Amazon AWS certificate and key algorithm considerations
Trust Protection Foundation can issue certificates using a wide range of key algorithms and key sizes. However, AWS places service-specific limits on which certificates can be accepted, stored, and used by its cloud services. These AWS platform restrictions may affect provisioning outcomes regardless of which algorithms are available in Trust Protection Foundation. This topic summarizes key considerations and highlights common limitations encountered when provisioning certificates to AWS services.
Key generation models and algorithm impact
Trust Protection Foundation supports both central key generation (keys generated and stored in Trust Protection Foundation) and remote key generation (keys created by Amazon Certificate Manager). AWS algorithm rules apply regardless of generation method:
-
Central generation: Trust Protection Foundation imports the certificate to ACM or IAM depending on the AWS service requirements.
-
Remote generation: Amazon CA generates and stores the private key in ACM; Trust Protection Foundation references the certificate without uploading key material.
AWS service restrictions may block or limit certain combinations of key type, key size, and destination (ACM or IAM). Trust Protection Foundation detects these issues during provisioning and displays user-friendly validation messages where possible.
Service-specific certificate and algorithm behaviors
AWS imposes different certificate requirements across its services. The following examples highlight commonly encountered limitations. For complete and current details, refer to AWS documentation.
Elastic Load Balancer (ELB – Classic Load Balancer)
-
EC (ECDSA) and RSA-4096 certificates must be uploaded to IAM.
-
Other RSA key sizes (such as RSA-2048 and RSA-3072) may be provisioned through ACM.
-
Attempting to use EC or RSA-4096 certificates via ACM for ELB may cause provisioning failures.
CloudFront
CloudFront enforces stricter certificate requirements for viewer TLS connections:
-
RSA-2048 is supported natively when the certificate is stored in ACM.
-
Larger RSA keys may require generating the certificate externally and importing it into ACM.
-
For ECDSA, CloudFront supports ECDSA P-256 (prime256v1) for viewer HTTPS. Other EC curves may not be accepted, even if ACM allows the certificate to be imported.
For details, see the CloudFront requirements for public key sizes and algorithms.
Application Load Balancer (ALB)
-
ALB supports certificates provisioned through ACM, including RSA 2048/3072/4096 and ECDSA keys.
-
ALB does not impose the ACM/IAM restrictions seen in ELB, making ALB the most flexible target for EC keys provisioned via ACM.
Where to find AWS’s authoritative key and certificate requirements
For complete AWS guidance on supported key types and sizes, see the AWS Key Management documentation:
For CloudFront certificate and algorithm requirements, refer to:
Related Topics