How do I troubleshoot ACM certificate issuance errors when I use a shared AWS Private CA?

Short description

If you issue certificates from a shared AWS Private CA through AWS Resource Access Manager (AWS RAM) or resource-based policies, then you might receive one of the following errors:

• "AccessDeniedException"
• "InvalidStateException"
• "ValidationException"
• "ResourceNotFoundException"
  Note: AWS Private CA Connectors for Active Directory (Connector for AD) and Simple Certificate Enrollment Protocol (SCEP) don't support cross-account sharing. The private certification authority (CA) and the connector must be in the same AWS account. AWS RAM doesn't support cross-account sharing for connector integration even though AWS RAM supports direct Private CA API operations.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Resolve the "AccessDeniedException" error

The calling account must have the acm-pca:IssueCertificate, acm-pca:GetCertificate, and acm-pca:GetCertificateAuthorityCertificate permissions on the shared private CA. The resource-based policy on the CA and an AWS Identity and Access Management (IAM) policy on the calling role grants the preceding permissions. If either policy is missing, then you receive the "AccessDeniedException" error.

Check the error message in AWS CloudTrail to identify the policy that's missing, and then resolve based on your error message.

No resource-based policy allows the acm-pca:IssueCertificate action

If you receive the "No resource-based policy allows the acm-pca:IssueCertificate action" error, then the CA owner hasn't shared the CA with your account.

Example CloudTrail error:

{"eventSource": "acm-pca.amazonaws.com","eventName": "IssueCertificate","awsRegion": "[REGION]","errorCode": "AccessDeniedException","errorMessage": "User: arn:aws:iam::[ACCOUNT_ID]:role/[ROLE_NAME] is not authorized to perform: acm-pca:IssueCertificate on resource: arn:aws:acm-pca:[REGION]:[CA_OWNER_ACCOUNT_ID]:certificate-authority/[CA_ID] because no resource-based policy allows the acm-pca:IssueCertificate action","requestParameters": {"certificateAuthorityArn": "arn:aws:acm-pca:[REGION]:[CA_OWNER_ACCOUNT_ID]:certificate-authority/[CA_ID]"}}

From the CA owner account, run one of the following commands based on how the CA was shared:

If the CA was shared through the AWS RAM console, then run the following get-resource-policies command:

aws ram get-resource-policies --resource-arns arn:aws:acm-pca:REGION: abcd1234-abcd-1234-abcd-12345678abcd:certificate-authority/111122223333

If the policy was attached directly through the Private CA API or AWS CLI, then run the following get-policy command:

aws acm-pca get-policy --resource-arn arn:aws:acm-pca:REGION: abcd1234-abcd-1234-abcd-12345678abcd:certificate-authority/111122223333

Note: Replace REGION with your AWS Region, 111122223333 with the CA owner account ID, and abcd1234-abcd-1234-abcd-12345678abcd with your CA ID.

The CA administrator must share the CA with the consuming account. Take one of the following actions:

• From the CA administrator account, share the CA through AWS RAM directly to another account or through AWS Organizations. Add the IssueCertificate, GetCertificate, and GetCertificateAuthorityCertificate permissions to the IAM policy on the calling role.
• For cross-account ACM certificate renewal, attach a resource-based policy through AWS RAM that grants the ACM service-linked role (SLR) in the consuming account access to the CA.
• If the ACM certificate and the private CA are in the same account, then run the following create-permission command to grant the acm.amazonaws.com service-linked role permissions on the private CA:

   aws acm-pca create-permission \
      --certificate-authority-arn arn:aws:acm-pca:REGION:111122223333:certificate-authority/abcd1234-abcd-1234-abcd-12345678abcd \
      --principal acm.amazonaws.com \
      --actions IssueCertificate GetCertificate ListPermissions

For more information, see Create single-account permissions for an IAM user.

No identity-based policy allows the acm-pca:IssueCertificate action

If you receive the "No identity-based policy allows the acm-pca:IssueCertificate action" error, then the calling role in your account doesn't have the required IAM permissions.

