Question

A company runs an internal microservices platform on EC2 behind an internal Application Load Balancer. Security requires all service-to-service traffic to use TLS with certificates that automatically renew, are trusted only within the corporate network, and never need to be publicly resolvable or validated through DNS/email challenges. The solution must minimize operational overhead for certificate issuance and rotation. What should the security engineer implement?

Accepted Answer

Set up AWS Private CA (ACM Private Certificate Authority), issue private certificates through ACM for the internal ALB, and let ACM manage automatic renewal.

Answer

Request public certificates from AWS Certificate Manager (ACM) for each service and attach them to the internal ALB, relying on ACM managed renewal.

Answer

Store self-signed certificates in AWS Secrets Manager and use a Lambda rotation function to regenerate and redeploy them to each service every 90 days.

Answer

Purchase certificates from a third-party public CA, import them into ACM, and configure Amazon EventBridge to alert 30 days before expiration so they can be manually reimported.