[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-12。"],[[["\u003cp\u003eCertificate authorities (CAs) operate in five distinct states: Enabled, Disabled, Staged, Awaiting User Activation, and Deleted, each determining their operational capabilities.\u003c/p\u003e\n"],["\u003cp\u003eSubordinate CAs begin in the \u003ccode\u003eAWAITING_USER_ACTIVATION\u003c/code\u003e state and must be activated within 30 days, transitioning to \u003ccode\u003eSTAGED\u003c/code\u003e, or they will be deleted; in contrast, Root CAs directly start in the \u003ccode\u003eSTAGED\u003c/code\u003e state.\u003c/p\u003e\n"],["\u003cp\u003eWhile in the \u003ccode\u003eSTAGED\u003c/code\u003e state, CAs can issue certificates when requested directly, but not through CA pool load-balancing, and it is the recommended phase for testing certificates.\u003c/p\u003e\n"],["\u003cp\u003eA CA pool requires at least one CA in the \u003ccode\u003eENABLED\u003c/code\u003e state to issue certificates, and once enabled, a CA cannot return to the \u003ccode\u003eSTAGED\u003c/code\u003e state.\u003c/p\u003e\n"],["\u003cp\u003eOnly CAs in the \u003ccode\u003eENABLED\u003c/code\u003e, \u003ccode\u003eDISABLED\u003c/code\u003e, or \u003ccode\u003eSTAGED\u003c/code\u003e states can revoke certificates and publish CRLs; billing occurs for CAs in these states as well.\u003c/p\u003e\n"]]],[],null,["# Certificate authority states\n============================\n\nThis page describes the operational states that apply to certificate authorities (CAs).\n\nOnce created, a CA is in one of the following states throughout its lifecycle.\n\n- Enabled\n- Disabled\n- Staged\n- Awaiting user activation\n- Deleted\n\nSubordinate CAs are created in the `AWAITING_USER_ACTIVATION` state, and they are set to the `STAGED` state after activation.\n| **Note:** If you don't activate subordinate CAs within 30 days of creation, the subordinate CAs are deleted.\n\nRoot CAs are created in the `STAGED` state. A root CA can never be in the `AWAITING_USER_ACTIVATION` state.\n\nWe recommend that you create and test certificates while the CA is still in the `STAGED` state. Once you have verified that the CA certificate has been published to all clients and tested certificate issuance from the CA, you can enable the CA to start issuing load-balanced certificates for the CA pool. For information on enabling a CA, see [Enable a CA](/certificate-authority-service/docs/managing-ca-state#enable).\n\nA CA pool cannot issue certificates until it has at least one CA in the `ENABLED` state.\n| **Note:** Once you enable a CA, it cannot be transitioned back to the `STAGED` state.\n\nThe following table illustrates the properties of a CA in each of the states.\n\n^1^CAs in the `STAGED` state cannot issue certificates through CA pool load-balancing. They can only issue certificates when requested directly by the clients.\n\nWhat's next\n-----------\n\n- Learn how to [enable, disable, and restore CAs](/certificate-authority-service/docs/managing-ca-state).\n- Learn how to [request certificates](/certificate-authority-service/docs/requesting-certificates)."]]
