‫So we've seen that AWS Certificate Manager
‫can issue public certificates
‫but you can also actually issue private certificates.
‫For this, you must create
‫an AWS Private Certificate Authority.
‫So it's a managed service,
‫and you can create a root Certificate Authority
‫or any subordinaries Certificate Authorities,
‫which are Certificate Authorities that depend on root.
‫So then from there,
‫you can issue and deploy end-entity X.509 certificates,
‫which means that there are certificates
‫that can be used by your applications.
‫These certificates cannot be used
‫to create new certificates.
‫So these certificates will be trusted
‫only by all your applications within your organization,
‫as long as they trust the Private Certificate Authority.
‫But you cannot deploy these certificates
‫on the public internet.
‫This is just not going to work
‫because it is a Private Certificate Authority.
‫On top of it, if you are using an AWS service
‫that has integration with ACM,
‫for example, your application load balancer,
‫it is completely possible for you
‫to load a certificate on it,
‫that is going to be a private certificate.
‫So as you can see in this example,
‫I've shown you CloudFront, API Gateway,
‫load balancers, Kubernetes service, and so on.
‫And these certificates can be issued for users
‫for whatever reason, for computers,
‫for your APIs or your HTTP endpoints, and your IoT devices.
‫So the use cases of using a Private Certificate Authority
‫is to have encrypted TLS communication internally,
‫or to cryptographically sign code
‫to authenticate users, computers, API endpoints,
‫and IOT devices by providing them certificates,
‫or to create a public key infrastructure
‫within an enterprise.
‫So that's it.
‫I hope you liked it.
‫And I will see you in the next lecture.