ACM Private Certificate Authority (ACM Private CA)

This workshop demonstrates how ACM Private Certificate Authority (PCA) service can be used to create a complete CA hierarchy, generate a private certificate, and apply the private certificate on an Application Load Balancer while following security best practices.

1. You will be using a AWS provided account for this workshop.

Setup Certificate Authority Hierarchy

2. An IAM Role called CaAdminRole is the role that a CA administrator would assume.

3. Build the infrastructure needed for creating a CA hierarchy by deploying the cloudformation template below

Please download the CF template by right clicking and save link as the filename template-ca-admin.yaml CA Admin Cloudformation Stack by right clicking and saving the yaml file on your laptop.

Upload and launch the cloudformation stack in the AWS account that you are logged into. If you are not familiar with this, follow instructions here by right clickking and opening link in a new browser tab Deploy Cloudformation Stack Instructions

4. Create a Root CA.

5. Create a Subordinate Issuing CA.

Create Application

7. An IAM Role called AppDevRole is the role that an application developer would assume.

8. Build the application infrastructure by deploying the cloudformation template below

Please download the CF template by right clicking and save link as the filename template-appdev.yaml AppDev Cloudformation Stack by right clicking and saving the yaml file on your laptop.

Upload and launch the cloudformation stack in your AWS account. If you are not familiar with this, follow instructions here by right clicking and opening link in a new browser tab Deploy Cloudformation Stack Instructions This cloudformation deployment takes about 3 minutes to complete.

9. Next step is to issue a private certificate to put on the application load balancer.

Open this link in a new browser tab for steps : Issue a private certificate

10. Attach a HTTPS listener and private certificate to the ALB.

Open this link in a new browser tab for steps : Attach HTTPS Listener

For Firefox: Validate Certificate Identity on Firefox Browser

For Google Chrome: Validate Certificate Identity on Chrome Browser

For Microsoft Edge: Validate Certificate Identity on Microsoft Edge Browser

For Google Chrome on Windows: Validate Certificate Identity on Windows

13. Cloud9 IDE environment setup

Security Monitoring:

In this section we will look at how to monitor privileged actions as you build your certificate management infrastructure. We will study two scenerios. The creation of a CA Certificate and mass revocation of end entity certificates.

14. [Scenerio 1]: Monitor Mass Revocation

This scenerio shows a developer revoking many end-entity certificates within a short period of time. We want to monitor and notify the security team if this type of privileged action takes place in order to investigate.

15. Create/Revoke End-Entity Certificates

First we will act as the Developer by creating and then revoking many certificates at once: Mass revocation

17. Mass Revocation Alarm Setup

Setup CloudWatch Alarms: Revocation Alarm setup

18. [Scenerio 2]: CA Certificate Created

Creating a CA Certificate is a privileged action that should only be taken by authorized personnel within the CA Hierarchy Management team. For this reason we want to monitor the creation of any CA Certificate within our hierarchy.

To do this we will setup a CloudWatch Alarm: CA Cert Alarm setup

20. Create Dashboard

Now we have two alarms that have produced ALARM states. This is due to our mass revocation of multiple certificates by the application developer and the creation of a CA Certificate upon creating our CA hierarchy. Organizations can use this mechanism to build dashboards to monitor and alert (SNS, Email, etc) when sensitive actions take place.

Create CloudWatch Dashboard: Create Dashboard

Advanced Section :

In this section we will learn about certificate extensions that can help you use certificates for applications beyond the common case of identifying TLS server endpoints. These include

What makes one certificate useful for signing code and another useful for terminating TLS are the extension fields in the certificate. Extension fields, or simply extensions, define the usage of the certificate. There are a few extensions defined in RFC 5280 that are widely commonly used and broadly supported, including

In this exercise let's create a codesigning certificate using the pre-built templates provided by ACM Private CA.

Follow these steps by right clicking and opening this link : Template ACM Private CA

Templates allow for constrained usage of certificates for specific usecases and IAM permissions can be used to control which principals - users or roles that can issue a specific kind of certificate.

Cleanup

AWS Event

Don't worry about cleanup, we will take care of it. Hopefully you've learned something useful in this workshop that you can take back your organization. Thank you for coming.

On Your Own

  1. Disable and delete Root CA and Subordinate CA
  2. Delete all three CloudFormation Templates

License Summary

This sample code is made available under a modified MIT license. See the LICENSE file.