AWS History and Timeline regarding AWS Private Certificate Authority - Overview, CA Modes and Connectors, Features, Summary of Updates, and Introduction to AWS Private CA

First Published: 2026-10-13
Last Updated: 2026-10-13

When operating an internal PKI with AWS Private CA for an extended period, assumptions made at the time of initial design, reflected in documentation, code, and IAM policies, often remain. The service was originally named ACM Private CA, with the root CA located outside of AWS, while only subordinate CAs were hosted within AWS. Certificate revocation was communicated via CRL. However, the AWS Private CA documentation as of October 13, 2026, indicates that the service name, the CA hierarchy that can be created, and the methods for communicating revocation have all changed. It is difficult to determine precisely which of these assumptions remained valid and for how long, based on a single document.

AWS Private CA was initially launched on April 4, 2018, as a feature of AWS Certificate Manager (ACM). At that time, it was named ACM Private CA, and AWS only supported hosting subordinate CAs. On June 20, 2019, the service gained the ability to create hierarchies including the root CA. On September 3, 2021, AWS-managed OCSP functionality was added. The service was renamed to AWS Private Certificate Authority on September 28, 2022, and a mode for issuing short-lived certificates was introduced on October 26, 2022. Subsequently, a connector for Active Directory (released August 29, 2023), a connector for SCEP (preview released June 11, 2024, generally available September 16, 2024), and an Amazon EKS add-on for the Kubernetes connector (released June 4, 2025) were released. On November 10, 2025, the service gained the ability to issue certificates using ML-DSA. Finally, on October 5, 2026, a detailed record of each certificate issuance, the IssueCertificateDetails event, was added to AWS CloudTrail.

This article is a timeline of what AWS Private CA added, with the name on that date and the source of each row's date. The timeline aims to answer two questions: first, when and as what the ACM Private CA name, the modes, and the connectors in your materials appeared, and where they fit in today's AWS Private CA; and second, which source gives each date, and which rows have different dates in different sources.

Based on what the primary sources state, the answers are as follows. From April 4, 2018, to September 28, 2022, the service was referred to as AWS Certificate Manager Private Certificate Authority in most What's New titles and as ACM Private CA and other names in the body of the announcements. Following the name change, it is now referred to as AWS Private Certificate Authority (AWS Private CA). The Document history includes rows where the updated name is used for entries originally dated before the name change, alongside entries that still use the older name. Therefore, this article uses names sourced from the What's New section and blog posts. Furthermore, the What's New and Document history sections record different dates for 13 events. The name change is documented as September 27, 2022, in the Document history, but as September 28, 2022, in What's New. The introduction of AWS-managed OCSP is recorded as August 18, 2021, in the Document history, but as September 3, 2021, in What's New. Additionally, ten events occurring from 2025 onwards, including those related to ML-DSA and IssueCertificateDetails, are announced in What's New but lack corresponding entries in the Document history. This article presents a table, "Where the Dates Differ," which lists these discrepancies, organized by source material.

This article focuses solely on the dates, order, names, and sources related to the addition of AWS Private CA features. It does not cover pricing. The design of CA hierarchies, the design of revocation, and limitations of short-lived certificate mode are discussed in AWS Private CA Hierarchy Design. The methods for distributing certificates in Kubernetes and the status of connectors for SCEP are detailed in Certificate Distribution in Kubernetes with AWS Private CA. The identifiers left behind after the rename are covered in AWS Service Renames Reference. This article keeps the rows for these topics short and leaves the details to those articles.

Background and Method of Creating AWS Private CA Historical Timeline

This section first outlines the sources used for each entry in the timeline and explains how the dates, names, and types of entries were determined. All sources were accessed on October 13, 2026.

The Primary Sources This Article Used, and What It Made into Entries

The entries in the timeline were drawn from the following primary sources:

What's New — This article gathered announcements carrying the tag and those found through a full-text search (using terms such as Private Certificate Authority, Private CA, Connector for SCEP, and acm-pca). As of October 13, 2026, there were 57 announcements with titles containing the name AWS Private CA (including previous names). The oldest announcement is dated April 4, 2018, and the most recent is dated October 5, 2026. This article used the publication date (postDateTime) of What's New as the date. Three announcements, including those from April 4, 2018, redirected to https://aws.amazon.com/about-aws/ when accessed on October 13, 2026. These three were read from the title, body, and postDateTime of the What's New listings.
AWS Private CA User Guide – Document history — This section is divided into two tables. The first table (51 rows) follows the text The following table describes significant changes to this documentation since January 2018. The oldest entry is dated June 20, 2018, and the most recent is September 30, 2026. The second table (1 row) is labeled Earlier Updates and follows the text The following table describes the documentation release history of AWS Private Certificate Authority before June 2018. In both tables, the columns are Change, Description, and Date, in that order, and the date of each row is at the end of the row.
ACM User Guide – Document history — This article used two entries related to AWS Private CA (from April 4, 2018, and August 17, 2020). These two entries are equivalent to the information found at AWS History and Timeline regarding AWS Certificate Manager.
AWS News Blog and AWS Security Blog — This article used an announcement from the AWS News Blog, dated April 4, 2018, regarding the service launch, and an article from the AWS Security Blog, dated November 26, 2025, concerning partitioned CRLs.
AWS Private CA User Guide – Individual Pages and API Reference — These resources were used to verify the state of the information as of the verification date.

The changes documented include updates related to the CA hierarchy and modes, connectors, revocation methods, key algorithms and key protection, monitoring and auditing, cross-account sharing, connection methods such as AWS PrivateLink and IPv6, name changes, limit modifications, and availability in the AWS GovCloud (US) and China Regions. Announcements regarding expansion to other regions (8 instances between 2018 and 2022) were not included. Similarly, changes that only modified the documentation's wording (such as three lines describing CRLs on 2026-09-29 and 2026-09-30, and additions to the troubleshooting section), as well as the entry from 2019-03-14 regarding the Testing certificate renewal workflow for ACM, were not included. Minor updates to plugins for Kubernetes (such as v1.0 on 2022-01-04, ARM on 2024-07-18, and AWS Controllers for Kubernetes on 2024-11-18), announcements regarding the availability of AWS Private CA certificates for other services, the publication of compliance documentation, and pricing-related announcements were also excluded. Based on these criteria, 45 items were selected. In other words, please note that the items on this timeline are not all updates to AWS Private Certificate Authority, but are representative updates that I have picked out.

