Certificates, ACM, and Private CA

Lesson 5 of 5 in KMS, Keys, and Certificates.

Keys protect data at rest; certificates establish who you are talking to before data moves at all. The exam groups them under one heading, and the reason is structural: both are cryptographic material with a lifecycle, and both are managed per Region.

AWS Certificate Manager issues public TLS certificates at no charge, and the valuable part is not the issuance but the renewal: ACM renews them automatically before expiry, and the private key for an ACM-issued certificate is generated and held by ACM. You prove domain control by DNS validation — publishing a CNAME record ACM gives you, which is the method to choose because it allows ACM to re-validate and renew silently forever — or by email validation, which is fragile, depends on WHOIS and role addresses, and makes renewals a human task. In Route 53, ACM can write the validation record for you.

Where the certificate can be used is the detail that decides exam questions. ACM integrates with CloudFront, Elastic Load Balancing, API Gateway, App Runner, Amazon Cognito and other AWS services that terminate TLS for you. There is no mechanism to install a managed ACM certificate onto an EC2 instance, because the service never hands you the private key for the standard, free public certificate.

That last sentence has an important modern exception. Since 17 June 2025 ACM also offers exportable public certificates: you must request the certificate as exportable (the flag cannot be added later, and certificates issued before that date can never be exported), the certificate is then valid for 395 days, it carries a charge at issuance and at renewal, and exporting it yields the certificate, the chain and the private key encrypted under a passphrase you supply — which you can then install on EC2, in containers, or on premises. The old reflex “ACM certificates cannot leave AWS, so use an imported certificate or your own PKI for EC2” is now conditional on how the certificate was requested, and the default remains non-exportable.

AWS Private CA is the other half: a managed certificate authority for names that must never be publicly trusted — internal service endpoints, mutual TLS between microservices, IoT device identities, VPN and Kubernetes workload certificates. You build a hierarchy: a root CA whose private key signs nothing but subordinates, and subordinate CAs that do the day-to-day issuing, so the root can be kept offline-equivalent and a compromised issuing CA can be revoked without replacing the entire trust chain. Private CA integrates with ACM, so ACM can issue and renew private certificates from your CA for the same AWS services — and private certificates issued through ACM can be exported, because your own CA signed them.

Revocation is the operational commitment people underestimate. A certificate authority that cannot revoke is a liability, so Private CA supports CRL distribution (a signed revocation list published to an S3 bucket you configure, which clients fetch on a schedule) and OCSP (an online responder clients query per certificate, fresher but a live dependency). Decide at creation, because enabling CRLs later means clients that cached a certificate without a distribution point will never look. And watch the cost shape: you pay a monthly charge per CA — which is substantial, and continues while the CA is merely in use — plus a charge per issued certificate. A pattern of “one CA per team” gets expensive fast, which is why consolidating into a shared hierarchy with subordinate CAs per environment is the usual design. A CA can be disabled to stop issuance while remaining able to serve revocation information, and deleting a CA has a restorable window of up to 30 days.

Key terms: AWS Certificate Manager (ACM), ACM exportable public certificate, AWS Private Certificate Authority, Mutual TLS (mTLS)

Interactive checkpoint quiz (3 questions) — open this page in a browser to take it.