AWS Certificate Management: ACM and Private CA

This guide covers the management of SSL/TLS certificates within AWS, focusing on AWS Certificate Manager (ACM) for public-facing resources and AWS Private Certificate Authority (Private CA) for internal security.

Learning Objectives

By the end of this guide, you should be able to:

• Distinguish between Public and Private Certificate Authorities (CAs).
• Identify the integration points for certificates in AWS (ALB, CloudFront, API Gateway).
• Describe the lifecycle of a certificate from request to deployment.
• Understand how to implement Encryption in Transit using ACM.

Key Terms & Glossary

• SSL/TLS (Secure Sockets Layer/Transport Layer Security): Protocols for establishing authenticated and encrypted links between networked computers.
• Certificate Authority (CA): A trusted entity that issues digital certificates, verifying the identity of the certificate holder.
• CSR (Certificate Signing Request): A block of encoded text that is given to a CA when applying for an SSL certificate.
• ACM (AWS Certificate Manager): A service to provision, manage, and deploy public and private SSL/TLS certificates.
• AWS Private CA: A managed private CA service that helps you easily and securely manage the lifecycle of your private certificates.
• CRL (Certificate Revocation List): A list of digital certificates that have been revoked by the issuing CA before their scheduled expiration date.

The "Big Idea"

[!IMPORTANT] The core mission of AWS Certificate Management is to establish Trust and Encryption in Transit.

Think of a certificate as a digital passport. Just as a government (CA) verifies your identity and issues a passport (Certificate) so you can travel safely, AWS ACM acts as the administrative office that issues these passports to your web servers. This ensures that when a user connects to your site, they know it is really your site and their data is encrypted during the journey.

Formula / Concept Box

Choosing the Right Management Tool

Hierarchical Outline

• I. Infrastructure for Encryption in Transit
  • Public Certificates: Used for traffic over the internet. Managed by ACM and trusted by browsers.
  • Private Certificates: Used for internal resource identification. Managed by AWS Private CA.
• II. Deployment Points
  • Elastic Load Balancing (ELB): Termination of HTTPS at the Application or Network Load Balancer.
  • Amazon CloudFront: Using certificates for custom domain names (e.g., api.example.com).
  • API Gateway: Assigning custom domains to REST/HTTP APIs.
• III. Certificate Lifecycle
  • Request/Import: Creating a new CSR or importing a 3rd-party cert into ACM.
  • Validation: Proving ownership of the domain via DNS CNAME records or email.
  • Renewal: ACM provides managed renewal for certificates it issues, provided DNS records remain in place.

Visual Anchors

Certificate Provisioning Flow

CA Hierarchy Visualization

Definition-Example Pairs

• Managed Renewal: The process where AWS automatically renews a certificate before it expires.
  • Example: A CloudFront distribution uses an ACM certificate for www.myapp.com. 60 days before expiry, ACM automatically validates the domain via DNS and replaces the cert without any manual intervention or downtime.
• Certificate Pinning: A security technique where an application only trusts a specific, predefined certificate.
  • Example: A mobile app is programmed to only communicate with a server that presents one specific certificate serial number, preventing "Man-in-the-Middle" attacks even if a CA is compromised.

Worked Examples

Example 1: Enabling HTTPS on an Application Load Balancer (ALB)

1. Request Certificate: Navigate to ACM in the AWS Console. Request a public certificate for example.com and *.example.com.
2. Validate: Choose DNS validation. ACM provides a CNAME record. Add this to your Route 53 hosted zone.
3. Configure Listener: Go to the EC2 Console > Load Balancers. Select your ALB.
4. Add Listener: Create a listener for HTTPS (Port 443).
5. Assign Cert: Under "Default SSL/TLS certificate," select the certificate from ACM.
6. Update Security Group: Ensure the ALB's security group allows inbound traffic on port 443.

Example 2: Configuring CloudFront for a Custom Domain

[!NOTE] To use an ACM certificate with CloudFront, the certificate must be requested in the us-east-1 (N. Virginia) region.

Checkpoint Questions

1. Which AWS service would you use to issue certificates for internal microservices that should NOT be trusted by public browsers?
2. Why must CloudFront certificates be created in the us-east-1 region specifically?
3. True or False: ACM automatically renews certificates imported from third-party providers (like DigiCert or GoDaddy).
4. What are the two methods ACM uses to validate domain ownership for a public certificate?

▶Click to see answers

1. AWS Private CA.
2. This is a technical requirement of the CloudFront global service architecture; the ACM store in us-east-1 is the only one CloudFront can access for distribution configs.
3. False. ACM only manages renewal for certificates it issues. Imported certificates must be manually updated.
4. DNS validation (preferred) and Email validation.