AWS Private Certificate Authority pricing calculator
CA Operation, Certificates & OCSP. Estimate your costs using AWS list prices.
Estimates from AWS list prices, not an AWS quote. Discounts, taxes and credit terms may affect your bill.
01 · How AWS Private Certificate Authority pricing works
What you pay for
- CA operation: $400 per general-purpose CA per month, $50 per short-lived-certificate CA per month (prorated).
- Certificates: tiered $0.75 / $0.35 / $0.001 per certificate (monthly volume); short-lived certificates $0.058 each.
- OCSP: per queried certificate and per 100,000 queries; CRLs stored in S3 billed by S3.
Common cost traps
- Each CA bills $400 monthly even if it issues nothing, including root CAs kept only for the hierarchy.
- Disabled CAs still bill the monthly fee until deleted.
- A test CA left running costs $4,800 per year.
Ways to reduce cost
- Use short-lived-certificate mode ($50/month) for workloads that renew within 7 days.
- Share one CA across accounts with AWS RAM instead of creating one per account.
- Delete unused CAs.
Free Tier & account eligibility
Free Tier depends on account age. Accounts created on or after 15 July 2025 get a $100 sign-up credit plus up to $100 more for completing onboarding activities; on the Free plan these last 6 months (or until used up), on the Paid plan unused Free Tier credits stay usable for 12 months from sign-up. Accounts created before 15 July 2025 keep the legacy Free Tier (12-month offers plus always-free offers). Always-free offers apply on both plans. 30-day free trial: no CA operation charge for the first private CA created in the account in each Region; certificates issued during the trial are still charged. No always-free allowance.
02 · AWS credits & runway
Do credits cover AWS Private Certificate Authority?
Private CA monthly operation fees, certificate issuance and OCSP charges are eligible usage and are offset by credits. General rules: credits only offset charges from the billing cycle in which they were applied onward (never past bills), they apply only to the services listed on the credit in Billing and Cost Management > Credits, they expire on the date shown there, and accounts on the AWS Free plan cannot receive Activate credits until they upgrade to the Paid plan.
Check my creditsExcluded charges & conditions
- Upfront payments for Savings Plans and Reserved Instances (All Upfront, and the upfront part of Partial Upfront). The recurring hourly fee of a No Upfront commitment is billed as normal usage and can be offset.
- AWS Marketplace charges (Activate credits make an exception for third-party foundation models used through Amazon Bedrock).
- AWS Enterprise Support, Enterprise On-Ramp, Unified Operations, resold support and partner-led support.
- Amazon Route 53 domain name registration and transfer fees.
- Taxes (sales, use, VAT and similar), AWS Professional Services, Training and Certification, Mechanical Turk, AWS Managed Services, and any use for cryptocurrency mining.
Illustrative credit runway
Single-service examples from the supplied data, not your calculator result. Months = credit amount ÷ monthly cost, before credit expiry. Credits can expire before these theoretical months are used; coverage and other AWS services can shorten runway.
| Usage profile | Monthly estimate | $10,000 | $25,000 | $100,000 |
|---|---|---|---|---|
| Small | $166.00 | 60.2 mo. | 150.6 mo. | 602.4 mo. |
| Medium | $2,550.00 | 3.9 mo. | 9.8 mo. | 39.2 mo. |
| Large | $8,140.00 | 1.2 mo. | 3.1 mo. | 12.3 mo. |
Small profile assumptions
1 short-lived-certificate CA, 2,000 short-lived certificates | Short-lived CA: 1 CA-months x $50 = $50.00; Short-lived certificates: 2,000 certificates x $0.058 = $116.00 | Total ~$166.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Medium profile assumptions
1 general-purpose CA, 5,000 certificates | General-purpose CA: 1 CA-months x $400 = $400.00; Certificates: 5,000 certificates tiered (1,000 @ $0.75; 4,000 @ $0.35) = $2,150.00 | Total ~$2,550.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Large profile assumptions
Root + 2 subordinate general-purpose CAs, 50,000 certificates, OCSP for 50,000 certificates | General-purpose CAs: 3 CA-months x $400 = $1,200.00; Certificates: 50,000 certificates tiered (1,000 @ $0.75; 9,000 @ $0.35; 40,000 @ $0.001) = $3,940.00; OCSP queried certificates: 50,000 certificate-months x $0.06 = $3,000.00 | Total ~$8,140.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
04 · Questions
AWS Private Certificate Authority pricing FAQ
What is the fixed cost?
$400 per general-purpose CA per month, or $50 for a short-lived-certificate CA.
How are certificates billed?
Per certificate issued, tiered by monthly volume from $0.75 down to $0.001.
Is there a free trial?
Yes. The first private CA in each Region of an account has no operation charge for 30 days; certificates are still billed.
Do credits cover Private CA?
Yes, it is eligible usage.
05 · Sources & estimate notes
Content pack dated 2026-10-19. Calculator rates remain their existing snapshots; this content update is not a price refresh.
Verification notes
- Runway prices come from the calculator repository snapshot rate card private-ca (no AWS Price List mapping in the build). Confirm the main unit prices on https://aws.amazon.com/private-ca/pricing/ before publishing.