Certificate authority
Amazon Trust Services: AWS's CA, Amazon roots and ACM ACME
Details
- CCADB CA owner
- Amazon Trust Services
- Country
- US
- Country (CCADB)
- United States of America
- ACME
- Yes
- Free certificates
- Yes
- Products
- DV wildcard multi-domain private-PKI
- Roots
- 5
- Roots trusted for TLS
- Chrome 4 · Mozilla 5 · Apple 5 · Microsoft 5
- Intermediates under its roots
- 114 (94 valid)
- Auditor
- BDO International Limited
- CAA
amazon.com
Amazon Trust Services is the certificate authority behind AWS Certificate Manager (ACM). It issues DV certificates for AWS customers: free when they stay on AWS load balancers, CloudFront and other integrated services, and paid when exported or issued through ACM's ACME endpoint, which AWS added in 2026.
Owner and headquarters
The CA is operated by Amazon, a US company; CCADB lists the CA owner as Amazon Trust Services, and the roots name the organization "Amazon" and country US.
Root certificates
As of November 2026, CCADB lists five roots under Amazon Trust Services. Amazon Root CA 1 (RSA 2048), 2 (RSA 4096), 3 (ECDSA P-256) and 4 (ECDSA P-384), created in 2015 and valid until 2038–2040, are trusted for TLS by Chrome, Mozilla, Apple and Microsoft. The fifth, Starfield Services Root Certificate Authority - G2 (2009–2037), is described in Amazon's repository as an older root kept for compatibility with older trust stores; Chrome has removed it, the other stores still include it. Amazon recommends that custom trust stores include all five. aws.amazon.com itself chains from Amazon Root CA 1 to a cross-certificate signed by Starfield Services Root G2.
Certificate products
DV certificates, including multi-domain and wildcard names, through ACM. AWS also sells private certificate authorities (AWS Private CA), which are separate from the publicly trusted hierarchy.
ACME support
Yes, since 2026. AWS announced ACME support for public certificates in ACM: a managed ACME endpoint issues Amazon Trust Services certificates to any ACMEv2 client, with IAM-based governance. ACME certificates are valid for 45 days, shorter than other ACM public certificates.
Free certificates
ACM public certificates are free when used with integrated AWS services; you can't export their private keys. Exportable public certificates and ACME-issued certificates are charged per domain name according to the ACM pricing page.
Notable incidents and changes
No major distrust events. The notable change for operators is pricing and portability: since exportable and ACME certificates became available, Amazon Trust Services certificates can be used outside AWS, and ACM says it plans shorter lifetimes to match the CA/Browser Forum's 2026–2029 schedule (SC-081v3).
CAA records
The CCADB lists 10 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Amazon Trust Services. One issue record with any of them lets Amazon Trust Services issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 3 domain(s):
example.com. CAA 0 issue "amazon.com"
example.com. CAA 0 issue "amazonaws.com"
example.com. CAA 0 issue "amazonaws.eu"| Domain | Valid intermediates |
|---|---|
amazon.com | 110 |
amazonaws.com | 110 |
amazonaws.eu | 110 |
amazontrust.com | 110 |
amazontrustservices.eu | 110 |
aws.amazon.com | 110 |
amznts.eu | 110 |
awstrust.com | 110 |
godaddy.com | 1 |
starfieldtech.com | 1 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
Amazon Trust Services has 5 root certificate(s) in the CCADB TLS report. Together they have signed 114 intermediate CA certificates, 94 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| Amazon Root CA 1 | RSA 2048 | 2038-01-17 | Included | Included | Included | Included | 33 (27) |
| Amazon Root CA 2 | RSA 4096 | 2040-05-26 | Included | Included | Included | Included | 5 (5) |
| Amazon Root CA 3 | ECDSA P-256 | 2040-05-26 | Included | Included | Included | Included | 21 (15) |
| Amazon Root CA 4 | ECDSA P-384 | 2040-05-26 | Included | Included | Included | Included | 45 (39) |
| Starfield Services Root Certificate Authority - G2 | RSA 2048 | 2037-12-31 | Removed | Included | Included | Included | 10 (8) |
Valid intermediate CAs operated by Amazon Trust Services under roots that other CAs own (CCADB; number of valid intermediates in brackets):
- GoDaddy (2)
Audits
Audit data the CCADB records for the TLS roots of Amazon Trust Services. Auditor(s): BDO International Limited. The most recent audit period ended on 2026-01-15.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2025-01-16 – 2026-01-15 | 2026-04-07 | cpacanada.ca |
| Network security | WebTrust | 2025-01-16 – 2026-01-15 | 2026-04-07 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2025-01-16 – 2026-01-15 | 2026-04-07 | cpacanada.ca |
| TLS EV Guidelines | WebTrust | 2025-01-16 – 2026-01-15 | 2026-04-07 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that Amazon Trust Services has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.7.pdf (effective 2026-08-19)
- Document repository: https://www.amazontrust.com/repository/
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels Amazon Trust Services lists in the CCADB (replace [at] and [dot] in addresses):
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Amazon Trust”:
FAQ
Can I use a free ACM certificate on my own server?
Not the free kind. Free ACM public certificates only work with integrated AWS services and their private keys can't be exported. Exportable public certificates and ACME-issued certificates can be used anywhere but are charged per domain.
What CAA record allows Amazon Trust Services to issue certificates?
Publish example.com. CAA 0 issue "amazon.com". The CCADB lists 10 recognized domain(s) for Amazon Trust Services: amazon.com, amazonaws.com, amazonaws.eu, amazontrust.com, amazontrustservices.eu, aws.amazon.com, amznts.eu, awstrust.com….
Who audits Amazon Trust Services?
BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-01-16 to 2026-01-15; the statement is dated 2026-04-07.
How do I report a problem certificate to Amazon Trust Services?
Use the channel(s) listed in the CCADB: https://www.amazontrust.com/repository/.