AWS Private Certificate Authority
AWS Private Certificate Authority is a managed cloud service for creating and operating an organization’s internal PKI.
What AWS Private Certificate Authority is
AWS Private Certificate Authority is a managed cloud service for creating and operating an organization’s internal PKI. Certificates can identify and protect servers, applications, users, devices, and containers. General-purpose certificate authorities allow any validity period, while short-lived mode issues certificates valid for up to seven days. APIs, AWS CLI commands, SDKs, and CloudFormation templates can automate certificate and authority management. Connectors support Active Directory, Kubernetes, and SCEP, with SCEP integrations available for mobile management tools such as Microsoft Intune and Jamf Pro. AWS-managed hardware security modules protect CA keys under FIPS 140-2 standards. IAM policies govern authority administration and certificate issuance or revocation. OCSP and certificate revocation lists distribute revocation data, while CloudTrail records API calls and can send logs to Amazon S3. Hierarchies can reach five tiers.
Good
- Supports general-purpose and short-lived certificates
- Automates management through AWS interfaces
- Connectors cover Active Directory, Kubernetes, and SCEP
- CA keys use FIPS 140-2 HSMs
- CloudTrail records service API calls
Watch out
- No free plan
- Issued certificates cost extra during trial
- Does not support Merkle Tree Certificates
- General-purpose CA operation is $400.00/mo
Who it suits
AWS Private CA suits organizations needing internal certificates for people, systems, devices, or containers. It is useful for teams automating PKI through AWS tools and connectors.
Verdict
AWS Private CA offers centralized private certificate issuance with automation, access controls, revocation options, and AWS integrations. Its pricing separates authority operation from certificate issuance, so both should be considered.
Plans and prices
From AWS Private Certificate Authority's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| 30-day CA operation trial | Free | CA operation only · Issued certificates still incur charges · First 30 days for the first private CA created in each account and Region |
| Short-lived private certificates | $0.06, paid once | Short-lived certificate mode CA · 1+ certificates · Per certificate issued |
| General-purpose private certificates | $0.75, paid once | General-purpose mode CA · Per certificate issued; calendar-month tiers per Region: 1–1,000 $0.75 each, 1,001–10,000 $0.35 each, 10,001+ $0.001 each |
| Short-lived certificate mode CA operation | $50 a month | Certificates valid up to 7 days · Certificate issuance charged separately · Per private CA; prorated for partial months |
| General-purpose mode CA operation | $400 a month | Can issue certificates with any validity period · Certificate issuance charged separately · Per private CA; prorated for partial months |
The facts
Each one read from AWS Private Certificate Authority's own pages, with the date it was checked.
What it does
- Access controls
- IAM policies can control who manages certificate authorities and who can issue or revoke certificates.checked 4 Oct 2026
- Audit logging
- AWS Private CA integrates with CloudTrail, which captures service API calls and can deliver log files to an Amazon S3 bucket.checked 4 Oct 2026
- Automation
- Certificate and CA management can be automated using APIs, AWS CLI commands, SDKs, and CloudFormation templates.checked 4 Oct 2026
- CA connectors
- The service offers connectors for Active Directory, Kubernetes, and SCEP; the pricing page says these connectors have no additional charge.checked 4 Oct 2026
- CA hierarchy limit
- AWS Private CA supports a hierarchy up to five tiers deep: a root, three subordinate CA levels, and one issuing CA.checked 4 Oct 2026
- Integrations
- The SCEP connector can work with mobile device management solutions such as Microsoft Intune and Jamf Pro.checked 4 Oct 2026
- Key protection
- AWS Private CA protects CA keys with AWS-managed hardware security modules that adhere to FIPS 140-2 security standards.checked 4 Oct 2026
- Notable limitation
- AWS Private CA does not currently support Merkle Tree Certificates.checked 4 Oct 2026
- Operating modes
- General-purpose mode supports any certificate validity period, while short-lived mode supports certificates valid for up to 7 days.checked 4 Oct 2026
- Purpose
- AWS Private CA is a managed service for issuing and managing private certificates and maintaining an organization's internal PKI.checked 4 Oct 2026
- Resources protected
- Certificates can identify and protect servers, applications, users, devices, and containers.checked 4 Oct 2026
- Revocation
- Customers can distribute certificate revocation information using OCSP, certificate revocation lists, or both.checked 4 Oct 2026
- Support agreement
- AWS states that AWS Private CA has a service level agreement.checked 4 Oct 2026
The company
- Company background
- Amazon Web Services says it launched in 2006 and is part of Amazon.checked 4 Oct 2026
Alternatives to AWS Private Certificate Authority
- 1
EJBCA
Free planOpen sourceWebAPILinuxmacOS8.2From £62,065 a year - 2
KeyTalk CKMS
AndroidiOSWebAPI7.7From €5 a month - 3
Let's Encrypt
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 4
OpenCA PKI
Free planOpen sourceWebLinuxmacOSSelf-hosted7.4Free plan - 5
step-ca
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 6
EZCA
AndroidiOSWebAPI7.0From $200 a month