Describe the feature

In the AWS ACM console, when requesting a new private certificate, I can select between the key algorithms: RSA 2048, ECDSA P 384, and ECDSA P 258.

In CDK, there is not a way to set the key algorithm and when requesting a cert, and it defaults to RSA 2048(which causes the cert to become a failed state because of the private CA being Elliptic Curve based).

Use Case

We use AWS private certificate authority service and have a CA set as ECDSA P384. To use this private CA we need to be able to generate certs via CDK. Currently, when creating a private cert with CDK, it defaults to RSA 2048 which lands the certificate in a FAILED state since it doesn't match the private certificate authority config.

Proposed Solution

Add a keyAlgorithm property to the PrivateCertificate contruct.

    const cert = new acm.PrivateCertificate(this, 'certificate', {
      domainName: props.certDomain,
      keyAlgorithm: "ECDSAP384"
      certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(this, 'CA',
        props.certificateAuthorityArn),
    });

Other Information

The only solution that works is to use an RSA based private CA and then cdk cert generation will work since the key algorithm is defaulted to RSA. Otherwise we manually create a certificate in the ACM console and select the key algorithm we expect and reference that certificate ARN in our cdk code.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.48.0

Environment details (OS name and version, etc.)

macOS version 12.5.1