How to choose a PKI service

AWS offers two primary PKI services, ACM and AWS Private CA. Use the guidance here to help you decide which service to use for a given scenario.

When to use ACM

A public SSL/TLS certificate is required to authenticate the identity of your web server and establish a secure connection with any trustworthy host it might interact with. With ACM, you can easily create and manage public and private SSL/TLS certificates or import an external public certificate into your AWS environment.

When Do I Use It?

Use ACM when you need to create a new public certificate, renew a public certificate created with ACM, or import an existing public certificate into your AWS environment.

Use ACM to generate a private certificate and manage it within the same environment as your public certificates. You must first use AWS Private CA to establish a private CA from which private certificates can be validated. Private certificates created in ACM are bound by the following restrictions:

• They must use RSA-2048 keys and SHA-256 hashing.

• They must be renewed after 13 months.

• Their subject must be a DNS name.

When to use AWS Private CA

Private certificates are issued by a private CA and are exclusively used for authentication between entities within your organization. As a result, private certificates cannot be publically trusted. AWS Private CA lets you establish a private CA and use it to create and manage private certificates under its authority. Private certificates can be managed by AWS Private CA as a standalone service or in conjunction with ACM.

• Use AWS Private CA if you need to create an internal CA for further authentication operations.

• Use AWS Private CA if you need to generate a private certificate for internal entity authentication.

  Note

  ACM can also generate private certificates once a private CA has been established. But AWS Private CA gives you more control over the management and encryption protocols of those private certificates.