---
title: "ezgh private-ca ca"
description: "Private certificate authorities: create, issue from, revoke and delete."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh private-ca ca

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh private-ca ca <command>
```

The project's private certificate authorities.

A root CA (`--type` root) is self-signed and signs only subordinate CAs. A subordinate is signed by a CA in the project (`--parent`) or by your own existing root (`--external`: download its CSR with `ca csr`, have your root sign it, then `ca import` the chain). Certificates are issued from an active subordinate: from a CSR, from a key EZGH generates, or through its ACME directory with a binding.

Part of [`ezgh private-ca`](/cli/reference/private-ca).

## Flags

This command also takes the [global flags](/cli/reference#global-flags).

## Subcommands

| Command | Description |
| --- | --- |
| [`ezgh private-ca ca create`](/cli/reference/private-ca-ca-create) | Create a certificate authority |
| [`ezgh private-ca ca csr`](/cli/reference/private-ca-ca-csr) | Print an external subordinate's CSR, for your root to sign |
| [`ezgh private-ca ca delete`](/cli/reference/private-ca-ca-delete) | Schedule a certificate authority's deletion |
| [`ezgh private-ca ca disable`](/cli/reference/private-ca-ca-disable) | Stop a certificate authority signing |
| [`ezgh private-ca ca enable`](/cli/reference/private-ca-ca-enable) | Let a disabled certificate authority sign again |
| [`ezgh private-ca ca get`](/cli/reference/private-ca-ca-get) | Show a certificate authority |
| [`ezgh private-ca ca import`](/cli/reference/private-ca-ca-import) | Import an external subordinate's signed certificate |
| [`ezgh private-ca ca issue`](/cli/reference/private-ca-ca-issue) | Issue a certificate from a CSR or a generated key |
| [`ezgh private-ca ca list`](/cli/reference/private-ca-ca-list) | List the project's certificate authorities |
| [`ezgh private-ca ca renew`](/cli/reference/private-ca-ca-renew) | Reissue a certificate authority's certificate for the same key |
| [`ezgh private-ca ca restore`](/cli/reference/private-ca-ca-restore) | Cancel a certificate authority's scheduled deletion |
| [`ezgh private-ca ca revoke`](/cli/reference/private-ca-ca-revoke) | Revoke a subordinate certificate authority |
| [`ezgh private-ca ca update`](/cli/reference/private-ca-ca-update) | Rename a certificate authority, or shorten its longest certificate |

Source: https://docs.ezghcloud.com/cli/reference/private-ca-ca/index.mdx