Skip to main content

certificates

Creates, updates, deletes, gets or lists a certificates resource.

Overview​

Namecertificates
TypeResource
Idaws.acm.certificates

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
acme_account_idstringThe ACME account identifier associated with the certificate.
acme_endpoint_arnstringThe ARN of the ACME endpoint used to issue the certificate. (pattern: <code>arn:[\w+=/,.@-]+:acm:[\w+=/,.@-]:[0-9]+:[\w+=,.@-]+(/[\w+=,.@-]+)</code>)
certificate_arnstringThe Amazon Resource Name (ARN) of the certificate. For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference. (pattern: <code>arn:[\w+=/,.@-]+:acm:[\w+=/,.@-]:[0-9]+:[\w+=,.@-]+(/[\w+=,.@-]+)</code>)
certificate_authority_arnstringThe Amazon Resource Name (ARN) of the private certificate authority (CA) that issued the certificate. This has the following format: arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012 (pattern: <code>arn:[\w+=/,.@-]+:acm:[\w+=/,.@-]:[0-9]+:[\w+=,.@-]+(/[\w+=,.@-]+)</code>)
certificate_key_pair_originstringThe origin of the certificate's key pair. (AWS_MANAGED, ACME, CUSTOMER_PROVIDED)
created_atstring (date-time)The time at which the certificate was requested.
domain_namestringThe fully qualified domain name for the certificate, such as www.example.com or example.com. (pattern: <code>(*.)?(((?!-)[A-Za-z0-9-]{0,62}[A-Za-z0-9]).)+((?!-)[A-Za-z0-9-]{1,62}[A-Za-z0-9])</code>)
domain_validation_optionsarrayContains information about the initial validation of each domain name that occurs as a result of the RequestCertificate request. This field exists only when the certificate type is AMAZON_ISSUED.
extended_key_usagesarrayContains a list of Extended Key Usage X.509 v3 extension objects. Each object specifies a purpose for which the certificate public key can be used and consists of a name and an object identifier (OID).
failure_reasonstringThe reason the certificate request failed. This value exists only when the certificate status is FAILED. For more information, see Certificate Request Failed in the Certificate Manager User Guide. (NO_AVAILABLE_CONTACTS, ADDITIONAL_VERIFICATION_REQUIRED, DOMAIN_NOT_ALLOWED, INVALID_PUBLIC_DOMAIN, DOMAIN_VALIDATION_DENIED, CAA_ERROR, PCA_LIMIT_EXCEEDED, PCA_INVALID_ARN, PCA_INVALID_STATE, PCA_REQUEST_FAILED, PCA_NAME_CONSTRAINTS_VALIDATION, PCA_RESOURCE_NOT_FOUND, PCA_INVALID_ARGS, PCA_INVALID_DURATION, PCA_ACCESS_DENIED, SLR_NOT_FOUND, OTHER)
imported_atstring (date-time)The date and time when the certificate was imported. This value exists only when the certificate type is IMPORTED.
in_use_byarrayA list of ARNs for the Amazon Web Services resources that are using the certificate. A certificate can be used by multiple Amazon Web Services resources.
issued_atstring (date-time)The time at which the certificate was issued. This value exists only when the certificate type is AMAZON_ISSUED.
issuerstringThe name of the certificate authority that issued and signed the certificate.
key_algorithmstringThe algorithm that was used to generate the public-private key pair. (RSA_1024, RSA_2048, RSA_3072, RSA_4096, EC_prime256v1, EC_secp384r1, EC_secp521r1)
key_usagesarrayA list of Key Usage X.509 v3 extension objects. Each object is a string value that identifies the purpose of the public key contained in the certificate. Possible extension values include DIGITAL_SIGNATURE, KEY_ENCHIPHERMENT, NON_REPUDIATION, and more.
managed_bystringIdentifies the Amazon Web Services service that manages the certificate issued by ACM. (CLOUDFRONT)
not_afterstring (date-time)The time after which the certificate is not valid.
not_beforestring (date-time)The time before which the certificate is not valid.
optionsobjectContains the certificate options. Certificate transparency logging opt-out is no longer available. All public certificates are recorded in a certificate transparency log.
renewal_eligibilitystringSpecifies whether the certificate is eligible for renewal. At this time, only exported private certificates can be renewed with the RenewCertificate command. (ELIGIBLE, INELIGIBLE)
renewal_summaryobjectContains information about the status of ACM's managed renewal for the certificate. This field exists only when the certificate type is AMAZON_ISSUED.
revocation_reasonstringThe reason the certificate was revoked. This value exists only when the certificate status is REVOKED. (UNSPECIFIED, KEY_COMPROMISE, CA_COMPROMISE, AFFILIATION_CHANGED, SUPERCEDED, SUPERSEDED, CESSATION_OF_OPERATION, CERTIFICATE_HOLD, REMOVE_FROM_CRL, PRIVILEGE_WITHDRAWN, A_A_COMPROMISE)
revoked_atstring (date-time)The time at which the certificate was revoked. This value exists only when the certificate status is REVOKED.
serialstringThe serial number of the certificate.
signature_algorithmstringThe algorithm that was used to sign the certificate.
statusstringThe status of the certificate. A certificate enters status PENDING_VALIDATION upon being requested, unless it fails for any of the reasons given in the troubleshooting topic Certificate request fails. ACM makes repeated attempts to validate a certificate for 72 hours and then times out. If a certificate shows status FAILED or VALIDATION_TIMED_OUT, delete the request, correct the issue with DNS validation or Email validation, and try again. If validation succeeds, the certificate enters status ISSUED. (PENDING_VALIDATION, ISSUED, INACTIVE, EXPIRED, VALIDATION_TIMED_OUT, REVOKED, FAILED)
subjectstringThe name of the entity that is associated with the public key contained in the certificate.
