DeleteCertificateAuthority

Deletes a certificate authority (CA) from your cluster.

Deleting a certificate authority removes its public certificate from the cluster's trust bundle. You can't delete the certificate authority that's currently signing certificates for the cluster (its signingStatus is IN_USE) — to remove the outgoing CA, first activate the successor CA with ActivateCertificateAuthority. Amazon EKS also protects a successor CA from deletion in certain cases to keep a valid rotation path — for example, a successor that Amazon EKS appended can't be deleted while it's the only successor on the cluster. This is an asynchronous operation that returns an update object.

Request Syntax

DELETE /clusters/name/certificate-authorities/certificateAuthorityId?clientRequestToken=clientRequestToken HTTP/1.1

URI Request Parameters

The request uses the following URI parameters.

Request Body

The request does not have a request body.

Response Syntax

HTTP/1.1 200
Content-type: application/json

{
   "certificateAuthority": { 
      "activatedAt": number,
      "activatedBy": "string",
      "createdAt": number,
      "createdBy": "string",
      "distributionStatus": "string",
      "id": "string",
      "signingStatus": "string"
   },
   "update": { 
      "cancellation": { 
         "reason": "string",
         "status": "string"
      },
      "createdAt": number,
      "errors": [ 
         { 
            "errorCode": "string",
            "errorMessage": "string",
            "resourceIds": [ "string" ]
         }
      ],
      "id": "string",
      "params": [ 
         { 
            "type": "string",
            "value": "string"
         }
      ],
      "status": "string",
      "type": "string"
   }
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

Errors

For information about the errors that are common to all actions, see Common Errors.

Examples

In the following example or examples, the Authorization header contents (AUTHPARAMS) must be replaced with an AWS Signature Version 4 signature. For more information about creating these signatures, see Signature Version 4 Signing Process in the Amazon EKS General Reference.

You need to learn how to sign HTTP requests only if you intend to manually create them. When you use the AWS Command Line Interface (AWS CLI) or one of the AWS SDKs to make requests to AWS, these tools automatically sign the requests for you with the access key that you specify when you configure the tools. When you use these tools, you don't need to learn how to sign requests yourself.

Example

The following example deletes the trusted certificate authority with the ID b2c3d4e5-6789-0abc-def0-1234567890ab from the cluster named my-cluster.

Sample Request

DELETE /clusters/my-cluster/certificate-authorities/b2c3d4e5-6789-0abc-def0-1234567890ab?clientRequestToken=5a8578bd-b6c1-4624-9e65-d0b70f857835 HTTP/1.1
Host: eks.us-west-2.amazonaws.com
Accept-Encoding: identity
User-Agent: aws-cli/2.9.0 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/eks.delete-certificate-authority
X-Amz-Date: 20260729T193227Z
Authorization: AUTHPARAMS

Sample Response

HTTP/1.1 200 OK
Date: Wed, 29 Jul 2026 19:32:43 GMT
Content-Type: application/json
x-amzn-RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
X-Amzn-Trace-Id: Root=1-xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx
Connection: keep-alive

{
	"certificateAuthority": {
		"id": "b2c3d4e5-6789-0abc-def0-1234567890ab",
		"createdAt": 1785312515.848,
		"createdBy": "CUSTOMER",
		"signingStatus": "NOT_USED",
		"distributionStatus": "DELETING"
	},
	"update": {
		"id": "3c4d5e6f-6789-90ab-cdef-EXAMPLE33333",
		"status": "InProgress",
		"type": "CertificateAuthorityUpdate",
		"params": [
			{
				"type": "CertificateAuthorityId",
				"value": "b2c3d4e5-6789-0abc-def0-1234567890ab"
			}
		],
		"createdAt": 1785312515.848,
		"errors": []
	}
}

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: