gcloud privateca subordinates activate supports first-party activation

Introduced 2026-08-11 · score 0.91

HOW TO USE IT

When a subordinate CA already exists and is awaiting activation, activate it with `gcloud privateca subordinates activate` and the issuer pool, location, and CA flags.

WHY THIS HELPS

Activate a subordinate CA that already exists or needs first-party activation.

REQUIREMENTS AND LIMITATIONS

• CERTIFICATE_AUTHORITY (required): ID or fully qualified identifier of the subordinate CA to activate.
• --location (required): Subordinate CA location; can be supplied through a fully qualified CA name or the `privateca/location` property.
• --pool (required): Parent CA pool of the subordinate CA; can be supplied through a fully qualified CA name.
• --issuer-pool (required): ID or fully qualified identifier of the issuing CA pool when using issuer flags.
• --issuer-location (required): Location of the issuing CA; can be supplied through a fully qualified issuer pool name or `privateca/location`.
• --issuer-ca: ID of the issuing CA. If omitted, an available enabled CA in the issuing pool is chosen.
• --pem-chain: File of PEM certificates from the current CA certificate through the root CA certificate. This is an alternative activation method to issuer flags; the docs specify exactly one of `--pem-chain` or issuer-based activation.
• Prerequisite: The subordinate CA must already be created and awaiting activation.
• The activation suggestion applies when create with issuer flags fails due to an already existing subordinate CA.

FIRST-PARTY EVIDENCE

• https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11
• https://docs.cloud.google.com/sdk/gcloud/reference/privateca/subordinates/activate

Check the installed version and the source before using it. Entry JSON

Report a problem with this card