# Use AWS Private CA certificate templates
<a name="UsingTemplates"></a>

AWS Private CA uses configuration templates to issue both CA certificates and end-entity certificates. When you issue a CA certificate from the PCA console, the appropriate root or subordinate CA certificate template is applied automatically. 

If you use the CLI or API to issue a certificate, you can supply a template ARN as a parameter to the `IssueCertificate` action. If you provide no ARN, then the `EndEntityCertificate/V1` template is applied by default. For more information, see the [IssueCertificate](https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html) API and [issue-certificate](https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) command documentation.

**Note**  
AWS Certificate Manager (ACM) users with cross-account shared access to a private CA can issue managed certificates that are signed by the CA. When you grant permission to the `IssueCertificate` action, you can restrict the certificate templates used for certificate issuance by adding a `acm-pca:TemplateArn` Condition to the policy.  
For more information, see [Resource-based policies](pca-rbp.md).

**Topics**
+ [

# AWS Private CA template varieties
](template-varieties.md)
+ [

# AWS Private CA template order of operations
](template-order-of-operations.md)
+ [

# AWS Private CA template definitions
](template-definitions.md)

# AWS Private CA template varieties
<a name="template-varieties"></a>

AWS Private CA supports four varieties of template.
+ **Base templates**

  Pre-defined templates in which no passthrough parameters are allowed.
+ **CSRPassthrough templates**

  Templates that extend their corresponding base template versions by allowing CSR passthrough. Extensions in the CSR that is used to issue the certificate are copied over to the issued certificate. In cases where the CSR contains extension values that conflict with the template definition, the template definition will always have the higher priority. For more details about priority, see [AWS Private CA template order of operationsTemplate order of operations](template-order-of-operations.md).
+ **APIPassthrough templates**

  Templates that extend their corresponding base template versions by allowing API passthrough. Dynamic values that are known to the administrator or other intermediate systems may not be known by the entity requesting the certificate, may be impossible to define in a template, and may not be available in the CSR. The CA administrator, however, can retrieve additional information from another data source, such as an Active Directory, to complete the request. For example, if a machine doesn't know what organization unit it belongs to, the administrator can look up the information in Active Directory and add it to the certificate request by including the information in a JSON structure.

  Values in the `ApiPassthrough` parameter of the `IssueCertificate` action ``are copied over to the issued certificate. In cases where the `ApiPassthrough` parameter contains information that conflicts with the template definition, the template definition will always have the higher priority. For more details about priority, see [AWS Private CA template order of operationsTemplate order of operations](template-order-of-operations.md). 
+ **APICSRPassthrough templates**

  Templates that extend their corresponding base template versions by allowing both API and CSR passthrough. Extensions in the CSR used to issue the certificate are copied over to the issued certificate, and values in the `ApiPassthrough` parameter of the `IssueCertificate` action are also copied over . In cases where the template definition, API passthrough values, and CSR passthrough extensions exhibit a conflict, the template definition has highest priority, followed by the API passthrough values, followed by the CSR passthrough extensions. For more details about priority, see [AWS Private CA template order of operationsTemplate order of operations](template-order-of-operations.md).

The tables below list all of the template types supported by AWS Private CA with links to their definitions.

**Note**  
For information about template ARNs in GovCloud regions, see [AWS Private Certificate Authority](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html#using-govcloud-arn-syntax-acmpca) in the *AWS GovCloud (US) User Guide*.


**Base templates**  

|  Template Name  |  Template ARN  |  Certificate Type  | 
| --- | --- | --- | 
|  [CodeSigningCertificate/V1](template-definitions.md#CodeSigningCertificate-V1)  |  `arn:aws:acm-pca:::template/CodeSigningCertificate/V1`  |  Code signing  | 
|  [EndEntityCertificate/V1](template-definitions.md#EndEntityCertificate-V1)  |  `arn:aws:acm-pca:::template/EndEntityCertificate/V1`  |  End-entity  | 
|  [EndEntityClientAuthCertificate/V1](template-definitions.md#EndEntityClientAuthCertificate-V1)  |  `arn:aws:acm-pca:::template/EndEntityClientAuthCertificate/V1`  |  End-entity  | 
|  [EndEntityServerAuthCertificate/V1](template-definitions.md#EndEntityServerAuthCertificate-V1)  |  `arn:aws:acm-pca:::template/EndEntityServerAuthCertificate/V1`  |  End-entity  | 
|  [OCSPSigningCertificate/V1](template-definitions.md#OCSPSigningCertificate-V1)  |  `arn:aws:acm-pca:::template/OCSPSigningCertificate/V1`  |  OCSP signing  | 
|  [RootCACertificate/V1](template-definitions.md#RootCACertificate-V1)  |  `arn:aws:acm-pca:::template/RootCACertificate/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen0/V1](template-definitions.md#SubordinateCACertificate_PathLen0-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen1/V1](template-definitions.md#SubordinateCACertificate_PathLen1-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen1/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen2/V1](template-definitions.md#SubordinateCACertificate_PathLen2-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen2/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen3/V1](template-definitions.md#SubordinateCACertificate_PathLen3-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen3/V1`  |  CA  | 


