AWS Private Certificate Authority (AWS Private CA) is a highly available, managed private certificate authority (CA) service. With AWS Private CA, you can securely issue and manage private certificates for your connected resources in one place—with a pay-as-you-go service. The service’s APIs allow developers to customize and deploy private certificates, and administrators can use AWS Private CA to create a fully cloud-based CA hierarchy or a hybrid hierarchy combining cloud and on-premises CAs. Administrators can also centrally manage enrollment for private certificates with complete AWS Identity and Access Management (IAM) policy controls and shared AWS accounts. AWS Private CA is a cryptographically agile service with different key algorithms and key sizes, in addition to hardware-protected private keys.
Key product features
Secure root CA and CA hierarchy management
An AWS Private CA hierarchy provides strong security and restrictive access controls for the most-trusted root CA at the top of the trust chain, while allowing more permissive access and bulk certificate issuance for subordinate CAs lower on the chain. You can control who can create a new CA or restrict access to existing CAs using AWS IAM policies. The private keys for your CA hierarchy are protected by FIPS 140-2 hardware.
AWS Private CA offers modes with different capabilities and pricing for all your use cases. All modes of AWS Private CA make it easy for administrators, builders, and developers with no background in PKI to quickly and easily set up and manage a private CA.
- short-lived certificate mode for certificates with a validity of up to 7 days
- general-purpose mode for certificates with any validity period
For information on mode pricing, visit the AWS Private CA pricing page.
Secure HSM-backed key storage for CA keys
Keys used by a CA to sign certificates are highly sensitive. AWS Private CA secures these keys with AWS-managed hardware security modules (HSMs). These HSMs adhere to FIPS 140-2 security standards to help protect your private CA against key compromises. Details on the FIPS 140-2 hardware can be found in the AWS Private CA documentation.
You can control access to AWS Private CA with IAM policies. For example, you can create a policy to grant IT administrators who are responsible for CA management full access to create and configure private CAs, while granting limited access to developers and users who need only to issue and revoke certificates.
Certificate revocation with CRL and OCSP
When establishing an encrypted TLS connection, a revocation infrastructure alerts the endpoint that the certificate should not be trusted. AWS Private CA customers can choose Online Certificate Status Protocol (OCSP), certificate revocation lists (CRLs), or both to distribute revocation information for their private certificates.
Cross-account CA sharing
Sharing CAs across your organization or AWS accounts avoids the cost and complexity of creating and managing multiple CAs in your AWS accounts. You can create resource shares through AWS Resource Access Manager (RAM) that include your private CAs and are associated with a set of accounts or AWS Organizations. This capability allows the included accounts to issue private certificates from the shared CA. You can then use AWS Certificate Manager (ACM) to issue private certificates from a shared CA, the certificate is generated locally in the requesting account, and ACM provides full lifecycle management and renewal for certificates created with general-purpose mode. ACM cannot issue short-lived certificates.
Native service integrations with Kubernetes
With AWS Private CA, you can issue certificates for Kubernetes clusters at scale with powerful automation. Integrate with Kubernetes on AWS and through select technology partners for increased agility and developer productivity. More easily automate and configure end-to-end encryption for Amazon Elastic Kubernetes Service (EKS).
Fully customizable certificates
AWS Private CA allows you to fully customize private certificates to the specific needs of your organization’s identity or data protection security requirements. By using customizable names, you can support identities for computers, web services, containers, users, IoT devices, and more. Standard certificate extensions are natively supported, and you can use Private CA’s custom extension capability to create certificates with non-standard extensions.
Write code to automate certificate management in the programming language of your choice using AWS Private CA. AWS SDKs make authentication more streamlined and integrate efficiently with your development environment. You can also write scripts or one-off commands using command line tools to interact with the service.
Auditing and logging
AWS Private CA provides you and your auditors with visibility into the activity of your private CAs. You can create audit reports that include the status of all the certificates issued from the CA. AWS Private CA is integrated with AWS CloudTrail. CloudTrail captures API calls from the AWS Private CA console, the AWS Command Line Interface (CLI), or your code and delivers the log files to your Amazon Simple Storage Service (S3) bucket. Using the information collected by CloudTrail, you can determine the request that was made, the IP address from which the request came, when it was made, and so on.