How to export a certificate for AWS Private CA in Short-Lived mode

Question

I am setting up certificate based authentication for AWS Workspaces.  I have set up a basic AWS Private Certificate Authority for the sole purpose.  This CA has one level, Root, and is in Short-lived mode as it is only used for CBA for WorkSpaces.

The documentation states that my next step is to export the private certificate and then load it into Active Directory Certificate server.  Directions below: 
https://docs.aws.amazon.com/workspaces/latest/adminguide/certificate-based-authentication.html

"Certificate-based authentication utilizes virtual smart cards for logon. Following the Guidelines for enabling smart card logon with third-party certification authorities in Active Directory, perform the following steps:

Configure domain controllers with a domain controller certificate to authenticate smart card users. If you have an Active Directory Certificate Services enterprise CA configured in your Active Directory, domain controllers are automatically enrolled with certificates to enable smart card logon.

On the AWS Private CA console or using the SDK or CLI, select your CA and under the CA certificate, export the CA private certificate. For more information, see Exporting a private certificate.

Publish the CA to Active Directory. Logon to a domain controller or a domain-joined machine. Copy the CA private certificate to any

Pkiscape · Accepted Answer

I think the documentation needs to be updated here because it's 100% not possible to use the ACM console like it mentions here: https://docs.aws.amazon.com/acm/latest/userguide/export-private.html to export, or even issue a certificate by a PCA (Private CA) in short-lived certificate mode. This is because when you use the ACM console to request a certificate, the setting of the validity of the certificate is always 13 months. PCAs in short-lived mode can only issue certs up to 7 days which is why you get that error.

Also, the ACM console is for issuing end-entity certificates anyways. I think that in that documentation you posted, it wants to you retrieve the CA certificate of the PCA. This can be done by going to the AWS console -> Private CA -> Select your PrivateCA -> then, look for the CA Certificate Tab. The CA certificate should be there in PEM which you can copy. The reason why I think this is the right ways is because the next step is:

-Publish the CA to Active Directory. Copy the CA private certificate to any

How to export a certificate for AWS Private CA in Short-Lived mode

相关内容