Key Doesn't Appear When Creating a Certificate Authority

Verify that policy statements exist to grant at least the minimum permissions described in the Required IAM Policy section of Managing Certificate Authorities. You might need policy statements for both groups and dynamic groups, depending on the resources you want to work with.

If you have no policy that grants CAs the permissions they need, then an administrator must write the policy. If you have no dynamic group for CAs to begin with, an administrator must first create a dynamic group with a matching rule that includes all CAs, and then write the policy.

If you don't see the expected key, confirm that you selected the compartment where the key exists. Resources don't need to belong to the same compartment, but you do need permissions to work with resources in all relevant compartments.

Also confirm that the Vault key exists in the same tenancy as the CA you're trying to create. The Certificates service doesn't support cross-tenancy requests.

To create a CA, you need a hardware-protected encryption key. A master encryption key protected by a hardware security module (HSM) is stored on an HSM and can't be exported from the HSM. All cryptographic operations involving the key also happen on the HSM. For more information about Vault keys, including information about protection modes, see Key and Secret Management Concepts.