from issuing certificates. All certificate requests
to a disabled CA are rejected. Other functionalities, such as revoking
certificates, publishing Certificate Revocation Lists (CRLs), and updating the
CA metadata can still take place.
To disable a CA, use the following instructions:
Console
In the Google Cloud console, go to theCertificate authoritiespage.
import("context""fmt""io"privateca"cloud.google.com/go/security/privateca/apiv1""cloud.google.com/go/security/privateca/apiv1/privatecapb")// Disable a Certificate Authority from the specified CA pool.funcdisableCa(wio.Writer,projectIdstring,locationstring,caPoolIdstring,caIdstring)error{// projectId := "your_project_id"// location := "us-central1" // For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.// caPoolId := "ca-pool-id" // The id of the CA pool under which the CA is present.// caId := "ca-id" // The id of the CA to be disabled.ctx:=context.Background()caClient,err:=privateca.NewCertificateAuthorityClient(ctx)iferr!=nil{returnfmt.Errorf("NewCertificateAuthorityClient creation failed: %w",err)}defercaClient.Close()fullCaName:=fmt.Sprintf("projects/%s/locations/%s/caPools/%s/certificateAuthorities/%s",projectId,location,caPoolId,caId)// Create the DisableCertificateAuthorityRequest.// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#DisableCertificateAuthorityRequest.req:=&privatecapb.DisableCertificateAuthorityRequest{Name:fullCaName}op,err:=caClient.DisableCertificateAuthority(ctx,req)iferr!=nil{returnfmt.Errorf("DisableCertificateAuthority failed: %w",err)}varcaResp*privatecapb.CertificateAuthorityifcaResp,err=op.Wait(ctx);err!=nil{returnfmt.Errorf("DisableCertificateAuthority failed during wait: %w",err)}ifcaResp.State!=privatecapb.CertificateAuthority_DISABLED{returnfmt.Errorf("unable to disabled Certificate Authority. Current state: %s",caResp.State.String())}fmt.Fprintf(w,"Successfully disabled Certificate Authority: %s.",caId)returnnil}
importcom.google.api.core.ApiFuture;importcom.google.cloud.security.privateca.v1.CertificateAuthority.State;importcom.google.cloud.security.privateca.v1.CertificateAuthorityName;importcom.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;importcom.google.cloud.security.privateca.v1.DisableCertificateAuthorityRequest;importcom.google.longrunning.Operation;importjava.io.IOException;importjava.util.concurrent.ExecutionException;publicclassDisableCertificateAuthority{publicstaticvoidmain(String[]args)throwsInterruptedException,ExecutionException,IOException{// TODO(developer): Replace these variables before running the sample.// location: For a list of locations, see:// https://cloud.google.com/certificate-authority-service/docs/locations// poolId: The id of the CA pool under which the CA is present.// certificateAuthorityName: The name of the CA to be disabled.Stringproject="your-project-id";Stringlocation="ca-location";StringpoolId="ca-pool-id";StringcertificateAuthorityName="certificate-authority-name";disableCertificateAuthority(project,location,poolId,certificateAuthorityName);}// Disable a Certificate Authority which is present in the given CA pool.publicstaticvoiddisableCertificateAuthority(Stringproject,Stringlocation,StringpoolId,StringcertificateAuthorityName)throwsIOException,ExecutionException,InterruptedException{// Initialize client that will be used to send requests. This client only needs to be created// once, and can be reused for multiple requests. After completing all of your requests, call// the `certificateAuthorityServiceClient.close()` method on the client to safely// clean up any remaining background resources.try(CertificateAuthorityServiceClientcertificateAuthorityServiceClient=CertificateAuthorityServiceClient.create()){// Create the Certificate Authority Name.CertificateAuthorityNamecertificateAuthorityNameParent=CertificateAuthorityName.newBuilder().setProject(project).setLocation(location).setCaPool(poolId).setCertificateAuthority(certificateAuthorityName).build();// Create the Disable Certificate Authority Request.DisableCertificateAuthorityRequestdisableCertificateAuthorityRequest=DisableCertificateAuthorityRequest.newBuilder().setName(certificateAuthorityNameParent.toString()).build();// Disable the Certificate Authority.ApiFuture<Operation>futureCall=certificateAuthorityServiceClient.disableCertificateAuthorityCallable().futureCall(disableCertificateAuthorityRequest);Operationresponse=futureCall.get();if(response.hasError()){System.out.println("Error while disabling Certificate Authority !"+response.getError());return;}// Get the current CA state.StatecaState=certificateAuthorityServiceClient.getCertificateAuthority(certificateAuthorityNameParent).getState();// Check if the Certificate Authority is disabled.if(caState==State.DISABLED){System.out.println("Disabled Certificate Authority : "+certificateAuthorityName);}else{System.out.println("Cannot disable the Certificate Authority ! Current CA State: "+caState);}}}}
importgoogle.cloud.security.privateca_v1asprivateca_v1defdisable_certificate_authority(project_id:str,location:str,ca_pool_name:str,ca_name:str)->None:"""Disable a Certificate Authority which is present in the given CA pool.Args:project_id: project ID or project number of the Cloud project you want to use.location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.ca_pool_name: the name of the CA pool under which the CA is present.ca_name: the name of the CA to be disabled."""caServiceClient=privateca_v1.CertificateAuthorityServiceClient()ca_path=caServiceClient.certificate_authority_path(project_id,location,ca_pool_name,ca_name)# Create the Disable Certificate Authority Request.request=privateca_v1.DisableCertificateAuthorityRequest(name=ca_path)# Disable the Certificate Authority.operation=caServiceClient.disable_certificate_authority(request=request)operation.result()# Get the current CA state.ca_state=caServiceClient.get_certificate_authority(name=ca_path).state# Check if the CA is disabled.ifca_state==privateca_v1.CertificateAuthority.State.DISABLED:print("Disabled Certificate Authority:",ca_name)else:print("Cannot disable the Certificate Authority ! Current CA State:",ca_state)
Restore a CA
When a CA is scheduled for deletion, there is a 30-day grace period before it is
deleted. During the grace period, a CA Service Operation Manager
(roles/privateca.caManager) or CA Service
Admin (roles/privateca.admin) can stop the deletion process. You can restore a
CA only during the grace period.
