page_title: Service Mesh Certificate Authority: AWS Certificate Manager
description: >-
Consul can be used with AWS Certificate Manager Private CA to manage and sign
certificates.
You can use the AWS Certificate Manager Private Certificate Authority instead of Consul's built-in CA to secure your service mesh. Learn how to configure the AWS ACM Private CA, its limitations in Consul, and cost planning considerations.
---
# AWS Certificate Manager Private CA as a Connect CA
# AWS Certificate Manager as a Service Mesh Certificate Authority
Consul can be used with [AWS Certificate Manager (ACM) Private Certificate
page_title: Service Mesh Certificate Authority: Built-in CA
description: >-
Consul ships with a built-in CA system so that Connect can be easily enabled
out of the box. The built-in CA generates and stores the root certificate and
private key on Consul servers. It can also be configured with a custom
certificate and private key if needed.
Consul has a built-in certificate authority for your service mesh that you can configure to work with custom certificates and private keys. Learn how to configure the built-in CA and use it alongside your preferred PKI.
---
# Built-In CA
# Built-In Certificate Authority for Service Mesh
Consul ships with a built-in CA system so that Connect can be
easily enabled out of the box. The built-in CA generates and stores the
description: An overview of the Connect Certificate Authority mechanisms.
page_title: Service Mesh Certificate Authority: Overview
description: >-
Consul uses a certificate authority (CA) to generate, use, manage, sign, and store certificates for your service mesh. Learn about certificate management, including configuration, root cert rotation, cross-signing, and regenerating the CA.
---
# Connect Certificate Management
# Service Mesh Certificate Authority Overview
Certificate management in Connect is done centrally through the Consul
servers using the configured CA (Certificate Authority) provider. A CA provider
page_title: Service Mesh Certificate Authority: Vault
description: >-
Consul can be used with Vault to manage and sign certificates. The Vault CA
provider uses the Vault PKI secrets engine to generate and sign certificates.
You can use the Vault certificate authority instead of Consul’s built-in CA to secure your service mesh. Learn how to configure the Vault CA and manage PKI paths with either Vault or Consul.
---
# Vault as a Connect CA
# Vault as a Service Mesh Certificate Authority
Consul can be used with [Vault](https://www.vaultproject.io) to
boruszak
2 years ago