subject_alternative_namesarrayOne or more domain names (subject alternative names) included in the certificate. This list contains the domain names that are bound to the public key that is contained in the certificate. The subject alternative names include the canonical domain name (CN) of the certificate and additional domain names that can be used to connect to the website.
typestringThe source of the certificate. For certificates provided by ACM, this value is AMAZON_ISSUED. For certificates that you imported with ImportCertificate, this value is IMPORTED. ACM does not provide managed renewal for imported certificates. For more information about the differences between certificates that you import and those that ACM provides, see Importing Certificates in the Certificate Manager User Guide. (IMPORTED, AMAZON_ISSUED, PRIVATE)
update_summaryobjectContains information about the most recent update to the certificate. This field exists only when the certificate type is AMAZON_ISSUED and a certificate update has been requested.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
describe_certificateselectregionReturns detailed metadata about the specified ACM certificate. If you have just created a certificate using the RequestCertificate action, there is a delay of several seconds before you can retrieve information about it.
list_certificatesselectregionRetrieves a list of certificate ARNs and domain names. You can request that only certificates that match a specific status be listed. You can also filter by specific attributes of the certificate. Default filtering returns only RSA_2048 certificates. For more information, see Filters. By default, this action does not return certificates with a CertificateKeyPairOrigin of ACME. To include ACME certificates, specify ACME in the CertificateKeyPairOrigins filter.
revoke_certificateupdateregion, CertificateArn, RevocationReasonRevokes a public ACM certificate. You can only revoke certificates that have been previously exported. Once a certificate is revoked, you cannot reuse the certificate. Revoking a certificate is permanent.
update_certificate_optionsupdateregion, CertificateArn, OptionsUpdates certificate options. You can use this operation to change the domain validation method or specify whether to export your certificate. For more information, see Migrate from email to DNS validation and Certificate Manager Exportable Managed Certificates.
delete_certificatedeleteregionDeletes a certificate and its associated private key. If this action succeeds, the certificate is not available for use by Amazon Web Services services integrated with ACM. Deleting a certificate is eventually consistent. The may be a short delay before the certificate no longer appears in the list that can be displayed by calling the ListCertificates action or be retrieved by calling the GetCertificate action. You cannot delete an ACM certificate that is being used by another Amazon Web Services service. To delete a certificate that is in use, you must first remove the certificate association using the console or the CLI for the associated service. Deleting a certificate issued by a private certificate authority (CA) has no effect on the CA. You will continue to be charged for the CA until it is deleted. For more information, see Deleting Your Private CA in the Private Certificate Authority User Guide. You cannot delete a certificate with a CertificateKeyPairOrigin of ACME. ACM automatically deletes these certificates 1 year after they expire. Deleting a certificate issued by a private certificate authority (CA) has no effect on the CA. You will continue to be charged for the CA until it is deleted. For more information, see Deleting your private CA in the Amazon Web Services Private Certificate Authority User Guide.
get_certificateexecregion, CertificateArnRetrieves a certificate and its certificate chain. The certificate may be either a public or private certificate issued using the ACM RequestCertificate action, or a certificate imported into ACM using the ImportCertificate action. The chain consists of the certificate of the issuing CA and the intermediate certificates of any other subordinate CAs. All of the certificates are base64 encoded. You can use OpenSSL to decode the certificates and inspect individual fields.
resend_validation_emailexecregion, CertificateArn, Domain, ValidationDomainResends the email that requests domain ownership validation. The domain owner or an authorized representative must approve the ACM certificate before it can be issued. The certificate can be approved by clicking a link in the mail to navigate to the Amazon certificate approval website and then clicking I Approve. However, the validation email can be blocked by spam filters. Therefore, if you do not receive the original mail, you can request that the mail be resent within 72 hours of requesting the ACM certificate. If more than 72 hours have elapsed since your original request or since your last attempt to resend validation mail, you must request a new certificate. For more information about setting up your contact email addresses, see Configure Email for your Domain.
search_certificatesexecregionRetrieves a list of certificates matching search criteria. You can filter certificates by X.509 attributes and ACM specific properties like certificate status, type and renewal eligibility. This operation provides more flexible filtering than ListCertificates by supporting complex filter statements.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
regionstringAWS region (default: us-east-1)