To restore a CA that is scheduled to be deleted to the disabled state, use the
following instructions:
Console
In the Google Cloud console, go to theCertificate authoritiespage.
import("context""fmt""io"privateca"cloud.google.com/go/security/privateca/apiv1""cloud.google.com/go/security/privateca/apiv1/privatecapb")// Undelete a Certificate Authority from the specified CA pool.funcunDeleteCa(wio.Writer,projectIdstring,locationstring,caPoolIdstring,caIdstring)error{// projectId := "your_project_id"// location := "us-central1" // For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.// caPoolId := "ca-pool-id" // The id of the CA pool under which the CA is present.// caId := "ca-id" // The id of the CA to be undeleted.ctx:=context.Background()caClient,err:=privateca.NewCertificateAuthorityClient(ctx)iferr!=nil{returnfmt.Errorf("NewCertificateAuthorityClient creation failed: %w",err)}defercaClient.Close()fullCaName:=fmt.Sprintf("projects/%s/locations/%s/caPools/%s/certificateAuthorities/%s",projectId,location,caPoolId,caId)// Check if the CA is deleted.// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#GetCertificateAuthorityRequest.caReq:=&privatecapb.GetCertificateAuthorityRequest{Name:fullCaName}caResp,err:=caClient.GetCertificateAuthority(ctx,caReq)iferr!=nil{returnfmt.Errorf("GetCertificateAuthority failed: %w",err)}ifcaResp.State!=privatecapb.CertificateAuthority_DELETED{returnfmt.Errorf("you can only undelete deleted Certificate Authorities. %s is not deleted",caId)}// Create the UndeleteCertificateAuthority.// See https://pkg.go.dev/cloud.google.com/go/security/privateca/apiv1/privatecapb#UndeleteCertificateAuthorityRequest.req:=&privatecapb.UndeleteCertificateAuthorityRequest{Name:fullCaName}op,err:=caClient.UndeleteCertificateAuthority(ctx,req)iferr!=nil{returnfmt.Errorf("UndeleteCertificateAuthority failed: %w",err)}ifcaResp,err=op.Wait(ctx);err!=nil{returnfmt.Errorf("UndeleteCertificateAuthority failed during wait: %w",err)}ifcaResp.State==privatecapb.CertificateAuthority_DELETED{returnfmt.Errorf("unable to undelete Certificate Authority. Current state: %s",caResp.State.String())}fmt.Fprintf(w,"Successfully undeleted Certificate Authority: %s.",caId)returnnil}
importcom.google.api.core.ApiFuture;importcom.google.cloud.security.privateca.v1.CertificateAuthority.State;importcom.google.cloud.security.privateca.v1.CertificateAuthorityName;importcom.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;importcom.google.cloud.security.privateca.v1.UndeleteCertificateAuthorityRequest;importcom.google.longrunning.Operation;importjava.io.IOException;importjava.util.concurrent.ExecutionException;importjava.util.concurrent.TimeUnit;importjava.util.concurrent.TimeoutException;publicclassUndeleteCertificateAuthority{publicstaticvoidmain(String[]args)throwsInterruptedException,ExecutionException,TimeoutException,IOException{// TODO(developer): Replace these variables before running the sample.// location: For a list of locations, see:// https://cloud.google.com/certificate-authority-service/docs/locations// poolId: The id of the CA pool under which the deleted CA is present.// certificateAuthorityName: The name of the CA to be restored (undeleted).Stringproject="your-project-id";Stringlocation="ca-location";StringpoolId="ca-pool-id";StringcertificateAuthorityName="certificate-authority-name";undeleteCertificateAuthority(project,location,poolId,certificateAuthorityName);}// Restore a deleted CA, if still within the grace period of 30 days.publicstaticvoidundeleteCertificateAuthority(Stringproject,Stringlocation,StringpoolId,StringcertificateAuthorityName)throwsIOException,ExecutionException,InterruptedException,TimeoutException{// Initialize client that will be used to send requests. This client only needs to be created// once, and can be reused for multiple requests. After completing all of your requests, call// the `certificateAuthorityServiceClient.close()` method on the client to safely// clean up any remaining background resources.try(CertificateAuthorityServiceClientcertificateAuthorityServiceClient=CertificateAuthorityServiceClient.create()){StringcertificateAuthorityParent=CertificateAuthorityName.of(project,location,poolId,certificateAuthorityName).toString();// Confirm if the CA is in DELETED stage.if(getCurrentState(certificateAuthorityServiceClient,certificateAuthorityParent)!