**CSRPassthrough templates**  

|  Template Name  |  Template ARN  |  Certificate Type  | 
| --- | --- | --- | 
|  [BlankEndEntityCertificate\$1CSRPassthrough/V1](template-definitions.md#BlankEndEntityCertificate_CSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankEndEntityCertificate_CSRPassthrough/V1`  | End-entity | 
|  [BlankEndEntityCertificate\$1CriticalBasicConstraints\$1CSRPassthrough/V1](template-definitions.md#BlankEndEntityCertificate_CriticalBasicConstraints_CSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankEndEntityCertificate_CriticalBasicConstraints_CSRPassthrough/V1`  |  End-entity  | 
|  [BlankSubordinateCACertificate\$1PathLen0\$1CSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen0_CSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen0_CSRPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen1\$1CSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen1_CSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen1_CSRPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen2\$1CSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen2_CSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen2_CSRPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen3\$1CSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen3_CSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen3_CSRPassthrough/V1`  |  CA  | 
|  [CodeSigningCertificate\$1CSRPassthrough/V1](template-definitions.md#CodeSigningCertificate_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/CodeSigningCertificate_CSRPassthrough/V1`  |  Code signing  | 
|  [EndEntityCertificate\$1CSRPassthrough/V1](template-definitions.md#EndEntityCertificate_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/EndEntityCertificate_CSRPassthrough/V1`  |  End-entity  | 
|  [EndEntityClientAuthCertificate\$1CSRPassthrough/V1](template-definitions.md#EndEntityClientAuthCertificate_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/EndEntityClientAuthCertificate_CSRPassthrough/V1`  |  End-entity  | 
|  [EndEntityServerAuthCertificate\$1CSRPassthrough/V1](template-definitions.md#EndEntityServerAuthCertificate_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/EndEntityServerAuthCertificate_CSRPassthrough/V1`  | End-entity | 
|  [OCSPSigningCertificate\$1CSRPassthrough/V1](template-definitions.md#OCSPSigningCertificate_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/OCSPSigningCertificate_CSRPassthrough/V1`  |  OCSP signing  | 
|  [SubordinateCACertificate\$1PathLen0\$1CSRPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen0_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0_CSRPassthrough/V1`  | CA | 
|  [SubordinateCACertificate\$1PathLen1\$1CSRPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen1_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen1_CSRPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen2\$1CSRPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen2_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen2_CSRPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen3\$1CSRPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen3_CSRPassthrough-V1)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen3_CSRPassthrough/V1`  |  CA  | 


**APIPassthrough templates**  

|  Template Name  |  Template ARN  |  Certificate Type  | 
| --- | --- | --- | 
|  [BlankEndEntityCertificate\$1APIPassthrough/V1](template-definitions.md#BlankEndEntityCertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankEndEntityCertificate_APIPassthrough/V1`  |  End-entity  | 
|  [BlankEndEntityCertificate\$1CriticalBasicConstraints\$1APIPassthrough/V1](template-definitions.md#BlankEndEntityCertificate_CriticalBasicConstraints_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankEndEntityCertificate_CriticalBasicConstraints_APIPassthrough/V1`  |  End-entity  | 
|  [CodeSigningCertificate\$1APIPassthrough/V1](template-definitions.md#CodeSigningCertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/CodeSigningCertificate_APIPassthrough/V1`  |  Code signing  | 
|  [EndEntityCertificate\$1APIPassthrough/V1](template-definitions.md#EndEntityCertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/EndEntityCertificate_APIPassthrough/V1`  |  End-entity  | 
|  [EndEntityClientAuthCertificate\$1APIPassthrough/V1](template-definitions.md#EndEntityClientAuthCertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/EndEntityClientAuthCertificate_APIPassthrough/V1`  |  End-entity  | 
|  [EndEntityServerAuthCertificate\$1APIPassthrough/V1](template-definitions.md#EndEntityServerAuthCertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/EndEntityServerAuthCertificate_APIPassthrough/V1`  |  End-entity  | 
|  [OCSPSigningCertificate\$1APIPassthrough/V1](template-definitions.md#OCSPSigningCertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/OCSPSigningCertificate_APIPassthrough/V1`  |  OCSP signing  | 
|  [RootCACertificate\$1APIPassthrough/V1](template-definitions.md#RootCACertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/RootCACertificate_APIPassthrough/V1`  |  CA  | 
|  [BlankRootCACertificate\$1APIPassthrough/V1](template-definitions.md#BlankRootCACertificate_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankRootCACertificate_APIPassthrough/V1`  |  CA  | 
|  [BlankRootCACertificate\$1PathLen0\$1APIPassthrough/V1](template-definitions.md#BlankRootCACertificate_PathLen0_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankRootCACertificate_PathLen0_APIPassthrough/V1`  |  CA  | 
|  [BlankRootCACertificate\$1PathLen1\$1APIPassthrough/V1](template-definitions.md#BlankRootCACertificate_PathLen1_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankRootCACertificate_PathLen1_APIPassthrough/V1`  |  CA  | 
|  [BlankRootCACertificate\$1PathLen2\$1APIPassthrough/V1](template-definitions.md#BlankRootCACertificate_PathLen2_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankRootCACertificate_PathLen2_APIPassthrough/V1`  |  CA  | 
|  [BlankRootCACertificate\$1PathLen3\$1APIPassthrough/V1](template-definitions.md#BlankRootCACertificate_PathLen3_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankRootCACertificate_PathLen3_APIPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen0\$1APIPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen0_APIPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0_APIPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen0\$1APIPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen0_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen0_APIPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen1\$1APIPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen1_APIPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen1_APIPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen1\$1APIPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen1_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen1_APIPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen2\$1APIPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen2_APIPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen2_APIPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen2\$1APIPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen2_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen2_APIPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen3\$1APIPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen3_APIPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen3_APIPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen3\$1APIPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen3_APIPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen3_APIPassthrough/V1`  |  CA  | 


**APICSRPassthrough templates**  

|  Template Name  |  Template ARN  |  Certificate Type  | 
| --- | --- | --- | 
|  [BlankEndEntityCertificate\$1APICSRPassthrough/V1](template-definitions.md#BlankEndEntityCertificate_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankEndEntityCertificate_APICSRPassthrough/V1`  |  End-entity  | 
|  |  |  | 
|  [BlankEndEntityCertificate\$1CriticalBasicConstraints\$1APICSRPassthrough/V1](template-definitions.md#BlankEndEntityCertificate_CriticalBasicConstraints_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankEndEntityCertificate_CriticalBasicConstraints_APICSRPassthrough/V1`  | End-entity | 
|  [CodeSigningCertificate\$1APICSRPassthrough/V1](template-definitions.md#CodeSigningCertificate_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/CodeSigningCertificate_APICSRPassthrough/V1`  |  Code signing  | 
|  [EndEntityCertificate\$1APICSRPassthrough/V1](template-definitions.md#EndEntityCertificate_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/EndEntityCertificate_APICSRPassthrough/V1`  |  End-entity  | 
|  [EndEntityClientAuthCertificate\$1APICSRPassthrough/V1](template-definitions.md#EndEntityClientAuthCertificate_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/EndEntityClientAuthCertificate_APICSRPassthrough/V1`  |  End-entity  | 
|  [EndEntityServerAuthCertificate\$1APICSRPassthrough/V1](template-definitions.md#EndEntityServerAuthCertificate_APICSRPassthrough)  | arn:aws:acm-pca:::template/EndEntityServerAuthCertificate\$1APICSRPassthrough/V1 |  End-entity  | 
|  [OCSPSigningCertificate\$1APICSRPassthrough/V1](template-definitions.md#OCSPSigningCertificate_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/OCSPSigningCertificate_APICSRPassthrough/V1`  |  OCSP signing  | 
|  [SubordinateCACertificate\$1PathLen0\$1APICSRPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen0_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0_APICSRPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen0\$1APICSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen0_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen0_APICSRPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen1\$1APICSRPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen1_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen1_APICSRPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen1\$1APICSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen1_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen1_APICSRPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen2\$1APICSRPassthrough/PathLen3\$1APIPassthroughV1](template-definitions.md#SubordinateCACertificate_PathLen2_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen2_APICSRPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen2\$1APICSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen2_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen2_APICSRPassthrough/V1`  |  CA  | 
|  [SubordinateCACertificate\$1PathLen3\$1APICSRPassthrough/V1](template-definitions.md#SubordinateCACertificate_PathLen3_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen3_APICSRPassthrough/V1`  |  CA  | 
|  [BlankSubordinateCACertificate\$1PathLen3\$1APICSRPassthrough/V1](template-definitions.md#BlankSubordinateCACertificate_PathLen3_APICSRPassthrough)  |  `arn:aws:acm-pca:::template/BlankSubordinateCACertificate_PathLen3_APICSRPassthrough/V1`  |  CA  | 

# AWS Private CA template order of operations
<a name="template-order-of-operations"></a>

Information contained in an issued certificate can come from four sources: the template definition, API passthrough, CSR passthrough, and the CA configuration.

