A bank operates internal APIs on private subnets across three regions, requiring TLS 1.3 for all east-west traffic, automated private certificate issuance and renewal, and centralized private trust without public domains. Manual CSR handling caused outages. Which encryption in transit design using certificate management should the architect deploy?
Select an answer to reveal the explanation.
Short Explanation
You need passports that renew themselves, not handwritten notes. Private CA with ACM is like a corporate DMV — trusted IDs, auto-renewed, TLS 1.3 enforced.
Full Explanation
The correct design succeeds because AWS Private CA provides centralized private trust across three regions without public domains, while ACM-issued private certificates deliver automated issuance and managed renewal that removes manual CSR handling, and enforcing TLS 1.3-only policies on load balancers and clients meets the east-west encryption mandate. Issuing ACM public certificates with automated validation and TLS 1.3 fails on trust applicability because public certificates require public domains and public trust and cannot serve internal-only hostnames without public control. Deploying private CA with ACM private certificates while allowing TLS 1.2 fallback fails on protocol strictness because permitting TLS 1.2 negotiation violates the requirement that all traffic use TLS 1.3. Importing third-party private certificates into ACM with TLS 1.3 fails on lifecycle automation because imported certificates are not auto-renewed by ACM and retain manual replacement risk that caused outages. For exams, distinguish ACM-issued versus imported certificates for renewal and public versus private CAs for domain needs. Practically, verify the balancer uses a TLS 1.3-only policy, ACM shows automatic renewal, and regional clients trust the private CA bundle.