Windows EC2无ELB/ALB时能否使用AWS Private CA？

Absolutely! The key here is distinguishing between AWS Certificate Manager (ACM) and AWS Private CA—the integration restrictions you referenced apply only to ACM, not to Private CA itself.

Let me break this down clearly:

• The note about needing services like Elastic Load Balancing, CloudFront, etc., relates to using ACM-managed certificates directly with your application. ACM is built to automate certificate deployment and renewal for those specific AWS services, so it doesn’t support attaching certificates straight to EC2 instances.
• AWS Private CA is a standalone service that lets you operate your own private certificate authority. You can use it to issue SSL/TLS certificates directly to your Windows EC2 instance, no load balancer required.

Here’s a high-level workflow to make this work:

1. Request a certificate from your Private CA (via AWS Console, CLI, or SDK) for your EC2 instance’s hostname or IP address.
2. Download the issued certificate files (including the private key and CA chain) to your Windows EC2 instance.
3. Install the certificate in the Windows Certificate Store, then configure your application to use this certificate for TLS connections.

One thing to keep in mind: Unlike ACM, you’ll need to handle certificate renewal manually (or build custom automation) since Private CA doesn’t auto-renew certificates for EC2 instances the way ACM does for its integrated services.

To reiterate: ACM’s integration limits don’t restrict AWS Private CA. You can absolutely use Private CA to secure your Windows EC2 instance even without an ELB/ALB.

内容的提问来源于stack exchange，提问作者subhadeep dutta gupta