Timeline Columns, Change Values, and Date Sources

This article uses the columns and values defined by AWS History and Timeline regarding AWS Certificate Manager, and adds one column for the name on that date. Each table in the timeline has the following six columns:

Date — The date for that row. The method for determining this is described in the following paragraph.
Change — The type of change. The value will be one of the seven listed below.
Name on That Date — The name the source used on that date, copied as the source wrote it. The value is taken from the title of the source material; if the title does not include the service name, the name used first in the body of the document is used. For rows where the source material does not mention the service name, the value is marked as —. If the Date Source is Document history and the date is prior to the name change (September 27, 2022), (Document history) is appended to the name. The reason for this is explained in the following section. The name and definition of this column are the same as those used in the timeline for AWS History and Timeline regarding Amazon Connect on this site.
What Happened — A description of what occurred. The text from the source material is presented in English.
Date Source — The type of source material from which the Date value was obtained. The value will be one of the six listed below.
Source — The document that served as the basis for the row. In addition to Date Source materials, other documents are also included.

The Date value is determined as follows: if there is an announcement in What's New, the value is the publication date of that announcement; if not, the value is the date of the entry in Document history; and if neither of those is available, the value is the publication date of the blog post. This order of precedence is the same as that described in Section 6.2 of Where the AWS Primary Sources Disagree About Launch Dates.

The values for Change are one of the following seven.

Added — A feature, integration, Region, or API was added.
Changed — Default values or behavior have been modified.
Renamed — The name has been changed.
Deprecated — A source stated that a feature is deprecated or that it will end in the future. The feature could still be used at that point. This term is not used in this article.
Removed — A source stated, with words such as no longer supports or no longer available, that a feature was removed. This term is not used in this article.
Ended — Support or availability has ended. This term is not used in this article.
Scheduled — A planned date that had not yet arrived on the verification date (2026-10-13). This term is not used in this article.

Within the range this article examined, no row was found in which AWS Private CA removed a feature. Therefore, this timeline only includes entries for "Added," "Changed," and "Renamed."

The values for "Date Source" are as follows:

What's New — The publication date (postDateTime) of the What's New announcement.
Document history — The date from the Document history section of the AWS Private CA User Guide. When a row uses entries from the ACM User Guide's Document history, What Happened says so.
AWS News Blog and AWS Security Blog — The publication date of the article. This article does not use them as a "Date Source."
User Guide — The date written in the main body of the AWS Private CA User Guide. This article does not use it.
API Reference — The date written in the main body of the AWS Private CA API Reference. This article uses it for one row (2023-01-26).

Dates from other articles have not been used as a "Date Source."

Names in the Document history, and How This Article Took the Name on That Date

In the AWS Private CA Document history, 26 rows predate the name change (September 27, 2022). Of these, 7 entries use only the old name, 4 use both the old and new names within the same entry, and 1 uses only the new name. The remaining 14 entries simply state Private CA or do not specify a service name.

The single entry using only the new name appears in the Earlier Updates table, dated 2018-04-04, and reads: This release introduces AWS Private Certificate Authority. This article has not found a source that used this name on 2018-04-04 (it read the What's New title, the AWS News Blog post, and the ACM Document history row of that day). An example of an entry using both names appears on 2019-09-30, which reads:

New section added on planning your PKI using AWS Private CA. For more information, see Planning Your ACM Private CA Deployment.

The old name remains in the text of the link.

Therefore, the names in Document history rows cannot be treated as the name on that date. This article took the name on that date from What's New announcements and blog posts, and quotes the names in the Document history as the Document history's wording.

Even the What's New announcements themselves do not consistently use a single name. Announcements from 2018 through the first half of 2021 frequently use AWS Certificate Manager Private Certificate Authority, while announcements from the second half of 2021 through the first half of 2022 often use ACM Private CA. The announcement dated 2022-05-05 uses ACM Private Certification Authority (as originally written). The announcement regarding Kubernetes integration on 2021-07-15 appears twice in the What's New list with different titles (see the 2020–2021 table).

Conflicting Dates and Statements for the Same Events

When the same event has multiple dates, different sources often record different dates. This article does not claim that any of these dates are incorrect. The main timeline lists a single date for each event. Dates from other sources are listed in the "Where the Dates Differ" table, organized by source. This table categorizes date discrepancies into four types:

Different kinds of dates — This refers to instances where sources record different types of dates, such as the announcement date, the date a document was updated, or the publication date of a blog post.
Same date, different statements — In these cases, the dates are the same, but the content or names mentioned in the sources differ.
The sources disagree — This category covers instances where sources give different dates of the same kind for the same event.
Statement not found — This category applies when the article has not been able to locate the source that provides one of the dates listed. Not finding a statement does not prove that no such statement exists.

The distinction between the What's New announcement date and the Document history date is categorized as "Different kinds of dates." This is because the Document history date refers to the date the document was updated, which is a different type of date than the announcement date. This categorization is based on Sections 3 and 4 of Where the AWS Primary Sources Disagree About Launch Dates.

Topics Covered in Other Articles

Other articles on this site cover the following topics as their main subjects. This article gives them only timeline rows and short descriptions.

Design of the CA Hierarchy, Revocation, Short-Lived Certificate Mode, mTLS on Application Load Balancer, Sharing, and Auditing — AWS Private CA Hierarchy Design
Certificate Issuance and Distribution in Kubernetes, and the Status of the Connector for SCEP — Certificate Distribution in Kubernetes with AWS Private CA
Identifiers Remaining After Renaming (API Namespaces, Managed Policy Names) — AWS Service Renames Reference
ML-DSA Standardization and AWS's Response to Post-Quantum Cryptography — Post-Quantum Cryptography Standardization Timeline and Migration on AWS
Timeline for AWS Certificate Manager (ACM) — AWS History and Timeline regarding AWS Certificate Manager
Timeline for AWS Directory Service — AWS History and Timeline regarding AWS Directory Service

AWS Private CA Historical Timeline (Updates from April 4, 2018)

The following five tables represent the core historical timeline. Following these tables is a "Where the Dates Differ" table, which lists events whose dates differ by source. Each table's columns are defined as described in the previous section. All references were obtained on October 13, 2026.

