AWS Private Certificate Authority
Private CA for internal certificates
Create and operate a managed private certificate authority to issue internal X.509 certificates for services, IoT devices, and mTLS; the CA's keys live in AWS-managed HSMs.
- Cost$$$ High
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · SOA
Think of it asLike a company's own employee badge office instead of applying for government-issued papers.
When to use it
✓ Use it when
You need certificates for internal resources or mTLS between services.
✗ Avoid it when
Public certificates for websites → Certificate Manager (free).
Common uses
- mTLS between microservices
- Certificates for IoT devices
- Certificates for internal endpoints via ACM
What does it cost?
- Pricing model: Monthly fee per CA (short-lived mode is cheaper) plus a fee per certificate issued.
⚠️ Cost traps
A CA created for testing and forgotten still incurs the monthly fee.