Example CloudTrail error:

{"eventSource": "acm-pca.amazonaws.com","eventName": "IssueCertificate","awsRegion": "[REGION]","errorCode": "AccessDeniedException","errorMessage": "User: arn:aws:iam::[ACCOUNT_ID]:role/[ROLE_NAME] is not authorized to perform: acm-pca:IssueCertificate on resource: arn:aws:acm-pca:[REGION]:[CA_OWNER_ACCOUNT_ID]:certificate-authority/[CA_ID] because no identity-based policy allows the acm-pca:IssueCertificate action","requestParameters": {"certificateAuthorityArn": "arn:aws:acm-pca:[REGION]:[CA_OWNER_ACCOUNT_ID]:certificate-authority/[CA_ID]"}}

Run the following IAM policy to attach the policy to the calling role that allows the required actions on the shared CA Amazon Resource Name (ARN):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "acm-pca:IssueCertificate",
        "acm-pca:GetCertificate",
        "acm-pca:GetCertificateAuthorityCertificate"
      ],
      "Resource": "arn:aws:acm-pca:REGION:111122223333:certificate-authority/abcd1234-abcd-1234-abcd-12345678abcd"
    }
  ]
}

Note: Replace REGION with your Region, 111122223333 with the CA owner account ID, and abcd1234-abcd-1234-abcd-12345678abcd with your CA ID.

For more information, see Policy examples.

Resolve the "InvalidStateException" error

The private CA must be in the ACTIVE state to issue certificates. You must install the CA certificate on any CA in the PENDING_CERTIFICATE state before the CA can process certificate signing requests (CSRs). To activate a CA that's in the DISABLED, DELETED, or EXPIRED, restore or reactivate the private CA through the AWS Private CA console.

Example CloudTrail error:

{"eventSource": "acm-pca.amazonaws.com","eventName": "IssueCertificate","awsRegion": "REGION","errorCode": "InvalidStateException","errorMessage": "The certificate authority is not in a valid state for issuing certificates.","requestParameters": {"certificateAuthorityArn": "arn:aws:acm-pca:REGION:ACCOUNT_ID:certificate-authority/ abcd1234-abcd-1234-abcd-12345678abcd"}}

If the CA is in the PENDING_CERTIFICATE state, then complete the following steps:

1. Open the AWS Private CA console.
2. Select your subordinate CA.
3. Choose Actions, and then choose Install CA certificate.
4. Choose External private CA to retrieve the CSR.
   Note: This is the text between BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST.
5. Sign the CSR with your external root or parent CA.
6. Import the signed CA certificate into AWS Private CA.

If you deleted the CA when the CA was in the PENDING_CERTIFICATE state, then install the CA certificate after you restore the CA. If more than 30 days have passed since you deleted, then the CA isn't available for restoration. Create a new private CA, and then share the new CA with the consuming account.

Resolve the "ValidationException" error

The private CA must accept the request parameters that you provide when you issue a certificate. The "ValidationException" error occurs when the certificate validity period exceeds the CA's allowed quota or when the certificate template violates the path length constraints on the CA.

Check the error message to identify the cause, and then follow the corresponding steps.

Path length check failed

If you receive the "Path length check failed" error message, then you tried to issue a subordinate CA certificate with a template with a path length that exceeds the issuing CA's pathLenConstraint.

Example CloudTrail error:

{"eventSource": "acm-pca.amazonaws.com","eventName": "IssueCertificate","awsRegion": "REGION","errorCode": "ValidationException","errorMessage": "Path length check failed for CA 'arn:aws:acm-pca:REGION:111122223333:certificate-authority/ abcd1234-abcd-1234-abcd-12345678abcd' and selected template 'arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen1/V1'.","requestParameters": {"certificateAuthorityArn": "arn:aws:acm-pca:REGION:ACCOUNT_ID:certificate-authority/ abcd1234-abcd-1234-abcd-12345678abcd","templateArn": "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen1/V1"}}

Use a certificate template with a path length value that's less than the issuing CA's pathLenConstraint. For example, if the shared CA has pathLen:0, then it can't issue subordinate CA certificates. If it has pathLen:1, then use SubordinateCACertificate_PathLen0/V1 instead of PathLen1.

