Building a Private PKI with AWS Private CA - Automated Certificate Issuance and Rotation
Build a private certificate authority and automatically issue mTLS certificates for internal service-to-service communication. Learn about certificate lifecycle management and CRL design.
Overview of Private CA
Private CA is a managed certificate authority service that automates the issuance and management of private certificates. While ACM (AWS Certificate Manager) issues public certificates for free, Private CA issues private certificates for use within an organization. It is used for use cases that public certificates cannot address, such as mTLS between microservices, VPN client authentication, and IoT device authentication. Private CA supports RSA 2048/4096 and ECDSA P256/P384 key algorithms, issuing certificates with X.509 v3 extensions. Operations from CA creation to certificate issuance can be performed via API, and API calls are recorded in CloudTrail.
Certificate Issuance and mTLS
Using certificates issued by Private CA for mTLS between services provides both communication encryption and client authentication. Using short-lived certificates reduces the effort of managing Certificate Revocation Lists (CRLs). Because the certificate validity period is short, the time window for exploiting a compromised certificate becomes shorter. Integration with ACM enables automatic deployment of private certificates to ALBs, enabling HTTPS on internal ALBs. In EKS environments, cert-manager can be combined with the Private CA Issuer plugin to automatically issue and rotate certificates per Pod.
Certificate Templates and Automation
Private CA issues purpose-specific certificates using certificate templates for server certificates, client certificates, code signing certificates, and more. ACM integration enables automatic deployment and renewal of Private CA-issued certificates to ALBs and API Gateway. Short-lived certificates (valid for 7 days or less) simplify CRL management. An OCSP (Online Certificate Status Protocol) responder configuration can verify certificate validity in real time. CA creation and certificate issuance can be automated with CloudFormation or Terraform, managing PKI infrastructure as IaC.
Use Case Design Patterns
For microservice mTLS, issue short-lived certificates per service and include the service name in the certificate's SAN (Subject Alternative Name) to integrate with service discovery. For IoT device authentication, pre-issue certificates from Private CA during device manufacturing and integrate with AWS IoT Core's Just-in-Time Registration (JITR) for automatic provisioning on first device connection. For VPN client authentication, issue both server and client certificates from Private CA for AWS Client VPN to configure mutual authentication. For code signing, integrate Private CA certificates into CI/CD pipelines to sign build artifacts (such as Lambda function deployment packages) and detect tampering.
Design Best Practices and Pitfalls
One approach is to configure the CA hierarchy with 2 tiers (root CA + subordinate CA) or 3 tiers (root CA + policy CA + issuing CA). Disable the root CA immediately after certificate issuance and operate only the subordinate CA to reduce the risk of root key misuse. CRLs can be published to an S3 bucket, and because misconfigured bucket access policies can cause certificate validation failures, administrators check the bucket policy settings. Enabling the OCSP responder lets clients check certificate status without downloading CRLs. When a CA expires, services that use its certificates sometimes go down. One option is CloudWatch alarms that monitor remaining CA validity and alert before expiration.
Private CA Pricing
Private CA pricing is based on a monthly fee per CA and a fee based on the number of certificates issued. In short-lived certificate mode, the monthly CA fee is discounted. One design uses a CA hierarchy (root CA -> subordinate CA) where the root CA is kept offline and only the subordinate CA is operational.
Summary
Private CA is a service that provides managed issuance and management of private certificates within an organization. Short-lived certificates (7 days or less) simplify CRL management, and ACM integration automates certificate deployment and renewal. mTLS provides mutual authentication between services, and a CA hierarchy (root CA + subordinate CA) forms the PKI.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Private Certificate Authority official page
- AWS Certificate Manager official page
- AWS IAM official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.