Skip to content
SPECIFICTION
Get listed

AWS Private Certificate Authority

aws.amazon.com

From $50/mo Free trial WebAPI
Visit aws.amazon.com
Spec score 8.3 #6 of 26 in Public Key Infrastructure Software

Spec sheet

Purpose
AWS Private CA is a managed service for issuing and managing private certificates and maintaining an organization's internal PKI.Read 4 Oct 2026 · aws.amazon.com
Integrations
The SCEP connector can work with mobile device management solutions such as Microsoft Intune and Jamf Pro.Read 4 Oct 2026 · aws.amazon.com
Access controls
IAM policies can control who manages certificate authorities and who can issue or revoke certificates.Read 4 Oct 2026 · aws.amazon.com
Audit logging
AWS Private CA integrates with CloudTrail, which captures service API calls and can deliver log files to an Amazon S3 bucket.Read 4 Oct 2026 · aws.amazon.com
Automation
Certificate and CA management can be automated using APIs, AWS CLI commands, SDKs, and CloudFormation templates.Read 4 Oct 2026 · aws.amazon.com
CA connectors
The service offers connectors for Active Directory, Kubernetes, and SCEP; the pricing page says these connectors have no additional charge.Read 4 Oct 2026 · aws.amazon.com
CA hierarchy limit
AWS Private CA supports a hierarchy up to five tiers deep: a root, three subordinate CA levels, and one issuing CA.Read 4 Oct 2026 · aws.amazon.com
Company background
Amazon Web Services says it launched in 2006 and is part of Amazon.Read 4 Oct 2026 · aws.amazon.com
Key protection
AWS Private CA protects CA keys with AWS-managed hardware security modules that adhere to FIPS 140-2 security standards.Read 4 Oct 2026 · aws.amazon.com
Notable limitation
AWS Private CA does not currently support Merkle Tree Certificates.Read 4 Oct 2026 · aws.amazon.com
Operating modes
General-purpose mode supports any certificate validity period, while short-lived mode supports certificates valid for up to 7 days.Read 4 Oct 2026 · aws.amazon.com
Resources protected
Certificates can identify and protect servers, applications, users, devices, and containers.Read 4 Oct 2026 · aws.amazon.com
Revocation
Customers can distribute certificate revocation information using OCSP, certificate revocation lists, or both.Read 4 Oct 2026 · aws.amazon.com
Support agreement
AWS states that AWS Private CA has a service level agreement.Read 4 Oct 2026 · aws.amazon.com

Plans and prices

30-day CA operation trial Free First 30 days for the first private CA created in each account and Region CA operation only · Issued certificates still incur charges Read 4 Oct 2026 · aws.amazon.com
Short-lived private certificates $0.06, paid once Per certificate issued Short-lived certificate mode CA · 1+ certificates Read 4 Oct 2026 · aws.amazon.com
General-purpose private certificates $0.75, paid once Per certificate issued; calendar-month tiers per Region: 1–1,000 $0.75 each, 1,001–10,000 $0.35 each, 10,001+ $0.001 each General-purpose mode CA Read 4 Oct 2026 · aws.amazon.com
Short-lived certificate mode CA operation $50 a month Per private CA; prorated for partial months Certificates valid up to 7 days · Certificate issuance charged separately Read 4 Oct 2026 · aws.amazon.com
General-purpose mode CA operation $400 a month Per private CA; prorated for partial months Can issue certificates with any validity period · Certificate issuance charged separately Read 4 Oct 2026 · aws.amazon.com

Every AWS Private Certificate Authority plan and price →

Where Specifiction places it

Alternatives to AWS Private Certificate AuthorityAll alternatives →