How do I configure disaster recovery for AWS Private CA?

Resolution

Because AWS Private CA is available in multiple AWS Regions, you can create redundant subordinate CAs in multiple Regions. Then, chain the subordinate CAs to the same root CA in a single Region.

Complete the following steps:

1. Create a subordinate CA (sub_CA_2) in a different AWS Region (sub_CA_2_region) from the root CA Region (root_CA_region).

2. Run the following command to get the sub_CA_2 from the sub_CA_2_region:

   aws acm-pca get-certificate-authority-csr --certificate-authority-arn sub_CA_2_ARN --region sub_CA_2_region

3. Run the following command to issue the sub_CA_2 certificate from the root CA in the root_CA_region:

   aws acm-pca issue-certificate --certificate-authority-arn root_CA_ARN --csr fileb://<CSRfile> --signing-algorithm SHA256WITHRSA --template-arn arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen1/V1 --validity Value=5,Type="YEARS" --region root_CA_region

4. Run the following command to get the certificate and certificate chain of the sub_CA_2 certificate:

   aws acm-pca get-certificate --certificate-authority-arn root_CA_ARN --certificate-arn certificate-arn-from-the-previous-step --region root_CA_region --output json > cert.json

5. Run the following commands to separate the certificate and certificate chain into two files:

   cert.pem for the subordinate CA certificate
   cert_chain.pem for the root CA certificate chain details

   cat cert.json | jq -r .Certificate > cert.pem 
   cat cert.json | jq -r .CertificateChain > cert_chain.pem

6. Run the following command to import the signed certificate to the sub_CA_2 into the sub_CA_2_region:

   aws acm-pca import-certificate-authority-certificate --certificate-authority-arn sub_CA_2_ARN --certificate fileb://cert.pem --certificate-chain fileb://cert_chain.pem --region sub_CA_2_region

The subordinate CA setup in the second Region is now complete and can be used to issue private certificates for disaster recovery.

For more information, see Redundancy and disaster recovery.

Related information

AWS Private CA best practices