AWS Private Certificate Authority review
A broad AWS-managed PKI service with clear CA pricing and usage-based certificate costs.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
AWS Private Certificate Authority is a hosted cloud service for creating root and subordinate private certificate authorities and issuing private X.509 certificates. It is designed for organizations managing certificates for internal servers, applications, users, devices, containers, IoT resources, Kubernetes clusters, and private networks. Administration is available through the AWS Management Console, API, CLI, and SDKs, with CA keys stored in AWS-managed hardware security modules. It is a particularly natural fit for teams already operating workloads and identity systems in AWS.
Pricing is divided between CA operation and certificate usage. General-purpose private CA operation costs $400 per private CA per month and supports certificates with any validity period. Short-lived certificate CA operation costs $50 per private CA per month and issues certificates valid for up to 7 days. General-purpose certificates cost $0.75 per certificate for 1–1,000, $0.35 for 1,001–10,000, and $0.001 for 10,001+. Short-lived certificates cost $0.058 per certificate. OCSP response generation costs $0.06 per certificate per month, while OCSP queries cost $0.2 per 100,000 queries. The first private CA in an AWS account and Region has a 30-day operation-charge waiver, although certificates issued during the trial are billed.
Its strongest case is breadth across common private PKI workflows: certificate profiles cover end-entity, CA, client-authentication, server-authentication, and code-signing certificates, while revocation works through CRLs and OCSP. Integrations include AWS Certificate Manager, Amazon EKS, Kubernetes cert-manager, Microsoft Intune, Jamf Pro, and Active Directory; connectors also support Kubernetes, Active Directory, and SCEP enrollment. Choose AWS Private CA when managed HSM-backed keys, API access, and AWS ecosystem integration matter. Teams seeking a free plan or a simpler, single-purpose certificate tool should look elsewhere.
Questions about AWS Private Certificate Authority
Does AWS Private Certificate Authority have a free plan? No free plan is listed; paid plans start at $0.06/unit/mo (OCSP response generation).
How much does AWS Private Certificate Authority cost? AWS Private Certificate Authority lists 8 paid plans; the lowest is OCSP response generation at $0.06/unit/mo.
Is there a free trial of AWS Private Certificate Authority? Yes: a 30-day free trial.
What does AWS Private Certificate Authority run on? Web. It runs in the cloud.
What does AWS Private Certificate Authority integrate with? 6 integrations, including AWS Certificate Manager, Amazon EKS, Kubernetes cert-manager, Microsoft Intune and Jamf Pro.
Who is AWS Private Certificate Authority built for? Mid-market companies and enterprises (our editorial estimate).
AWS Private Certificate Authority pros and cons
- Where it wins
- Root and subordinate CAs with CRL and OCSP revocation
- HSM-backed CA keys and certificate templates
- Connectors for Kubernetes, Active Directory, and SCEP
- Where it doesn't
- No free plan
- Usage charges make total costs more complex
- Best fit depends on the AWS ecosystem
AWS Private Certificate Authority fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update