AWS Private CA features

An AWS Private CA hierarchy provides strong security and restrictive access controls for the most-trusted root CA at the top of the trust chain, while allowing more permissive access and bulk certificate issuance for subordinate CAs lower on the chain. You can control who can create a new CA or restrict access to existing CAs using AWS IAM policies. The private keys for your CA hierarchy are protected by FIPS 140-2 hardware.

AWS Private CA offers modes with different capabilities and pricing for all your use cases.  All modes of AWS Private CA make it easy for administrators, builders, and developers with no background in private key infrastructure (PKI) to quickly and easily set up and manage a private CA.

• short-lived certificate mode for certificates with a validity of up to 7 days
   
• general-purpose mode for certificates with any validity period

For information on mode pricing, visit the AWS Private CA pricing page.

Connectors allow you to replace your existing CAs with AWS Private CA in environments that have an established native certificate distribution solution. AWS Private CA offers three connector types. Using the portfolio of connectors, you can use AWS Private CA as the single CA solution for your organization.  

• Connector for Active Directory (AD): The Connector for AD allows you to use AWS Private CA as a drop-in replacement for your self-managed enterprise CAs without the need to deploy, patch, or update local agents or proxy servers. Enterprises that use AD to manage Windows environments can reduce their private CA costs and complexity. You can issue certificates to your domain-joined objects like users, computers, domain controllers, and smart cards that enroll using AD auto-enrollment and group policy features. Learn more about the Connector for AD in the Getting Started guide.
• Connector for Kubernetes: You can use the Connector for Kubernetes to issue certificates for Kubernetes clusters at scale. Integrate with Kubernetes to more easily automate and configure end-to-end encryption for Amazon Elastic Kubernetes Service (Amazon EKS). You can download the Connector for Kubernetes from the GitHub repository.
• Connector for SCEP: The Connector for SCEP allows you to use a managed, cloud CA to enroll mobile devices and networking gear like firewalls and routers. Simple Certificate Enrollment Protocol (SCEP) is a widely-adopted protocol used by mobile device management (MDM) solutions for getting digital identity certificates from a CA and enrolling mobile devices. Use AWS Private CA with popular MDM solutions like Microsoft Intune and Jamf Pro.

Keys used by a CA to sign certificates are highly sensitive. AWS Private CA secures these keys with AWS-managed hardware security modules (HSMs). These HSMs adhere to FIPS 140-2 security standards to help protect your private CA against key compromises. Details on the FIPS 140-2 hardware can be found in the AWS Private CA documentation.

You can control access to AWS Private CA with IAM policies. For example, you can create a policy to grant IT administrators who are responsible for CA management full access to create and configure private CAs, while granting limited access to developers and users who need only to issue and revoke certificates.

When establishing an encrypted TLS connection, a revocation infrastructure alerts the endpoint that the certificate should not be trusted. AWS Private CA customers can choose Online Certificate Status Protocol (OCSP), certificate revocation lists (CRLs), or both to distribute revocation information for their private certificates.

Sharing CAs across your organization or AWS accounts avoids the cost and complexity of creating and managing multiple CAs in your AWS accounts. You can create resource shares through AWS Resource Access Manager (RAM) that include your private CAs and are associated with a set of accounts or AWS Organizations. This capability allows the included accounts to issue private certificates from the shared CA. You can then use AWS Certificate Manager (ACM) to issue private certificates from a shared CA, the certificate is generated locally in the requesting account, and ACM provides full lifecycle management and renewal for certificates created with general-purpose mode. ACM cannot issue short-lived certificates.

AWS Private CA allows you to fully customize private certificates to the specific needs of your organization’s identity or data protection security requirements. By using customizable names, you can support identities for computers, web services, containers, users, IoT devices, and more. Standard certificate extensions are natively supported, and you can use Private CA’s custom extension capability to create certificates with non-standard extensions.

Write code to automate certificate management in the programming language of your choice using AWS Private CA. AWS SDKs make authentication more streamlined and integrate efficiently with your development environment. You can also write scripts or one-off commands using command line tools to interact with the service.

AWS Private CA provides you and your auditors with visibility into the activity of your private CAs. You can create audit reports that include the status of all the certificates issued from the CA. AWS Private CA is integrated with AWS CloudTrail. CloudTrail captures API calls from the AWS Private CA console, the AWS Command Line Interface (CLI), or your code and delivers the log files to your Amazon Simple Storage Service (S3) bucket. Using the information collected by CloudTrail, you can determine the request that was made, the IP address from which the request came, when it was made, and so on.