AWS Private Certificate Authority

Plans and prices

Every plan, in full

On the record

Access controls

IAM policies can control who manages certificate authorities and who can issue or revoke certificates.aws.amazon.com · read 4 Oct 2026

Audit logging

AWS Private CA integrates with CloudTrail, which captures service API calls and can deliver log files to an Amazon S3 bucket.aws.amazon.com · read 4 Oct 2026

Automation

Certificate and CA management can be automated using APIs, AWS CLI commands, SDKs, and CloudFormation templates.aws.amazon.com · read 4 Oct 2026

CA connectors

The service offers connectors for Active Directory, Kubernetes, and SCEP; the pricing page says these connectors have no additional charge.aws.amazon.com · read 4 Oct 2026

CA hierarchy limit

AWS Private CA supports a hierarchy up to five tiers deep: a root, three subordinate CA levels, and one issuing CA.aws.amazon.com · read 4 Oct 2026

Company background

Amazon Web Services says it launched in 2006 and is part of Amazon.aws.amazon.com · read 4 Oct 2026

Integrations

The SCEP connector can work with mobile device management solutions such as Microsoft Intune and Jamf Pro.aws.amazon.com · read 4 Oct 2026

Key protection

AWS Private CA protects CA keys with AWS-managed hardware security modules that adhere to FIPS 140-2 security standards.aws.amazon.com · read 4 Oct 2026

Notable limitation

AWS Private CA does not currently support Merkle Tree Certificates.aws.amazon.com · read 4 Oct 2026

Operating modes

General-purpose mode supports any certificate validity period, while short-lived mode supports certificates valid for up to 7 days.aws.amazon.com · read 4 Oct 2026

Purpose

AWS Private CA is a managed service for issuing and managing private certificates and maintaining an organization's internal PKI.aws.amazon.com · read 4 Oct 2026

Resources protected

Certificates can identify and protect servers, applications, users, devices, and containers.aws.amazon.com · read 4 Oct 2026

Revocation

Customers can distribute certificate revocation information using OCSP, certificate revocation lists, or both.aws.amazon.com · read 4 Oct 2026

Support agreement

AWS states that AWS Private CA has a service level agreement.aws.amazon.com · read 4 Oct 2026

Alternatives to AWS Private Certificate Authority

E EJBCAWebWindows+4 E EZCAAndroidiPhone & iPad+6 LS Let's EncryptWebWindows+4 KC KeyTalk CKMSAndroidiPhone & iPad+6 SC step-caWindowsMac+3 OP OpenCA PKIWebWindows+3 O OpenXPKIWebLinux+2 X XiPKIMacLinux+2

Every alternative, ranked