API passthrough values are only respected when you use an API passthrough or APICSR passthrough template. CSR passthrough is only respected when you use a CSRPassthrough or APICSR passthrough template. When these sources of information are in conflict, a general rule usually applies: For each extension value, the template definition has highest priority, followed by API passthrough values, followed by CSR passthrough extensions.

**Examples**

1. The template definition for [EndEntityClientAuthCertificate\$1APIPassthrough](template-definitions.md#EndEntityClientAuthCertificate_APIPassthrough) defines the ExtendedKeyUsage extension with a value of "TLS web server authentication, TLS web client authentication". If ExtendedKeyUsage is defined in the CSR or in the `IssueCertificate` `ApiPassthrough` parameter, the `ApiPassthrough` value for ExtendedKeyUsage will be ignored because the template definition takes priority, and the CSR value for ExtendedKeyUsage value will be ignored because the template is not a CSR passthrough variety.
**Note**  
The template definition nonetheless copies over other values from the CSR, such as Subject and Subject Alternative Name. These values are still taken from the CSR even though the template is not a CSR passthrough variety, because the template definition always takes highest priority.

1. The template definition for [EndEntityClientAuthCertificate\$1APICSRPassthrough](template-definitions.md#EndEntityClientAuthCertificate_APICSRPassthrough) defines the Subject Alternative Name (SAN) extension as being copied from the API or CSR. If the SAN extension is defined in the CSR and provided in the `IssueCertificate`` ApiPassthrough` parameter, the API passthrough value will take priority because API passthrough values take priority over CSR passthrough values.

# AWS Private CA template definitions
<a name="template-definitions"></a>

The following sections provide configuration details about supported AWS Private CA certificate templates. 

## BlankEndEntityCertificate\$1APIPassthrough/V1 definition
<a name="BlankEndEntityCertificate_APIPassthrough"></a>

With blank end-entity certificate templates, you can issue end-entity certificates with only X.509 Basic constraints present. This is the simplest end-entity certificate that AWS Private CA can issue, but it can be customized using the API structure. The Basic constraints extension defines whether or not the certificate is a CA certificate. A blank end-entity certificate template enforces a value of FALSE for Basic constraints to ensure that an end-entity certificate is issued and not a CA certificate.

You can use blank passthrough templates to issue smart card certificates that require specific values for Key usage (KU) and Extended key usage (EKU). For example, Extended key usage may require Client Authentication and Smart Card Logon, and Key usage may require Digital Signature, Non Repudiation, and Key Encipherment. Unlike other passthrough templates, blank end-entity certificate templates allow the configuration of KU and EKU extensions, where KU can be any of the nine supported values (digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, and decipherOnly) and EKU can be any of the supported values (serverAuth, clientAuth, codesigning, emailProtection, timestamping, and OCSPSigning) plus custom extensions.


**BlankEndEntityCertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:FALSE  | 
|  Authority key identifier  | [SKI from CA certificate] | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

## BlankEndEntityCertificate\$1APICSRPassthrough/V1 definition
<a name="BlankEndEntityCertificate_APICSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankEndEntityCertificate\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:FALSE  | 
|  Authority key identifier  | [SKI from CA certificate] | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

## BlankEndEntityCertificate\$1CriticalBasicConstraints\$1APICSRPassthrough/V1 definition
<a name="BlankEndEntityCertificate_CriticalBasicConstraints_APICSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankEndEntityCertificate\$1CriticalBasicConstraints\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, CA:FALSE  | 
|  Authority key identifier  | [SKI from CA certificate] | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration, API, or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankEndEntityCertificate\$1CriticalBasicConstraints\$1APIPassthrough/V1 definition
<a name="BlankEndEntityCertificate_CriticalBasicConstraints_APIPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankEndEntityCertificate\$1CriticalBasicConstraints\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, CA:FALSE  | 
|  Authority key identifier  | [SKI from CA certificate] | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or API]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankEndEntityCertificate\$1CriticalBasicConstraints\$1CSRPassthrough/V1 definition
<a name="BlankEndEntityCertificate_CriticalBasicConstraints_CSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankEndEntityCertificate\$1CriticalBasicConstraints\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, CA:FALSE  | 
|  Authority key identifier  | [SKI from CA certificate] | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankEndEntityCertificate\$1CSRPassthrough/V1 definition
<a name="BlankEndEntityCertificate_CSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankEndEntityCertificate\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  CA:FALSE  | 
|  Authority key identifier  | [SKI from CA certificate] | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen0\$1CSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen0_CSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen0\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen0\$1APICSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen0_APICSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen0\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen0\$1APIPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen0_APIPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen0\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

