Freedom251 › Public Key Infrastructure Software
AWS Private Certificate Authority
Visit AWS Private Certificate Authority Alternatives Pricing
What AWS Private Certificate Authority is
AWS Private Certificate Authority is a managed cloud service for creating and operating an organization’s internal PKI. It issues private certificates that can identify and protect servers, applications, users, devices, and containers. General-purpose mode allows any certificate validity period, while short-lived mode supports certificates valid for up to seven days. APIs, AWS CLI commands, SDKs, and CloudFormation templates can automate certificate-authority and certificate administration. Connectors are provided for Active Directory, Kubernetes, and SCEP, with no additional connector charge stated; SCEP can work with Microsoft Intune and Jamf Pro. AWS-managed hardware security modules protect CA keys under FIPS 140-2 standards. IAM policies govern authority management and certificate issuance or revocation. Revocation information can use OCSP, certificate revocation lists, or both, while CloudTrail records API calls for delivery to Amazon S3. Hierarchies can reach five tiers. Pricing starts at $50/mo, with a 30-day trial.
Who it suits
It suits organizations managing internal certificates and PKI across servers, applications, devices, containers, or users. Teams using Kubernetes, Active Directory, SCEP, or AWS automation can use its connectors and APIs.
What it does well
- Supports general-purpose and short-lived certificates
- Automation through APIs, CLI, SDKs, and CloudFormation
- Connectors for Active Directory, Kubernetes, and SCEP
- HSM protection follows FIPS 140-2 standards
- OCSP and certificate revocation list support
What to know first
- No free plan
- General-purpose CA operation costs $400.00 per month
- Hierarchy limited to five tiers
- Does not support Merkle Tree Certificates
Limits
The first private CA in each account and Region receives 30 days of CA-operation credit, but issued certificates still incur charges. Short-lived certificates are limited to seven-day validity, while general-purpose CA operation costs $400 per month and short-lived CA operation costs $50 per month.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| 30-day CA operation trial | First 30 days for the first private CA created in each account and Region · CA operation only · Issued certificates still incur charges | Free |
| Short-lived private certificates | Per certificate issued · Short-lived certificate mode CA · 1+ certificates | $0.06, paid once |
| General-purpose private certificates | Per certificate issued; calendar-month tiers per Region: 1–1,000 $0.75 each, 1,001–10,000 $0.35 each, 10,001+ $0.001 each · General-purpose mode CA | $0.75, paid once |
| General-purpose mode CA operation | Per private CA; prorated for partial months · Can issue certificates with any validity period · Certificate issuance charged separately | $400 a month |
| Short-lived certificate mode CA operation | Per private CA; prorated for partial months · Certificates valid up to 7 days · Certificate issuance charged separately | $50 a month |
As aws.amazon.com lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Open the AWS Private CA website
- Choose short-lived or general-purpose CA operation
- Create the first private CA in your AWS account and Region
- Configure administration with APIs, CLI, SDKs, or CloudFormation
- Add an Active Directory, Kubernetes, or SCEP connector if needed
- Set IAM policies and revocation distribution methods
Verdict
AWS Private Certificate Authority combines managed internal PKI operations with automation, access controls, revocation options, and integrations. Its paid CA operation and certificate charges should be considered alongside the available trial.
Questions
Is AWS Private CA free?
There is no free plan. A 30-day CA-operation trial is listed for the first private CA in each account and Region, while issued certificates are charged.
What does AWS Private CA cost?
Short-lived CA operation is $50 a month, and general-purpose CA operation is $400 a month. Certificate issuance is charged separately, with listed per-certificate prices.
Which platforms are supported?
AWS Private CA is available through API and web interfaces and uses a cloud deployment model.
Can certificate management be automated?
Yes. APIs, AWS CLI commands, SDKs, and CloudFormation templates can automate CA and certificate management.
Does it integrate with device management?
Its SCEP connector can work with mobile device management solutions such as Microsoft Intune and Jamf Pro.
How deep can the CA hierarchy be?
The supported hierarchy is five tiers: one root, three subordinate CA levels, and one issuing CA.
Facts from AWS Private Certificate Authority's own pages
- Access controls
- IAM policies can control who manages certificate authorities and who can issue or revoke certificates. · aws.amazon.com, 4 Oct 2026
- Audit logging
- AWS Private CA integrates with CloudTrail, which captures service API calls and can deliver log files to an Amazon S3 bucket. · aws.amazon.com, 4 Oct 2026
- Automation
- Certificate and CA management can be automated using APIs, AWS CLI commands, SDKs, and CloudFormation templates. · aws.amazon.com, 4 Oct 2026
- CA connectors
- The service offers connectors for Active Directory, Kubernetes, and SCEP; the pricing page says these connectors have no additional charge. · aws.amazon.com, 4 Oct 2026
- CA hierarchy limit
- AWS Private CA supports a hierarchy up to five tiers deep: a root, three subordinate CA levels, and one issuing CA. · aws.amazon.com, 4 Oct 2026
- Company background
- Amazon Web Services says it launched in 2006 and is part of Amazon. · aws.amazon.com, 4 Oct 2026
- Integrations
- The SCEP connector can work with mobile device management solutions such as Microsoft Intune and Jamf Pro. · aws.amazon.com, 4 Oct 2026
- Key protection
- AWS Private CA protects CA keys with AWS-managed hardware security modules that adhere to FIPS 140-2 security standards. · aws.amazon.com, 4 Oct 2026
- Notable limitation
- AWS Private CA does not currently support Merkle Tree Certificates. · aws.amazon.com, 4 Oct 2026
- Operating modes
- General-purpose mode supports any certificate validity period, while short-lived mode supports certificates valid for up to 7 days. · aws.amazon.com, 4 Oct 2026
- Purpose
- AWS Private CA is a managed service for issuing and managing private certificates and maintaining an organization's internal PKI. · aws.amazon.com, 4 Oct 2026
- Resources protected
- Certificates can identify and protect servers, applications, users, devices, and containers. · aws.amazon.com, 4 Oct 2026
- Revocation
- Customers can distribute certificate revocation information using OCSP, certificate revocation lists, or both. · aws.amazon.com, 4 Oct 2026
- Support agreement
- AWS states that AWS Private CA has a service level agreement. · aws.amazon.com, 4 Oct 2026
Where AWS Private Certificate Authority stands on Freedom251
- Public Key Infrastructure Software#12 of 26