Skip to main content
In this lesson we cover AWS Private Certificate Authority (AWS Private CA): what it is, how it works, common use cases, and key features to help you secure internal communications with private X.509 certificates. What is a private certificate authority?
  • Think of a national mint that issues a country’s currency: a single trusted issuer that produces, tracks, and can retire notes if compromised. A private certificate authority plays the same role for digital certificates — it issues, manages lifetimes, and can revoke certificates used for authentication and encryption.
  • Private CAs are intended for internal trust boundaries: certificates they issue are trusted within your organization (servers, applications, devices, and users), but not by public browsers or the general internet.
What is AWS Private Certificate Authority?
  • AWS Private CA is a managed service that lets you create and operate private CAs without running your own CA servers. AWS handles the infrastructure, and you get certificate issuance, renewal, revocation, and audit logging through AWS integrations and CloudTrail.
  • It supports private X.509 certificates for internal TLS, mutual TLS (mTLS), device authentication, and other internal PKI needs.
Common use cases
A diagram titled "Private Certificate Authority" showing AWS Private Certificate Authority on the left issuing certificates that feed into CLI/SDK and AWS Certificate Manager on the right. The CLI/SDK and ACM boxes connect to AWS services, represented by icons.
ACM vs. Private CA — a simple distinction
  • AWS Certificate Manager (ACM): Best for publicly trusted TLS certificates (websites or internet-facing services). ACM can also manage private certificates when integrated with a Private CA, and it provides automatic certificate renewal and distribution to supported AWS services.
  • AWS Private Certificate Authority: Best for private/internal certificates that are not meant to be trusted by public browsers. Use Private CA when you need a managed internal CA to issue and manage X.509 certificates for your organization.
For the AWS Solutions Architect Associate exam and real-world deployments: remember ACM is the go-to for internet-facing, publicly trusted certificates; AWS Private CA is the managed option for internal/private certificate issuance. Integrating Private CA with ACM allows ACM to manage private cert lifecycle for your AWS services.
Key features of AWS Private Certificate Authority How AWS Private CA typically fits into your architecture
  1. Create a root CA or subordinate CA in AWS Private CA. For higher security, keep an offline root and use a subordinate CA for active issuance.
  2. Integrate the Private CA with ACM if you want AWS services to automatically receive and renew private certificates.
  3. Issue certificates using the AWS Console, ACM, AWS CLI/SDK, or through automation pipelines.
  4. Monitor and audit certificate activity with CloudTrail; revoke certificates and publish CRLs if compromise occurs.
Best practices
  • Keep the root CA offline where possible and use a subordinate CA for day-to-day issuance.
  • Automate certificate rotation and renewal using ACM integrations or custom automation with AWS SDKs.
  • Enable CloudTrail logging for CA actions and monitor CRL and OCSP usage patterns.
  • Restrict who can issue and revoke certificates using AWS IAM policies and service control policies (SCPs).
Protect your CA keys: if a CA (especially a root CA) is compromised, all certificates it signed may be untrusted. Use offline roots, strict IAM controls, and regularly audit CA access and operations.
Additional resources
A slide titled "Features" showing four numbered cards for Private Certificates, Integration with AWS Certificate Manager (ACM), Audit-Friendly, and Lifecycle Management, each with a colorful circular icon. The cards are arranged horizontally on light gray rounded panels with gradient icons.

Watch Video