Certificates and Public Key Infrastructure (PKI) in AWS

This guide covers the implementation and management of SSL/TLS certificates using AWS Certificate Manager (ACM) and ACM Private CA, as required for the AWS Certified DevOps Engineer - Professional exam.

Learning Objectives

After studying this guide, you should be able to:

• Differentiate between Public, Private, and Imported certificates in ACM.
• Explain the Domain Validation process (DNS vs. Email).
• Design a Private CA hierarchy for internal organizational security.
• Configure automatic renewal and handle manual renewal for imported certificates.
• Integrate ACM certificates with services like CloudFront, ALB, and API Gateway.

Key Terms & Glossary

• X.509 v3: The standard format for public key certificates.
• FQDN (Fully Qualified Domain Name): The complete domain name for a specific host (e.g., www.example.com).
• CSR (Certificate Signing Request): A block of encoded text given to a CA to apply for a digital identity certificate.
• CRL (Certificate Revocation List): A list of digital certificates that have been revoked by the issuing CA before their scheduled expiration date.
• Chain of Trust: A hierarchical line of certificates that allows a relying party to trust a subscriber's certificate by following the path back to a trusted Root CA.

The "Big Idea"

In modern DevOps, security is not just a perimeter wall but a layer of Defense in Depth. PKI provides the mechanism for Encryption in Transit and Identity Verification. By automating certificate management through ACM, organizations eliminate the common operational risk of service outages caused by expired certificates, while maintaining a centralized, auditable control point for cryptographic identities.

Formula / Concept Box

Hierarchical Outline

• AWS Certificate Manager (ACM)
  • Public Certificates: Free, trusted by browsers, managed renewal.
  • Imported Certificates: Used for 3rd party CAs; no automatic renewal.
  • Service Integration: ALB, CloudFront (us-east-1), API Gateway, Elastic Beanstalk.
• ACM Private Certificate Authority (PCA)
  • Private Trust: Used for internal traffic; not trusted by browsers by default.
  • CA Hierarchy: Root CA (highly restricted) -> Subordinate CAs (bulk issuance).
  • Customization: Supports custom expiration dates and subject names.
• Validation Methods
  • DNS Validation: Uses CNAME records; preferred for automation and multi-domain certs.
  • Email Validation: Sends to 5 system addresses; requires manual click for each domain.

Visual Anchors

Certificate Validation Workflow (DNS)

PKI Trust Hierarchy

Definition-Example Pairs

• Root CA: The anchor of trust in a PKI.
  • Example: An organization creates a Root CA in ACM PCA that is kept offline, used only once a year to sign Subordinate CA certificates.
• Subordinate CA: A CA that sits below the Root CA and issues certificates to end-users or services.
  • Example: A "Development Environment CA" that issues short-lived certificates for internal microservices.
• SAN (Subject Alternative Name): An extension to X.509 that allows multiple domain names to be protected by a single certificate.
  • Example: A single certificate covering example.com, www.example.com, and shop.example.net.

Worked Examples

Scenario: Renewing an Imported Certificate

Problem: You have a certificate from an external CA (e.g., DigiCert) imported into ACM. It is expiring in 10 days. How do you handle this without downtime?

1. Detection: Since ACM cannot automatically renew imported certs, you must monitor the DaysToExpiry metric in CloudWatch or use AWS Config rules.
2. Request: Request a new certificate/renewal from your external provider (DigiCert).
3. Import: Use the ImportCertificate API or ACM Console to upload the new certificate body, private key, and certificate chain.
4. Association: Because the Certificate ARN remains the same if you re-import over the existing entry, the ALB/CloudFront distribution will pick up the new certificate automatically without manual re-association.

Checkpoint Questions

1. Why must a certificate used with CloudFront be requested in the us-east-1 region?
2. What is the main advantage of DNS validation over Email validation for a DevOps team using Infrastructure as Code (IaC)?
3. Can you download the private key of a Public certificate requested through ACM?
4. What service integration is required to monitor the expiration of imported certificates?

Muddy Points & Cross-Refs

• ACM vs. KMS: Don't confuse them! ACM manages SSL/TLS certificates (identity/transit). KMS manages symmetric/asymmetric keys for data encryption (at-rest).
• Private Key Access: You can never download the private key for ACM-managed public certificates. If you need the private key for an EC2-hosted web server (like Nginx), you must use ACM Private CA or import your own certificate.
• Cross-Reference: See "Unit 6: Security and Compliance" for how ACM interacts with AWS Shield and WAF for defense-in-depth.

Comparison Tables

DNS Validation vs. Email Validation

Public ACM Certs vs. Private PCA Certs