TLS and Certificate Management

What it is

Transport Layer Security (TLS) encrypts data between a client and a server and lets the client check the server's identity with a certificate. For data in transit, the security design decides where TLS starts and ends, who issues the certificates, and how to force clients to use it.

AWS Certificate Manager (ACM) issues and manages certificates for AWS services. AWS Private Certificate Authority (Private CA) issues certificates for internal systems.

How it works

ACM public certificates

ACM issues public certificates for domain names you prove you control. Use them with integrated services such as Elastic Load Balancing, CloudFront and API Gateway. ACM keeps the private key, so you never handle the key file for these certificates.

# AWS CLI: request a certificate validated through DNS
aws acm request-certificate \
  --domain-name example.com \
  --subject-alternative-names "*.example.com" \
  --validation-method DNS

Validation proves domain control.

ACM renews certificates it issued automatically, as long as they are in use with an integrated service and the validation record is still present. An imported certificate is not renewed by ACM, so you must replace it before it expires. ACM publishes expiry events to EventBridge, and you can alarm on days to expiry with Config or CloudWatch.

Where certificates must live

A certificate is Regional, so request it in the same Region as the load balancer or API.

For CloudFront, request it in us-east-1. An Application Load Balancer can hold several certificates on a listener and picks one using SNI (Server Name Indication).

Private CA

AWS Private CA lets you run your own certificate authority hierarchy without managing hardware. Use it for internal services, mutual TLS (mTLS) between microservices, devices, and Kubernetes workloads.

• Build a root CA and subordinate CAs, and use the root only to sign the subordinates.
• Issue short lived certificates to reduce the damage from key exposure.
• Publish revocation through a certificate revocation list (CRL) or OCSP (Online Certificate Status Protocol).
• Share a CA with other accounts through AWS Resource Access Manager (RAM).
• Private CA certificates can be exported to servers you manage, and certificates for ACM integrated services can also come from a private CA.

Clients must trust the private root. Distribute the root certificate to them through your management tooling.

Choosing

Enforcing encryption in transit

Turning TLS on is not enough, because clients can still choose plain connections unless you refuse them.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyInsecureTransport",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::amzn-s3-demo-bucket", "arn:aws:s3:::amzn-s3-demo-bucket/*"],
    "Condition": { "Bool": { "aws:SecureTransport": "false" } }
  }]
}

This bucket policy denies any request not made over HTTPS. The same condition key works in policies for other resources, such as SQS and SNS.

End to end encryption

When a load balancer terminates TLS, traffic from the load balancer to the target is plain unless you re-encrypt. For sensitive data, use HTTPS to the target, or use an NLB TCP listener for passthrough. The target certificate can be self signed on an ALB, because the ALB does not validate it, but a mutual TLS design should use a private CA.

Troubleshooting certificates

• Status stuck at pending validation means the DNS CNAME is missing or in the wrong zone.
• The certificate is not listed for CloudFront because it was requested outside us-east-1.
• Clients report a name mismatch when the domain is not in the certificate's names.
• A certificate in a failed state could not be validated within the allowed time.
• Imported certificates expire quietly, so set an alarm.