For more information, see Plan the structure of a CA hierarchy. For more information about templates, see Use AWS Private CA certificate templates.

Validity period exceeds CA usage mode

If you receive the "Validity period exceeds CA usage mode" error message, then you configured the shared CA in short-lived mode.

Example CloudTrail error:

{"eventSource": "acm-pca.amazonaws.com","eventName": "IssueCertificate","awsRegion": "REGION","errorCode": "ValidationException","errorMessage": "The requested certificate validity exceeds the maximum allowed by the usage mode. Reduce the requested validity period to be equal to or less than that supported by the usage mode for this CA or use a CA with a different usage mode.","requestParameters": {"certificateAuthorityArn": "arn:aws:acm-pca:REGION]:111122223333:certificate-authority/ abcd1234-abcd-1234-abcd-12345678abcd","validity": {"value": 365,"type": "DAYS"}}}

In general-purpose mode, the CA can issue certificates with any validity period. In short-lived mode, the CA issues certificates with a maximum validity period of 7 days.

For more information, see Understand AWS Private CA modes.

To resolve the error, take one of the following actions:

• If your use case requires certificates with a validity period that's longer than 7 days, then deploy a CA in general-purpose mode.

• If you use a Connector for AD to allow Lightweight Directory Access Protocols (LDAPs) certificate issuance, then use a root CA that's configured in general-purpose mode.

• If you use certificates from a short-lived CA, then run the following acm-pca command to reduce the --validity parameter to 7 days or less:

  aws acm-pca issue-certificate \
      --certificate-authority-arn arn:aws:acm-pca:REGION:111122223333:certificate-authority/abcd1234-abcd-1234-abcd-12345678abcd \
      --csr fileb://csr.pem \
      --signing-algorithm "SHA256WITHRSA" \
      --validity Value=7,Type="DAYS"

  Note: Replace REGION with your Region, 111122223333 with the CA owner account ID, and abcd1234-abcd-1234-abcd-12345678abcd with your CA ID.

Resolve "ResourceNotFoundException" error

The Connector for AD service account must have the correct permissions, and the consuming account must have access to the referenced private CA. If you don't meet either requirement, then you receive the "ResourceNotFoundException" error.

Example CloudTrail error:

{"eventSource": "acm-pca.amazonaws.com","eventName": "GetCertificate","awsRegion": "REGION","sourceIPAddress": "pca-connector-ad.amazonaws.com","userAgent": "pca-connector-ad.amazonaws.com","errorCode": "ResourceNotFoundException","errorMessage": "Could not find specified certificate.","requestParameters": {"certificateAuthorityArn": "arn:aws:acm-pca:REGION:111122223333:certificate-authority/ abcd1234-abcd-1234-abcd-12345678abcd","certificateArn": "arn:aws:acm-pca:REGION:111122223333:certificate-authority/ abcd1234-abcd-1234-abcd-12345678abcd/certificate/00000000-0000-0000-0000-000000000000"}}

If the certificate ARN shows 00000000-0000-0000-0000-000000000000, then the CA never successfully issued the certificate. The call originates from pca-connector-ad.amazonaws.com and confirms that this is a Connection for AD integration failure.

Verify service account permissions for Connector for AD

If you use Directory Service AD Connector with Connector for AD, then confirm that you delegated the required permissions to the service account. AWS Managed Microsoft AD delegates these permissions automatically.

After you delegate the correct permissions, delete the failed connector, and then create a new one.

Verify that the CA exists and is active

If you deleted the private CA or it's no longer accessible, then request a new certificate from another active CA. If the CA is within the 30-day restoration window, then restore the CA. Confirm that the status changes to ACTIVE.

Related information

How to use AWS RAM to share your ACM Private CA cross-account

Install a root CA certificate

Request a private certificate