Skip to content

Amazon Secrets Manager

Use this procedure to provision a certificate from Certificate Manager - SaaS to an Amazon Secrets Manager machine. Each provisioned certificate is stored as a single secret that holds the certificate, its private key, and optionally the issuing chain.

  1. Sign in to Certificate Manager - SaaS.

  2. Click Installations > Machines.

  3. Click the checkbox next to the Amazon Secrets Manager machine where you'll install the certificate.

  4. Click Provision a certificate.

  5. From the Choose a certificate from the inventory field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

    Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.

  6. In the Secret Name field, enter the name of the secret that stores the certificate bundle. The name can be up to 256 characters. If the machine defines a Secret Name Prefix, that prefix is prepended to the name you enter here.

    Important

    Certificate Manager - SaaS writes only to secrets it manages. If a secret with that name already exists and is not tagged venafi:managed=true, provisioning fails and the existing secret is left untouched. Either choose a different name, or add the venafi:managed tag with the value true to the existing secret in Amazon Secrets Manager.

  7. From the Secret Format drop-down, select how the certificate bundle is serialized in the secret:

    • JSON (certificate, private key, chain) (default)
    • Kubernetes (tls.crt, tls.key, ca.crt)
    • PKCS#12

    Note

    The JSON and Kubernetes formats are stored as secret text. PKCS#12 is stored as binary secret data with an empty passphrase, so protect it with Amazon Secrets Manager access controls and KMS encryption.

  8. Enable Include Certificate Chain to store the issuing certificate chain alongside the leaf certificate.

  9. If you don't want the certificate to be pushed when you save, toggle the Push upon saving slider to No.

  10. Click Save.

    Want to schedule your provisions?

    Schedule your provisions daily, weekly, or monthly. Learn more

After saving, the certificate is pushed to Amazon Secrets Manager and an installation is created on the Installations tab.

What to expect in Amazon Secrets Manager

  • Every secret that Certificate Manager - SaaS creates or updates is tagged venafi:managed=true, venafi:certificate-id (the certificate serial number), and venafi:expiry (the expiration date).
  • When a certificate is renewed, Certificate Manager - SaaS writes a new version of the same secret and makes it the current version. The secret name does not change.
  • The serialized certificate bundle must be smaller than the Amazon Secrets Manager limit of 64 KB. If it is larger, provisioning fails before the secret is written. Clearing Include Certificate Chain reduces the size of the bundle.