PKI - Amazon Web Services (AWS) | Encryption Consulting

Public Key Infrastructure on AWS runs through two services: AWS Certificate Manager (ACM) for public TLS certificates and ACM Private CA for an organization’s own certificate authority hierarchy. It matters because public certificate lifetimes are shrinking fast under new industry rules, down to 198 days as of February 2026 and on a path to 47 days by 2029, which makes manual certificate handling untenable. Recommended action: use ACM’s free automatic renewal for public certificates and ACM Private CA for internal PKI, and automate everything else now rather than after the next shortened validity period lands.

Key Takeaways

AWS Certificate Manager (ACM) issues and auto-renews public TLS certificates for integrated AWS services at no charge; ACM Private CA lets an organization run its own certificate authority hierarchy for internal use.
Public certificate validity dropped to a 198-day default on February 18, 2026, following the CA/Browser Forum’s mandate capping validity at 200 days from March 15, 2026, with further cuts to 100 days in March 2027 and 47 days in March 2029.
ACM Private CA offers two pricing modes: general-purpose ($400 per CA per month, any validity period) and short-lived certificate mode ($50 per CA per month, certificates capped at 7 days), plus per-certificate issuance fees.
ACM certificates cannot be exported by default; exportable public certificates and BYOK-imported certificates carry separate per-certificate fees on top of the underlying AWS resource costs.
IAM policies and CloudTrail logging govern and audit who can request, export, or manage certificates and private CAs, separately from the certificates themselves.

Published: August 2020. Updated: August 2026. Reviewed by Encryption Consulting’s PKI Services Team.

For a full operational best-practices treatment of ACM specifically, see AWS Certificate Manager (ACM) – Best Practices. For a deeper look at running your own CA hierarchy on AWS, see AWS Certificate Manager Private CA. For how PKI compares across clouds, see What is Cloud-based PKI Architecture?.

What Is PKI on AWS?

Public Key Infrastructure (PKI) on AWS is built around AWS Certificate Manager (ACM), the service that creates, manages, and deploys public and private SSL/TLS X.509 certificates and keys. Certificates authenticate the identity of a website or private resource and protect the data flowing to it. AWS-supported certificates can come from two paths: ACM issuing a public certificate directly, or an organization running its own private certificate authority through ACM Private CA and issuing certificates from it.

How Does Native vs. External Key Control Work for AWS PKI?

AWS PKI offers several models for how a certificate’s underlying key material is generated and held:

Model	How it works	Best fit
ACM public certificates (native)	AWS generates and manages the key pair and certificate; used with integrated services like CloudFront, Elastic Load Balancing, and API Gateway.	Public-facing websites and services with significant traffic that need free, auto-renewing certificates.
ACM Private CA, general-purpose (native)	An organization runs its own CA hierarchy inside AWS, with any certificate validity period.	Internal PKI for authenticating users, applications, services, and devices; certificates cannot be used on the public internet.
ACM Private CA, short-lived mode (native)	The same private CA hierarchy, restricted to certificates valid up to 7 days, at a lower monthly cost.	High-volume, ephemeral workloads (containers, service mesh) that reissue certificates frequently anyway.
Imported (BYOK) certificates	A third-party certificate and its key material are imported into ACM for use with integrated AWS services.	Organizations that already purchase certificates from an external CA and want AWS-side deployment automation.
External CA cross-signing / KMS External Key Store	A private CA’s root stays with an external, organization-controlled authority, or the encryption keys behind AWS KMS itself are held by an external key manager (XKS).	Regulated environments where a regulator or contract requires AWS never hold the authoritative root or key material.

Default to ACM’s free public certificates for anything internet-facing, and ACM Private CA for internal PKI; reserve BYOK or external cross-signing for a specific provenance or regulatory requirement.

How Should IAM Be Structured for AWS PKI?

Grant certificate request and export permissions separately, since exporting a certificate’s private key is a materially higher-risk operation than requesting one for use with an integrated service.
Scope ACM Private CA administrative permissions (creating or deleting a CA) to a small, dedicated group, separate from the broader set of identities allowed to request certificates from that CA.
Use resource-based policies on the private CA to control which accounts and services in an organization can issue certificates from it.
Review IAM policies granting ACM and Private CA permissions on the same cadence as other production access reviews.

What Are AWS Certificate Manager’s Current Certificate Characteristics?

Characteristic	Detail
Domain validation	ACM certificates are domain-validated; the subject field identifies a domain name, validated by email or DNS.
Validity period	198 days by default as of February 18, 2026 (previously 395 days), following the CA/Browser Forum’s 200-day cap effective March 15, 2026.
Managed renewal	ACM automatically renews eligible certificates, now roughly 45 days before expiry for the shorter validity period.
Browser and application trust	Trusted by all major browsers (Chrome, Edge, Firefox, Safari) and by Java.
Multiple domain names	Each certificate includes one Fully Qualified Domain Name (FQDN) with additional names addable.
Wildcard names	An asterisk (*) in the domain name protects multiple sites in the same domain with one certificate.
Supported algorithms	2048-bit and 4096-bit RSA (RSA_2048, RSA_4096), and Elliptic Curve P-256 and P-384 (EC_prime256v1, EC_secp384r1).

