Alibaba Cloud Private Certificate Authority (PCA) lets you build a private PKI without maintaining CA hardware. It uses a three-tier CA hierarchy for identity authentication, data encryption, and full-lifecycle certificate management.-Certificate Management Service(SSL Certificate)-阿里云帮助中心

Key concepts

PCA hierarchy

PCA uses a three-tier hierarchy: root CA, intermediate CA, and end-entity certificate.

Root CA: The trust anchor of the certificate chain. It is used only to issue intermediate CA certificates. We recommend that you strictly control its usage and permissions.
Intermediate CA: Issues end-entity certificates. We recommend that you create separate intermediate CAs for different organizational units or business lines to enable isolated management.
End-entity certificate: Issued by an intermediate CA and deployed on servers, clients, and devices.

Private CA and Compliance CA

PCA offers two CA types for different business scenarios:

Dimension	Private CA	Compliance CA
Use cases	Internal identity authentication, IoT device communication	MLPS compliance assessments, compliance with SM series cryptographic algorithms, electronic signatures
Supported algorithms	RSA, ECC	SM series cryptographic algorithms (SM2/SM3/SM4)
Certificate types	Server certificates, client certificates	Client certificates
CA creation method	Purchase a root CA, and then create an intermediate CA.	Purchasing an intermediate CA automatically generates a root CA.
Regulatory requirements	No external regulatory requirements	Meets regulatory requirements such as two-factor authentication and mutual authentication.

Use cases

Private CA

A private CA is suitable for identity authentication and secure communication within enterprises or IoT environments without external regulatory compliance requirements.

Typical scenarios:

IoT device authentication: Authenticate vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications in Internet of Vehicles (IoV) applications. For example, a single vehicle may require five or more certificates.
Internal enterprise systems: Enable mutual authentication (mTLS) between internal systems, such as Office Automation (OA) and Human Resources (HR) systems.
Microservices architecture: Authenticate and encrypt communications between services.

Key advantages: Automated certificate issuance, revocation, and renewal for large-scale device deployments.

Compliance CA

A Compliance CA is designed for scenarios that require MLPS compliance, cryptographic assessments, or domestic technology adoption, mandating SM series cryptographic algorithms and adherence to relevant regulations.

Typical scenarios:

Government systems: Implement HTTPS encryption and electronic seals by using SM series cryptographic algorithms.
Financial systems: Secure direct bank-enterprise connections and use electronic signatures.
Core enterprise systems: Ensure identity trust and data integrity for Enterprise Resource Planning (ERP) and supply chain systems.

Key advantages: Meets SM series cryptographic algorithm requirements to help you pass MLPS and cryptographic assessment audits.

Procedure

Private CA

Build a private certificate platform for your organization by completing the following steps. Under a single root CA, you can purchase multiple intermediate CAs based on your organizational structure to manage certificates for different departments separately.

Purchase a private CA

When you create a private CA for the first time, you must purchase a private root CA. For more information, see Purchase a private root CA. For information about refunds, see Refund policies for PCA. After a refund is processed, you can manually delete the CA instance from the CA list.
Note
Each root CA instance includes: 1 root CA, 1 intermediate CA, and a complimentary quota of 10 private certificates. The complimentary quota is subject to the following rules:
- Quota usage period: You must use the complimentary quota to issue certificates within 30 days of purchase. Unused quota expires and is cleared after this period.
- Certificate validity: Certificates issued by using the complimentary quota are valid for 30 days from the date of issuance and are not extended when the root CA is renewed. The validity of separately purchased certificates can be customized.
Enable the root CA and intermediate CA

After purchase, enable the root CA first, and then the intermediate CA. For more information, see Enable a private CA.

Note
To modify the information of an enabled private CA, reset the target root CA or intermediate CA and re-enable it. For more information, see Reset a private CA.
Assign a private certificate quota

Assign a certificate issuance quota to an intermediate CA. The intermediate CA uses this quota to issue private certificates. For more information, see Assign a private certificate quota.

Note
By default, each root CA includes a complimentary quota of 10 private certificates. You can purchase additional quota as needed. For more information, see Purchase a private certificate quota.
Issue a private certificate

Use an enabled intermediate CA to issue private certificates. For more information, see Issue a private certificate.

Note
Issuing a private certificate consumes the corresponding certificate quota. The consumed quota cannot be refunded.
Download and install the private certificate

Download the issued private certificate and deploy it to the intended entity. For more information, see Download a private certificate and Deploy a private certificate.

Compliance CA

A Compliance CA is suitable for scenarios that require cryptographic assessments or compliance with electronic authentication service regulations, such as direct bank-enterprise connections and electronic signatures.

Purchase a Compliance CA

Before you use a Compliance CA for the first time, you must purchase a compliant intermediate CA. A corresponding compliant root CA is automatically generated. For more information, see Purchase a compliant intermediate CA.

Note
For information about refunds, see Refund policies for PCA. After a refund is processed, you can manually delete the CA instance from the CA list.
Enable the root CA

When you enable the root CA, an intermediate CA is automatically generated and enabled. For more information, see Enable a Compliance CA.
Purchase and assign a compliant certificate quota

Assign a certificate issuance quota to the intermediate CA. For more information, see Purchase and assign a compliant certificate quota.
Issue a compliant certificate

Use the intermediate CA to issue a compliant certificate, which is a client certificate. For more information, see Issue a compliant certificate.
Download and install the compliant certificate

Download the compliant certificate and install it. For more information, see Download a compliant certificate, Install the USBKey driver, and Best practices for deploying PCA in cryptographic assessment scenarios.

Billing

PCA uses a prepaid model. You are billed separately for CA instances and certificate quotas. For detailed billing rules, see Billing of PCA.
For information about refunds, see Refund policies for PCA. After a refund is processed, you can manually delete the corresponding CA instance from the CA list.

FAQ

What are the limitations of the complimentary quota?

You must use the complimentary quota within 30 days of purchasing the root CA. Unused quota expires after this period.
Certificates issued by using the complimentary quota are valid for 30 days and are not extended when the root CA is renewed.
The validity period of separately purchased certificates can be customized.

How do I modify the information of an enabled CA?

Reset the CA and then re-enable it. For more information, see Reset a private CA.

How do I delete an unused CA?

After a refund for a CA is processed, you can manually delete the CA instance from the CA list. For information about refunds, see Refund policies for PCA.

Can I convert between Private CA and Compliance CA?

No. Private CAs and Compliance CAs are two independent CA types designed for different business scenarios. Choose the type that best fits your needs.