SELECT examples​

Returns detailed metadata about the specified ACM certificate. If you have just created a certificate using the RequestCertificate action, there is a delay of several seconds before you can retrieve information about it.

SELECT
acme_account_id,
acme_endpoint_arn,
certificate_arn,
certificate_authority_arn,
certificate_key_pair_origin,
created_at,
domain_name,
domain_validation_options,
extended_key_usages,
failure_reason,
imported_at,
in_use_by,
issued_at,
issuer,
key_algorithm,
key_usages,
managed_by,
not_after,
not_before,
options,
renewal_eligibility,
renewal_summary,
revocation_reason,
revoked_at,
serial,
signature_algorithm,
status,
subject,
subject_alternative_names,
type,
update_summary
FROM aws.acm.certificates
WHERE region = '{{ region }}' -- required
;

UPDATE examples​

Revokes a public ACM certificate. You can only revoke certificates that have been previously exported. Once a certificate is revoked, you cannot reuse the certificate. Revoking a certificate is permanent.

UPDATE aws.acm.certificates
SET 
CertificateArn = '{{ CertificateArn }}',
RevocationReason = '{{ RevocationReason }}'
WHERE 
region = '{{ region }}' --required
AND CertificateArn = '{{ CertificateArn }}' --required
AND RevocationReason = '{{ RevocationReason }}' --required
RETURNING
certificate_arn;

DELETE examples​

Deletes a certificate and its associated private key. If this action succeeds, the certificate is not available for use by Amazon Web Services services integrated with ACM. Deleting a certificate is eventually consistent. The may be a short delay before the certificate no longer appears in the list that can be displayed by calling the ListCertificates action or be retrieved by calling the GetCertificate action. You cannot delete an ACM certificate that is being used by another Amazon Web Services service. To delete a certificate that is in use, you must first remove the certificate association using the console or the CLI for the associated service. Deleting a certificate issued by a private certificate authority (CA) has no effect on the CA. You will continue to be charged for the CA until it is deleted. For more information, see Deleting Your Private CA in the Private Certificate Authority User Guide. You cannot delete a certificate with a CertificateKeyPairOrigin of ACME. ACM automatically deletes these certificates 1 year after they expire. Deleting a certificate issued by a private certificate authority (CA) has no effect on the CA. You will continue to be charged for the CA until it is deleted. For more information, see Deleting your private CA in the Amazon Web Services Private Certificate Authority User Guide.

DELETE FROM aws.acm.certificates
WHERE region = '{{ region }}' --required
;

Lifecycle Methods​

Retrieves a certificate and its certificate chain. The certificate may be either a public or private certificate issued using the ACM RequestCertificate action, or a certificate imported into ACM using the ImportCertificate action. The chain consists of the certificate of the issuing CA and the intermediate certificates of any other subordinate CAs. All of the certificates are base64 encoded. You can use OpenSSL to decode the certificates and inspect individual fields.

EXEC aws.acm.certificates.get_certificate 
@region='{{ region }}' --required 
@@json=
'{
"CertificateArn": "{{ CertificateArn }}"
}'
;
Last updated on