=State.DELETED){System.out.println("CA is not deleted !");return;}// Create the Request.UndeleteCertificateAuthorityRequestundeleteCertificateAuthorityRequest=UndeleteCertificateAuthorityRequest.newBuilder().setName(certificateAuthorityParent).build();// Undelete the CA.ApiFuture<Operation>futureCall=certificateAuthorityServiceClient.undeleteCertificateAuthorityCallable().futureCall(undeleteCertificateAuthorityRequest);Operationresponse=futureCall.get(5,TimeUnit.SECONDS);// CA state changes from DELETED to DISABLED if successfully restored.// Confirm if the CA is DISABLED.if(response.hasError()||getCurrentState(certificateAuthorityServiceClient,certificateAuthorityParent)!=State.DISABLED){System.out.println("Unable to restore the Certificate Authority! Please try again !"+response.getError());return;}// The CA will be in the DISABLED state. Enable before use.System.out.println("Successfully restored the Certificate Authority ! "+certificateAuthorityName);}}// Get the current state of CA.privatestaticStategetCurrentState(CertificateAuthorityServiceClientclient,StringcertificateAuthorityParent){returnclient.getCertificateAuthority(certificateAuthorityParent).getState();}}
importgoogle.cloud.security.privateca_v1asprivateca_v1defundelete_certificate_authority(project_id:str,location:str,ca_pool_name:str,ca_name:str)->None:"""Restore a deleted CA, if still within the grace period of 30 days.Args:project_id: project ID or project number of the Cloud project you want to use.location: location you want to use. For a list of locations, see: https://cloud.google.com/certificate-authority-service/docs/locations.ca_pool_name: the name of the CA pool under which the deleted CA is present.ca_name: the name of the CA to be restored (undeleted)."""caServiceClient=privateca_v1.CertificateAuthorityServiceClient()ca_path=caServiceClient.certificate_authority_path(project_id,location,ca_pool_name,ca_name)# Confirm if the CA is in DELETED stage.ca_state=caServiceClient.get_certificate_authority(name=ca_path).stateifca_state!=privateca_v1.CertificateAuthority.State.DELETED:print("CA is not deleted !")return# Create the Request.request=privateca_v1.UndeleteCertificateAuthorityRequest(name=ca_path)# Undelete the CA.operation=caServiceClient.undelete_certificate_authority(request=request)result=operation.result()print("Operation result",result)# Get the current CA state.ca_state=caServiceClient.get_certificate_authority(name=ca_path).state# CA state changes from DELETED to DISABLED if successfully restored.# Confirm if the CA is DISABLED.ifca_state==privateca_v1.CertificateAuthority.State.DISABLED:print("Successfully undeleted Certificate Authority:",ca_name)else:print("Unable to restore the Certificate Authority! Please try again! Current state:",ca_state,)
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eCertificate Authorities (CAs) can be enabled to include them in a CA pool's certificate issuance rotation, and this action is required if the CA is in the \u003ccode\u003eSTAGED\u003c/code\u003e or \u003ccode\u003eDISABLED\u003c/code\u003e state.\u003c/p\u003e\n"],["\u003cp\u003eDisabling a CA prevents it from issuing new certificates, but it allows for other operations like revoking existing certificates and updating CA metadata, and it's important to know that disabled CAs continue to incur billing.\u003c/p\u003e\n"],["\u003cp\u003eA CA that has been scheduled for deletion can be restored within a 30-day grace period by CA Service Operation Managers or Admins, returning it to a \u003ccode\u003eDISABLED\u003c/code\u003e state, from which it can be re-enabled.\u003c/p\u003e\n"],["\u003cp\u003eThe console, gcloud and multiple different programming languages (Go, Java, Python) can be used to manage the state of your CAs.\u003c/p\u003e\n"]]],[],null,[]]
