Issue a private certificate

Prerequisites

• You have purchased and enabled a private intermediate CA. For more information, see Purchase and enable a private CA.

• The Remaining Certificates of your private intermediate CA is not 0. To purchase and allocate a private certificate quota, see Purchase and assign a quota on private certificates.

Procedure

1. Log in to the Certificate Management Service console.

2. In the navigation pane on the left, choose Certificate Management > Private Certificate Management. On the Private Certificate Management page, select the region where the PCA service is located.

3. On the Private CAs tab, find the target intermediate CA, and click Apply for Certificate in the Actions column.

4. In the Apply for Certificate panel, configure the certificate settings as described in the following table, and then click Confirm.

   After you submit the application, the private CA immediately issues the certificate. You can then click Certificates in the Actions column for the intermediate CA to view the issued certificate.

   Configuration item	Description
   Certificate Type	Server Certificate: Installed on an application server for server identity authentication. Client Certificate: Installed on a client that accesses an application for client identity authentication.
   Personal Name	Required only for a client certificate. Enter a unique identifier for the client user.
   Common Name (CN)	Required only for a server certificate. Enter the Common Name (CN) of the certificate subject, which is a domain name or an IP address.
   Validity Period	The certificate validity period of a private certificate depends on the service duration of the intermediate CA: If the service duration is less than one year, the certificate validity period cannot exceed the purchased PCA service duration. For example, if you purchased a one-month PCA service, the maximum certificate validity period is 31 days. To extend the validity period, renew the PCA service first. For more information, see Renew a CA. If the service duration is one year or longer, you can set a validity period of 1 to 100 years.
   SAN	Add SAN (Subject Alternative Name) extension attributes to a certificate to support multiple subjects. If the certificate must support multiple subjects, add subject information by using the SAN extension. For a server certificate, you can specify a domain name or an IP address. For a client certificate, you can specify an email address or a URI. You can add up to 10 SAN extension attributes. Note SAN (Subject Alternative Name) is an extension defined in the X.509 standard that allows an SSL certificate to be bound to multiple domain names. A URI (Uniform Resource Identifier) identifies the Alibaba Cloud resource to which the certificate belongs, such as an Elastic Compute Service (ECS) instance where the private certificate is deployed.
   More	To add information such as a name, company, or department to the certificate, click More to configure.
   Include CRL Address	Enabled by default. For more information, see CRL service.

What to do next

After the certificate is issued, you can download and install it on your client or server. For more information, see Download a private certificate.