### BlankSubordinateCACertificate\$1PathLen1\$1APIPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen1_APIPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen1\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen1\$1CSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen1_CSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen1\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen1\$1APICSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen1_APICSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen1\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen2\$1APIPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen2_APIPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen2\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen2\$1CSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen2_CSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen2\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen2\$1APICSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen2_APICSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen2\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen3\$1APIPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen3_APIPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen3\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen3\$1CSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen3_CSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen3\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### BlankSubordinateCACertificate\$1PathLen3\$1APICSRPassthrough/V1 definition
<a name="BlankSubordinateCACertificate_PathLen3_APICSRPassthrough"></a>

For general information about blank templates, see [BlankEndEntityCertificate\$1APIPassthrough/V1 definition](#BlankEndEntityCertificate_APIPassthrough).


**BlankSubordinateCACertificate\$1PathLen3\$1APICSRPassthrough**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### CodeSigningCertificate/V1 definition
<a name="CodeSigningCertificate-V1"></a>

This template is used to create certificates for code signing. You can use code-signing certificates from AWS Private CA with any code-signing solution that is based on a private CA infrastructure. For example, customers using Code Signing for AWS IoT can generate a code-signing certificate with AWS Private CA and import it to AWS Certificate Manager. For more information, see [What Is Code Signing for AWS IoT?](https://docs.aws.amazon.com/signer/latest/developerguide/Welcome.html) and [Obtain and Import a Code Signing Certificate](https://docs.aws.amazon.com/signer/latest/developerguide/obtain-cert.html).


**CodeSigningCertificate/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature  | 
|  Extended key usage  |  Critical, code signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### CodeSigningCertificate\$1APICSRPassthrough/V1 definition
<a name="CodeSigningCertificate_APICSRPassthrough"></a>

This template extends CodeSigningCertificate/V1 to support API and CSR passthrough values.


**CodeSigningCertificate\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature  | 
|  Extended key usage  |  Critical, code signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### CodeSigningCertificate\$1APIPassthrough/V1 definition
<a name="CodeSigningCertificate_APIPassthrough"></a>

This template is identical to the `CodeSigningCertificate` template with one difference: In this template, AWS Private CA passes additional extensions through the API to the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the API.


**CodeSigningCertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature  | 
|  Extended key usage  |  Critical, code signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### CodeSigningCertificate\$1CSRPassthrough/V1 definition
<a name="CodeSigningCertificate_CSRPassthrough-V1"></a>

This template is identical to the `CodeSigningCertificate` template with one difference: In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.


**CodeSigningCertificate\$1CSRPassthrough/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature  | 
|  Extended key usage  |  Critical, code signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityCertificate/V1 definition
<a name="EndEntityCertificate-V1"></a>

This template is used to create certificates for end entities such as operating systems or web servers. 


**EndEntityCertificate/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication, TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityCertificate\$1APICSRPassthrough/V1 definition
<a name="EndEntityCertificate_APICSRPassthrough"></a>

This template extends EndEntityCertificate/V1 to support API and CSR passthrough values.


**EndEntityCertificate\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication, TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityCertificate\$1APIPassthrough/V1 definition
<a name="EndEntityCertificate_APIPassthrough"></a>

This template is identical to the `EndEntityCertificate` template with one difference: In this template, AWS Private CA passes additional extensions through the API to the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the API.


**EndEntityCertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication, TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityCertificate\$1CSRPassthrough/V1 definition
<a name="EndEntityCertificate_CSRPassthrough-V1"></a>

This template is identical to the `EndEntityCertificate` template with one difference: In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.


**EndEntityCertificate\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication, TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityClientAuthCertificate/V1 definition
<a name="EndEntityClientAuthCertificate-V1"></a>

This template differs from the `EndEntityCertificate` only in the Extended key usage value, which restricts it to TLS web client authentication.


**EndEntityClientAuthCertificate/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityClientAuthCertificate\$1APICSRPassthrough/V1 definition
<a name="EndEntityClientAuthCertificate_APICSRPassthrough"></a>

This template extends EndEntityClientAuthCertificate/V1 to support API and CSR passthrough values.


**EndEntityClientAuthCertificate\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityClientAuthCertificate\$1APIPassthrough/V1 definition
<a name="EndEntityClientAuthCertificate_APIPassthrough"></a>

This template is identical to the `EndEntityClientAuthCertificate` template with one difference. In this template, AWS Private CA passes additional extensions through the API into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the API.


**EndEntityClientAuthCertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityClientAuthCertificate\$1CSRPassthrough/V1 definition
<a name="EndEntityClientAuthCertificate_CSRPassthrough-V1"></a>

This template is identical to the `EndEntityClientAuthCertificate` template with one difference. In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.


**EndEntityClientAuthCertificate\$1CSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
| Key usage |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web client authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityServerAuthCertificate/V1 definition
<a name="EndEntityServerAuthCertificate-V1"></a>

This template differs from the `EndEntityCertificate` only in the Extended key usage value, which restricts it to TLS web server authentication.


**EndEntityServerAuthCertificate/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityServerAuthCertificate\$1APICSRPassthrough/V1 definition
<a name="EndEntityServerAuthCertificate_APICSRPassthrough"></a>

This template extends EndEntityServerAuthCertificate/V1 to support API and CSR passthrough values.


**EndEntityServerAuthCertificate\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityServerAuthCertificate\$1APIPassthrough/V1 definition
<a name="EndEntityServerAuthCertificate_APIPassthrough"></a>

This template is identical to the `EndEntityServerAuthCertificate` template with one difference. In this template, AWS Private CA passes additional extensions through the API into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the API.


**EndEntityServerAuthCertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### EndEntityServerAuthCertificate\$1CSRPassthrough/V1 definition
<a name="EndEntityServerAuthCertificate_CSRPassthrough-V1"></a>

This template is identical to the `EndEntityServerAuthCertificate` template with one difference. In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.


**EndEntityServerAuthCertificate\$1CSRPassthrough/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  CA:`FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, key encipherment  | 
|  Extended key usage  |  TLS web server authentication  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### OCSPSigningCertificate/V1 definition
<a name="OCSPSigningCertificate-V1"></a>

This template is used to create certificates for signing OCSP responses. The template is identical to the `CodeSigningCertificate` template, except that the Extended key usage value specifies OCSP signing instead of code signing.


**OCSPSigningCertificate/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
| Authority key identifier |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  | Critical, digital signature | 
|  Extended key usage  |  Critical, OCSP signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### OCSPSigningCertificate\$1APICSRPassthrough/V1 definition
<a name="OCSPSigningCertificate_APICSRPassthrough"></a>

This template extends the OCSPSigningCertificate/V1 to support API and CSR passthrough values.


**OCSPSigningCertificate\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  | Critical, digital signature | 
|  Extended key usage  |  Critical, OCSP signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### OCSPSigningCertificate\$1APIPassthrough/V1 definition
<a name="OCSPSigningCertificate_APIPassthrough"></a>

This template is identical to the `OCSPSigningCertificate` template with one difference. In this template, AWS Private CA passes additional extensions through the API into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the API.


**OCSPSigningCertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  | Critical, digital signature | 
|  Extended key usage  |  Critical, OCSP signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### OCSPSigningCertificate\$1CSRPassthrough/V1 definition
<a name="OCSPSigningCertificate_CSRPassthrough-V1"></a>

This template is identical to the `OCSPSigningCertificate` template with one difference. In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.


**OCSPSigningCertificate\$1CSRPassthrough/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  `CA:FALSE`  | 
|  Authority key identifier  |  [SKI from CA certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  | Critical, digital signature | 
|  Extended key usage  |  Critical, OCSP signing  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### RootCACertificate/V1 definition
<a name="RootCACertificate-V1"></a>

This template is used to issue self-signed root CA certificates. CA certificates include a critical basic constraints extension with the CA field set to `TRUE` to designate that the certificate can be used to issue CA certificates. The template does not specify a path length ([pathLenConstraint](PcaTerms.md#terms-pathlength)) because this could inhibit future expansion of the hierarchy. Extended key usage is excluded to prevent use of the CA certificate as a TLS client or server certificate. No CRL information is specified because a self-signed certificate cannot be revoked.


**RootCACertificate/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, keyCertSign, CRL sign  | 
|  CRL distribution points  |  N/A  | 

### RootCACertificate\$1APIPassthrough/V1 definition
<a name="RootCACertificate_APIPassthrough"></a>

This template extends RootCACertificate/V1 to support API passthrough values.


**RootCACertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`  | 
|  Authority key identifier  |  [Passthrough from API]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, keyCertSign, CRL sign  | 
|  CRL distribution points\$1  |  N/A  | 

### BlankRootCACertificate\$1APIPassthrough/V1 definition
<a name="BlankRootCACertificate_APIPassthrough"></a>

With blank root certificate templates, you can issue root certificates with only X.509 basic constraints present. This is the simplest root certificate that AWS Private CA can issue, but it can be customized using the API structure. The basic constraints extension defines whether or not the certificate is a CA certificate. A blank root certificate template enforces a value of `TRUE` for basic constraints to ensure that a root CA certificate is issued.

