AUTOMATING AWS PRIVATE CA AUDIT REPORTS AND CERTIFICATE EXPIRATION ALERTS

Summary from the TLDR InfoSec newsletter

AWS Private CA is a service that allows an organization to issue certificates via ACM without the need for a public certificate, which may disclose sensitive services. However, certificates generated via the console default to a 13-month validity period. In contrast, certificates generated using the SDK or CLI are more flexible, but they do not include certificate expiration notices. The solution in this post leverages Lambda functions to periodically generate a report of certificates and notify via email and Security Hub of any certificates that are expiring within 30 days.