Index:

2018–2019 - The period when it was introduced as an ACM feature, allowing the creation of hierarchies including a root CA.
2020–2021 - The period when cross-account sharing, AWS PrivateLink, integration with Kubernetes, and AWS-managed OCSP were added.
2022–2023 - The period when the name changed to AWS Private Certificate Authority, and short-lived certificate mode and a connector for Active Directory were added.
2024–2025 - The period when a connector for SCEP, regions in China, a connector for Kubernetes (as an Amazon EKS add-on), and ML-DSA were added.
2026 - The period when utilization metrics, granular permission selection for sharing, and detailed records per certificate issuance were added.
Where the Dates Differ - Events whose dates differ by source.

* You can sort the table by clicking on the column name.

2018–2019 — Launch as an ACM Feature, and Root CA Hierarchies

What's New announcements during this period referred to the service as AWS Certificate Manager Private Certificate Authority or ACM Private CA. At the time of launch, only subordinate CAs were available within AWS.

Date	Change	Name on That Date	What Happened	Date Source	Source
2018-04-04	Added	AWS Certificate Manager Private Certificate Authority	AWS Certificate Manager now includes a Private Certificate Authority feature. The title of the What's New announcement is `Introducing AWS Certificate Manager Private Certificate Authority`. The AWS News Blog article from the same day stated, `Today we’re launching a new feature for AWS Certificate Manager (ACM), Private Certificate Authority (CA).` and further explained, `This new service allows ACM to act as a private subordinate CA.` The same post states `ACM Private CA builds on ACM’s existing certificate capabilities …` and uses the name `ACM Private CA`. When the address of the What's New announcement was opened on 2026-10-13, it was redirected, so the Date was taken from the `postDateTime` in the What's New list.	What's New	AWS Certificate Manager Launches Private Certificate Authority, Document history
2018-06-20	Added	Private CA (Document history)	Customers can now restore deleted Certificate Authorities (CAs) within 30 days of deletion. The Document history row states, `Private CA restore allows customers to restore certificate authorities (CAs) for up to 30 days after they have been deleted.` The date listed in this entry reflects the date the document was updated. This article has not found a What's New announcement of this feature (searched with full-text searches of the two What's New lists).	Document history	Document history
2019-05-08	Added	AWS Certificate Manager Private Certificate Authority	The service became available in the AWS GovCloud (US) Regions. The announcement title was `AWS Certificate Manager Private Certificate Authority is now available in AWS GovCloud`. The corresponding entry in the Document history states `Added region support for the AWS GovCloud (US-West and US-East) Regions.` The address of the announcement was redirected on 2026-10-13, so the Date was taken from the `postDateTime` in the What's New listing.	What's New	Document history
2019-06-20	Added	AWS Certificate Manager Private Certificate Authority	Customers can now create a CA hierarchy within AWS, including the root CA. The announcement states, `Certificate authority (CA) administrators can now create a private CA hierarchy, including root and subordinate CAs.` It further explains, `This feature expands ACM Private CA capabilities from a single level hierarchy that required you to operate your root and intermediate CAs, to an AWS-managed solution that provides a full CA hierarchy without the need to maintain external root CAs.` The corresponding entry in the Document history reads, `Support for creating and hosting root CAs removes need for an external parent.`	What's New	AWS Certificate Manager Private Certificate Authority now supports root CA hierarchies, Document history
2019-10-02	Added	AWS Certificate Manager Private Certificate Authority	Nine new certificate templates were added. The announcement states: `CA administrators now have the flexibility to issue additional certificate types, including certificates for signing code and OCSP responses, and client-only or server-only TLS certificates.` The Document history row is dated 2019-10-01.	What's New	AWS Certificate Manager Private Certificate Authority now includes 9 new certificate templates
2019-10-29	Added	AWS Certificate Manager (ACM) Private Certificate Authority (CA)	The system now enforces name constraints for certificates of imported CAs during issuance. The announcement states: `AWS Certificate Manager (ACM) Private Certificate Authority (CA) now enforces name constraints in imported CA certificates.` The Document history row is dated 2019-10-28.	What's New	AWS Certificate Manager (ACM) Private Certificate Authority (CA) now enforces name constraints in imported CA certificates
2019-11-21	Added	Private Certificate Authority	You can now apply tags when creating a CA, and you can write IAM policies using those tags. The announcement states: `Upon creation, you can tag your ACM certificates and private certificate authorities (CAs).` and `In addition, you can now set IAM policies on your ACM Certificates and Private CAs using tags.` The corresponding entry in the Document history (`Tag-based permissions`) is dated 2019-11-05.	What's New	Tag-on Create and Tag-Based IAM for AWS Certificate Manager and Private Certificate Authority, Document history
2019-12-19	Added	Private Certificate Authority	The API now includes FIPS 140-2 validated endpoints. The announcement states: `AWS Certificate Manager (ACM) and ACM Private Certificate Authority (CA) now offers Federal Information Processing Standards (FIPS) 140-2 validated endpoints in US Regions to protect sensitive information.` This refers to API connection points, and not the HSM used to protect the CA's keys. The corresponding entry in the Document history is dated 2019-12-13.	What's New	AWS Certificate Manager and Private Certificate Authority Support FIPS 140-2 Endpoints
2019-12-19	Added	AWS Certificate Manager Private Certificate Authority	CA creation, certificate issuance, and other operations could now be received as Amazon CloudWatch Events. The announcement states `AWS Certificate Manager (ACM) Private Certificate Authority (CA) now emits Amazon CloudWatch Events.` The Document history row is dated 2019-12-23.	What's New	AWS Certificate Manager Private Certificate Authority Now Emits State Change Events

2020–2021 — Sharing, AWS PrivateLink, Kubernetes Integration, and Managed OCSP

During the period of 2020–2021, it became possible to share the CA with other accounts, and OCSP was added as a means of reporting revocation. More What's New titles used the short name ACM Private CA.

