AWS recently announced root certificate authority (CA) hierarchies for AWS Certificate Manager (ACM) Private CA. CA administrators can now quickly and easily create a complete CA hierarchy, including root and subordinate CAs, with no need for external CAs. In this presentation, we provide an overview of ACM Private CA and discuss some common use cases, such as issuing private certificates in order to identify devices. You learn how to create a two-level CA hierarchy and use it to issue private certificates. You also learn security best practices for creating and managing a CA hierarchy, and you have a chance to ask questions.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Root CA hierarchies for AWS Certificate
Manager (ACM) Private CA
Todd Cignetti
Principal Product Manager
AWS
F N D 3 2 0
Ram Ramani
Security Solutions Architect
AWS

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
• Challenges of operating a public key infrastructure
• ACM Private Certificate Authority (CA)
• Use cases
• Demonstration
• Planning CA hierarchy
• Best practices
• Questions & answers

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Challengesof operating private certificate authorities
• Security, accountability, and availability issues
• Require infrastructure and security expertise
• Complex
• Expensive

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
ACM Private CA
Secure and managed
private CA service
Manage certificates centrally
Enable developer agility
Pay-as-you-go pricing
Flexibility to customize
private certificates
Subordinate CAs

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Root CA hierarchies for ACM Private CA
Root CA and complete
CA hierarchies
CA administrators can now create a complete CA hierarchy,
including root and subordinate CAs, with no need for external CAs

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Before ACM Private CA hierarchies
• Subordinate issuing CA with existing
(external) intermediate and root CA
• Issuing CA used for bulk issuance of end-
entity certificates
Certificate
signing
request
Signed
CA
certificate
Root CA
End-entity
certificates
Existing CA infrastructure
Intermediate
CA certificate
Root CA
certificate
Intermediate CA
Issuing CA

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
ACM Private CA hierarchies
• Complete CA hierarchy, including root CA
• Third-party external CA is now optional
Certificate
signing
request
Signed
CA
certificate
Root CA
End-entity
certificates
Intermediate
CA certificate
Root CA
certificate
Intermediate CA
Issuing CA

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why create a CA hierarchy?
• Restrict access to the root CA
• Grant more permissive access to subordinate CAs
• Delegate subordinate CAs for different applications/groups
• Audit and generate alarms for every certificate issued by root
• Audit random samples of bulk certificates issued by subordinates

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
What can end-entity certificates identify?
• TLS endpoints and resources
• IPSec VPN endpoints
• Dynamic cloud resources
• IoT devices

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Use cases
• Replace software/server-based CAs
• Replace offline root CA
• Complement an existing root CA
Identify cloud resources for dev/test/production with a cloud-hosted CA infrastructure
and APIs

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
CA configuration
When you create a CA, think about
• Key types and sizes
RSA 2048, RSA 4096, ECDSA P256, ECDSA P384
• Revocation configuration
• AWS CloudTrail logging of API calls
• Amazon CloudWatch metrics – alarms and notifications
• Audit reporting
• Access policies
• CA lifecycle management

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Offline vs. online root CA
• Physical access controls and isolation
• One or more operators open the vault
• Perform signing ceremony to use the CA
• No network access
Offline CA – physical HSM, network-disconnected, stored in a vault (typically)
Best choice depends on your requirements and internal policies
• Logical access controls and isolation
• Faster signing (important if a CA certificate expires)
• Easier management
• Doesn’t require physical presence

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Logical access controls and isolation
• Account separation
• Access controls
• IAM-managed policies
• Disable CAs by default
• Custom policies for two-person control
• Auditing and logging
• Alarm on certificate issuance for root CAs
• Careful review of each certificate issued by root and other top-level CAs

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
{
"Effect": "Allow",
"Action": [
"acm-pca:IssueCertificate"
],
"Resource": "arn:aws:acm-
pca:*:*:certificate-authority/*",
"Condition": {
"StringLike": {
"acm-pca:TemplateArn": [
"arn:aws:acm-
pca:::template/*CACertificate*/V*"
]
}
}
},
{
"Effect": "Deny",
"Action": [
"acm-pca:IssueCertificate"
],
"Resource": "arn:aws:acm-
pca:*:*:certificate-authority/*",
"Condition": {
"StringNotLike": {
"acm-pca:TemplateArn": [
"arn:aws:acm-
pca:::template/*CACertificate*/V*"
]
}
}
},
PrivilegedUser managed policy

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
CA hierarchy
• Use path length constraint to limit CA height
• Reduce height when possible
• Shorter chains reduce processing overhead
• Use minimum tree height that meets your goals

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Choosing CA validity period
Issuing CA validity period must be >= lifetime of issued certificates
Issuing CA
replace replace
End-entity
certificate
Root CA
replace
replace

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Operations
• Distributing root certificates/keys to trust stores
• Revocation and vending status information
• Redundancy/disaster recovery

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Questions

23. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Todd Cignetti
@Todd_Cignetti
Ram Ramani
@rramani