Our Blog

AWS Private CA now provides detailed certificate issuance logs

Published
October 5, 2026
https://aws.amazon.com/about-aws/whats-new/2026/10/aws-private-ca-certificate-issuance-logs/

AWS Private CA Announces Detailed Certificate Issuance Logs

AWS Private CA now provides detailed certificate issuance logs, a new AWS CloudTrail service event that records complete certificate content, issuing CA information, requester identity, and signing status for every issuance. This feature aids in compliance auditing, certificate inventory, algorithm migration tracking, and failed-issuance monitoring.

New Features

  • Complete Certificate Content: The new IssueCertificateDetails event captures the complete to-be-signed (TBS) certificate with all X.509 fields and extensions, plus convenience fields for the subject, issuer, serial number, validity period, template, and signing algorithm.
  • Pre-signing Failures: Events are emitted for both successful and failed issuances, including a record with a failure explanation for pre-signing failures such as name constraints violations.
  • Requester Identification: Each event identifies the requester, including the account and IAM principal for direct API callers, or the service principal for certificates issued through AWS Private CA connectors or integrated AWS services.
  • Cross-account Configuration: In cross-account configurations, the event is delivered to the CA owner account.

What to do

  • Enable CloudTrail management events for your AWS account.
  • Use Amazon EventBridge for real-time actions on these events.
  • Query events in batch with Amazon Athena for auditing and monitoring.

Source: AWS release notes




If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.

Follow our blog

Get the latest insights and advice on AWS services from our experts.

By clicking Sign Up you're confirming that you agree with our Terms and Conditions.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Related posts

Check out other insights from the team at West Loop Strategy.

View all
https://aws.amazon.com/about-aws/whats-new/2025/11/marketplace-a2a-server-bedrock-agentcore-runtime/

AWS Marketplace adds A2A server support for Amazon Bedrock AgentCore Runtime

AWS Marketplace now offers Agent-to-Agent (A2A) server support and streamlined deployment for third-party AI agents and tools built for Amazon Bedrock AgentCore Runtime
Read more
https://aws.amazon.com/about-aws/whats-new/2026/09/sagemaker-workflows-python-bash/

Amazon SageMaker Unified Studio Workflows support Python and Bash operators

Amazon SageMaker Unified Studio Workflows now supports PythonOperator and BashOperator, enabling you to run custom Python functions and shell commands directly in your serverless workflows without provisioning separate compute resources
Read more
https://aws.amazon.com/about-aws/whats-new/2026/05/add-security-settings-stig-aws-microsoft-ad/

AWS Directory Service expands directory security settings with STIG-aligned controls for Managed AD

AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) now has expanded its security settings to include STIG-aligned configurations for high-impact security areas
Read more
View all