Certificates and encryption in transit: DVA-C03 study notes and practice questions

What to know for the exam

Certificate questions ask how to encrypt traffic in transit, and which service issues or holds the certificate. Start by asking who will trust the certificate: the public internet, your own clients, or only your developers.

AWS Certificate Manager

ACM issues public certificates at no charge for services that integrate with it, such as Elastic Load Balancing, CloudFront and API Gateway. By default you cannot export the private key of an ACM public certificate, so it is used only by those integrated services. Since 2025 ACM can also issue exportable public certificates, for a fee, when you need the certificate on your own servers, such as EC2 instances. ACM renews these certificates automatically when DNS validation records stay in place. Email validation needs someone to respond, so DNS validation is the usual answer for automatic renewal.

ACM does not renew imported certificates. If you import a certificate from another certificate authority, you must renew and import it again before it expires.

Location matters:

• CloudFront only uses certificates in the US East (N. Virginia) Region, us-east-1.
• API Gateway edge-optimized custom domains also need the certificate in us-east-1.
• Regional API Gateway endpoints, Application Load Balancers and other Regional services need the certificate in the same Region as the resource.

AWS Private CA

AWS Private CA lets you run a private certificate authority for internal names, mutual TLS between your services, and devices that are not on the internet. Certificates it issues are trusted only by clients that trust your private root. ACM can issue certificates from a private CA for integrated services, which keeps renewal automatic.

Generating certificates and keys for development

For local work, you can create a self-signed certificate with openssl, and an SSH key pair with ssh-keygen. A self-signed certificate is not trusted by browsers or other clients, so use it only for development and tests. EC2 key pairs can be created in AWS with aws ec2 create-key-pair, and the private key is returned once. Save it securely and do not commit it to source control.

Never use a development certificate or key in production, and never store a private key in an S3 bucket that others can read.

Enforcing encryption in transit

• A wildcard such as *.example.com covers one level of subdomain only, and every CloudFront alternate domain name must be in the certificate.
• A CloudFront viewer protocol policy can redirect HTTP to HTTPS or allow HTTPS only.
• An S3 bucket policy that denies requests where aws:SecureTransport is false blocks plain HTTP.
• Mutual TLS for API Gateway is set on a Regional custom domain with a truststore of client CA certificates in S3; disable the default execute-api endpoint so callers cannot skip it.

How to choose

Common traps

• Choosing email validation for a certificate that must renew on its own.
• Requesting a certificate in the wrong Region for CloudFront or edge-optimized API Gateway.
• Expecting ACM to renew an imported certificate.
• Trying to export the private key of a standard ACM public certificate. Only a certificate requested as exportable can be exported.
• Using self-signed certificates for production clients that do not trust them.
• Enforcing HTTPS with a redirect and expecting the origin code to change. CloudFront can redirect viewers to HTTPS without code changes.

Try the 2 practice questions ↓