> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS private CA

> Learn how to issue and manage certificates using AWS Private Certificate Authority (PCA) with Infisical.

Issue and manage certificates using AWS Private Certificate Authority (PCA) for cloud-native private certificate management.

## Prerequisites

Before setting up AWS PCA integration, ensure you have:

* An AWS account with AWS Private CA service access
* An AWS Private CA in **ACTIVE** status
* An [AWS App Connection](https://infisical.com/docs/integrations/app-connections/aws.md) configured in Infisical with the required IAM permissions (see below)

### IAM permissions

Your AWS connection's IAM role or user needs the following permissions on your Private CA resource(s):

* `acm-pca:DescribeCertificateAuthority`
* `acm-pca:GetCertificateAuthorityCertificate`
* `acm-pca:IssueCertificate`
* `acm-pca:GetCertificate`
* `acm-pca:RevokeCertificate`

To scope permissions to a single CA, set the `Resource` to that CA's ARN:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificateAuthorityCertificate",
        "acm-pca:IssueCertificate",
        "acm-pca:GetCertificate",
        "acm-pca:RevokeCertificate"
      ],
      "Resource": "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/your-ca-id"
    }
  ]
}
```

To allow access to multiple CAs, list each ARN in the `Resource` array:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificateAuthorityCertificate",
        "acm-pca:IssueCertificate",
        "acm-pca:GetCertificate",
        "acm-pca:RevokeCertificate"
      ],
      "Resource": [
        "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/ca-id-1",
        "arn:aws:acm-pca:us-west-2:123456789012:certificate-authority/ca-id-2"
      ]
    }
  ]
}
```

> [!NOTE]
>
> Using a specific CA ARN in `Resource` is recommended over `"*"` to follow the principle of least privilege.

See the [AWS Connection](https://infisical.com/docs/integrations/app-connections/aws.md) page for full setup instructions.

## Complete workflow: From setup to certificate issuance

**1. Copy Your AWS PCA ARN**

In the AWS Console, navigate to **AWS Private CA** and select your certificate authority. Copy the **ARN** from the CA details page.

![Copy PCA ARN](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/aws-pca/aws-pca-copy-arn.png)

**2. Navigate to External Certificate Authorities**

In **Certificate Manager**, go to **Certificate Authorities** and scroll to the **External Certificate Authorities** section.

**3. Create New AWS PCA Certificate Authority**

Select **Create CA** and configure:

* **CA Type**: Choose **AWS Private CA (PCA)**
* **Name**: A slug name for this CA — lowercase letters, numbers, and hyphens only (e.g., "production-aws-pca")
* **AWS Connection**: Select your AWS connection from the dropdown
* **Certificate Authority ARN**: Paste the ARN copied from the previous step
* **Region**: Select the AWS region where your PCA is hosted

**4. Create a Certificate Profile**

Go to **Certificate Manager → Certificate Profiles** and create a profile with your AWS PCA CA as the issuing CA.

**5. Configure an Application and Issue a Certificate**

Create an [Application](https://infisical.com/docs/documentation/platform/pki/applications/overview.md), attach the profile, and configure an [enrollment method](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/overview). Then submit a certificate request from within the Application. The request will be sent to AWS PCA and the issued certificate will be available once the order completes.

## Issuing CA certificates

To issue a certificate with `CA:TRUE`, set **Basic Constraints** to allow CA certificates on the [Certificate Policy](https://infisical.com/docs/documentation/platform/pki/settings/policies.md), then tick **Issue as Certificate Authority** when requesting one.

AWS Private CA adds a few constraints:

* **Path length is required** on the request, and must be between `0` and `3`. There is no unlimited option.
* **Key usages are set by AWS** to digital signature, certificate signing and CRL signing, overriding the profile.
* The private CA in AWS must be in general-purpose mode, and its own path length must allow another CA beneath it.

## Troubleshooting

**CA Not in ACTIVE Status**

* AWS PCA must be in the **ACTIVE** state before Infisical can issue certificates. Verify the status in the AWS Console under **AWS Private CA**.

**IAM Permission Errors**

* Ensure your AWS connection's IAM role or user has the required `acm-pca:*` permissions scoped to the correct CA ARN. See the [IAM Permissions](#iam-permissions) section above.

**Invalid CA ARN**

* Double-check the ARN format: `arn:aws:acm-pca:<region>:<account-id>:certificate-authority/<ca-id>`.

**CA Certificate Rejected**

* Check the path length is between `0` and `3`, the policy's **Basic Constraints** allow CA certificates, and the CA is general-purpose. See [Issuing CA Certificates](#issuing-ca-certificates).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.