How manage a AWS Private CA in AWS Certificate Manager

Question

I created a Root Private CA in my AWS account. I want to manage it through AWS Certificate Manager, in order to have Lifecycle rules with notifications. I can't find relevant explanation in the official documentation. How can I do that?

Answer 1

You can use the AWS Private CA IssueCertificate API to create a certificate from your private CA. This API returns the ARN of the certificate, which you can use to retrieve the certificate by calling the GetCertificate API.

However, you cannot use ACM to manage the private CA itself, it is hidden away from you. You can only manage certificates that are imported into ACM or issued by ACM.

To import a certificate into ACM, you can use the ImportCertificate API or the AWS Management Console.

in order to have Lifecycle rules with notifications

ACM imported certificates do not support lifecycle rules. You can use CloudWatch Events to monitor ACM certificates, but you cannot use lifecycle rules to automatically delete or renew certificates. From Importing certificates into AWS Certificate Manager:

You are responsible for monitoring the expiration date of your imported certificates and for renewing them before they expire. You can simplify this task by using Amazon CloudWatch Events to send notices when your imported certificates approach expiration. For more information, see Using Amazon EventBridge.