Amazon Technologies, Inc.

Kyle Benjamin Schultheiss

Todd Lawrence Cignetti

Param Sharma

Jonathan Kozolchyk

Marcel Andrew Levy

Jose Maria Silveira Neto

Peter Zachary Bowen

Ronald Andrew Hoskinson

Brandonn Gorman

Sandeep Shantharaj

Preston Anthony Elder, Iii

Kenneth Lawler

Upendra Bhalchandra Shevade

Gregory Rustin Rogers

Daniel Massaguer

Josh Rosenthol

Xin Yi Liu

Yohanes Santoso

Yu Gu

Michael S Slaughter

Lee-Ming Zen

Yiwen Wu

Daniel Lee McCarriar

Trevoli Ponds-White

Fan Xiang

Andrew Charles Wantuch

Leonardo Lizcano

Steven Hunton Ngo

Chris Stoner

Techniques are described for enabling users of a certificate management service to create certificate issuance policies that can be applied to certificate issuance requests across both public and private certificate authorities (CAs) and other certificate-related services. According to embodiments described herein, a certificate issuance policy includes one or more certificate issuance rules to be applied to requests associated with one or more specified user accounts or roles for certificate-related resources (e.g., public certificates, private certificates, etc.). The application of a certificate issuance rule can be conditioned on a particular request context (e.g., based on a user account or role associated with a request, a type of certificate requested, a subject name identified in the request, etc.) and can specify a wide range of actions to be performed on requests matching a rule (e.g., allowing or denying a request, modifying one or more parameters of the request, etc.).

Custom rules for global certificate issuance

A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by private certificate authorities. A private certificate authority hosted by the computing resource service provider is able to issue signed certificates to network entities within the customer enterprise. The certificate management service provides a network-accessible application programming interface to the private certificate authority that allows applications to create and deploy private certificates programmatically. The system provides the flexibility to create private certificates for applications that require custom certificate lifetimes or resource names.

Certificate authority

A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by public and/or private certificate authorities. In an embodiment, customers may use the certificate management service to generate private certificate authority which can issue signed certificates to network entities within the customer enterprise. In an embodiment, the private certificate authority is hosted by the computing resource service provider, and the certificate management service automates the renewal and management of active certificates. In an embodiment, the certificate management service allows customer applications to create, renew, and revoke certificates issued by both private and public certificate authorities via an application programming interface.

Certificate manager

A first analysis based on at least a subset of collected health metrics of a monitored resource is performed at a health monitoring service. If the first analysis indicates that the probability that the monitored resource is in an unhealthy state is above a threshold, a mitigation action that includes directing at least some of the workload away from the monitored resource is implemented. In addition, a remediation analysis of the monitored resource is started to determine, using at least one additional health metric that was not examined in the first analysis, whether a longer-term remediation action is to be initiated.

Establishing secured connections between premises outside a provider network

Techniques for validating digital certificate information before signing are described. A method of validating digital certificate information before signing may include generating a to-be-signed (TBS) certificate, providing the TBS certificate to a certificate pre-issuance validation service to perform one or more validations on the TBS certificate, and receiving a request to issue a signed certificate based on the TBS certificate following validation of the TBS certificate by the certificate pre-issuance validation service.

Validating certificate information before signing

A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by public and/or private certificate authorities. In an embodiment, when a new certificate is generated, a certificate template is used to apply various settings and policies for the new certificate. In various examples, templates may be used to establish default values, enforce required and optional values, place restrictions on one or more data fields, and enforce signature requirements. In some embodiments, the template establishes rules for rejecting certificate requests that don't conform to the template.

Certificate generation method

Systems and method for generating and managing certificate authorities. For instance, a certificate service may provide one or more user interfaces for creating certificate authorities, such as a root certificate authority, a subordinate certificate authority, and/or an intermediate certificate authority. For example, a user may use a user device to create a certificate hierarchy. The certificate service may also provide one or more user interfaces for issuing certificates using the certificate authorities. One or more computing resources may then use the end-entity certificates issued from the certificate authority hierarchy for authentication and/or encryption. For security purposes, the certificate authority may also allow the user to set policies representing users that are able to access and/or utilize the certificate authorities to perform actions, such as issuing certificates. The certificate service may also generate audit reports indicating certificates that are created using the certificate authorities.

Systems for generating and managing certificate authorities

In an embodiment, a computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by private certificate authorities. In an embodiment, a private certificate authority hosted by the computing resource service provider is able to issue signed certificates to network entities within the customer enterprise. In an embodiment, the certificate management service provides a network-accessible application programming interface to the private certificate authority that allows applications to create and deploy private certificates programmatically. In an embodiment, the system provides the flexibility to create private certificates for applications that require custom certificate lifetimes or resource names.

Multi-mode health monitoring service

Domain Name System (DNS) requests can be routed to either a private DNS server or a public DNS server based on a determination made by a DNS classifier. The private DNS server allows customers to use custom DNS names for internal resources without exposing the names or IP addresses to the public Internet.

Selective routing of domain name system (DNS) requests

A message indicating a route to a network destination is received at a routing service from a particular routing device of a provider network. The message is formatted in accordance with a set of APIs implemented using a stateless protocol, and indicates a route to a particular network destination associated with a particular RIB stored at a persistent data store accessible from various nodes of the routing service. The RIB is modified accordingly. A routing service back-end node generates an entry of a forwarding information base (FIB) associated with the particular RIB. The FIB entry is transmitted to one or more routing devices including the particular routing device, and is used to forward data packets of one or more other services.

Scalable routing service

Growing community of inventors

Centreville, VA, United States of America

Kyle Benjamin Schultheiss