You can use blank passthrough root templates to issue root certificates that require specific values for key usage (KU). For example, key usage might require `keyCertSign` and `cRLSign`, but not `digitalSignature`. Unlike the other non-blank root passthrough certificate template, blank root certificate templates allow the configuration of the KU extension, where KU can be any of the nine supported values (`digitalSignature`, `nonRepudiation`, `keyEncipherment`, `dataEncipherment`, `keyAgreement`, `keyCertSign`, `cRLSign`, `encipherOnly`, and `decipherOnly`). 


**BlankRootCACertificate\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`  | 
|  Subject key identifier  |  [Derived from CSR]  | 

### BlankRootCACertificate\$1PathLen0\$1APIPassthrough/V1 definition
<a name="BlankRootCACertificate_PathLen0_APIPassthrough"></a>

For general information about blank root CA templates, see [BlankRootCACertificate\$1APIPassthrough/V1 definition](#BlankRootCACertificate_APIPassthrough).


**BlankRootCACertificate\$1PathLen0\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Subject key identifier  |  [Derived from CSR]  | 

### BlankRootCACertificate\$1PathLen1\$1APIPassthrough/V1 definition
<a name="BlankRootCACertificate_PathLen1_APIPassthrough"></a>

For general information about blank root CA templates, see [BlankRootCACertificate\$1APIPassthrough/V1 definition](#BlankRootCACertificate_APIPassthrough).


**BlankRootCACertificate\$1PathLen1\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Subject key identifier  |  [Derived from CSR]  | 

### BlankRootCACertificate\$1PathLen2\$1APIPassthrough/V1 definition
<a name="BlankRootCACertificate_PathLen2_APIPassthrough"></a>

For general information about blank root CA templates, see [BlankRootCACertificate\$1APIPassthrough/V1 definition](#BlankRootCACertificate_APIPassthrough).


**BlankRootCACertificate\$1PathLen2\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Subject key identifier  |  [Derived from CSR]  | 

### BlankRootCACertificate\$1PathLen3\$1APIPassthrough/V1 definition
<a name="BlankRootCACertificate_PathLen3_APIPassthrough"></a>

For general information about blank root CA templates, see [BlankRootCACertificate\$1APIPassthrough/V1 definition](#BlankRootCACertificate_APIPassthrough).


**BlankRootCACertificate\$1PathLen3\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Subject key identifier  |  [Derived from CSR]  | 

### SubordinateCACertificate\$1PathLen0/V1 definition
<a name="SubordinateCACertificate_PathLen0-V1"></a>

This template is used to issue subordinate CA certificates with a path length of `0`. CA certificates include a critical basic constraints extension with the CA field set to `TRUE` to designate that the certificate can be used to issue CA certificates. Extended key usage is not included, which prevents the CA certificate from being used as a TLS client or server certificate.

For more information about certification paths, see [Setting Length Constraints on the Certification Path](https://docs.aws.amazon.com/privateca/latest/userguide/ca-hierarchy.html#length-constraints).


**SubordinateCACertificate\$1PathLen0/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in certificates that are issued with this template only if the CA is configured with CRL generation enabled.

### SubordinateCACertificate\$1PathLen0\$1APICSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen0_APICSRPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen0/V1 to support API and CSR passthrough values.


**SubordinateCACertificate\$1PathLen0\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen0\$1APIPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen0_APIPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen0/V1 to support API passthrough values.


**SubordinateCACertificate\$1PathLen0\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen0\$1CSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen0_CSRPassthrough-V1"></a>

This template is identical to the `SubordinateCACertificate_PathLen0` template with one difference: In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.

**Note**  
A CSR that contains custom additional extensions must be created outside of AWS Private CA.


**SubordinateCACertificate\$1PathLen0\$1CSRPassthrough/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 0`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.

### SubordinateCACertificate\$1PathLen1/V1 definition
<a name="SubordinateCACertificate_PathLen1-V1"></a>

This template is used to issue subordinate CA certificates with a path length of `1`. CA certificates include a critical Basic constraints extension with the CA field set to `TRUE` to designate that the certificate can be used to issue CA certificates. Extended key usage is not included, which prevents the CA certificate from being used as a TLS client or server certificate.

For more information about certification paths, see [Setting Length Constraints on the Certification Path](https://docs.aws.amazon.com/privateca/latest/userguide/ca-hierarchy.html#length-constraints).


