How do I enable partitioned CRLs in AWS Private CA?

To enable partitioned CRLs for an existing certificate authority in AWS Private CA, you need to update the revocation configuration of your CA. Here's how to do it:

1. Sign in to the AWS Management Console for AWS Private Certificate Authority.
2. Select the name of your CA to view its details.
3. Scroll down and choose the "Revocation configuration" tab.
4. Click "Edit" on the top right.
5. Select "Activate CRL distribution" if it's not already enabled.
6. Select the S3 bucket where you want to store your CRLs.
7. Expand the "CRL settings" dropdown.
8. Check the "Enable partitioning" checkbox to enable partitioned CRLs.
9. Optionally, you can enter a Custom CRL Name in the appropriate field if you want to specify a custom CDP URI.
10. Save your changes.

Alternatively, you can use the AWS CLI to update your CA's revocation configuration by running the update-certificate-authority command with the appropriate revocation configuration parameters.

When changing from a complete CRL to a partitioned CRL, AWS Private CA will create new partitions as needed and add the IDP (Issuing Distribution Point) extension to all CRLs, including the original one. Note that when using partitioned CRLs, you must validate that the CRL's associated issuing distribution point (IDP) URI matches the certificate's CDP URI to ensure the right CRL has been fetched. AWS Private CA marks the IDP extension as critical, which your client must be able to process.

Partitioned CRLs dramatically increase the number of certificates a private CA can issue and can be particularly beneficial for memory-constrained devices, such as certain IoT devices.
Sources
Set up a CRL for AWS Private CA - AWS Private Certificate Authority
CrlConfiguration - AWS Private Certificate Authority
Plan your AWS Private CA certificate revocation method - AWS Private Certificate Authority
How to update CRLs without public access using AWS Private CA | AWS Security Blog
Resolve ACM Private CA CRL S3 GetBucketAcl permission errors | AWS re:Post