Question

A company runs internal microservices on EC2 instances within a private VPC. Security policy requires all service-to-service communication to use TLS with certificates issued from a trusted internal certificate authority. The certificates must not be publicly trusted, and the company wants to automate issuance and renewal without managing its own CA infrastructure on servers. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Private CA (AWS Certificate Manager Private Certificate Authority) to issue certificates for internal services, integrating with ACM for automated renewal.

Answer

Request public certificates from AWS Certificate Manager (ACM) and distribute them to each internal service.

Answer

Deploy an OpenSSL-based CA on an EC2 instance and write cron jobs to issue and rotate certificates for each microservice.

Answer

Import self-signed certificates into ACM and reference them from each EC2 instance.