AWS Certificates vs. Public CA Certificates

What Is a Certificate Authority?

A certificate authority is an organization that issues digital certificates that authenticate and encrypt data, devices, and applications using PKI. They are essential for enabling widespread usage of public key cryptography. By keeping and disseminating the public keys linked to the matching private keys, they serve as trusted authorities.

Only particular domains that have sent a certificate signing request are granted certificates by CAs (CSR).  Organization, organizational unit, nation name, state, locality, and common name are frequently the distinguishing details. Usually, the location’s IP address or domain name serves as the common name.

Public Versus Private Certificate Authorities

Publicly trusted certificate authorities, as previously mentioned, are independent organizations that major web browsers have recognized as trustworthy and that adhere to the standards and policies for certificates set out by the CA/Browser Forum.

Public certificate authorities sign the certificates they issue using particular cryptographic keys. These particular key files are frequently identified as coming from a reliable CA. As a result, communications are quickly protected since people have confidence in it.

There are many parallels between private and public certificate authority. They carry out similar tasks and have comparable infrastructures. Private certificate authorities, however, only issue certificates for private networks, as opposed to public certificate authorities, which also issue certifications for entities on the entire Internet. Instead of a trusted third party, private certificate authorities create and verify certificate files that are uploaded to an internal public key infrastructure (PKI).

Browsers and programs instantly identify and trust certificates that are issued by public certificate authorities. With privately issued digital certificates, this is not the case.

Is AWS a CA?

A private, for-profit CA is called Amazon Web Services (AWS). It is not currently regarded as a trusted public certificate authority because it is not a member of the CA/Browser Forum. Customers of AWS can combine AWS Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, Amazon EC2 instance, and other integrated services that are administered by the AWS Management Console with ACM certificates. You can provision and maintain specific types of public and private certificates using ACM.

Before integrating certificates from private, it is critical to extensively research the issuer because your infrastructure will require significant changes in order to correctly accept any private certificates. Applications must also be expressly configured by an administrator to trust newly issued certificates. Uploading the certificate files to the AWS Identity and Access Manager is a vital step (IAM).

Does AWS Provide SSL Certificates?

AWS Certificate Manager (ACM) is able to provision, store, and renew both public and private SSL/TLS certificates complying with the X.509 standard. These can be accomplished with any Amazon service that ACM is integrated with. ACM automates renewing and updating of expiring ACM certificates. Some things to note about AWS server certificates:

• ACM does not provide extended validation certificates or organization validation certificates, only domain validation certificates
• ACM only provides certificates for the SSL/TLS protocols
• ACM cannot be used for email encryption

Does AWS Support Public CA Certificates?

ACM provided by the public CA, such as Sectigo Certificate Manager, can be used to deploy certificates from public CAs like Sectigo in AWS services.

It is important to note that Amazon only does domain validation for ACM certificates. On the other hand, there are three stages of validation available for SSL/TLS certificates issued by publicly recognized CAs.

Domain Validation (DV)

The CA confirms the applicant’s ownership of the requested domain name (typically through email verification). DV certifications can be provided in a matter of minutes with no further information vetting required.

Organization Validation (OV)

The CA not only confirms that the application has legal access to the requested domain name, but also makes additional, more fundamental inquiries about the applicant’s organization. For increased user trust, this information is made visible on the certificate.

Extended Validation (EV)

The CA will confirm the business owner(s), and the applicant(s) must produce acceptable ownership and company-related papers. Detailed research is conducted on the company in addition to confirming that the applicant has the necessary rights to the targeted domain, and the results are reflected on the certificate.

Read more on the different types of SSL certificates

Despite the fact that ACM provides some automation, IT teams frequently find themselves managing multiple automation services from different vendors due to the wide range of systems, applications, and devices that use digital certificates. As a result, efficiency frequently suffers. Instead, the efficiency promised by automation is achieved through a single certificate management dashboard that automates discovery, deployment, and lifecycle management across all use cases and vendor platforms.