Where is the delete button? There isn't one, and that is a feature. POST /v1/cas/{ca}/retire takes a CA out of service — but certificates, generations, CRLs and audit history are an append-only record that outlives its CA. Five years from now, someone will need to prove what this CA issued and when; a deleted CA would make that answer "we can't say", which is the one answer a CA must never give.
Two boundaries around retirement are worth knowing before you meet them:
- The infra hierarchy refuses it.
goca-infra-rootandica-infrasign goca's own listener certificates; retiring the built-in anchor would be an outage with a delay timer. The migration path is re-binding thegoca-service-tlstemplate to your own issuing CA — never removing the fallback. - Retire is not the only "read-only" state. Editing a CA's spec never touches existing generations or issued certificates either — a spec's fields divide into instructions to future operations (freely editable) and records of the minted artifact, which only rollover can change.
Take CAs out of service; never expect to erase that they served.
Now I can retire a CA without erasing its history — because I can't, on purpose.