About the Amazon Trust Services Migration

Amazon Web Services is moving the certificates for our services—including Amazon SES—to use our own certificate authority, Amazon Trust Services. We have carefully planned this change to minimize the impact it will have on your workflow. Most customers will not have to take any action during this migration.

About the Certificates

The Amazon Trust Services Certificate Authority (CA) uses the Starfield Services CA, which has been valid since 2005. The Amazon Trust Services certificates are available in most major operating systems released in the past 10 years, and are also trusted by all modern web browsers.

If you send email through the Amazon SES SMTP interface using a mail server that you operate, we recommend that you confirm that the appropriate certificates are installed. You can test whether your server trusts the Amazon Trust Services CAs by visiting the following URLs (for example, by using cURL):

• https://good.sca0a.amazontrust.com/
• https://good.sca1a.amazontrust.com/
• https://good.sca2a.amazontrust.com/
• https://good.sca3a.amazontrust.com/
• https://good.sca4a.amazontrust.com/

If you see a message stating that the certificate issuer is not recognized, then you should install the appropriate root certificate. You can download individual certificates from https://www.amazontrust.com/repository. The process of adding a trusted certificate to your server varies depending on the operating system you use. For more information, see “Adding New Certificates,” below.

AWS SDKs and CLI

Recent versions of the AWS SDKs and the AWS CLI are not impacted by this change. If you use an AWS SDK or a version of the AWS CLI released prior to February 5, 2015, you should upgrade to the latest version.

Potential Issues

If your system is configured to use a very restricted list of root CAs (for example, if you use certificate pinning), you may be impacted by this migration. In this situation, you must update your pinned certificates to include the Amazon Trust Services CAs.

Adding New Root Certificates

The following sections list the steps you can take to install the Amazon Root CA certificates on your systems if they are not already present.

macOS

To install a new certificate on a macOS server

1. Download the .pem file for the certificate you want to install from https://www.amazontrust.com/repository.
2. Change the file extension for the file you downloaded from .pem to .crt.
3. At the command prompt, type the following command to install the certificate: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/certificatename.crt, replacing /path/to/certificatename.crt with the full path to the certificate file.

Windows Server

To install a new certificate on a Windows server

1. Download the .pem file for the certificate you want to install from https://www.amazontrust.com/repository.
2. Change the file extension for the file you downloaded from .pem to .crt.
3. At the command prompt, type the following command to install the certificate: certutil -addstore -f "ROOT" c:\path\to\certificatename.crt, replacing c:\path\to\certificatename.crt with the full path to the certificate file.

Ubuntu

To install a new certificate on an Ubuntu (or similar) server

1. Download the .pem file for the certificate you want to install from https://www.amazontrust.com/repository.
2. Change the file extension for the file you downloaded from .pem to .crt.
3. Copy the certificate file to the directory /usr/local/share/ca-certificates/
4. At the command prompt, type the following command to update the certificate authority store: sudo update-ca-certificates

Red Hat Enterprise Linux/Fedora/CentOS

To install a new certificate on a Red Hat Enterprise Linux (or similar) server

1. Download the .pem file for the certificate you want to install from https://www.amazontrust.com/repository.
2. Change the file extension for the file you downloaded from .pem to .crt.
3. Copy the certificate file to the directory /etc/pki/ca-trust/source/anchors/
4. At the command line, type the following command to enable dynamic certificate authority configuration: sudo update-ca-trust force-enable
5. At the command line, type the following command to update the certificate authority store: sudo update-ca-trust extract

To learn more about this migration, see How to Prepare for AWS’s Move to Its Own Certificate Authority on the AWS Security Blog.