Resolution
----------

You must use a [self-signed root certificate](https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr-create-cert) (customerCA.crt) to sign the cluster [certificate signing request (CSR)](https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#get-csr). Verify that the certificate is an issuing certificate or trust anchor root certificate with this AWS Command Line Interface (AWS CLI) command:

**Note:** If you receive errors when you run AWS CLI commands, see [Troubleshoot AWS CLI errors](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html). Also, make sure that [you're using the most recent AWS CLI version](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html).

```plaintext
$ openssl x509 -in customerCA.crt -text -noout
```

If the certificate **customerCA.crt** is a root certificate, then the issuer and subject are the same. For more information, see [Sign the CSR](https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr).

Related information
-------------------

[What is AWS CloudHSM?](https://docs.aws.amazon.com/cloudhsm/latest/userguide/introduction.html)

I tried to initialize an AWS CloudHSM cluster, and received the error "InitializeCluster request failed: CloudHsmInvalidRequestException - TrustAnchor provided is not a valid x509 certificate."

Resolve CloudHSM cluster error "InitializeCluster failed"

How do I resolve the CloudHSM error "InitializeCluster request failed: CloudHsmInvalidRequestException - TrustAnchor provided is not a valid x509 certificate"?

Security, Identity, & Compliance

AWS re:Post Knowledge Center Spotlight:  AWS Certificate Manager (ACM)

How do I resolve errors when a private CA issues a new certificate?

How do I troubleshoot a 502 "The request could not be satisfied" error in CloudFront?

How do I resolve the ACM certificate "validation time out" error?

How do I use the ACM console to request a private certificate when the AWS Private CA validity is less than 13 months? 

SSL certificate fails a few minutes after validation

How to update the certificate in cloudhsm keystore using AWS cloudhsm functionality?

ACM import certificate error - The certificate chain provided is not in a valid PEM format.

Can't use Claude request failed INVALID_PAYMENT_INSTRUMENT:A valid payment instrument must be provided.

Domain registration failed (.se) [Parameters in request are not valid]

How do I resolve the CloudHSM error "InitializeCluster request failed: CloudHsmInvalidRequestException - TrustAnchor provided is not a valid x509 certificate"?

Resolution

Related information

Relevant content