Date	Change	Name on That Date	What Happened	Date Source	Source
2020-01-27	Added	AWS Certificate Manager Private Certificate Authority	It is now possible to create CAs and certificates using AWS CloudFormation. The announcement states `This feature offers templates for CAs, CA activation and private certificates.` The Document history row is dated 2020-01-22.	What's New	AWS Certificate Manager Private Certificate Authority Now Offers CloudFormation Resources
2020-04-17	Changed	AWS Certificate Manager Private Certificate Authority	The maximum rate for certificate issuance requests has been increased, and it is now possible to encrypt the Amazon S3 bucket used to store CRLs and audit reports. The announcement states `ACM Private CA has increased the rate limit for certificate issuance requests from 5 requests per second to 25 requests per second, allowing you to issue as many as 2.1M certificates per day.`	What's New	AWS Certificate Manager Private Certificate Authority now includes increased certificate issuance rate limits and support for Amazon S3 bucket encryption
2020-08-04	Added	AWS Certificate Manager Private Certificate Authority	API access is now available through AWS PrivateLink VPC endpoints. The announcement states `Starting today, AWS Certificate Manager (ACM) Private Certificate Authority (CA) now offers PrivateLink endpoints.` The Document history row is dated 2020-03-26.	What's New	AWS Certificate Manager Private Certificate Authority now supports Private Link endpoints
2020-08-17	Added	AWS Certificate Manager Private Certificate Authority	The CA now allows sharing with other accounts and organizations through AWS Resource Access Manager. The announcement states `AWS Certificate Manager (ACM) Private Certificate Authority (CA) now supports sharing a Private CA with any AWS account or within your organization.` The entry in the AWS Private CA Document history for the same date reads: `AWS Certificate Manager users can be authorized to issue certificates using private CAs that they do not own.` The entry in the ACM Document history for the same date reads: `Added cross-account support for using private CAs from AWS Private CA.`, and uses the name in use since 2022.	What's New	AWS Certificate Manager Private Certificate Authority now supports Private CA sharing, Document history, ACM Document history
2021-01-19	Added	AWS Certificate Manager Private Certificate Authority	Certificate attributes could now be passed through the API, and the start date and time of a certificate's validity could now be set. The announcement states `Customers can now include certificate attributes via API calls at the time of issuance in addition to inclusion in the certificate signing request (CSR).` and `Additionally, with this launch, customers can configure the certificate start date and time to account for clock skew and other situations in which IoT or other devices reset to a specific date in the past when they lose power.`	What's New	AWS Certificate Manager Private Certificate Authority now supports additional certificate customization
2021-05-26	Added	AWS Certificate Manager Private Certificate Authority	The S3 bucket used to store CRLs now supports S3 Block Public Access. The announcement states `Previously, CRLS generated by ACM Private CA had to be in stored in public buckets, which was counter to best practices.` The Document history row is dated 2021-05-27.	What's New	AWS Certificate Manager Private Certificate Authority now supports storing CRLs in private S3 buckets
2021-06-15	Added	AWS Certificate Manager Private Certificate Authority	The range of certificate types that can be issued by shared CAs has been expanded. The announcement states `Customers can now share CAs across accounts to issue certificates defined as client only TLS and server only TLS, as well as fully customizable certificates.`	What's New	AWS Certificate Manager Private Certificate Authority now supports more flexibility for CAs shared across accounts
2021-07-15	Added	ACM Private Certificate Authority	A plugin was released that allows Kubernetes to request certificates through cert-manager. The announcement states `ACM Private Certificate Authority (CA) now supports an open source plugin for cert-manager that offers a more secure certificate authority solution for Kubernetes containers.` The What's New list also has an announcement with the same `postDateTime` and the title `AWS Private Certificate Authority introduces integration with Kubernetes`. The list's creation date for that announcement is 2021-07-15, and its address returned 404 on 2026-10-13. The list's creation date for the announcement titled `ACM Private Certificate Authority …` is 2021-08-02.	What's New	ACM Private Certificate Authority introduces integration with Kubernetes
2021-09-03	Added	ACM Private CA	Certificate revocation could now be announced through OCSP managed by AWS. The announcement states, `AWS Certificate Manager (ACM) Private Certificate Authority (CA) announces the availability of Online Certificate Status Protocol (OCSP) for distributing certificate revocation information.` It also states `Previously, ACM Private CA customers could use CRLs to check revocation status for certificates issued by ACM Private CA or build and manage their own OCSP.` The entry in the Document history (`Support for Managed OCSP`) is dated 2021-08-18.	What's New	ACM Private CA now supports the Online Certificate Status Protocol (OCSP), Document history

2022–2023 — The Rename to AWS Private Certificate Authority, Short-Lived Certificate Mode, and the Connector for Active Directory

During this period, the service was renamed to AWS Private Certificate Authority. Following the name change, a mode for issuing only short-lived certificates was introduced, along with the Connector for AD.