How Should You Handle Certificate Rotation and Renewal on AWS?

ACM’s automatic renewal handles the mechanics for integrated services, but the underlying validity period keeps shrinking on a published industry schedule, so a manual, calendar-based renewal process will not keep pace:

Date	Maximum public certificate validity
March 15, 2026	200 days (ACM’s own default moved to 198 days on February 18, 2026)
March 15, 2027	100 days
March 15, 2029	47 days

By 2029, a domain that renews manually today will need roughly eight times as many renewals per year. For certificates issued from ACM Private CA, short-lived certificate mode (7-day validity) is worth adopting deliberately for workloads that already reissue credentials frequently, such as containers and service mesh sidecars, rather than treating short lifetimes purely as an externally imposed constraint.

What Should You Log for AWS PKI?

AWS CloudTrail events for every certificate request, export, renewal, and private CA lifecycle action (create, delete, disable).
ACM Private CA audit reports, which list every certificate issued from a given CA for compliance review.
Certificate expiry and renewal-failure alerts from Amazon CloudWatch, so a renewal failure is caught before the certificate actually expires.

What Does AWS PKI Cost?

Public certificates provisioned through ACM for use with integrated AWS services are free; an organization pays only for the underlying AWS resources. Exportable public certificates cost $7 per Fully Qualified Domain Name and $79 per wildcard certificate, both reduced from $15 and $149 respectively alongside the February 2026 validity change. ACM Private CA is priced in two tiers: general-purpose mode at $400 per CA per month (any validity period) or short-lived certificate mode at $50 per CA per month (certificates capped at 7 days), plus per-certificate issuance fees that scale down at higher monthly volumes (as low as $0.001 each above 10,000 certificates a month for general-purpose, or a flat $0.058 each for short-lived mode). Confirm current rates against AWS’s own pricing pages before budgeting a large-scale private CA rollout.

What Does Multi-Cloud PKI Architecture Look Like?

Each major cloud runs its own certificate authority service (ACM Private CA on AWS, Certificate Authority Service on GCP, and integration with Key Vault-backed CAs on Azure), and none of them natively cross-issues or trusts another’s private CA hierarchy. A consistent multi-cloud PKI architecture either designates one cloud’s private CA as the root of trust that others subordinate to, or maintains an independent enterprise root outside any single cloud and issues subordinate CAs into each.

See What is Cloud-based PKI Architecture? for the full breakdown of how PKI architecture differs across AWS, GCP, and Azure.

What Are the Limitations of AWS PKI?

Certificates issued from ACM Private CA cannot be used on the public internet; they are valid only for internal authentication.
The industry-wide shift to shorter certificate validity periods means any manual certificate-management process will fall behind within the next few renewal cycles.
ACM Private CA’s general-purpose mode carries a materially higher flat monthly fee than short-lived mode, which needs to be weighed against actual validity-period needs.
ACM’s automatic renewal only applies to certificates used with integrated AWS services; exported certificates require the organization to manage renewal itself.

Decision Checklist: Choosing the Right AWS PKI Service

Use ACM’s free public certificates for anything internet-facing served through an integrated AWS service.
Stand up ACM Private CA for internal authentication of users, applications, services, and devices.
Choose general-purpose or short-lived Private CA mode based on the actual validity period your workloads need, not by default.
Automate certificate lifecycle management now, ahead of the 100-day cap arriving in March 2027.
Separate certificate-request permissions from certificate-export and private-CA-administration permissions in IAM.

What Would Encryption Consulting Recommend?

Most AWS customers we work with built their certificate processes around 90-day or annual renewal cycles that the 2026 validity cuts have already broken. Encryption Consulting’s PKI Services design and implement your ACM and ACM Private CA hierarchy, and our PKI-as-a-Service and CertSecure Manager automate certificate lifecycle management across AWS and every other environment you run, so the next validity cut is a non-event rather than a scramble.

Frequently Asked Questions

What is the difference between ACM and ACM Private CA?

ACM issues free, publicly trusted certificates for use with integrated AWS services. ACM Private CA lets an organization run its own certificate authority hierarchy for internal-only certificates, billed separately by the month plus per certificate.

How long are AWS public certificates valid now?

ACM’s default validity dropped to 198 days as of February 18, 2026, ahead of the CA/Browser Forum’s 200-day cap taking effect March 15, 2026. Further mandated cuts bring the maximum to 100 days in March 2027 and 47 days in March 2029.

How much does ACM Private CA cost?

General-purpose mode is $400 per CA per month for any validity period; short-lived certificate mode is $50 per CA per month for certificates capped at 7 days. Both add per-certificate issuance fees.

Can certificates issued by ACM Private CA be used on the public internet?

No. Private CA certificates are for internal authentication only; public-facing services need a publicly trusted certificate from ACM itself or another public CA.

Does AWS support BYOK or HYOK for PKI?

ACM supports importing third-party certificates and their key material (a BYOK-style model). For HYOK-equivalent custody of the encryption keys behind AWS services more broadly, AWS KMS supports External Key Store (XKS), which keeps the authoritative key material with an external key manager.

Need help automating your AWS certificate lifecycle ahead of the next validity-period cut? Talk to Encryption Consulting’s PKI Services team.