**SubordinateCACertificate\$1PathLen1/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.

### SubordinateCACertificate\$1PathLen1\$1APICSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen1_APICSRPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen1/V1 to support API and CSR passthrough values.


**SubordinateCACertificate\$1PathLen1\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen1\$1APIPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen1_APIPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen0/V1 to support API passthrough values.


**SubordinateCACertificate\$1PathLen1\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen1\$1CSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen1_CSRPassthrough-V1"></a>

This template is identical to the `SubordinateCACertificate_PathLen1` template with one difference: In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.

**Note**  
A CSR that contains custom additional extensions must be created outside of AWS Private CA.


**SubordinateCACertificate\$1PathLen1\$1CSRPassthrough/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 1`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.

### SubordinateCACertificate\$1PathLen2/V1 definition
<a name="SubordinateCACertificate_PathLen2-V1"></a>

This template is used to issue subordinate CA certificates with a path length of 2. CA certificates include a critical Basic constraints extension with the CA field set to `TRUE` to designate that the certificate can be used to issue CA certificates. Extended key usage is not included, which prevents the CA certificate from being used as a TLS client or server certificate.

For more information about certification paths, see [Setting Length Constraints on the Certification Path](https://docs.aws.amazon.com/privateca/latest/userguide/ca-hierarchy.html#length-constraints).


**SubordinateCACertificate\$1PathLen2/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.

### SubordinateCACertificate\$1PathLen2\$1APICSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen2_APICSRPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen2/V1 to support API and CSR passthrough values.


**SubordinateCACertificate\$1PathLen2\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen2\$1APIPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen2_APIPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen2/V1 to support API passthrough values.


**SubordinateCACertificate\$1PathLen2\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen2\$1CSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen2_CSRPassthrough-V1"></a>

This template is identical to the `SubordinateCACertificate_PathLen2` template with one difference: In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.

**Note**  
A CSR that contains custom additional extensions must be created outside of AWS Private CA.


**SubordinateCACertificate\$1PathLen2\$1CSRPassthrough/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 2`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.

### SubordinateCACertificate\$1PathLen3/V1 definition
<a name="SubordinateCACertificate_PathLen3-V1"></a>

This template is used to issue subordinate CA certificates with a path length of 3. CA certificates include a critical Basic constraints extension with the CA field set to `TRUE` to designate that the certificate can be used to issue CA certificates. Extended key usage is not included, which prevents the CA certificate from being used as a TLS client or server certificate.

For more information about certification paths, see [Setting Length Constraints on the Certification Path](https://docs.aws.amazon.com/privateca/latest/userguide/ca-hierarchy.html#length-constraints).


**SubordinateCACertificate\$1PathLen3/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.

### SubordinateCACertificate\$1PathLen3\$1APICSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen3_APICSRPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen3/V1 to support API and CSR passthrough values.


**SubordinateCACertificate\$1PathLen3\$1APICSRPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen3\$1APIPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen3_APIPassthrough"></a>

This template extends SubordinateCACertificate\$1PathLen3/V1 to support API passthrough values.


**SubordinateCACertificate\$1PathLen3\$1APIPassthrough/V1**  

|  X509v3 Parameter  | Value | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from API or CSR]  | 
|  Subject  |  [Passthrough from API or CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration]  | 

\$1 CRL distribution points are included in the template only if the CA is configured with CRL generation enabled. 

### SubordinateCACertificate\$1PathLen3\$1CSRPassthrough/V1 definition
<a name="SubordinateCACertificate_PathLen3_CSRPassthrough-V1"></a>

This template is identical to the `SubordinateCACertificate_PathLen3` template with one difference: In this template, AWS Private CA passes additional extensions from the certificate signing request (CSR) into the certificate if the extensions are not specified in the template. Extensions specified in the template always override extensions in the CSR.

**Note**  
A CSR that contains custom additional extensions must be created outside of AWS Private CA.


**SubordinateCACertificate\$1PathLen3\$1CSRPassthrough/V1**  

|  X509v3 Parameter  |  Value  | 
| --- | --- | 
|  Subject alternative name  |  [Passthrough from CSR]  | 
|  Subject  |  [Passthrough from CSR]  | 
|  Basic constraints  |  Critical, `CA:TRUE`, `pathlen: 3`  | 
|  Authority key identifier  |  [SKI from CA Certificate]  | 
|  Subject key identifier  |  [Derived from CSR]  | 
|  Key usage  |  Critical, digital signature, `keyCertSign`, CRL sign  | 
|  CRL distribution points\$1  |  [Passthrough from CA configuration or CSR]  | 

\$1CRL distribution points are included in certificates issued with this template only if the CA is configured with CRL generation enabled.