Date	Change	Name on That Date	What Happened	Date Source	Source
2022-03-21	Added	ACM Private CA	You can now customize the subject names, special purpose extensions, and name constraint for CA certificates. The announcement stated, `AWS Certificate Manager (ACM) Private Certificate Authority (CA) now supports customizable certificate subject names.` and `This includes the name constraint extension in CA certificates.` The corresponding entry in the Document history is dated 2022-03-16.	What's New	ACM Private CA now supports custom subject names, extensions, and name constraints
2022-07-20	Added	—	New certificate templates were added to support CA and device certificates compliant with Matter. The Document history row states, `Three new certificate templates add support for Matter-compliant CA and end-entity certificates.` This entry reflects the date the document was updated.	Document history	Document history
2022-09-28	Renamed	AWS Private Certificate Authority	The name changed to AWS Private Certificate Authority (AWS Private CA). The announcement stated, `Today, we renamed AWS Certificate Manager Private Certificate Authority to AWS Private Certificate Authority (AWS Private CA).` and `This launch coincides with the launch of AWS Private CA’s updated console.` The Document history row (`Service rebranding and console update`) dated 2022-09-27 states, `The service is renamed to AWS Private Certificate Authority (AWS Private CA).`	What's New	AWS Certificate Manager Private Certificate Authority is now AWS Private Certificate Authority, Document history
2022-10-26	Added	AWS Private Certificate Authority	A mode that issues only short-lived certificates (short-lived certificate mode) was added. The announcement states `With today’s launch of short-lived certificate mode, you can now use a private CA with a dedicated mode for issuing those short-lived certificates.` and `The existing mode of AWS Private CA is now known as general-purpose mode and supports certificates of any validity period.` As of 2026-10-13, the API Reference lists the mode values as `GENERAL_PURPOSE` and `SHORT_LIVED_CERTIFICATE`, noting that `Short-lived certificate validity is limited to seven days.` The Document history row is dated 2022-10-24.	What's New	AWS Private Certificate Authority introduces a mode for short-lived certificates, CertificateAuthority
2023-01-26	Changed	AWS Private CA	For regions outside of China, all CA private keys are now protected using hardware security modules (HSMs) that comply with FIPS PUB 140-2 Level 3. As of 2026-10-13, the API Reference states, in its note on `KeyStorageSecurityStandard`, `Starting January 26, 2023, AWS Private CA protects all CA private keys in non-China regions using hardware security modules (HSMs) that comply with FIPS PUB 140-2 Level 3.` The Date is the date written in this body text. This article has not found a What's New announcement that gives this date (searched with full-text searches of the two What's New lists).	API Reference	CertificateAuthority
2023-02-13	Renamed	AWS Private CA	The names of AWS managed policies have been changed to align with the new service name. The Document history row (`Changing security policy names to match new service name`) states `Adoption of new names for AWS managed IAM policies that specify standard permissions on AWS Private CA.` Details of the updated names can be found in Section 6.5 of AWS Service Renames Reference.	Document history	Document history
2023-08-29	Added	AWS Private CA	A connector for Active Directory was released. The announcement states, `The Connector for AD allows you to use AWS Private CA as a drop-in replacement for your self-managed enterprise certificate authorities without the need to deploy, patch, or update local agents or proxy servers.` It also states, `The Connector for AD is available in all AWS Regions where AWS Private CA is available, except Israel (Tel Aviv) and the AWS GovCloud (US) Regions.` The Document history row is dated 2023-08-24. On 2023-08-31, an announcement from the AWS Directory Service side was published.	What's New	AWS Private CA launches Connector for Active Directory, AWS Directory Service and AWS Private CA provide certificates for Active Directory

2024–2025 — Connector for SCEP, the China Regions, the Amazon EKS Add-on, and ML-DSA

During this period, connectors for SCEP were released, and the Kubernetes connector became an Amazon EKS add-on. Many of the changes occurring in 2025 are documented in the What's New section, but lack corresponding entries in the Document history.

Date	Change	Name on That Date	What Happened	Date Source	Source
2024-01-16	Added	AWS Private CA	It is now possible to issue certificates for mobile driver’s licenses (mDL) compliant with the ISO/IEC 18013-5:2021 standard. The announcement states: `You can now use AWS Private Certificate Authority (AWS Private CA) to help issue ISO/IEC 18013-5:2021 international standard mobile driver’s license (mDL) certificates.`	What's New	AWS Private CA now helps issue ISO/IEC mobile driver’s license certificates
2024-01-25	Added	AWS Private CA	It is now possible to revoke certificates for Matter. The announcement states: `AWS Private Certificate Authority (AWS Private CA) now supports revocation for Matter certificates.` A corresponding entry in the Document history states: `Adds support for the Certificate Revocation List Distribution Point (CDP) extension for Matter.`	What's New	AWS Private CA now supports revocation for Matter certificates, Document history
2024-06-11	Added	AWS Private CA	A connector for SCEP is now available in preview. The announcement is titled `AWS Private CA introduces Connector for SCEP for mobile devices (Preview)`. The heading for the entry in the Document history is `AWS Private CA now supports Connector for SCEP (Preview)`.	What's New	AWS Private CA introduces Connector for SCEP for mobile devices (Preview), Document history
2024-06-27	Added	AWS Private CA	Support for the SM2 signing algorithm is now available, limited to the China Regions. The entry in the Document history reads: `AWS Private CA now supports the SM2 signing algorithm, for China Region only.` The date listed for this entry reflects the date the document was updated.	Document history	Document history
2024-07-02	Added	AWS Private CA	Now available in the AWS China (Beijing) Region, operated by Sinnet, and the AWS China (Ningxia) Region, operated by NWCD. The announcement states: `AWS Private Certificate Authority (AWS Private CA) is now available in the AWS China (Beijing) Region, operated by Sinnet, and in the AWS China (Ningxia) Region, operated by NWCD.`	What's New	AWS Private CA is now available in the Beijing and Ningxia Regions in China
2024-07-23	Added	—	The Connector for SCEP for Omnissa Workspace ONE is now generally available. The Document history row states `Connector for SCEP for Omnissa Workspace ONE is now generally available.` This entry reflects the date the document was updated. The general availability of the Connector for SCEP as a whole is documented in the entry dated 2024-09-16.	Document history	Document history
2024-09-16	Added	AWS Private CA	The Connector for SCEP is now generally available. The announcement states: `AWS Private Certificate Authority (AWS Private CA) launches General Availability of the Connector for SCEP, which lets you use a managed and secure cloud certificate authority (CA) to enroll mobile devices securely and at scale.` The corresponding entry in the Document history reads: `Connector for SCEP is now generally available.` Details regarding the different availability statuses for the Connector for SCEP are available in Section 10.2 of Certificate Distribution in Kubernetes with AWS Private CA.	What's New	AWS Private CA now supports SCEP for mobile devices, Document history
2025-06-02	Added	AWS Private CA	The connector for Active Directory now supports child domains within Active Directory. The announcement states `AWS Private Certificate Authority (AWS Private CA) now supports Active Directory (AD) child domains through the Private CA Connector for AD.`	What's New	AWS Private CA announces support for Microsoft Active Directory child domains
2025-06-04	Added	Private CA	The connector for Kubernetes is now generally available as an Amazon EKS add-on. The announcement states `Today, AWS announces the general availability of Private CA Connector for Kubernetes Amazon EKS add-on.` There is no entry for this event in the Document history.	What's New	Amazon EKS add-ons now supports Private CA Connector for Kubernetes
2025-06-23	Added	AWS Private CA	It now supports IPv6 through new dual-stack endpoints. The announcement states `AWS Private Certificate Authority (AWS Private CA) now supports Internet Protocol version 6 (IPv6) through new dual-stack endpoints.`	What's New	AWS Private CA now supports Internet Protocol Version 6 (IPv6)
2025-07-18	Changed	AWS Private CA	The number of certificates one CA can issue was raised to 100 million, with conditions. The announcement states: `AWS Private Certificate Authority (AWS Private CA) now enables you to issue up to 100 million certificates per certificate authority (CA), an increase from the previous default limit of 1 million certificates.` Regarding the conditions, the announcement specifies: `The new 100 million certificates per CA limit is available by default for CAs configured without revocation or with revocation configuration set to partitioned Certificate Revocation List (CRL) and/or Online Certificate Status Protocol (OCSP).` There is no entry for this event in the Document history.	What's New	AWS Private CA now supports issuing up to 100 million certificates per CA
2025-08-06	Added	AWS Private CA	The FIPS endpoints could now also be reached through AWS PrivateLink. The announcement states: `AWS Private Certificate Authority (AWS Private CA) now supports AWS PrivateLink with all AWS Private CA Federal Information Processing Standard (FIPS) endpoints that are available in commercial AWS Regions and the AWS GovCloud (US) Regions.` There is no entry for this event in the Document history.	What's New	AWS Private CA expands AWS PrivateLink support to FIPS endpoints
2025-09-09	Added	AWS Private CA	AWS Managed Microsoft AD could now auto-enroll LDAPS and smart card certificates through Connector for AD. The announcement states: `AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) now offers certificate auto-enrollment for LDAPS and Smart Card and certificate based authentication with AWS Private Certificate Authority (AWS Private CA) through AWS Private CA Connector for AD.` There is no entry for this event in the Document history. The history of AWS Directory Service is available at AWS History and Timeline regarding AWS Directory Service.	What's New	AWS Managed Microsoft AD adds LDAPS and Smart Card support using AWS Private CA
2025-11-10	Added	AWS Private CA	ML-DSA CAs could now be created, and ML-DSA certificates issued. The announcement states: `AWS Private Certificate Authority (AWS Private CA) now enables you to create certificate authorities (CAs) and issue certificates that use Module Lattice-based Digital Signature Algorithm (ML-DSA).` It also states: `ML-DSA is a post-quantum digital signature algorithm standardized by National Institute of Standards and Technology (NIST) as Federal Information Processing Standards (FIPS) 204.` There is no entry for this event in the Document history. Details on the standardization process can be found at Post-Quantum Cryptography Standardization Timeline and Migration on AWS.	What's New	AWS Private CA now supports post-quantum digital certificates
2025-12-19	Added	AWS Private CA	OCSP became available in the China and AWS GovCloud (US) Regions. The announcement states: `AWS Private Certificate Authority (AWS Private CA) now supports Online Certificate Status Protocol (OCSP) in China and AWS GovCloud (US) Regions.` There is no entry for this event in the Document history.	What's New	AWS Private CA OCSP now available in China and AWS GovCloud (US) Regions

