Does AWS Private CA support indirect CRLs?


We need to maintain an indirect CRL for a multi-level PKI architecture and would like to use a single CRL issuer to accomplish this. Does AWS Private CA support the creation and management of indirect CRLs?

asked a month ago20 views
1 Answer


Yes. AWS Private Certificate Authority (CA) supports indirect CRLs. To use indirect CRLs with AWS Private CA, you can specify one or more CDPs when creating the CRL. The CDPs can be specified as URLs or DNS names in the CRL Distribution Points extension of the CA certificate. Refer here for more details:

Thanks Arun

answered a month ago
  • Hi Arun, that link doesn't mention anything about configuring CDPs or indirect CRLs. I understand that it's probably possible to generate certificates with custom CDPs. My question is about whether or not AWS PCA supports the management of indirect CRLs. In other words, does PCA have the ability to automatically sign a CRL with a CA different than the issuing CA?

  • hi Dani, ACM PCA currently doesn't support automatic signing of CRL's with a different CA than the issuing CA. If you want to sign the CRL with a different CA, you will have to sign the CRL and then distribute it to the appropriate parties. Alternatively, you could configure the issuing CA to issue the CRL as and indirect CRL, where the CRL has a reference to another CRL issued by a different CA

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions