An internal microservice must authenticate calling clients with mutual TLS, where each client presents an X.509 certificate that the server validates against a private certificate authority the company controls. The team needs AWS to issue and manage these short-lived private client certificates without operating their own certificate authority infrastructure on servers. Which AWS approach should the developer use to issue the client certificates?
- ARequest public certificates from AWS Certificate Manager for each client, since public ACM certificates are trusted by every internal service.
- BUse AWS Private Certificate Authority to issue the private client certificates from a CA hierarchy the company owns and operates in AWS. Correct
- CGenerate self-signed certificates on each client host and distribute the matching public keys to the server manually for trust.
- DStore a shared client certificate in AWS Secrets Manager and have every client retrieve the same certificate at startup for the handshake.
Why A is wrong: Tempting because ACM issues certificates, but public ACM certificates are for server identity on public endpoints, not company-issued client certificates from a private trust chain.
Why B is correct: AWS Private CA runs a managed private CA that issues internal X.509 certificates for mutual TLS, which is exactly the use case for company-controlled client identity.
Why C is wrong: Self-signed certificates work technically but provide no managed CA, no central revocation, and no automated issuance, which the requirement explicitly asks AWS to handle.
Why D is wrong: A single shared certificate defeats per-client identity in mutual TLS, and Secrets Manager stores secrets rather than issuing or managing a certificate authority.