AWS Private Certificate Authority (AWS Private CA) is a highly available, managed private certificate authority (CA) service. With AWS Private CA, you can you can create private certificates to identify resources and protect data. You can create versatile certificate and CA configurations to identify and protect your resources, including servers, applications, users, devices, and containers. AWS Private CA allows you to create a solid foundation which you can use to protect your data, identify resources, and help meet your regulatory and compliance needs. Using AWS Private CA can help you avoid outages and improve uptime by automating CA and certificate management using API calls, AWS CLI commands, or AWS CloudFormation templates.
The service’s APIs allow developers to customize and deploy private certificates, and administrators can use AWS Private CA to create a fully cloud-based CA hierarchy or a hybrid hierarchy combining cloud and on-premises CAs. AWS Private CA is a cryptographically agile service with different key algorithms and key sizes, in addition to hardware-protected private keys.
Key product features
Secure root CA and CA hierarchy management
An AWS Private CA hierarchy provides strong security and restrictive access controls for the most-trusted root CA at the top of the trust chain, while allowing more permissive access and bulk certificate issuance for subordinate CAs lower on the chain. You can control who can create a new CA or restrict access to existing CAs using AWS IAM policies. The private keys for your CA hierarchy are protected by FIPS 140-2 hardware.
AWS Private CA offers modes with different capabilities and pricing for all your use cases. All modes of AWS Private CA make it easy for administrators, builders, and developers with no background in private key infrastructure (PKI) to quickly and easily set up and manage a private CA.
- short-lived certificate mode for certificates with a validity of up to 7 days
- general-purpose mode for certificates with any validity period
For information on mode pricing, visit the AWS Private CA pricing page.
Connectors allow you to replace your existing CAs with AWS Private CA in environments that have an established native certificate distribution solution. AWS Private CA offers two connector types:
- Connector for Active Directory (AD): The Connector for AD allows you to use AWS Private CA as a drop-in replacement for your self-managed enterprise CAs without the need to deploy, patch, or update local agents or proxy servers. Enterprises that use AD to manage Windows environments can reduce their private CA costs and complexity. You can issue certificates to your domain-joined objects like users, computers, domain controllers, and smart cards that enroll using AD auto-enrollment and group policy features. Learn more about the Connector for AD in the Getting Started guide.
- Connector for Kubernetes: You can use the Connector for Kubernetes to issue certificates for Kubernetes clusters at scale. Integrate with Kubernetes to more easily automate and configure end-to-end encryption for Amazon Elastic Kubernetes Service (Amazon EKS). You can download the Connector for Kubernetes from the GitHub repository.
Secure HSM-backed key storage for CA keys
Keys used by a CA to sign certificates are highly sensitive. AWS Private CA secures these keys with AWS-managed hardware security modules (HSMs). These HSMs adhere to FIPS 140-2 security standards to help protect your private CA against key compromises. Details on the FIPS 140-2 hardware can be found in the AWS Private CA documentation.
You can control access to AWS Private CA with IAM policies. For example, you can create a policy to grant IT administrators who are responsible for CA management full access to create and configure private CAs, while granting limited access to developers and users who need only to issue and revoke certificates.
Certificate revocation with CRL and OCSP
When establishing an encrypted TLS connection, a revocation infrastructure alerts the endpoint that the certificate should not be trusted. AWS Private CA customers can choose Online Certificate Status Protocol (OCSP), certificate revocation lists (CRLs), or both to distribute revocation information for their private certificates.
Cross-account CA sharing
Sharing CAs across your organization or AWS accounts avoids the cost and complexity of creating and managing multiple CAs in your AWS accounts. You can create resource shares through AWS Resource Access Manager (RAM) that include your private CAs and are associated with a set of accounts or AWS Organizations. This capability allows the included accounts to issue private certificates from the shared CA. You can then use AWS Certificate Manager (ACM) to issue private certificates from a shared CA, the certificate is generated locally in the requesting account, and ACM provides full lifecycle management and renewal for certificates created with general-purpose mode. ACM cannot issue short-lived certificates.
Fully customizable certificates
AWS Private CA allows you to fully customize private certificates to the specific needs of your organization’s identity or data protection security requirements. By using customizable names, you can support identities for computers, web services, containers, users, IoT devices, and more. Standard certificate extensions are natively supported, and you can use Private CA’s custom extension capability to create certificates with non-standard extensions.
Write code to automate certificate management in the programming language of your choice using AWS Private CA. AWS SDKs make authentication more streamlined and integrate efficiently with your development environment. You can also write scripts or one-off commands using command line tools to interact with the service.
Auditing and logging
AWS Private CA provides you and your auditors with visibility into the activity of your private CAs. You can create audit reports that include the status of all the certificates issued from the CA. AWS Private CA is integrated with AWS CloudTrail. CloudTrail captures API calls from the AWS Private CA console, the AWS Command Line Interface (CLI), or your code and delivers the log files to your Amazon Simple Storage Service (S3) bucket. Using the information collected by CloudTrail, you can determine the request that was made, the IP address from which the request came, when it was made, and so on.