AWS Private Certificate Authority Specialized2018年〜
A managed certificate authority service for issuing and managing private certificates
What It Does
AWS Private Certificate Authority (Private CA) is a managed service for issuing and managing private SSL/TLS certificates used within your organization. It lets you issue private certificates for internal applications, IoT devices, VPNs, and container-to-container communication without building your own CA infrastructure.
Use Cases
HTTPS for internal web applications, mTLS (mutual TLS) authentication between microservices, certificate-based authentication for IoT devices, and issuing VPN client certificates.
Everyday Analogy
Think of an in-house ID card office. Public IDs (ACM public certificates) are issued by government agencies (public CAs), but employee badges (private certificates) are issued by your internal office (Private CA). They're only valid within the company but can authenticate access to internal systems.
What Is Private CA?
AWS Private CA provides a managed private PKI (Public Key Infrastructure). While ACM (AWS Certificate Manager) issues free public certificates, Private CA issues private certificates trusted within your organization. You can build a hierarchy of root and subordinate CAs, and it also provides certificate revocation management (CRL, OCSP).
Issuing and Managing Certificates
Certificates issued by Private CA integrate with ACM and can be deployed directly to AWS services like ELB, CloudFront, and API Gateway. Certificate templates let you specify the purpose - server certificates, client certificates, code signing certificates, and more. Certificate lifecycle management and automatic renewal are also available through ACM integration. For a structured overview of certificate issuance and management, reference books on Amazon are a handy resource.
Getting Started
In the Private CA console, create a CA and configure the CA type (root / subordinate), key algorithm, and validity period. Once the CA is activated, request private certificates from the ACM console or API. Choosing short-lived certificate mode reduces the monthly fee.
Things to Watch Out For
- Each CA incurs a fixed monthly fee of $400 (short-lived certificate mode is $50/month). Per-certificate issuance charges also apply
- For HTTPS on public websites, use ACM's free public certificates. Private CA is for internal systems
