DVA-C02 Question 175
Select 3You are developing a secure internal application that requires mutual TLS (mTLS) to authenticate clients and servers within your organization. Your organization has chosen to use AWS Private Certificate Authority (AWS Private CA) to issue certificates for this purpose. Which of the following steps are necessary to set up and use AWS Private CA for this scenario?
- A
Create a private CA in AWS Private CA and activate it.
- B
Issue a root certificate directly from AWS Private CA and distribute it to all clients and servers.
- C
Use the AWS Certificate Manager (ACM) to request a private certificate for the clients and servers from the private CA.
- D
Ensure the private CA is associated with an Application Load Balancer (ALB) to enable certificate issuance.
- E
Configure the clients and servers to trust the private CA's certificate chain.
Show answer and explanation
Correct answers: A, C, E
Explanation
To enable mutual TLS in a secure application using AWS Private CA, you need to start by creating and activating a private CA. Then, private certificates can be issued to clients and servers using the AWS Certificate Manager (ACM). Finally, the clients and servers must trust the private CA's certificate chain to establish secure, authenticated communication. Root certificates are not issued directly by AWS Private CA, and private CAs are not directly associated with services like ALBs.
- A. Correct.
Correct. Creating and activating a private CA is the first step to start issuing private certificates using AWS Private CA.
- B. Incorrect.
Incorrect. AWS Private CA does not issue root certificates directly. Instead, AWS Private CA helps issue subordinate certificates. Root certificates are typically imported or established in advance.
- C. Correct.
Correct. AWS Certificate Manager (ACM) can be used to request private certificates from the private CA for use by clients and servers.
- D. Incorrect.
Incorrect. Private CAs are not directly associated with ALBs. Instead, certificates issued by the CA can be imported or used by services like ALBs.
- E. Correct.
Correct. To establish trust for mTLS, clients and servers must trust the certificate chain issued by the private CA.