2026 — Utilization Metrics, Customer Managed Permissions, and Detailed Certificate Issuance Logs

The entries for 2026 are all taken from What's New announcements. With the exception of the entry dated 2026-09-09, there are no entries in Document history.

Date	Change	Name on That Date	What Happened	Date Source	Source
2026-03-12	Added	AWS Private CA	The Connector for SCEP now supports AWS PrivateLink, allowing clients to request certificates from within your Amazon Virtual Private Cloud (VPC) without traversing the public internet. The announcement stated: `AWS Private CA Connector for SCEP now supports AWS PrivateLink, allowing your clients to request certificates from within your Amazon Virtual Private Cloud (VPC) without traversing the public internet.`	What's New	AWS Private CA Connector for SCEP now supports AWS PrivateLink
2026-03-31	Added	AWS Private CA	You can now view the number of certificates issued per CA and the number of CAs per Region through CloudWatch metrics. The announcement stated: `The new metrics track the number of certificates issued by each CA and the total number of CAs in each Region, enabling you to monitor usage against these quotas and proactively manage CA lifecycle to maintain high availability.`	What's New	AWS Private CA now publishes utilization metrics to Amazon CloudWatch
2026-04-09	Added	AWS Private CA	When sharing a CA, the API operations to allow could now be chosen (customer managed permissions). The announcement states `With customer managed permissions, you can now select exactly which AWS Private CA API operations to allow when sharing a CA, granting only the specific operations each consuming account needs.` and `Previously, you could only use AWS managed permissions, which provide predefined sets of actions and restrict cross-account issuers to specific certificate templates.`	What's New	AWS Private CA now supports customer managed permissions for cross-account sharing
2026-09-09	Added	AWS Private CA	The AWS Private CA Connector for Kubernetes as a managed Amazon EKS add-on, and the Connector for AD, are now available in the AWS GovCloud (US) Regions. The announcement states: `AWS Private Certificate Authority (AWS Private CA) announces the availability of the AWS Private CA Connector for Kubernetes as a managed Amazon EKS add-on and the AWS Private CA Connector for Active Directory in AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions.` A previous announcement on 2023-08-29 had excluded AWS GovCloud (US) from the list of regions where the Connector for AD is available. There is also a corresponding entry in the Document history.	What's New	AWS Private CA EKS add-on and Connector for AD now available in AWS GovCloud (US), Document history
2026-10-05	Added	AWS Private CA	A new `IssueCertificateDetails` event has been added to AWS CloudTrail, which records the contents of the certificate, the issuing CA, and the requester for each certificate issuance. The announcement states `Previously, the CloudTrail management event for the IssueCertificate API confirmed that the API call succeeded by providing a certificate ARN but did not capture the certificate content, information about the CA that signed it, or issuances that failed before signing.` See AWS Private CA Hierarchy Design, Section 9, for details on how to use this for auditing.	What's New	AWS Private CA now provides detailed certificate issuance logs

Where the Dates Differ

The following table lists events with differing dates across different sources, as well as events that describe different details even when occurring on the same date according to different sources. In the "Dates by Source" column, dates that have been placed in the main timeline are marked with (timeline). The values in the "Kind of Difference" column correspond to the four categories defined in the previous section.

