faults array.
The certificate service issues TLS certificates for your domains and keeps them
current. You give it a name and a list of domains; it proves you control them
over DNS, gets them signed, and renews them before they expire. You can also
upload a certificate you already hold.
Certificates are attached to a load balancer
listener by CRN, so the load balancer never handles your private key directly.
Issuing
The DNS challenge, start to finish, and what changes when you host the
domain elsewhere.
Uploading your own
Material you already hold — active immediately, and never renewed for you.
Serving a certificate
Multi-SNI, the default certificate, and the two removals a listener
refuses.
Renewal and revocation
What renews on its own, how revoking differs from deleting, and every
status.
Certificate material
The only endpoint that returns the private key, and who may call it.
Permissions
Every IAM action, which call needs it, and how to scope a policy by
certificate name.
Limits and troubleshooting
Stuck in
pending_dns, wildcard failures, and reading faults.