AWS Certificate Manager & Private Certificate Authority

Overview

AWS Certificate Manager (ACM) and AWS Private Certificate Authority (ACM PCA) work together to provide comprehensive certificate management solutions for both public and private infrastructure.

AWS Certificate Manager (ACM) Basics

ACM provides free SSL/TLS certificates for AWS services with automatic renewal and domain validation.

AWS Private Certificate Authority (ACM PCA) Basics

ACM PCA enables you to create and manage private certificate authorities for internal PKI infrastructure.

Traffic Flow Diagrams

Public Certificate Traffic Flow

Private Certificate Traffic Flow

Hybrid Certificate Architecture

Setup Commands & Configuration

1. Creating a Private Certificate Authority

aws acm-pca create-certificate-authority \
    --certificate-authority-configuration file://ca-config.json \
    --certificate-authority-type "ROOT" \
    --idempotency-token "unique-token-123" \
    --tags Key=Name,Value=MyRootCA Key=Environment,Value=Production
        

CA Configuration File (ca-config.json)

{
    "KeyAlgorithm": "RSA_2048",
    "SigningAlgorithm": "SHA256WITHRSA",
    "Subject": {
        "Country": "US",
        "Organization": "MyCompany",
        "OrganizationalUnit": "IT Department",
        "CommonName": "MyCompany Root CA"
    }
}
        

2. Installing CA Certificate

# Get the CA ARN from the create command output
export CA_ARN="arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"

# Get Certificate Signing Request
aws acm-pca get-certificate-authority-csr \
    --certificate-authority-arn $CA_ARN \
    --output text > ca.csr
        

# Issue the CA certificate (self-signed for root CA)
aws acm-pca issue-certificate \
    --certificate-authority-arn $CA_ARN \
    --csr fileb://ca.csr \
    --signing-algorithm "SHA256WITHRSA" \
    --template-arn "arn:aws:acm-pca:::template/RootCACertificate/V1" \
    --validity Value=3650,Type=DAYS
        

3. Activating the Certificate Authority

# Get the issued certificate
aws acm-pca get-certificate \
    --certificate-authority-arn $CA_ARN \
    --certificate-arn $CERT_ARN \
    --output text > ca-cert.pem

# Import the CA certificate to activate the CA
aws acm-pca import-certificate-authority-certificate \
    --certificate-authority-arn $CA_ARN \
    --certificate fileb://ca-cert.pem
        

4. Creating a Subordinate Certificate Authority

# Create subordinate CA
aws acm-pca create-certificate-authority \
    --certificate-authority-configuration file://subordinate-ca-config.json \
    --certificate-authority-type "SUBORDINATE" \
    --idempotency-token "subordinate-token-456" \
    --tags Key=Name,Value=MySubordinateCA Key=Environment,Value=Production
        

Subordinate CA Configuration (subordinate-ca-config.json)

{
    "KeyAlgorithm": "RSA_2048",
    "SigningAlgorithm": "SHA256WITHRSA",
    "Subject": {
        "Country": "US",
        "Organization": "MyCompany",
        "OrganizationalUnit": "IT Department",
        "CommonName": "MyCompany Subordinate CA"
    }
}
        

5. Issuing End-Entity Certificates

# Issue a certificate for a web server
aws acm-pca issue-certificate \
    --certificate-authority-arn $SUBORDINATE_CA_ARN \
    --csr fileb://server.csr \
    --signing-algorithm "SHA256WITHRSA" \
    --template-arn "arn:aws:acm-pca:::template/EndEntityCertificate/V1" \
    --validity Value=365,Type=DAYS
        

6. Requesting Public ACM Certificates

# Request a public certificate
aws acm request-certificate \
    --domain-name "example.com" \
    --subject-alternative-names "www.example.com" "api.example.com" \
    --validation-method DNS \
    --tags Key=Name,Value=ExampleComCert Key=Environment,Value=Production
        

7. Certificate Validation

# Get validation records for DNS validation
aws acm describe-certificate \
    --certificate-arn $PUBLIC_CERT_ARN \
    --query 'Certificate.DomainValidationOptions[*].ResourceRecord'

# Automatically add validation records to Route 53
aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890123 \
    --change-batch file://validation-records.json
        

Validation Records JSON (validation-records.json)

{
    "Changes": [
        {
            "Action": "CREATE",
            "ResourceRecordSet": {
                "Name": "_acme-challenge.example.com",
                "Type": "CNAME",
                "TTL": 300,
                "ResourceRecords": [
                    {
                        "Value": "validation-string.acm-validations.aws."
                    }
                ]
            }
        }
    ]
}
        

8. Certificate Deployment

# Deploy certificate to Application Load Balancer
aws elbv2 modify-listener \
    --listener-arn $LISTENER_ARN \
    --certificates CertificateArn=$PUBLIC_CERT_ARN \
    --ssl-policy "ELBSecurityPolicy-TLS-1-2-2017-01"
        

# Deploy certificate to CloudFront distribution
aws cloudfront update-distribution \
    --id $DISTRIBUTION_ID \
    --distribution-config file://distribution-config.json
        

Command Execution Flow

Best Practices

Monitoring and Automation

# Set up CloudWatch alarms for certificate expiration
aws cloudwatch put-metric-alarm \
    --alarm-name "CertificateExpiration" \
    --alarm-description "Alert when certificate expires soon" \
    --metric-name DaysToExpiry \
    --namespace AWS/CertificateManager \
    --statistic Minimum \
    --period 86400 \
    --threshold 30 \
    --comparison-operator LessThanThreshold \
    --evaluation-periods 1