Event	Dates by Source	Kind of Difference
The launch and the name on that date	What's New 2018-04-04 (timeline), AWS News Blog 2018-04-04, ACM Document history 2018-04-04, AWS Private CA Document history 2018-04-04. The What's New title uses `AWS Certificate Manager Private Certificate Authority`, the AWS News Blog post uses `ACM Private CA`, the ACM Document history uses `AWS Private CA` in the heading and `ACM Private Certificate Manager (CM)` (as originally written) in the body, and the AWS Private CA Document history uses `AWS Private Certificate Authority`.	Same date, different statements
Nine certificate templates	Document history 2019-10-01, What's New 2019-10-02 (timeline)	Different kinds of dates
Name constraints in imported CA certificates	Document history 2019-10-28, What's New 2019-10-29 (timeline)	Different kinds of dates
Permissions based on tags	Document history 2019-11-05, What's New 2019-11-21 (timeline)	Different kinds of dates
FIPS 140-2 endpoints	Document history 2019-12-13, What's New 2019-12-19 (timeline)	Different kinds of dates
CloudWatch Events	What's New 2019-12-19 (timeline), Document history 2019-12-23	Different kinds of dates
CloudFormation resources	Document history 2020-01-22, What's New 2020-01-27 (timeline)	Different kinds of dates
AWS PrivateLink	Document history 2020-03-26, What's New 2020-08-04 (timeline)	Different kinds of dates
S3 Block Public Access for CRL buckets	What's New 2021-05-26 (timeline), Document history 2021-05-27	Different kinds of dates
Titles of the Kubernetes integration announcement	What's New 2021-07-15 (timeline), two announcements: `ACM Private Certificate Authority introduces integration with Kubernetes` (list creation date 2021-08-02), and `AWS Private Certificate Authority introduces integration with Kubernetes` (list creation date 2021-07-15; the address returned 404 on 2026-10-13).	Same date, different statements
Managed OCSP	Document history 2021-08-18, What's New 2021-09-03 (timeline)	Different kinds of dates
Specifying subject names, extensions, and name constraints	Document history 2022-03-16, What's New 2022-03-21 (timeline)	Different kinds of dates
The rename	Document history 2022-09-27, What's New 2022-09-28 (timeline). This site's AWS Service Renames Reference gives 2022-09-27 as the value of the Document history.	Different kinds of dates
Short-lived certificate mode	Document history 2022-10-24, What's New 2022-10-26 (timeline)	Different kinds of dates
Connector for AD	Document history 2023-08-24, What's New 2023-08-29 (timeline) (the AWS Private CA announcement), What's New 2023-08-31 (the AWS Directory Service side announcement `AWS Directory Service and AWS Private CA provide certificates for Active Directory`).	Different kinds of dates

The dates of ML-DSA (2025-11-10), the Connector for SCEP (2024-06-11 and 2024-09-16), and the rename (2022-09-27) are the same as the values in this site's Post-Quantum Cryptography Standardization Timeline and Migration on AWS, Certificate Distribution in Kubernetes with AWS Private CA, and AWS Service Renames Reference.

Current Overview, Functions, Features of AWS Private CA

This section provides a brief overview of AWS Private CA as of the verification date (October 13, 2026). Details regarding each feature's design can be found in the articles mentioned in the previous section, as well as in the AWS Private CA User Guide.

CA Types and Modes

As of 2026-10-13, the CertificateAuthority page of the API Reference lists two possible values for the Type field: ROOT and SUBORDINATE. At the time of its initial release on 2018-04-04, AWS Private CA operated as a subordinate CA. The ability to create hierarchies, including root CAs, within AWS was introduced on 2019-06-20.

The same page also lists two possible values for the UsageMode field: GENERAL_PURPOSE and SHORT_LIVED_CERTIFICATE, stating, Short-lived certificate validity is limited to seven days. The default value is GENERAL_PURPOSE. Constraints on selecting a mode are detailed in Section 6 of AWS Private CA Hierarchy Design.

Connectors

The announcement from September 16, 2024, states:

The Connector for SCEP is one of three connectors that allow you to use AWS Private CA with Kubernetes, Active Directory, and, now, mobile devices.

The initial dates for these three connectors are as follows:

Kubernetes — The cert-manager plugin was released on July 15, 2021, and the Amazon EKS add-on on June 4, 2025.
Active Directory (Connector for AD) — August 29, 2023.
SCEP (Connector for SCEP) — Preview released on June 11, 2024; generally available on September 16, 2024.

Revocation Methods

An article on the AWS News Blog, published on the service launch date, states:

ACM Private CA automatically maintains certificate revocation lists (CRLs) in Amazon Simple Storage Service (Amazon S3) and lets administrators generate audit reports of certificate creation with the API or console.

AWS-managed OCSP was added on September 3, 2021.

Regarding partitioned CRLs, it is important to pay attention to the dates of the relevant documentation. The announcement of July 18, 2025, lists a partitioned Certificate Revocation List (CRL) as a condition for up to 100 million certificates, distinguishing it from a complete CRL. In contrast, an article on the AWS Security Blog dated November 26, 2025, titled AWS Private Certificate Authority now supports partitioned CRLs, states:

AWS Private CA addresses these challenges with partitioned CRLs, which enable the issuance and revocation of up to 100 million certificates per CA.

Therefore, this article does not specify the date when partitioned CRLs first became available and does not include that date in its timeline. This article has not found a source that gives that date (it searched with full-text searches of the two What's New lists, the aws-knowledge search, and a web search). The design for certificate revocation is detailed in Section 5 of AWS Private CA Hierarchy Design.

Key Algorithms

As of October 13, 2026, the CertificateAuthorityConfiguration page of the API Reference lists ten values for KeyAlgorithm. These include three RSA algorithms (RSA_2048, RSA_3072, RSA_4096), three elliptic curve algorithms (EC_prime256v1, EC_secp384r1, EC_secp521r1), three ML-DSA algorithms (ML_DSA_44, ML_DSA_65, ML_DSA_87), and SM2. The ML-DSA algorithms were added on November 10, 2025. Regarding SM2, the Document history row of June 27, 2024, states that it can be used only in the China Regions.

