What is AWS Private Certificate Authority?
AWS Private Certificate Authority (AWS Private CA) is a managed service for building private certificate authority hierarchies in AWS. You create root and subordinate CAs without the investment and maintenance costs of operating an on-premises public key infrastructure.
The private CAs issue end-entity X.509 certificates for your internal resources: servers, applications, users, devices, and containers. Operations are available from the AWS Management Console, the AWS Private CA API, or the AWS CLI.
Core Features
- Private CA hierarchies: Root and subordinate certificate authorities, including import of external CA certificates
- Certificate issuance: End-entity X.509 certificates for TLS channels, authentication of users, computers, API endpoints, and IoT devices, and code signing
- Revocation status: Support for the Online Certificate Status Protocol (OCSP) to obtain certificate revocation status
- Two operating modes: General-purpose mode and short-lived certificate mode, each with its own pricing
- Connectors: Connectors for Active Directory, Kubernetes, and SCEP with no additional charge
- Automation: Manage CAs and certificates via APIs, the AWS CLI, or AWS CloudFormation templates
- Broad algorithm coverage: RSA and ECDSA algorithms plus the post-quantum signature algorithms ML-DSA-44, ML-DSA-65, and ML-DSA-87
- ACM integration: Private certificates requested through AWS Certificate Manager can be used with any ACM integrated service
Typical Use Cases
Internal TLS: Encrypted connections between internal services in AWS and on premises, including mutual TLS in private networks.
Kubernetes: Integrating private CAs into Amazon Elastic Kubernetes Service to issue certificates for communication inside the cluster.
Service mesh: Authentication and encryption between services in a service mesh.
IoT: Automated certificate issuance for IoT devices and internal infrastructure as the basis for device identities.
Benefits
- No purchase or operation of an on-premises CA
- Two operating modes with different pricing for long-lived and short-lived certificates
- Connectors for Active Directory, Kubernetes, and SCEP at no additional charge
- Post-quantum signature algorithms (ML-DSA) available alongside RSA and ECDSA
- Certificates whose private key you cannot access, for example when used with Elastic Load Balancing, CloudFront, or API Gateway, are free per the documentation
- 30 days with no CA operation charge for the first private CA per account and Region
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS Private CA: designing the CA hierarchy, choosing between general-purpose and short-lived certificate mode, integrating with ACM, EKS, and Active Directory, and establishing automation and operating processes for certificate management.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is AWS Private CA used for?
AWS Private CA enables creation of private certificate authority hierarchies, including root and subordinate CAs, without operating an on-premises CA. The private CAs issue end-entity X.509 certificates, for example to create encrypted TLS communication channels, authenticate users, computers, API endpoints, and IoT devices, cryptographically sign code, and implement the Online Certificate Status Protocol (OCSP) for obtaining certificate revocation status.
Which cryptographic algorithms are supported?
For private key generation and certificate signing the documentation lists ML-DSA-44, ML-DSA-65, ML-DSA-87, RSA-2048, RSA-3072, RSA-4096, EC prime256v1, EC secp384r1, EC secp521r1, and SM2 (China Regions only). Documented signing algorithms include SHA256WITHRSA, SHA384WITHRSA, SHA512WITHRSA, and the corresponding ECDSA variants. When AWS Certificate Manager issues certificates from a private CA, it supports only a subset of these algorithms.
What does it cost?
According to the pricing page, operating a private CA costs USD 400 per month in general-purpose mode and USD 50 per month in short-lived certificate mode. In general-purpose mode the first 1,000 certificates cost USD 0.75 each, the next up to 10,000 cost USD 0.35 each, and beyond that USD 0.001 each; short-lived certificate mode is USD 0.058 per certificate. OCSP costs USD 0.06 per queried certificate per month plus USD 0.20 per 100,000 queries. The Kubernetes, Active Directory, and SCEP connectors carry no additional charge.
Is there a free trial?
Yes. Per the pricing page, any AWS account can try AWS Private CA with no CA operation charge for the first 30 days for the first private CA created in the account in each Region. Certificate fees apply during the trial.
Which integrations exist?
Certificates you request through AWS Certificate Manager can be associated with any service integrated with ACM. Private CAs can additionally be integrated into Amazon Elastic Kubernetes Service to issue certificates inside a Kubernetes cluster; per the documentation, EKS itself is not an ACM integrated service. Certificates issued through the AWS Private CA API or CLI, or exported from ACM, can be installed anywhere you want.
Can private CAs be used across Regions?
No. Like most AWS resources, private CAs are Regional resources. To use private CAs in more than one Region you must create them in those Regions; they cannot be copied between Regions.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.