Repository

If you require pinning then we recommend that you pin to the public key of the root. Applications that pin to subordinate CAs or end-entity certificates that chain to ATS roots are at a higher risk for outages. We do not recommend pinning to the attributes of a certificate associated with a root. All CAs can have multiple certificates associated with their keys. Because trust is based on keys and not certificate attributes, pinning to certificate attributes may result in unexpected behavior. If you have technical constraints that require pinning to certificate attributes we have provided that information below.

For relying parties that make use of custom trust stores we recommend that all five of the above roots be included in the trust store. "Amazon Root CA 1 - 4" represent different key types/algorithms. "Starfield Services Root Certificate Authority - G2" is an older root that is compatible with other older trust stores and clients that can not be updated. Including all five of the roots ensure maximum compatibility for your application.

Root certificates with the "EU" designation in the CN will be used for certificate issuance in the AWS European Sovereign Cloud region only. These roots are pending inclusion in public root store programs. End-entity certificates issued from the AWS European Sovereign Cloud region will be trusted in public root store programs that follow the cross-signed certificates issued from our existing "Amazon Root CA 1, 3, and 4" roots.

The following certificate authorities are operated according to the practices described in the above CPS.
Distinguished names are represented using the algorithm recommended in RFC 4514.