Protection of CA Keys

Specifications for HSMs used to protect CA private keys vary across different documentation.

AWS News Blog article from April 4, 2018 — States that ACM Private CA keys are stored securely in AWS managed hardware security modules (HSMs) that adhere to FIPS 140-2 Level 3 security standards.
API Reference from October 13, 2026 — States Starting January 26, 2023, AWS Private CA protects all CA private keys in non-China regions using hardware security modules (HSMs) that comply with FIPS PUB 140-2 Level 3. and lists three values for KeyStorageSecurityStandard: FIPS_140_2_LEVEL_2_OR_HIGHER, FIPS_140_2_LEVEL_3_OR_HIGHER, and CCPC_LEVEL_1_OR_HIGHER.
What's New announcements from 2025 onwards — The announcement of June 23, 2025, states securing the CA's private keys using FIPS 140-3 Level 3 hardware security modules (HSMs). Announcements from July 18, 2025, and September 9, 2026, also mention FIPS 140-3 Level 3, while the announcement from June 4, 2025, refers to Federal Information Processing Standard (FIPS) 140-3 Security Level 3.

This article does not state that any of these sources are incorrect. The API Reference continues to use the name "FIPS 140-2," while the announcements use "FIPS 140-3." When specifying the standard in design documents, it is necessary to indicate which source document the wording is taken from.

Monitoring and Auditing

Monitoring and auditing capabilities were expanded to include CloudWatch Events (starting December 19, 2019), CloudWatch utilization metrics (starting March 31, 2026), and CloudTrail events related to IssueCertificateDetails (starting October 5, 2026).

Frequently Asked Questions about AWS Private CA History

This section answers common questions about the history of AWS Private CA.

When did ACM Private CA launch, and when was it renamed AWS Private CA?

It launched as an ACM feature on April 4, 2018. The What's New announcement is titled Introducing AWS Certificate Manager Private Certificate Authority, while an AWS News Blog post from the same day referred to it as ACM Private CA. There are two dates associated with the name change, according to different documentation. The What's New announcement, dated September 28, 2022, states

Today, we renamed AWS Certificate Manager Private Certificate Authority to AWS Private Certificate Authority (AWS Private CA).

The Document history indicates a revision date of September 27, 2022. The former represents the date of the announcement, while the latter is the date the document was updated.

Why do some 2018–2020 entries in the Document history use the name AWS Private CA?

This is because even entries with dates prior to the name change include lines written with the new name. For example, the entry for April 4, 2018, under the Earlier Updates table, states, This release introduces AWS Private Certificate Authority. Conversely, some entries still use the old name; for instance, the entry for September 30, 2019, uses both AWS Private CA and ACM Private CA within the same entry. Therefore, it is not possible to determine the name on that date based solely on the entries in the Document history. This article uses the names found in the What's New announcements and blog posts.

When could AWS Private CA first create a root CA?

AWS Private CA first became capable of creating a root CA on June 20, 2019. An article on the AWS News Blog from April 4, 2018, stated that This new service allows ACM to act as a private subordinate CA. The announcement on June 20, 2019, described the previous form as a single level hierarchy that required you to operate your root and intermediate CAs and stated that it now supported the creation of a hierarchy that could include both root and subordinate CAs.

When did short-lived certificate mode and the three connectors become available?

Short-lived certificate mode was introduced on October 26, 2022 (the Document history row is dated October 24, 2022). The Connector for AD became available on August 29, 2023 (the Document history row is dated August 24, 2023). The Connector for SCEP was initially released as a preview on June 11, 2024, and became generally available on September 16, 2024. Between those two dates, on July 23, 2024, the Connector for SCEP for Omnissa Workspace ONE became generally available. For Kubernetes, a plugin was released for cert-manager on July 15, 2021, and became generally available as an Amazon EKS add-on on June 4, 2025.

When did AWS Private CA add OCSP and ML-DSA certificates?

AWS-managed OCSP was announced on September 3, 2021, according to the What's New announcement, and its entry in the Document history is dated August 18, 2021. Prior to that, the methods for indicating certificate revocation were either CRL or self-managed OCSP. OCSP became available in the China and AWS GovCloud (US) Regions on December 19, 2025. ML-DSA certificates and Certificate Authorities were introduced on November 10, 2025, although this event is not documented in the Document history.

Summary

AWS Private CA launched on April 4, 2018, as a feature within AWS Certificate Manager (ACM), initially supporting only subordinate CAs. On June 20, 2019, it gained the ability to create hierarchies including root CAs. From 2020 to 2021, support was added for cross-account sharing, AWS PrivateLink, Kubernetes integration, and an AWS-managed OCSP responder. The service was renamed to AWS Private Certificate Authority on September 28, 2022, and short-lived certificate mode was added on October 26, 2022. Between 2023 and 2025, all three connectors were in place: Active Directory, SCEP, and Kubernetes. On November 10, 2025, it gained the capability to issue certificates using ML-DSA. In 2026, utilization metrics, the choice of permissions for sharing, and detailed records for each certificate issuance were added.

⇒ Materials published before September 28, 2022, refer to the service using older names such as ACM Private CA. While the Document history may sometimes use the new name for entries prior to the name change, it is necessary to verify the name used on that date by checking the What's New announcements and blog posts.

⇒ Within the range this article examined, AWS Private CA has added features. No row describing a removed feature was found. The CA hierarchy expanded from supporting only subordinate CAs to including root CAs. The methods for certificate revocation expanded from CRL to both CRL and OCSP. Support for the SM2 (2024-06-27, China Regions only) and ML-DSA (2025-11-10) algorithms was added.

⚠ Dates for the same events differ across documents. What's New reflects the announcement date, while the Document history indicates when the document itself was updated. Many of the events from 2025 onwards are announced in the What's New section but do not have corresponding entries in the Document history. When cross-referencing information, it is important to confirm which document and date are being referenced. All information is current as of October 13, 2026.

This timeline will be updated as AWS Private CA continues to evolve.

References:
Tech Blog with curated related content

Written by Hidekazu Konishi