Sign in

v1

latestOpenAPI 3.0.0Apache 2.0 License2026-07-14159984.9 KB

Exports a private certificate issued by a private certificate authority (CA) for use anywhere. The exported file contains the certificate, the certificate chain, and the encrypted private 2048-bit RSA key associated with the public key that is embedded in the certificate. For security, you must assign a passphrase for the private key when exporting it.

For information about exporting and formatting a certificate using the ACM console or CLI, see Export a Private Certificate.

post/#X-Amz-Target=CertificateManager.ExportCertificate

Headers

X-Amz-Target'CertificateManager.ExportCertificate' required

Request body

CertificateArnstring required
<p>An Amazon Resource Name (ARN) of the issued certificate. This must be of the form:</p> <p> <code>arn:aws:acm:region:account:certificate/12345678-1234-1234-1234-123456789012</code> </p>
Passphrasestring password required
<p>Passphrase to associate with the encrypted exported private key. </p> <note> <p>When creating your passphrase, you can use any ASCII character except #, $, or %.</p> </note> <p>If you want to later decrypt the private key, you must have the passphrase. You can use the following OpenSSL command to decrypt a private key. After entering the command, you are prompted for the passphrase.</p> <p> <code>openssl rsa -in encrypted_key.pem -out decrypted_key.pem</code> </p>

Response

Success

Certificatestring

The base64 PEM-encoded certificate.

CertificateChainstring

The base64 PEM-encoded certificate chain. This does not include the certificate that you are exporting.

PrivateKeystring password

The encrypted private key associated with the public key in the certificate. The key is output in PKCS #8 format and is base64 PEM-encoded.